567 Commits (b9051a342c153f64937e9a38fbde0df728f8dca5)

Author	SHA1	Message	Date
Kyle Havlovitz	3b44343276	Add a field to disable following redirects on http checks	3 years ago
Mark Anderson	98a2e282be	Fixup acl.EnterpriseMeta ... Signed-off-by: Mark Anderson <manderson@hashicorp.com>	3 years ago
Dhia Ayachi	83720e5737	add a rate limiter to config auto-reload (#12490) ... * add config watcher to the config package * add logging to watcher * add test and refactor to add WatcherEvent. * add all API calls and fix a bug with recreated files * add tests for watcher * remove the unnecessary use of context * Add debug log and a test for file rename * use inode to detect if the file is recreated/replaced and only listen to create events. * tidy ups (#1535) * tidy ups * Add tests for inode reconcile * fix linux vs windows syscall * fix linux vs windows syscall * fix windows compile error * increase timeout * use ctime ID * remove remove/creation test as it's a use case that fail in linux * fix linux/windows to use Ino/CreationTime * fix the watcher to only overwrite current file id * fix linter error * fix remove/create test * set reconcile loop to 200 Milliseconds * fix watcher to not trigger event on remove, add more tests * on a remove event try to add the file back to the watcher and trigger the handler if success * fix race condition * fix flaky test * fix race conditions * set level to info * fix when file is removed and get an event for it after * fix to trigger handler when we get a remove but re-add fail * fix error message * add tests for directory watch and fixes * detect if a file is a symlink and return an error on Add * rename Watcher to FileWatcher and remove symlink deref * add fsnotify@v1.5.1 * fix go mod * do not reset timer on errors, rename OS specific files * rename New func * events trigger on write and rename * add missing test * fix flaking tests * fix flaky test * check reconcile when removed * delete invalid file * fix test to create files with different mod time. * back date file instead of sleeping * add watching file in agent command. * fix watcher call to use new API * add configuration and stop watcher when server stop * add certs as watched files * move FileWatcher to the agent start instead of the command code * stop watcher before replacing it * save watched files in agent * add add and remove interfaces to the file watcher * fix remove to not return an error * use `Add` and `Remove` to update certs files * fix tests * close events channel on the file watcher even when the context is done * extract `NotAutoReloadableRuntimeConfig` is a separate struct * fix linter errors * add Ca configs and outgoing verify to the not auto reloadable config * add some logs and fix to use background context * add tests to auto-config reload * remove stale test * add tests to changes to config files * add check to see if old cert files still trigger updates * rename `NotAutoReloadableRuntimeConfig` to `StaticRuntimeConfig` * fix to re add both key and cert file. Add test to cover this case. * review suggestion Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> * add check to static runtime config changes * fix test * add changelog file * fix review comments * Apply suggestions from code review Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> * update flag description Co-authored-by: FFMMM <FFMMM@users.noreply.github.com> * fix compilation error * add static runtime config support * fix test * fix review comments * fix log test * Update .changelog/12329.txt Co-authored-by: Dan Upton <daniel@floppy.co> * transfer tests to runtime_test.go * fix filewatcher Replace to not deadlock. * avoid having lingering locks Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> * split ReloadConfig func * fix warning message Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> * convert `FileWatcher` into an interface * fix compilation errors * fix tests * extract func for adding and removing files * add a coalesceTimer with a very small timer * extract coaelsce Timer and add a shim for testing * add tests to coalesceTimer fix to send remaining events * set `coalesceTimer` to 1 Second * support symlink, fix a nil deref. * fix compile error * fix compile error * refactor file watcher rate limiting to be a Watcher implementation * fix linter issue * fix runtime config * fix runtime test * fix flaky tests * fix compile error * Apply suggestions from code review Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> * fix agent New to return an error if File watcher New return an error * quit timer loop if ctx is canceled * Apply suggestions from code review Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: Ashwin Venkatesh <ashwin@hashicorp.com> Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> Co-authored-by: FFMMM <FFMMM@users.noreply.github.com> Co-authored-by: Daniel Upton <daniel@floppy.co> Co-authored-by: Chris S. Kim <ckim@hashicorp.com>	3 years ago
FFMMM	973d2d0f9a	mark disable_compat_1.9 to deprecate in 1.13, change default to true (#12675) ... Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>	3 years ago
Dhia Ayachi	16b19dd82d	auto-reload configuration when config files change (#12329) ... * add config watcher to the config package * add logging to watcher * add test and refactor to add WatcherEvent. * add all API calls and fix a bug with recreated files * add tests for watcher * remove the unnecessary use of context * Add debug log and a test for file rename * use inode to detect if the file is recreated/replaced and only listen to create events. * tidy ups (#1535) * tidy ups * Add tests for inode reconcile * fix linux vs windows syscall * fix linux vs windows syscall * fix windows compile error * increase timeout * use ctime ID * remove remove/creation test as it's a use case that fail in linux * fix linux/windows to use Ino/CreationTime * fix the watcher to only overwrite current file id * fix linter error * fix remove/create test * set reconcile loop to 200 Milliseconds * fix watcher to not trigger event on remove, add more tests * on a remove event try to