415 Commits (bc520a4fc8c52209db21f61e9da5e666092e5e16)

Author	SHA1	Message	Date
R.B. Boyer	d921690bfe	acl: global tokens created by auth methods now correctly replicate to secondary datacenters (#9351) ... Previously the tokens would fail to insert into the secondary's state store because the AuthMethod field of the ACLToken did not point to a known auth method from the primary.	4 years ago
Kyle Havlovitz	c4eff420be	Merge pull request #9009 from hashicorp/update-secondary-ca ... connect: Fix an issue with updating CA config in a secondary datacenter	4 years ago
Kyle Havlovitz	0bfda4481f	Add CA server delegate interface for testing	4 years ago
Kyle Havlovitz	9be7c6401c	connect: update some function comments in CA manager	4 years ago
Matt Keeler	66fd23d67f	Refactor to call non-voting servers read replicas (#9191) ... Co-authored-by: Kit Patella <kit@jepsen.io>	4 years ago
R.B. Boyer	c7233ba871	server: remove config entry CAS in legacy intention API bridge code (#9151) ... Change so line-item intention edits via the API are handled via the state store instead of via CAS operations. Fixes #9143	4 years ago
R.B. Boyer	c003871c54	server: break up Intention.Apply monolithic method (#9007) ... The Intention.Apply RPC is quite large, so this PR attempts to break it down into smaller functions and dissolves the pre-config-entry approach to the breakdown as it only confused things.	4 years ago
Matt Keeler	c048e86bb2	Switch to using the external autopilot module	4 years ago
Daniel Nephin	b532e092dc	structs: add a namespace test for CheckServiceNode.CanRead	4 years ago
Daniel Nephin	c42fe5ae43	subscribe: set the request namespace	4 years ago
Daniel Nephin	a5dd2001cf	stream: remove Event.Key ... Makes Payload a type with FilterByKey so that Payloads can implement filtering by key. With this approach we don't need to expose a Namespace field on Event, and we don't need to invest micro formats or require a bunch of code to be aware of exactly how the key field is encoded.	4 years ago
R.B. Boyer	58387fef0a	server: config entry replication now correctly uses namespaces in comparisons (#9024) ... Previously config entries sharing a kind & name but in different namespaces could occasionally cause "stuck states" in replication because the namespace fields were ignored during the differential comparison phase. Example: Two config entries written to the primary: kind=A,name=web,namespace=bar kind=A,name=web,namespace=foo Under the covers these both get saved to memdb, so they are sorted by all 3 components (kind,name,namespace) during natural iteration. This means that before the replication code does it's own incomplete sort, the underlying data IS sorted by namespace ascending (bar comes before foo). After one pass of replication the primary and secondary datacenters have the same set of config entries present. If "kind=A,name=web,namespace=bar" were to be deleted, then things get weird. Before replication the two sides look like: primary: [ kind=A,name=web,namespace=foo ] secondary: [ kind=A,name=web,namespace=bar kind=A,name=web,namespace=foo ] The differential comparison phase walks these two lists in sorted order and first compares "kind=A,name=web,namespace=foo" vs "kind=A,name=web,namespace=bar" and falsely determines they are the SAME and are thus cause an update of "kind=A,name=web,namespace=foo". Then it compares "<nothing>" with "kind=A,name=web,namespace=foo" and falsely determines that the latter should be DELETED. During reconciliation the deletes are processed before updates, and so for a brief moment in the secondary "kind=A,name=web,namespace=foo" is erroneously deleted and then immediately restored. Unfortunately after this replication phase the final state is identical to the initial state, so when it loops around again (rate limited) it repeats the same set of operations indefinitely.	4 years ago
Freddy	9c04cbc40f	Add HasExact to topology endpoint (#9010)	4 years ago
