269 Commits (c12245be3c1ef036ec4525066ab492775318e163)

Author	SHA1	Message	Date
Semir Patel	aaac20f4a8	resource: misc finalizer apis (#19474)	1 year ago
John Murret	77e9a50f8b	Source / local_app golden tests to include all protocols. (#19436) ... * cover all protocols in local_app golden tests * fix xds tests * updating latest * fix broken test * add sorting of routers to TestBuildLocalApp to get rid of the flaking	1 year ago
skpratt	896d8f5ec5	temporarily disallow L7 traffic permissions (#19322)	1 year ago
Semir Patel	0abd96c0d9	resource: resource service now checks for `v2tenancy` feature flag (#19400)	1 year ago
Matt Keeler	5698353652	Resource Hook Pre-Decode Utilities (#18548) ... Add some generic type hook wrappers to first decode the data There seems to be a pattern for Validation, Mutation and Write Authorization hooks where they first need to decode the Any data before doing the domain specific work. This PR introduces 3 new functions to generate wrappers around the other hooks to pre-decode the data into a DecodedResource and pass that in instead of the original pbresource.Resource. This PR also updates the various catalog data types to use the new hook generators.	1 year ago
Ashesh Vidyut	0295b959c9	Net 5875 - Create the Exported Services Resources (#19117) ... * init * computed exported service * make proto * exported services resource * exported services test * added some tests and namespace exported service * partition exported services * computed service * computed services tests * register types * fix comment * make proto lint * fix proto format make proto * make codegen * Update proto-public/pbmulticluster/v1alpha1/computed_exported_services.proto Co-authored-by: Eric Haberkorn <erichaberkorn@gmail.com> * Update internal/multicluster/internal/types/computed_exported_services.go Co-authored-by: Eric Haberkorn <erichaberkorn@gmail.com> * using different way of resource creation in tests * make proto * fix computed exported services test * fix tests * differnet validation for computed services for ent and ce * Acls for exported services * added validations for enterprise features in ce * fix error * fix acls test * Update internal/multicluster/internal/types/validation_exported_services_ee.go Co-authored-by: Eric Haberkorn <erichaberkorn@gmail.com> * removed the create method * update proto * removed namespace * created seperate function for ce and ent * test files updated and validations fixed * added nil checks * fix tests * added comments * removed tenancy check * added mutation function * fix mutation method * fix list permissions in test * fix pr comments * fix tests * lisence * busl license * Update internal/multicluster/internal/types/helpers_ce.go Co-authored-by: Eric Haberkorn <erichaberkorn@gmail.com> * Update internal/multicluster/internal/types/helpers_ce.go Co-authored-by: Eric Haberkorn <erichaberkorn@gmail.com> * Update internal/multicluster/internal/types/helpers_ce.go Co-authored-by: Eric Haberkorn <erichaberkorn@gmail.com> * make proto * some pr comments addressed * some pr comments addressed * acls helper * some comment changes * removed unused files * fixes * fix function in file * caps * some positioing * added test for validation error * fix names * made valid a function * remvoed patch * removed mutations * v2 beta1 * v2beta1 * rmeoved v1alpha1 * validate error * merge ent * some nits * removed dup func * removed nil check --------- Co-authored-by: Eric Haberkorn <erichaberkorn@gmail.com>	1 year ago
Poonam Jadhav	b5023b69c3	feat: read resource namespace (#19320) ... * test: add missing tests for read resource namespace * refactor: remove redundant test * refactor: rename import aliases * fix: typo var name * refctor: remove another redundant test	1 year ago
Michael Zalimeni	a7803bd829	[NET-6305] xds: Ensure v2 route match and protocol are populated for gRPC (#19343) ... * xds: Ensure v2 route match is populated for gRPC Similar to HTTP, ensure that route match config (which is required by Envoy) is populated when default values are used. Because the default matches generated for gRPC contain a single empty `GRPCRouteMatch`, and that proto does not directly support prefix-based config, an interpretation of the empty struct is needed to generate the same output that the `HTTPRouteMatch` is explicitly configured to provide in internal/mesh/internal/controllers/routes/generate.go. * xds: Ensure protocol set for gRPC resources Add explicit protocol in `ProxyStateTemplate` builders and validate it is always set on clusters. This ensures that HTTP filters and `http2_protocol_options` are populated in all the necessary places for gRPC traffic and prevents future unintended omissions of non-TCP protocols. Co-authored-by: John Murret <john.murret@hashicorp.com> --------- Co-authored-by: John Murret <john.murret@hashicorp.com>	1 year ago