add the file back to the watcher and trigger the handler if success * fix race condition * fix flaky test * fix race conditions * set level to info * fix when file is removed and get an event for it after * fix to trigger handler when we get a remove but re-add fail * fix error message * add tests for directory watch and fixes * detect if a file is a symlink and return an error on Add * rename Watcher to FileWatcher and remove symlink deref * add fsnotify@v1.5.1 * fix go mod * do not reset timer on errors, rename OS specific files * rename New func * events trigger on write and rename * add missing test * fix flaking tests * fix flaky test * check reconcile when removed * delete invalid file * fix test to create files with different mod time. * back date file instead of sleeping * add watching file in agent command. * fix watcher call to use new API * add configuration and stop watcher when server stop * add certs as watched files * move FileWatcher to the agent start instead of the command code * stop watcher before replacing it * save watched files in agent * add add and remove interfaces to the file watcher * fix remove to not return an error * use `Add` and `Remove` to update certs files * fix tests * close events channel on the file watcher even when the context is done * extract `NotAutoReloadableRuntimeConfig` is a separate struct * fix linter errors * add Ca configs and outgoing verify to the not auto reloadable config * add some logs and fix to use background context * add tests to auto-config reload * remove stale test * add tests to changes to config files * add check to see if old cert files still trigger updates * rename `NotAutoReloadableRuntimeConfig` to `StaticRuntimeConfig` * fix to re add both key and cert file. Add test to cover this case. * review suggestion Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> * add check to static runtime config changes * fix test * add changelog file * fix review comments * Apply suggestions from code review Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> * update flag description Co-authored-by: FFMMM <FFMMM@users.noreply.github.com> * fix compilation error * add static runtime config support * fix test * fix review comments * fix log test * Update .changelog/12329.txt Co-authored-by: Dan Upton <daniel@floppy.co> * transfer tests to runtime_test.go * fix filewatcher Replace to not deadlock. * avoid having lingering locks Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> * split ReloadConfig func * fix warning message Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> * convert `FileWatcher` into an interface * fix compilation errors * fix tests * extract func for adding and removing files Co-authored-by: Ashwin Venkatesh <ashwin@hashicorp.com> Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> Co-authored-by: FFMMM <FFMMM@users.noreply.github.com> Co-authored-by: Daniel Upton <daniel@floppy.co>	3 years ago
FFMMM	1adfd7b94c	polish rpc.service.call metric behavior (#12624)	3 years ago
Eric	e4b4f175ed	Bump go-control-plane ... * `go get cloud.google.com/go@v0.59.0` * `go get github.com/envoyproxy/go-control-plane@v0.9.9` * `make envoy-library` * Bumpprotoc to 3.15.8	3 years ago
Mike Morris	f8a2ae2606	agent: convert listener config to TLS types (#12522) ... * tlsutil: initial implementation of types/TLSVersion tlsutil: add test for parsing deprecated agent TLS version strings tlsutil: return TLSVersionInvalid with error tlsutil: start moving tlsutil cipher suite lookups over to types/tls tlsutil: rename tlsLookup to ParseTLSVersion, add cipherSuiteLookup agent: attempt to use types in runtime config agent: implement b.tlsVersion validation in config builder agent: fix tlsVersion nil check in builder tlsutil: update to renamed ParseTLSVersion and goTLSVersions tlsutil: fixup TestConfigurator_CommonTLSConfigTLSMinVersion tlsutil: disable invalid config parsing tests tlsutil: update tests auto_config: lookup old config strings from base.TLSMinVersion auto_config: update endpoint tests to use TLS types agent: update runtime_test to use TLS types agent: update TestRuntimeCinfig_Sanitize.golden agent: update config runtime tests to expect TLS types * website: update Consul agent tls_min_version values * agent: fixup TLS parsing and compilation errors * test: fixup lint issues in agent/config_runtime_test and tlsutil/config_test * tlsutil: add CHACHA20_POLY1305 cipher suites to goTLSCipherSuites * test: revert autoconfig tls min version fixtures to old format * types: add TLSVersions public function * agent: add warning for deprecated TLS version strings * agent: move agent config specific logic from tlsutil.ParseTLSVersion into agent config builder * tlsutil(BREAKING): change default TLS min version to TLS 1.2 * agent: move ParseCiphers logic from tlsutil into agent config builder * tlsutil: remove unused CipherString function * agent: fixup import for types package * Revert "tlsutil: remove unused CipherString function" This reverts commit 6ca7f6f58d. * agent: fixup config builder and runtime tests * tlsutil: fixup one remaining ListenerConfig -> ProtocolConfig * test: move TLS cipher suites parsing test from tlsutil into agent config builder tests * agent: remove parseCiphers helper from auto_config_endpoint_test * test: remove unused imports from tlsutil * agent: remove resolved FIXME comment * tlsutil: remove TODO and FIXME in cipher suite validation * agent: prevent setting inherited cipher suite config when TLS 1.3 is specified * changelog: add entry for converting agent config to TLS types * agent: remove FIXME in runtime test, this is covered in builder tests with invalid tls9 value now * tlsutil: remove config tests for values checked at agent config builder boundary * tlsutil: remove tls version check from loadProtocolConfig * tlsutil: remove tests and TODOs for logic checked in TestBuilder_tlsVersion and TestBuilder_tlsCipherSuites * website: update search link for supported Consul agent cipher suites * website: apply review suggestions for tls_min_version description * website: attempt to clean up markdown list formatting for tls_min_version * website: moar linebreaks to fix tls_min_version formatting * Revert "website: moar linebreaks to fix tls_min_version formatting" This reverts commit 3858592742. * autoconfig: translate old values for TLSMinVersion * agent: rename var for translated value of deprecated TLS version value * Update agent/config/deprecated.go Co-authored-by: Dan Upton <daniel@floppy.co> * agent: fix lint issue * agent: fixup deprecated config test assertions for updated warning Co-authored-by: Dan Upton <daniel@floppy.co>	3 years ago