Daniel Nephin	8b601fdcac	Merge pull request #8771 from amenzhinsky/fix-grpc-use-tls-mapping ... Fix GRPCUseTLS flag HTTP API mapping	4 years ago
s-christoff	9bb348c6c7	Enhance the output of consul snapshot inspect (#8787)	4 years ago
Freddy	13df5d5bf8	Add protocol to the topology endpoint response (#8868)	4 years ago
Daniel Nephin	da6400192b	Merge pull request #8768 from hashicorp/streaming/add-subscribe-service ... subscribe: add subscribe service for streaming change events	4 years ago
Freddy	da91e999f6	Return intention info in svc topology endpoint (#8853)	4 years ago
Daniel Nephin	21c21191f4	structs: add CheckServiceNode.CanRead ... And use it from the subscribe endpoint.	4 years ago
R.B. Boyer	1b413b0444	connect: support defining intentions using layer 7 criteria (#8839) ... Extend Consul’s intentions model to allow for request-based access control enforcement for HTTP-like protocols in addition to the existing connection-based enforcement for unspecified protocols (e.g. tcp).	4 years ago
R.B. Boyer	a2a8e9c783	connect: intentions are now managed as a new config entry kind "service-intentions" (#8834) ... - Upgrade the ConfigEntry.ListAll RPC to be kind-aware so that older copies of consul will not see new config entries it doesn't understand replicate down. - Add shim conversion code so that the old API/CLI method of interacting with intentions will continue to work so long as none of these are edited via config entry endpoints. Almost all of the read-only APIs will continue to function indefinitely. - Add new APIs that operate on individual intentions without IDs so that the UI doesn't need to implement CAS operations. - Add a new serf feature flag indicating support for intentions-as-config-entries. - The old line-item intentions way of interacting with the state store will transparently flip between the legacy memdb table and the config entry representations so that readers will never see a hiccup during migration where the results are incomplete. It uses a piece of system metadata to control the flip. - The primary datacenter will begin migrating intentions into config entries on startup once all servers in the datacenter are on a version of Consul with the intentions-as-config-entries feature flag. When it is complete the old state store representations will be cleared. We also record a piece of system metadata indicating this has occurred. We use this metadata to skip ALL of this code the next time the leader starts up. - The secondary datacenters continue to run the old intentions replicator until all servers in the secondary DC and primary DC support intentions-as-config-entries (via serf flag). Once this condition it met the old intentions replicator ceases. - The secondary datacenters replicate the new config entries as they are migrated in the primary. When they detect that the primary has zeroed it's old state store table it waits until all config entries up to that point are replicated and then zeroes its own copy of the old state store table. We also record a piece of system metadata indicating this has occurred. We use this metadata to skip ALL of this code the next time the leader starts up.	4 years ago
R.B. Boyer	4998a08c56	server: create new memdb table for storing system metadata (#8703) ... This adds a new very tiny memdb table and corresponding raft operation for updating a very small effective map[string]string collection of "system metadata". This can persistently record a fact about the Consul state machine itself. The first use of this feature will come in a later PR.	4 years ago
freddygv	413a894a1a	Do not evaluate discovery chain for topology upstreams	4 years ago
freddygv	cf7b7fcdd6	Single DB txn for ServiceTopology and other PR comments	4 years ago
freddygv	f906b94351	Add func to combine up+downstream queries	4 years ago
freddygv	b012d8374e	support querying upstreams/downstreams from registrations	4 years ago
Aliaksandr Mianzhynski	74cfba7065	Fix GRPCUseTLS flag HTTP API mapping	4 years ago
freddygv	9fa1b13df9	Resolve conflicts	4 years ago