John Murret	59d4962564	NET-6079 - wire up sidecarproxy golden file inputs into xds controller - sources (#19241) ... * NET-5397 - wire up golden tests from sidecar-proxy controller for xds controller and xdsv2 * WIP * WIP * everything matching except leafCerts. need to mock those * single port destinations working except mixed destinations * golden test input to xds controller tests for destinations * proposed fix for failover group naming errors * clean up test to use helper. * clean up test to use helper. * fix test file * add docstring for test function. * add docstring for test function. * fix linting error * fixing test after route fix merged into main * first source test works * WIP * modify all source files * source tests pass * fixing tests after bug fix in main	1 year ago
John Murret	9775758d0c	NET-5397 - wire up destination golden tests from sidecar-proxy controller for xds controller and xdsv2 (#19167) ... * NET-5397 - wire up golden tests from sidecar-proxy controller for xds controller and xdsv2 * WIP * WIP * everything matching except leafCerts. need to mock those * single port destinations working except mixed destinations * golden test input to xds controller tests for destinations * proposed fix for failover group naming errors * clean up test to use helper. * clean up test to use helper. * fix test file * add docstring for test function. * add docstring for test function. * fix linting error * fixing test after route fix merged into main	1 year ago
Iryna Shustava	809bf1deb8	mesh: ensure route configs are named uniquely per port (#19323)	1 year ago
Dhia Ayachi	d5c9f11b59	Tenancy Bridge v2 (#19220) ... * tenancy bridge v2 for v2 resources * add missing copywrite headers	1 year ago
Nitya Dhanushkodi	def66ddf0e	mesh: provide missing domain to route configurations in ProxyStateTemplate (#19298) ... * add empty domains * update unit tests	1 year ago
Iryna Shustava	dfea3a0efe	acls,catalog,mesh: properly authorize workload selectors on writes (#19260) ... To properly enforce writes on resources that have workload selectors with prefixes, we need another service authorization rule that allows us to check whether read is allowed within a given prefix. Specifically we need to only allow writes if the policy prefix allows for a wider set of names than the prefix selector on the resource. We should also not allow policies with exact names for prefix matches. Part of [NET-3993]	1 year ago
Eric Haberkorn	f45be222bb	Prevent circular dependencies between v2 resources and generate a mermaid diagram with their dependencies (#19230)	1 year ago
Nitya Dhanushkodi	51b58cd910	fix expose paths (#19257) ... When testing adding http probes to apps, I ran into some issues which I fixed here: - The listener should be listening on the exposed listener port, updated that. - The listener and route names were pointing to the path of the exposed path. In my test, the path was "/" resulting in an empty string path. Also, the path may not be unique across exposed path listeners, so I decided to use the path+exposed port as the unique identifier.	1 year ago
John Murret	9f4f99c626	NET-6097 - sidecar proxy controller - give name to first failover policy target (#19239)	1 year ago
Semir Patel	4c5a46e5e1	v2tenancy: rename v1alpha1 -> v2beta1 (#19227)	1 year ago
R.B. Boyer	6741392a4f	catalog: add FailoverPolicy ACL hook tenancy test (#19179)	1 year ago
R.B. Boyer	df8ea430c6	mesh: add DestinationPolicy ACL hook tenancy tests (#19178) ... Enhance the DestinationPolicy ACL hook tests to cover tenanted situations. These tests will only execute in enterprise.	1 year ago
Semir Patel	ad177698f7	resource: enforce lowercase v2 resource names (#19218)	1 year ago
R.B. Boyer	6c7d0759e4	mesh: add xRoute ACL hook tenancy tests (#19177) ... Enhance the xRoute ACL hook tests to cover tenanted situations. These tests will only execute in enterprise.	1 year ago
John Murret	a7fbd00865	NET-5073 - ProxyConfiguration: implement various connection options (#19187) ... * NET-5073 - ProxyConfiguration: implement various connection options * PR feedback - LocalConnection and InboundConnection do not affect exposed routes. configure L7 route destinations. fix connection proto sequence numbers. * add timeout to L7 Route Destinations	1 year ago