Dan Upton	b36d4e16b6	Support per-listener TLS configuration ⚙️ (#12504) ... Introduces the capability to configure TLS differently for Consul's listeners/ports (i.e. HTTPS, gRPC, and the internal multiplexed RPC port) which is useful in scenarios where you may want the HTTPS or gRPC interfaces to present a certificate signed by a well-known/public CA, rather than the certificate used for internal communication which must have a SAN in the form `server.<dc>.consul`.	3 years ago
mrspanishviking	7180c99960	Revert "[Docs] Agent configuration hierarchy "	3 years ago
trujillo-adam	4151dc097a	fixing merge conflicts part 3	3 years ago
trujillo-adam	76d55ac2b4	merging new hierarchy for agent configuration	3 years ago
Eric	3302b2eec2	Add the `connect.enable_serverless_plugin` configuration option.	3 years ago
Dhia Ayachi	cd9d8d44a5	file watcher to be used for configuration auto-reload feature (#12301) ... * add config watcher to the config package * add logging to watcher * add test and refactor to add WatcherEvent. * add all API calls and fix a bug with recreated files * add tests for watcher * remove the unnecessary use of context * Add debug log and a test for file rename * use inode to detect if the file is recreated/replaced and only listen to create events. * tidy ups (#1535) * tidy ups * Add tests for inode reconcile * fix linux vs windows syscall * fix linux vs windows syscall * fix windows compile error * increase timeout * use ctime ID * remove remove/creation test as it's a use case that fail in linux * fix linux/windows to use Ino/CreationTime * fix the watcher to only overwrite current file id * fix linter error * fix remove/create test * set reconcile loop to 200 Milliseconds * fix watcher to not trigger event on remove, add more tests * on a remove event try to add the file back to the watcher and trigger the handler if success * fix race condition * fix flaky test * fix race conditions * set level to info * fix when file is removed and get an event for it after * fix to trigger handler when we get a remove but re-add fail * fix error message * add tests for directory watch and fixes * detect if a file is a symlink and return an error on Add * rename Watcher to FileWatcher and remove symlink deref * add fsnotify@v1.5.1 * fix go mod * fix flaky test * Apply suggestions from code review Co-authored-by: Ashwin Venkatesh <ashwin@hashicorp.com> * fix a possible stack overflow * do not reset timer on errors, rename OS specific files * start the watcher when creating it * fix data race in tests * rename New func * do not call handler when a remove event happen * events trigger on write and rename * fix watcher tests * make handler async * remove recursive call * do not produce events for sub directories * trim "/" at the end of a directory when adding * add missing test * fix logging * add todo * fix failing test * fix flaking tests * fix flaky test * add logs * fix log text * increase timeout * reconcile when remove * check reconcile when removed * fix reconcile move test * fix logging * delete invalid file * Apply suggestions from code review Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> * fix review comments * fix is watched to properly catch a remove * change test timeout * fix test and rename id * fix test to create files with different mod time. * fix deadlock when stopping watcher * Apply suggestions from code review Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> * fix a deadlock when calling stop while emitting event is blocked * make sure to close the event channel after the event loop is done * add go doc * back date file instead of sleeping * Apply suggestions from code review Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> * check error Co-authored-by: Ashwin Venkatesh <ashwin@hashicorp.com> Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>	3 years ago
R.B. Boyer	b60d89e7ef	bulk rewrite using this script ... set -euo pipefail unset CDPATH cd "$(dirname "$0")" for f in $(git grep '\brequire := require\.New(' | cut -d':' -f1 | sort -u); do echo "=== require: $f ===" sed -i '/require := require.New(t)/d' $f # require.XXX(blah) but not require.XXX(tblah) or require.XXX(rblah) sed -i 's/\brequire\.\([a-zA-Z0-9_]*\)(\([^tr]\)/require.\1(t,\2/g' $f # require.XXX(tblah) but not require.XXX(t, blah) sed -i 's/\brequire\.\([a-zA-Z0-9_]*\)(\(t[^,]\)/require.\1(t,\2/g' $f # require.XXX(rblah) but not require.XXX(r, blah) sed -i 's/\brequire\.\([a-zA-Z0-9_]*\)(\(r[^,]\)/require.\1(t,\2/g' $f gofmt -s -w $f done for f in $(git grep '\bassert := assert\.New(' | cut -d':' -f1 | sort -u); do echo "=== assert: $f ===" sed -i '/assert := assert.New(t)/d' $f # assert.XXX(blah) but not assert.XXX(tblah) or assert.XXX(rblah) sed -i 's/\bassert\.\([a-zA-Z0-9_]*\)(\([^tr]\)/assert.\1(t,\2/g' $f # assert.XXX(tblah) but not assert.XXX(t, blah) sed -i 's/\bassert\.\([a-zA-Z0-9_]*\)(\(t[^,]\)/assert.\1(t,\2/g' $f # assert.XXX(rblah) but not assert.XXX(r, blah) sed -i 's/\bassert\.\([a-zA-Z0-9_]*\)(\(r[^,]\)/assert.\1(t,\2/g' $f gofmt -s -w $f done	3 years ago
Daniel Nephin	0166b0839c	config: correctly capture all errors. ... Some calls to multierror.Append were not using the existing b.err, which meant we were losing all previous errors.	3 years ago
FFMMM	74eb257b1c	[sync ent] increase segment max limit to 4*64, make configurable (#1424) (#11795) ... * commit b6eb27563e747a78b7647d2b5da405e46364cc46 Author: FFMMM <FFMMM@users.noreply.github.com> Date: Thu Dec 9 13:53:44 2021 -0800 increase segment max limit to 4*64, make configurable (#1424) Signed-off-by: FFMMM <FFMMM@users.noreply.github.com> * fix: rename ent changelog file Signed-off-by: FFMMM <FFMMM@users.noreply.github.com>	3 years ago
