2005 Commits (b859b0a7a0ddcc9ad8e3b340243e4f87d1d1f57e)

Author	SHA1	Message	Date
Matt Keeler	acccdbe45c	Fix identity resolution on clients and in secondary dcs (#7862) ... Previously this happened to be using the method on the Server/Client that was meant to allow the ACLResolver to locally resolve tokens. On Servers that had tokens (primary or secondary dc + token replication) this function would lookup the token from raft and return the ACLIdentity. On clients this was always a noop. We inadvertently used this function instead of creating a new one when we added logging accessor ids for permission denied RPC requests. With this commit, a new method is used for resolving the identity properly via the ACLResolver which may still resolve locally in the case of being on a server with tokens but also supports remote token resolution.	5 years ago
Chris Piraino	7a7760bfd5	Make new gateway tests compatible with enterprise (#7856)	5 years ago
Daniel Nephin	600645b5f9	Add unconvert linter ... To find unnecessary type convertions	5 years ago
Drew Bailey	c9d0b83277	Value is already an int, remove type cast	5 years ago
Daniel Nephin	9d5ab443a7	Merge pull request #7689 from hashicorp/dnephin/remove-deadcode-1 ... Remove some dead code	5 years ago
Daniel Nephin	47238a693d	Merge pull request #7819 from hashicorp/dnephin/remove-t.Parallel-1 ... test: Remove t.Parallel() from agent/structs tests	5 years ago
R.B. Boyer	1efafd7523	acl: add auth method for JWTs (#7846)	5 years ago
Kit Patella	58ee349a83	Merge pull request #7843 from hashicorp/oss-sync/auditing-config ... agent/config: Fix tests & include Audit struct as a pointer on Config	5 years ago
Kit Patella	10b3478a4d	agent/config: include Audit struct as a pointer on Config, fix tests	5 years ago
Kit Patella	b5564751bf	Merge pull request #7841 from hashicorp/oss-sync/auditing-config ... OSS sync - Auditing config	5 years ago
Kit Patella	f5030957d0	agent/config: add auditing config to OSS and add to enterpriseConfigMap exclusions	5 years ago
Chris Piraino	c21052457b	Return early from updateGatewayServices if nothing to update (#7838) ... * Return early from updateGatewayServices if nothing to update Previously, we returned an empty slice of gatewayServices, which caused us to accidentally delete everything in the memdb table * PR comment and better formatting	5 years ago
Chris Piraino	4d6751bf16	Fix TestInternal_GatewayServiceDump_Ingress (#7840) ... Protocol was added as a field on GatewayServices after GatewayServiceDump PR branch was created.	5 years ago
R.B. Boyer	7414a3fa53	cli: ensure 'acl auth-method update' doesn't deep merge the Config field (#7839)	5 years ago
Chris Piraino	74c0543ef2	PR comment and better formatting	5 years ago
Chris Piraino	fb9ee9d892	Return early from updateGatewayServices if nothing to update ... Previously, we returned an empty slice of gatewayServices, which caused us to accidentally delete everything in the memdb table	5 years ago
Freddy	b3ec383d04	Gateway Services Nodes UI Endpoint (#7685) ... The endpoint supports queries for both Ingress Gateways and Terminating Gateways. Used to display a gateway's linked services in the UI.	5 years ago
Kyle Havlovitz	136549205c	Merge pull request #7759 from hashicorp/ingress/tls-hosts ... Add TLS option for Ingress Gateway listeners	5 years ago
Kyle Havlovitz	8d140ce9af	Disallow the blanket wildcard prefix from being used as custom host	5 years ago
Chris Piraino	a0e1f57ac2	Remove development log line	5 years ago
Chris Piraino	26f92e74f6	Compute all valid DNSSANs for ingress gateways ... For DNSSANs we take into account the following and compute the appropriate wildcard values: - source datacenter - namespaces - alt domains	5 years ago
Daniel Nephin	5655d7f34e	Add outlier_detection check to integration test ... Fix decoding of time.Duration types.	5 years ago
Daniel Nephin	eaa05d623a	xds: Add passive health check config for upstreams	5 years ago
Chris Piraino	429d0cedd2	Restoring config entries updates the gateway-services table (#7811) ... - Adds a new validateConfigEntryEnterprise function - Also fixes some state store tests that were failing in enterprise	5 years ago
Daniel Nephin	e60bb9f102	test: Remove t.Parallel() from agent/structs tests ... go test will only run tests in parallel within a single package. In this case the package test run time is exactly the same with or without t.Parallel() (~0.7s). In generally we should avoid t.Parallel() as it causes a number of problems with `go test` not reporting failure messages correctly. I encountered one of these problems, which is what prompted this change. Since `t.Parallel` is not providing any benefit in this package, this commit removes it. The change was automated with: git grep -l 't.Parallel' | xargs sed -i -e '/t.Parallel/d'	5 years ago
Freddy	c32a4f1ece	Fix up enterprise compatibility for gateways (#7813)	5 years ago
Jono Sosulska	9b363e9f23	Fix spelling of deregister (#7804)	5 years ago