R.B. Boyer	0fb088aac3	agent: make the json/hcl decoding of ConnectProxyConfig fully work with CamelCase and snake_case (#8741) ... Fixes #7418	4 years ago
Paul Banks	7d58901ae8	Fix bad int -> string conversions caught by go vet changes in 1.15 (#8739)	4 years ago
Kyle Havlovitz	35bb09f85c	Merge pull request #8646 from hashicorp/common-intermediate-ttl ... Move IntermediateCertTTL to common CA config	4 years ago
freddygv	7fd518ff1d	Merge master	4 years ago
freddygv	7b9d1b41d5	Resolve conflicts against master	4 years ago
freddygv	768dbaa68d	Add session flag to cookie config	4 years ago
freddygv	eab90ea9fa	Revert EnvoyConfig nesting	4 years ago
Kyle Havlovitz	2f7210bde2	Move IntermediateCertTTL to common CA config	4 years ago
freddygv	cd4cf5161f	Update resolver defaulting	4 years ago
freddygv	eaa250cc80	Ensure resolver node with LB isn't considered default	4 years ago
freddygv	ef877449ce	Move valid policies to pkg level	4 years ago
freddygv	f81fe6a1a1	Remove LB infix and move injection to xds	4 years ago
R.B. Boyer	119e945c3e	connect: all config entries pick up a meta field (#8596) ... Fixes #8595	4 years ago
R.B. Boyer	d0f74cd1e8	connect: fix bug in preventing some namespaced config entry modifications (#8601) ... Whenever an upsert/deletion of a config entry happens, within the open state store transaction we speculatively test compile all discovery chains that may be affected by the pending modification to verify that the write would not create an erroneous scenario (such as splitting traffic to a subset that did not exist). If a single discovery chain evaluation references two config entries with the same kind and name in different namespaces then sometimes the upsert/deletion would be falsely rejected. It does not appear as though this bug would've let invalid writes through to the state store so the correction does not require a cleanup phase.	4 years ago
freddygv	63f79e5f9b	Restructure structs and other PR comments	4 years ago
freddygv	0236e169bb	Add documentation for resolver LB cfg	4 years ago
freddygv	81115b6eaa	Compile down LB policy to disco chain nodes	4 years ago
freddygv	ff56a64b08	Add LB policy to service-resolver	4 years ago
Jack	9e1c6727f9	Add http2 and grpc support to ingress gateways (#8458)	4 years ago
R.B. Boyer	74d5df7c7a	xds: use envoy's rbac filter to handle intentions entirely within envoy (#8569)	4 years ago
Daniel Nephin	07ad662131	Fix panic when decoding 'Connect: null' ... Surprisingly the json Unmarshal updates the aux pointer to a nil.	4 years ago
Hans Hasselberg	a932aafc91	add primary keys to list keyring (#8522) ... During gossip encryption key rotation it would be nice to be able to see if all nodes are using the same key. This PR adds another field to the json response from `GET v1/operator/keyring` which lists the primary keys in use per dc. That way an operator can tell when a key was successfully setup as primary key. Based on https://github.com/hashicorp/serf/pull/611 to add primary key to list keyring output: ```json [ { "WAN": true, "Datacenter": "dc2", "Segment": "", "Keys": { "0OuM4oC3Os18OblWiBbZUaHA7Hk+tNs/6nhNYtaNduM=": 6, "SINm887hKTzmMWeBNKTJReaTLX3mBEJKriDyt88Ad+g=": 6 }, "PrimaryKeys": { "SINm887hKTzmMWeBNKTJReaTLX3mBEJKriDyt88Ad+g=": 6 }, "NumNodes": 6 }, { "WAN": false, "Datacenter": "dc2", "Segment": "", "Keys": { "0OuM4oC3Os18OblWiBbZUaHA7Hk+tNs/6nhNYtaNduM=": 8, "SINm887hKTzmMWeBNKTJReaTLX3mBEJKriDyt88Ad+g=": 8 }, "PrimaryKeys": { "SINm887hKTzmMWeBNKTJReaTLX3mBEJKriDyt88Ad+g=": 8 }, "NumNodes": 8 }, { "WAN": false, "Datacenter": "dc1", "Segment": "", "Keys": { "0OuM4oC3Os18OblWiBbZUaHA7Hk+tNs/6nhNYtaNduM=": 3, "SINm887hKTzmMWeBNKTJReaTLX3mBEJKriDyt88Ad+g=": 8 }, "PrimaryKeys": { "SINm887hKTzmMWeBNKTJReaTLX3mBEJKriDyt88Ad+g=": 8 }, "NumNodes": 8 } ] ``` I intentionally did not change the CLI output because I didn't find a good way of displaying this information. There are a couple of options that we could implement later: * add a flag to show the primary keys * add a flag to show json output Fixes #3393.	4 years ago