Dan Upton	7fe81171d9	Rename `ACLMasterToken` => `ACLInitialManagementToken` (#11746)	3 years ago
Dan Upton	3a91815169	agent/token: rename `agent_master` to `agent_recovery` (internally) (#11744)	3 years ago
freddygv	5c1f7aa372	Allow cross-partition references in disco chain ... * Add partition fields to targets like service route destinations * Update validation to prevent cross-DC + cross-partition references * Handle partitions when reading config entries for disco chain * Encode partition in compiled targets	3 years ago
Daniel Nephin	e47cecc653	config: add NoFreelistSync option ... # Conflicts: # agent/config/testdata/TestRuntimeConfig_Sanitize-enterprise.golden # agent/consul/server.go	3 years ago
Dan Upton	d8afd2f6c8	Rename `master` and `agent_master` ACL tokens in the config file format (#11665)	3 years ago
R.B. Boyer	db91cbf484	auto-config: ensure the feature works properly with partitions (#11699)	3 years ago
R.B. Boyer	1e02460bd1	re-run gofmt on 1.17 (#11579) ... This should let freshly recompiled golangci-lint binaries using Go 1.17 pass 'make lint'	3 years ago
Kyle Havlovitz	6c0bd0550f	Merge pull request #11461 from deblasis/feature/empty_client_addr_warning ... config: warn the user if client_addr is empty	3 years ago
FFMMM	4ddf973a31	add root_cert_ttl option for consul connect, vault ca providers (#11428) ... * add root_cert_ttl option for consul connect, vault ca providers Signed-off-by: FFMMM <FFMMM@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Chris S. Kim <ckim@hashicorp.com> * add changelog, pr feedback Signed-off-by: FFMMM <FFMMM@users.noreply.github.com> * Update .changelog/11428.txt, more docs Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> * Update website/content/docs/agent/options.mdx Co-authored-by: Kyle Havlovitz <kylehav@gmail.com> Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> Co-authored-by: Kyle Havlovitz <kylehav@gmail.com>	3 years ago
Daniel Nephin	51d8417545	Merge pull request #10690 from tarat44/h2c-support-in-ping-checks ... add support for h2c in h2 ping health checks	3 years ago
Alessandro De Blasis	2f970555d9	config: warn the user if client_addr is empty ... if the provided value is empty string then the client services (DNS, HTTP, HTTPS, GRPC) are not listening and the user is not notified in any way about what's happening. Also, since a not provided client_addr defaults to 127.0.0.1, we make sure we are not getting unwanted warnings Signed-off-by: Alessandro De Blasis <alex@deblasis.net>	3 years ago
Daniel Nephin	0784a31e85	acl: remove init check for legacy anon token ... This token should always already be migrated from a previous version.	3 years ago
FFMMM	0954d261ae	use *telemetry.MetricsPrefix as prometheus.PrometheusOpts.Name (#11290) ... Signed-off-by: FFMMM <FFMMM@users.noreply.github.com>	3 years ago
tarat44	3fe637156c	add test cases for h2ping_use_tls default behavior	3 years ago
tarat44	ecdcfd6360	only set default on H2PingUseTLS if H2PING is set	3 years ago
tarat44	ca2e7c2039	fix formatting	3 years ago
tarat44	c1ed3a9a94	change config option to H2PingUseTLS	3 years ago
tarat44	3c9f5a73d9	add support for h2c in h2 ping health checks	3 years ago
Daniel Nephin	1502547e38	Revert "Merge pull request #10588 from hashicorp/dnephin/config-fix-ports-grpc" ... This reverts commit 74fb650b6b, reversing changes made to 58bd817336.	3 years ago
Daniel Nephin	e8ac5fd90b	config: Move ACLEnableKeyListPolicy to DeprecatedConfig	3 years ago
Daniel Nephin	5c40b717ed	config: move acl_ttl to DeprecatedConfig	3 years ago
Daniel Nephin	977f6d8888	config: move acl_{default,down}_policy to DeprecatedConfig	3 years ago
Daniel Nephin	5eafcea4d4	config: Deprecate EnableACLReplication ... replaced by ACL.TokenReplication	3 years ago
Daniel Nephin	5dc16180ad	config: move ACL master token and replication to DeprecatedConfig	3 years ago
Daniel Nephin	54256fb751	config: Move two more fields to DeprecatedConfig ... And add a test for deprecated config fields.	3 years ago
Daniel Nephin	8ed14296ea	config: Introduce DeprecatedConfig ... This struct allows us to move all the deprecated config options off of the main config struct, and keeps all the deprecation logic in a single place, instead of spread across 3+ places.	3 years ago
Freddy	e18f3c1f6d	Update error texts (#11022) ... Co-authored-by: Daniel Nephin <dnephin@hashicorp.com>	3 years ago
Daniel Nephin	1f9479603c	Add failures_before_warning to checks (#10969) ... Signed-off-by: Jakub Sokołowski <jakub@status.im> * agent: add failures_before_warning setting The new setting allows users to specify the number of check failures that have to happen before a service status us updated to be `warning`. This allows for more visibility for detected issues without creating alerts and pinging administrators. Unlike the previous behavior, which caused the service status to not update until it reached the configured `failures_before_critical` setting, now Consul updates the Web UI view with the `warning` state and the output of the service check when `failures_before_warning` is breached. The default value of `FailuresBeforeWarning` is the same as the value of `FailuresBeforeCritical`, which allows for retaining the previous default behavior of not triggering a warning. When `FailuresBeforeWarning` is set to a value higher than that of `FailuresBeforeCritical it has no effect as `FailuresBeforeCritical` takes precedence. Resolves: https://github.com/hashicorp/consul/issues/10680 Signed-off-by: Jakub Sokołowski <jakub@status.im> Co-authored-by: Jakub Sokołowski <jakub@status.im>	3 years ago
R.B. Boyer	a6d22efb49	acl: some acl authz refactors for nodes (#10909)	3 years ago
Dhia Ayachi	1950ebbe1f	oss portion of ent #1069 (#10883)	3 years ago
R.B. Boyer	097e1645e3	agent: ensure that most agent behavior correctly respects partition configuration (#10880)	3 years ago