Chris Piraino	f55e20a2f7	Allow ingress gateways to send empty clusters, routes, and listeners (#7795) ... This is useful when updating an config entry with no services, and the expected behavior is that envoy closes all listeners and clusters. We also allow empty routes because ingress gateways name route configurations based on the port of the listener, so it is important we remove any stale routes. Then, if a new listener with an old port is added, we will not have to deal with stale routes hanging around routing to the wrong place. Endpoints are associated with clusters, and thus by deleting the clusters we don't have to care about sending empty endpoint responses.	5 years ago
Chris Piraino	0bd5618cb2	Cleanup proxycfg for TLS ... - Use correct enterprise metadata for finding config entry - nil out cancel functions on config snapshot copy - Look at HostsSet when checking validity	5 years ago
Chris Piraino	5105bf3d67	Require individual services in ingress entry to match protocols (#7774) ... We require any non-wildcard services to match the protocol defined in the listener on write, so that we can maintain a consistent experience through ingress gateways. This also helps guard against accidental misconfiguration by a user. - Update tests that require an updated protocol for ingress gateways	5 years ago
Freddy	b069887b2a	Remove timeout and call to Fatal from goroutine (#7797)	5 years ago
Chris Piraino	0c22eacca8	Add TLS field to ingress API structs ... - Adds test in api and command/config/write packages	5 years ago
Chris Piraino	30792e933b	Add test for adding DNSSAN for ConnectCALeaf cache type	5 years ago
Chris Piraino	0b9ba9660d	Validate hosts input in ingress gateway config entry ... We can only allow host names that are valid domain names because we put these hosts into a DNSSAN. In addition, we validate that the wildcard specifier '*' is only present as the leftmost label to allow for a wildcard DNSSAN and associated wildcard Host routing in the ingress gateway proxy.	5 years ago
Kyle Havlovitz	f14c54e25e	Add TLS option and DNS SAN support to ingress config ... xds: Only set TLS context for ingress listener when requested	5 years ago
Chris Piraino	905279f5d1	A proxy-default config entry only exists in the default namespace	5 years ago
Chris Piraino	d498a0afc9	Correctly set a namespace label in the required domain for xds routes ... If an upstream is not in the default namespace, we expect DNS requests to be served over "<service-name>.ingress.<namespace>.*"	5 years ago
Chris Piraino	114a18e890	Remove outdated comment	5 years ago
Chris Piraino	d8517bd6fd	Better document wildcard specifier interactions	5 years ago
Chris Piraino	45e635286a	Re-add comment on connect-proxy virtual hosts	5 years ago
Kyle Havlovitz	f9672f9bf1	Make sure IngressHosts isn't parsed during JSON decode	5 years ago
Chris Piraino	c44f877758	Comment why it is ok to expect upstreams slice to not be empty	5 years ago
Chris Piraino	881760f701	xds: Use only the port number as the configured route name ... This removes duplication of protocol from the stats_prefix	5 years ago
Kyle Havlovitz	89e6b16815	Filter wildcard gateway services to match listener protocol ... This now requires some type of protocol setting in ingress gateway tests to ensure the services are not filtered out. - small refactor to add a max(x, y) function - Use internal configEntryTxn function and add MaxUint64 to lib	5 years ago
Chris Piraino	f40833d094	Allow Hosts field to be set on an ingress config entry ... - Validate that this cannot be set on a 'tcp' listener nor on a wildcard service. - Add Hosts field to api and test in consul config write CLI - xds: Configure envoy with user-provided hosts from ingress gateways	5 years ago
Chris Piraino	b73a13fc9e	Remove service_subset field from ingress config entry ... We decided that this was not a useful MVP feature, and just added unnecessary complexity	5 years ago
Kyle Havlovitz	711d1389aa	Support multiple listeners referencing the same service in gateway definitions	5 years ago
Kyle Havlovitz	247f9eaf13	Allow ingress gateways to route traffic based on Host header ... This commit adds the necessary changes to allow an ingress gateway to route traffic from a single defined port to multiple different upstream services in the Consul mesh. To do this, we now require all HTTP requests coming into the ingress gateway to specify a Host header that matches "<service-name>.*" in order to correctly route traffic to the correct service. - Differentiate multiple listener's route names by port - Adds a case in xds for allowing default discovery chains to create a route configuration when on an ingress gateway. This allows default services to easily use host header routing - ingress-gateways have a single route config for each listener that utilizes domain matching to route to different services.	5 years ago
R.B. Boyer	a854e4d9c5	acl: oss plumbing to support auth method namespace rules in enterprise (#7794) ... This includes website docs updates.	5 years ago
R.B. Boyer	3242d0816d	test: make the kube auth method test helper use freeport (#7788)	5 years ago