Iryna Shustava	105ebfdd00	catalog, mesh: implement missing ACL hooks (#19143) ... This change adds ACL hooks to the remaining catalog and mesh resources, excluding any computed ones. Those will for now continue using the default operator:x permissions. It refactors a lot of the common testing functions so that they can be re-used between resources. There are also some types that we don't yet support (e.g. virtual IPs) that this change adds ACL hooks to for future-proofing.	1 year ago
Iryna Shustava	2ea33e9b86	mesh: add more validations to Destinations resource (#19202)	1 year ago
Iryna Shustava	e94d6ceca6	mesh: add validation hook to proxy configuration (#19186)	1 year ago
Ashwin Venkatesh	3d1a606c3b	Clone proto into deepcopy correctly (#19204)	1 year ago
R.B. Boyer	99f7a1219e	catalog: add metadata filtering to refine workload selectors (#19198) ... This implements the Filter field on pbcatalog.WorkloadSelector to be a post-fetch in-memory filter using the https://github.com/hashicorp/go-bexpr expression language to filter resources based on their envelope metadata fields. All existing usages of WorkloadSelector should be able to make use of the filter.	1 year ago
R.B. Boyer	f0e4897736	mesh: ensure that xRoutes have ParentRefs that have matching Tenancy to the enclosing resource (#19176) ... We don't want an xRoute controlling traffic for a Service in another tenancy.	1 year ago
Dhia Ayachi	5fbf0c00d3	Add namespace read write tests (#19173)	1 year ago
Ashwin Venkatesh	c2a0d4f9ca	Create DeepCopy() and Json Marshal/Unmarshal for proto-public (#19015) ... * Override Marshal/UnmarshalJSON for proto-public types * Generate Deepcopy() for proto-public types for Kubernetes CRDs.	1 year ago
Nitya Dhanushkodi	95d9b2c7e4	[NET-4931] xdsv2, sidecarproxycontroller, l4 trafficpermissions: support L7 (#19185) ... * xdsv2: support l7 by adding xfcc policy/headers, tweaking routes, and make a bunch of listeners l7 tests pass * sidecarproxycontroller: add l7 local app support * trafficpermissions: make l4 traffic permissions work on l7 workloads * rename route name field for consistency with l4 cluster name field * resolve conflicts and rebase * fix: ensure route name is used in l7 destination route name as well. previously it was only in the route names themselves, now the route name and l7 destination route name line up	1 year ago
Iryna Shustava	e3cb4ec35e	mesh: properly handle missing workload protocols (#19172) ... Sometimes workloads could come with unspecified protocols such as when running on Kubernetes. Currently, if this is the case, we will just default to tcp protocol. However, to make sidecar-proxy controller work with l7 protocols we should instead inherit the protocol from service. This change adds tracking for services that a workload is part of and attempts to inherit the protocol whenever services a workload is part of doesn't have conflicting protocols.	1 year ago
Iryna Shustava	a39eec0ef4	mesh: fix race in the sidecar-proxy controller test (#19183)	1 year ago
John Murret	dbca544d25	NET-5951 - Unique route names for implicit routes (#19174) ... * NET-5951 - Unique route names for implicit routes * remove use of datacenter * PR feedback	1 year ago
Iryna Shustava	54a12ab3c9	mesh: sidecar proxy controller improvements (#19083) ... This change builds on #19043 and #19067 and updates the sidecar controller to use those computed resources. This achieves several benefits: * The cache is now simplified which helps us solve for previous bugs (such as multiple Upstreams/Destinations targeting the same service would overwrite each other) * We no longer need proxy config cache * We no longer need to do merging of proxy configs as part of the controller logic * Controller watches are simplified because we no longer need to have complex mapping using cache and can instead use the simple ReplaceType mapper. It also makes several other improvements/refactors: * Unifies all caches into one. This is because originally the caches were more independent, however, now that they need to interact with each other it made sense to unify them where sidecar proxy controller uses one cache with 3 bimappers * Unifies cache and mappers. Mapper already needed all caches anyway and so it made sense to make the cache do the mapping also now that the cache is unified. * Gets rid of service endpoints watches. This was needed to get updates in a case when service's identities have changed and we need to update proxy state template's spiffe IDs for those destinations. This will however generate a lot of reconcile requests for this controller as service endpoints objects can change a lot because they contain workload's health status. This is solved by adding a status to the service object tracking "bound identities" and have service endpoints controller update it. Having service's status updated allows us to get updates in the sidecar proxy controller because it's already watching service objects * Add a watch for workloads. We need it so that we get updates if workload's ports change. This also ensures that we update cached identities in case workload's identity changes.	1 year ago