Daniel Nephin	d5498770fa	acl: make ACLDisabledTTL a constant ... This field was never user-configurable. We always overwrote the value with 120s from NonUserSource. However, we also never copied the value from RuntimeConfig to consul.Config, So the value in NonUserSource was always ignored, and we used the default value of 30s set by consul.DefaultConfig. All of this code is an unnecessary distraction because a user can not actually configure this value. This commit removes the fields and uses a constant value instad. Someone attempting to set acl.disabled_ttl in their config will now get an error about an unknown field, but previously the value was completely ignored, so the new behaviour seems more correct. We have to keep this field in the AutoConfig response for backwards compatibility, but the value will be ignored by the client, so it doesn't really matter what value we set.	3 years ago
Daniel Nephin	17841248dd	config: remove ACLResolver settings from RuntimeConfig	3 years ago
Daniel Nephin	7160f7a614	acl: remove ACLDatacenter ... This field has been unnecessary for a while now. It was always set to the same value as PrimaryDatacenter. So we can remove the duplicate field and use PrimaryDatacenter directly. This change was made by GoLand refactor, which did most of the work for me.	3 years ago
Blake Covarrubias	11f1f3fe34	Add OSS changes for specifying audit log permission mode	3 years ago
Daniel Nephin	242b3a2dc5	streaming: set a default timeout ... The blocking query backend sets the default value on the server side. The streaming backend does not using blocking queries, so we must set the timeout on the client.	3 years ago
Chris S. Kim	91c90a672a	agent: update proxy upstreams to inherit namespace from service (#10688)	3 years ago
R.B. Boyer	188e8dc51f	agent/structs: add a bunch more EnterpriseMeta helper functions to help with partitioning (#10669)	3 years ago
Blake Covarrubias	a0cd3dd88e	Add DNS recursor strategy option (#10611) ... This change adds a new `dns_config.recursor_strategy` option which controls how Consul queries DNS resolvers listed in the `recursors` config option. The supported options are `sequential` (default), and `random`. Closes #8807 Co-authored-by: Blake Covarrubias <blake@covarrubi.as> Co-authored-by: Priyanka Sengupta <psengupta@flatiron.com>	3 years ago
Daniel Nephin	bb675139c1	Merge pull request #10567 from hashicorp/dnephin/config-unexport-build ... config: unexport the remaining builder methods	3 years ago
Daniel Nephin	bb7fb21004	Fix godoc comment ... Co-authored-by: Freddy <freddygv@users.noreply.github.com>	3 years ago
Daniel Nephin	233d03dbbd	Apply suggestions from code review ... Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>	3 years ago
Daniel Nephin	c48f26b0a6	config: update config settings and flags for ports.xds	3 years ago
Daniel Nephin	895bf9adec	config: update GRPCPort and addr in runtime config	3 years ago
R.B. Boyer	c94b8c6a39	config: add agent config flag for enterprise clients to indicate they wish to join a particular partition (#10572)	3 years ago
Daniel Nephin	d1c9d9bc68	config: unexport the remaining builder methods ... And remove BuildAndValidate. This commit completes some earlier work to reduce the config interface a single Load function. The last remaining test was converted to use Load instad of BuildAndValidate.	3 years ago
Daniel Nephin	3a045cca8d	ca: remove unused RotationPeriod field ... This field was never used. Since it is persisted as part of a map[string]interface{} it is pretty easy to remove it.	3 years ago
Daniel Nephin	f34d3543b1	testing: fix a test for 32-bit ... The hcl decoding apparently uses strconv.ParseInt, which fails to parse a 64bit int. Since hcl v1 is basically EOl, it seems unlikely we'll fix this in hcl. Since this test is only about loading values from config files, the extra large number doesn't seem important. Trim a few zeros from the numbers so that they parse properly on 32bit platforms. Also skip a slow test when -short is used.	3 years ago
Daniel Nephin	0a14a3e17c	inline assignment	3 years ago
Freddy	ffb13f35f1	Rename CatalogDestinationsOnly (#10397) ... CatalogDestinationsOnly is a passthrough that would enable dialing addresses outside of Consul's catalog. However, when this flag is set to true only _connect_ endpoints for services can be dialed. This flag is being renamed to signal that non-Connect endpoints can't be dialed by transparent proxies when the value is set to true.	3 years ago
Freddy	429f9d8bb8	Add flag for transparent proxies to dial individual instances (#10329)	4 years ago
Matt Keeler	da31e0449e	Move some things around to allow for license updating via config reload ... The bulk of this commit is moving the LeaderRoutineManager from the agent/consul package into its own package: lib/gort. It also got a renaming and its Start method now requires a context. Requiring that context required updating a whole bunch of other places in the code.	4 years ago
Matt Keeler	50cc9fdd06	Add OSS bits for supporting specifying the enterprise license via config	4 years ago
Daniel Nephin	6bda3a48ba	Merge pull request #10200 from hashicorp/dnephin/backport-audit-log-config-changes ... config: backport audit log config changes from enterprise	4 years ago
Joshua Shanks	00ca99bf67	GH-8728 add raft default values	4 years ago
Daniel Nephin	49e7e37cc7	config: handled deprecated config key with a warning	4 years ago
Daniel Nephin	0ddbb98668	Backport audit log config changes from enterprise	4 years ago
Mark Anderson	4aa0a0b2a3	Fixup agent/config tests ... Signed-off-by: Mark Anderson <manderson@hashicorp.com>	4 years ago
Daniel Nephin	347f3d2128	Merge pull request #10155 from hashicorp/dnephin/config-entry-remove-fields ... config-entry: remove Kind and Name field from Mesh config entry	4 years ago
Mark Anderson	8040f91a43	Add support for downstreams ... Enhance config by adding SocketPath and LocalSocketPath config values Supports syntax of the form: ``` services { name = "sock_forwarder" id = "sock_forwarder.1" socket_path = "/tmp/downstream_3.sock" connect { sidecar_service { proxy { local_service_socket_path = "/tmp/downstream.sock" } } } } ``` Signed-off-by: Mark Anderson <manderson@hashicorp.com>	4 years ago
Mark Anderson	583ae65d5b	Convert mode to string representation ... Signed-off-by: Mark Anderson <manderson@hashicorp.com>	4 years ago
Mark Anderson	06f0f79218	Continue working through proxy and agent ... Rework/listeners, rename makeListener Refactor, tests pass Signed-off-by: Mark Anderson <manderson@hashicorp.com>	4 years ago
Mark Anderson	8b1217417a	First changes for unix domain sockets upstreams ... Start making structure changes to support unix domain socket address for upstreams upstreams = [ { destination_name = "echo-service" local_bind_socket_path = "/tmp/upstream.sock" config { passive_health_check { interval = "10s" max_failures = 42 } } } Signed-off-by: Mark Anderson <manderson@hashicorp.com>	4 years ago
Daniel Nephin	62efaaab21	config-entry: remove Kind and Name field from Mesh config entry ... No config entry needs a Kind field. It is only used to determine the Go type to target. As we introduce new config entries (like this one) we can remove the kind field and have the GetKind method return the single supported value. In this case (similar to proxy-defaults) the Name field is also unnecessary. We always use the same value. So we can omit the name field entirely.	4 years ago
Daniel Nephin	bb472111fd	config: default UseStreamingBackend to true	4 years ago
Freddy	078c40425f	Rename "cluster" config entry to "mesh" (#10127) ... This config entry is being renamed primarily because in k8s the name cluster could be confusing given that the config entry applies across federated datacenters. Additionally, this config entry will only apply to Consul as a service mesh, so the more generic "cluster" name is not needed.	4 years ago
freddygv	7bd51ff536	Replace TransparentProxy bool with ProxyMode ... This PR replaces the original boolean used to configure transparent proxy mode. It was replaced with a string mode that can be set to: - "": Empty string is the default for when the setting should be defaulted from other configuration like config entries. - "direct": Direct mode is how applications originally opted into the mesh. Proxy listeners need to be dialed directly. - "transparent": Transparent mode enables configuring Envoy as a transparent proxy. Traffic must be captured and redirected to the inbound and outbound listeners. This PR also adds a struct for transparent proxy specific configuration. Initially this is not stored as a pointer. Will revisit that decision before GA.	4 years ago
Tara Tufano	9deb52e868	add http2 ping health checks (#8431) ... * add http2 ping checks * fix test issue * add h2ping check to config resources * add new test and docs for h2ping * fix grammatical inconsistency in H2PING documentation * resolve rebase conflicts, add test for h2ping tls verification failure * api documentation for h2ping * update test config data with H2PING * add H2PING to protocol buffers and update changelog * fix typo in changelog entry	4 years ago
R.B. Boyer	499fee73b3	connect: add toggle to globally disable wildcard outbound network access when transparent proxy is enabled (#9973) ... This adds a new config entry kind "cluster" with a single special name "cluster" where this can be controlled.	4 years ago
Freddy	8207b832df	Add TransparentProxy option to proxy definitions	4 years ago
Christopher Broglie	f0307c73e5	Add support for configuring TLS ServerName for health checks ... Some TLS servers require SNI, but the Golang HTTP client doesn't include it in the ClientHello when connecting to an IP address. This change adds a new TLSServerName field to health check definitions to optionally set it. This fixes #9473.	4 years ago
freddygv	6fd30d0384	Add TransparentProxy opt to proxy definition	4 years ago
Silas Rech	ab9c484137	Fix advertise_addr_wan_ipv6 configuration key	4 years ago
Daniel Nephin	3aec942b17	streaming: default rpc.enable_streaming to true ... So that all servers will start the grpc server used by streaming	4 years ago
Daniel Nephin	1f9247677b	Merge pull request #9763 from hashicorp/dnephin/cache-warn-on-error-in-notify ... cache: log a warning when Cache.Notify handles an error	4 years ago
Daniel Nephin	b91c5a8383	config: rename testCase fields ... So that their name better reflects their purpose	4 years ago
Daniel Nephin	534631659c	config: make TestLoad_IntegrationWithFlags easier to work with ... Replace the large table of tests with individual calls to run(). By using runCase, failure messages will include the line number for the test case, as well as a line number from the test functions. Example: === FAIL: agent/config TestLoad_IntegrationWithFlags/failing_case (0.01s) runtime_test.go:4721: case: failing case runtime_test.go:4864: error "data_dir cannot be empty" does not contain "I expected this error" Previous: runtime_test.go:4864: error "data_dir cannot be empty" does not contain "I expected this error" Without the line number to the testCase data, debugging these tests is difficult. It is impossible to jump directly to the test case, and difficult to find the location because of many similarly named cases.	4 years ago
Daniel Nephin	bd728df345	move test case iteration to caller ... To make the test case logic more obvious	4 years ago
Daniel Nephin	f86ceea803	config: remove test cases for impossible scenarios ... AEInterval is overridden by NonUserSource, so there is no way for a user to set this value. These two cases represented impossible real world scenarios. Instead the test is replaced with one that shows that the AEInterval can not be set by config. This change allows us to remove the hcltail and jsontail fields from testCase	4 years ago
Daniel Nephin	76787d4dd0	Fix error checking ... There were two identical if lines, remove one and use a switch/case so the compiler can catch this problem.	4 years ago
Daniel Nephin	863551beb4	config: move testing shims to LoadOpts ... This will allow us to eventually port these tests to use config.Load instead of unexported functions.	4 years ago
Daniel Nephin	4411da5ddd	Remove patchActual, does not appear to be necessary ... also small rename and fix comment	4 years ago
Daniel Nephin	d9b8d30cad	cache: log a warning when Cache.Notify handles an error ... Without these warnings, errors are silently ignored, which can make debugging problems more challenging.	4 years ago
Daniel Nephin	1dcafa51a4	config: make config.TestLoad_FullConfig use config.Load ... This commit makes a number of changes that should make TestLoad_FullConfig easier to work with, and make the test more like real world scenarios. * use separate files in testdata/ dir to store the config source. Separate files are much easier to edit because editors can syntax highlight json/hcl, and it makes strings easier to find. Previously trying to find strings would match strings used in other tests. * use the exported config.Load interface instead of internal NewBuilder and BuildAndValidate. * remove the tail config overrides, which are only necessary with nonZero works.	4 years ago
Daniel Nephin	a0dd45941b	config: Unexport Builder and NewBuilder ... This type and constructor are implementation details of config loading. All callers should use config.Load.	4 years ago
Daniel Nephin	32d36d0dd4	config: replace calls to config.NewBuilder with config.Load ... This is another incremental change to reduce config loading to a single small interface. All calls to NewBuilder can be replaced with Load.	4 years ago
Daniel Nephin	97a577502d	config: improve the interface of Load ... This commit reduces the interface to Load() a bit, in preparation for unexporting NewBuilder and having everything call Load. The three arguments are reduced to a single argument by moving the other two into the options struct. The three return values are reduced to two by moving the RuntimeConfig and Warnings into a LoadResult struct.	4 years ago
Daniel Nephin	27df0d9a78	Merge pull request #9252 from hashicorp/dnephin/config-unmethod ... config: remove Builder receiver from funcs that dont use it	4 years ago
Daniel Nephin	e66af1a559	agent/consuk: Rename RPCRate -> RPCRateLimit ... so that the field name is consistent across config structs.	4 years ago
Daniel Nephin	e35d5c93c7	config: remove Builder receiver from funcs that dont use it ... This change allows us to re-use these functions in other places without the Builder, and makes it more explicit about which functions can warn/error and which can not.	4 years ago
Daniel Nephin	c500182105	config: Use golden for TestRuntimeConfig_Sanitize ... A golden file makes the expected value easier to work with. This change also removes a number of shims for enterprise and replaces them with a single one for the golden filename.	4 years ago
Pierre Souchay	7c1b69cbeb	Display a warning when rpc.enable_streaming = true is set on a client (#9530) ... * Display a warning when rpc.enable_streaming = true is set on a client This option has no effect when running as an agent * Added warning when server starts with use_streaming_backend but without rpc.enable_streaming * Added unit test	4 years ago
Daniel Nephin	6f1f679457	Merge pull request #9250 from hashicorp/dnephin/config-tags-2 ... config: remove unnecessary json/hcl struct tags	4 years ago
Daniel Nephin	7b45d0baea	Merge pull request #9249 from hashicorp/dnephin/config-tags ... config: use fields to detect enterprise-only settings	4 years ago
Daniel Nephin	de7e1d7ca1	config: remove unnecessary json/hcl struct tags ... Using find/replace with regex json:"[^"]+" hcl:"[^"]+"	4 years ago
Daniel Nephin	724a281e1c	config: Use config fields to warn about enterprise settings ... It is no safe to assumes that the mapstructure keys will contain all the keys because some config can be specified with command line flags or literals. This change allows us to remove the json marshal/unmarshal cycle for command line flags, which will allow us to remove all of the hcl/json struct tags on config fields.	4 years ago
Daniel Nephin	a9285ad76a	Merge pull request #9251 from hashicorp/dnephin/config-cleanup-flags-and-opts ... config: move testing shims and cleanup some defaults	4 years ago
Daniel Nephin	ce1deae3c8	config: use LiteralConfig for flag values	4 years ago
Daniel Nephin	a9734b69c5	config: remove t.Parallel and some unused fields from tests ... Use go-cmp for better diffs in tests	4 years ago
Michael Montgomery	ba3fe0c875	Remove unneeded test	4 years ago
Michael Montgomery	e4f603dfae	Merge branch 'master' into 6074-allow-config-MaxHeaderBytes	4 years ago
Michael Montgomery	817903b925	Fixed failing tests ... Removed use of `NewTestAgent`, per review comment Removed CLI flag, per review comment Updated website documentation Added changelog entry	4 years ago
Daniel Nephin	b9e60c0775	testing: skip slow tests with -short ... Add a skip condition to all tests slower than 100ms. This change was made using `gotestsum tool slowest` with data from the last 3 CI runs of master. See https://github.com/gotestyourself/gotestsum#finding-and-skipping-slow-tests With this change: ``` $ time go test -count=1 -short ./agent ok github.com/hashicorp/consul/agent 0.743s real 0m4.791s $ time go test -count=1 -short ./agent/consul ok github.com/hashicorp/consul/agent/consul 4.229s real 0m8.769s ```	4 years ago
Hans Hasselberg	44674bcdf8	fix serf_wan documentation (#9289) ... WAN config is different than LAN config, source of truth is f72d2042a8/config.go (L315-L326) and now the docs are correct.	4 years ago
Daniel Nephin	a1e4b69527	config: remove unused const	4 years ago
Daniel Nephin	78f767e78c	config: move testing shims to BuilderOpts ... And remove the devMode field from builder. This change helps make the Builder state more explicit by moving inputs to the BuilderOps struct, leaving only fields that can change during Builder.Build on the Builder struct.	4 years ago
Daniel Nephin	0a44906fe3	config: Use LiteralSource for some defaults ... Using the LiteralSource makes it much easier to find default values, because an IDE reports the location of a default. With an HCL string they are harder to discover. Also removes unnecessary mapstructure.Decodes of constant values.	4 years ago
Michael Montgomery	585c84e9ff	Merge branch 'master' into 6074-allow-config-MaxHeaderBytes	4 years ago
Matt Keeler	66fd23d67f	Refactor to call non-voting servers read replicas (#9191) ... Co-authored-by: Kit Patella <kit@jepsen.io>	4 years ago
Kit Patella	8e554ee74b	Merge branch 'mkcp/telemetry/add-all-metric-definitions' of ssh://github.com/hashicorp/consul into mkcp/telemetry/add-all-metric-definitions	4 years ago
Kit Patella	ad4cebc1d8	fix some tests that were broken from the TelemetryConfig change	4 years ago
Kit Patella	fc30f07cc7	linting: sort and group import	4 years ago
Kit Patella	2fe021f03c	update runtime_test to handle PrometheusOpts expiry field change	4 years ago
Kit Patella	5e0e4098c9	push prometheus sink definiitons into prometheus.PrometheusOpts	4 years ago
R.B. Boyer	61eac21f1a	agent: return the default ACL policy to callers as a header (#9101) ... Header is: X-Consul-Default-ACL-Policy=<allow|deny> This is of particular utility when fetching matching intentions, as the fallthrough for a request that doesn't match any intentions is to enforce using the default acl policy.	4 years ago
Matt Keeler	c048e86bb2	Switch to using the external autopilot module	4 years ago
R.B. Boyer	8e616a93c1	agent: sanitize ui metrics proxy header values on agent/self endpoint (#9104)	4 years ago
R.B. Boyer	a66c4591d7	agent: introduce path allow list for requests going through the metrics proxy (#9059) ... Added a new option `ui_config.metrics_proxy.path_allowlist`. This defaults to `["/api/v1/query", "/api/v1/query_range"]` when the metrics provider is set to `prometheus`. Requests that do not use one of the allow-listed paths (via exact match) get a 403 Forbidden response instead.	4 years ago
Michael Montgomery	5b6ac035ff	Resolves #6074. Adds new option to configure HTTP Server's MaxHeaderBytes with option `-http-max-header-bytes` ... Adds tests for behavior	4 years ago
Daniel Nephin	853667e7d8	health: change the name of UseStreamingBackend config ... Remove it from the cache section, and update the docs.	4 years ago
Daniel Nephin	ea77eccb14	Merge pull request #8825 from hashicorp/streaming/add-config ... streaming: add config and docs	4 years ago
Daniel Nephin	e7d505dc33	config: add field for enabling streaming in the client ... agent: register the new streaming cache-type	4 years ago
Matt Keeler	0d8bf9c62c	Remove oss/ent divergence of runtime_test.go (#8903)	4 years ago
Kit Patella	adeabf2399	Merge pull request #8877 from hashicorp/mkcp/telemetry/consul.api.http ... Add flag for disabling 1.9 metrics backwards compatibility and warnings when set to default	4 years ago
Matt Keeler	38f5ddce2a	Add per-agent reconnect timeouts (#8781) ... This allows for client agent to be run in a more stateless manner where they may be abruptly terminated and not expected to come back. If advertising a per-agent reconnect timeout using the advertise_reconnect_timeout configuration when that agent leaves, other agents will wait only that amount of time for the agent to come back before reaping it. This has the advantageous side effect of causing servers to deregister the node/services/checks for that agent sooner than if the global reconnect_timeout was used.	4 years ago
Daniel Nephin	b93577c94f	config: add field for enabling streaming RPC endpoint	4 years ago
Kit Patella	7fe2f80b4b	add config flag to disable 1.9 metrics backwards compatibility. Add warnings on start and reload on default value	4 years ago
R.B. Boyer	a2a8e9c783	connect: intentions are now managed as a new config entry kind "service-intentions" (#8834) ... - Upgrade the ConfigEntry.ListAll RPC to be kind-aware so that older copies of consul will not see new config entries it doesn't understand replicate down. - Add shim conversion code so that the old API/CLI method of interacting with intentions will continue to work so long as none of these are edited via config entry endpoints. Almost all of the read-only APIs will continue to function indefinitely. - Add new APIs that operate on individual intentions without IDs so that the UI doesn't need to implement CAS operations. - Add a new serf feature flag indicating support for intentions-as-config-entries. - The old line-item intentions way of interacting with the state store will transparently flip between the legacy memdb table and the config entry representations so that readers will never see a hiccup during migration where the results are incomplete. It uses a piece of system metadata to control the flip. - The primary datacenter will begin migrating intentions into config entries on startup once all servers in the datacenter are on a version of Consul with the intentions-as-config-entries feature flag. When it is complete the old state store representations will be cleared. We also record a piece of system metadata indicating this has occurred. We use this metadata to skip ALL of this code the next time the leader starts up. - The secondary datacenters continue to run the old intentions replicator until all servers in the secondary DC and primary DC support intentions-as-config-entries (via serf flag). Once this condition it met the old intentions replicator ceases. - The secondary datacenters replicate the new config entries as they are migrated in the primary. When they detect that the primary has zeroed it's old state store table it waits until all config entries up to that point are replicated and then zeroes its own copy of the old state store table. We also record a piece of system metadata indicating this has occurred. We use this metadata to skip ALL of this code the next time the leader starts up.	4 years ago
Kit Patella	f5c51ae13b	remove consul.api.http from filtered metric prefixes	4 years ago
Kit Patella	52451cf846	Merge pull request #8271 from coignetp/http-metrics-label ... Use method and path as labels for http metrics	4 years ago
Paul Banks	d0c160130b	Merge pull request #8694 from hashicorp/ui-config-metrics ... Add config changes for UI metrics	4 years ago
R.B. Boyer	9801ef8eb1	agent: enable enable_central_service_config by default (#8746)	4 years ago
Paul Banks	f6d55e1d25	Fix reload test; address other PR feedback	4 years ago