Iryna Shustava	ad06c96456	mesh: add computed destinations with a controller that computes them (#19067) ... This commit adds a new type ComputedDestinations that will contain all destinations from any Destinations resources and will be name-aligned with a workload. This also adds an explicit-destinations controller that computes these resources. This is needed to simplify the tracking we need to do currently in the sidecar-proxy controller and makes it easier to query all explicit destinations that apply to a workload.	1 year ago
R.B. Boyer	29ba5b5c79	catalog: block unsupported failover policy settings for now (#19168)	1 year ago
John Murret	6da4798e05	NET-5799 - ensure catalog controllers and dependency mappers function correctly for tenancy fields (#19142) ... * use bimapper * WIP * clean up * PR feedback	1 year ago
Iryna Shustava	60b75a55f7	mesh: implement exposed paths (#19044) ... Implement exposed paths listeners in the sidecar proxy controller.	1 year ago
John Murret	6cbd417f29	NET-5822 - Add default outbound router in TProxy (#19087) ... * NET-5822 - Add default outbound router in TProxy * fixing connection timeout to be 5 s instead of 10 seconds	1 year ago
Iryna Shustava	c35df12c95	mesh: Add ComputedProxyConfiguration and a controller that computes it. (#19043) ... * Introduce a new type `ComputedProxyConfiguration` and add a controller for it. This is needed for two reasons. The first one is that external integrations like kubernetes may need to read the fully computed and sorted proxy configuration per workload. The second reasons is that it makes sidecar-proxy controller logic quite a bit simpler as it no longer needs to do this. * Generalize workload selection mapper and fix a bug where it would delete IDs from the tree if only one is left after a removal is done.	1 year ago
Semir Patel	830c4ea81c	v2tenancy: cluster scoped reads (#19082)	1 year ago
Chris S. Kim	92ce814693	Remove old build tags (#19128)	1 year ago
Matt Keeler	4713317457	protohcl: allow attribute syntax for all map fields (#19108)	1 year ago
Eric Haberkorn	ad3aab1ef7	Add traffic permissions integration tests. (#19008) ... Add traffic permissions integration tests.	1 year ago
R.B. Boyer	754ab9abf2	mesh: ensure we add the virtual port number for L7 implicit upstreams (#19085)	1 year ago
Chris S. Kim	b43cde5d19	Add workload identity hooks (#19045)	1 year ago
Eric Haberkorn	f2b7b4591a	Fix Traffic Permissions Default Deny (#19028) ... Whenver a traffic permission exists for a given workload identity, turn on default deny. Previously, this was only working at the port level.	1 year ago
John Murret	d67e5c6e35	NET-5590 - authorization: check for identity:write in CA certs, xds server, and getting envoy bootstrap params (#19049) ... * NET-5590 - authorization: check for identity:write in CA certs, xds server, and getting envoy bootstrap params * gofmt file	1 year ago
skpratt	21ea527089	TrafficPermissions: add ACL hooks (#19023) ... * add ACL hooks * add hooks for CTPs	1 year ago
Eric Haberkorn	7ce6ebaeb3	Handle Traffic Permissions With Empty Sources Properly (#19024) ... Fix issues with empty sources * Validate that each permission on traffic permissions resources has at least one source. * Don't construct RBAC policies when there aren't any principals. This resulted in Envoy rejecting xDS updates with a validation error. ``` error= | rpc error: code = Internal desc = Error adding/updating listener(s) public_listener: Proto constraint validation failed (RBACValidationError.Rules: embedded message failed validation | caused by RBACValidationError.Policies[consul-intentions-layer4-1]: embedded message failed validation | caused by PolicyValidationError.Principals: value must contain at least 1 item(s)): rules { ```	1 year ago
Iryna Shustava	3ea6afb4d4	mesh: rename Upstreams and UpstreamsConfiguration to Destinations* (#18995)	1 year ago
skpratt	202090e5d5	v2 explicit destination traffic permissions (#18823) ... * workload identity boilerplate * notes from discussion with Iryna * WIP traffic permissions controller poc * workload identity, traffic permissions validation, errors, types * traffic permissions mapper framing, traffic permissions controller updates. * more roughing out of the controller * cleanup * controller and mapper logic * tests * refactor mapper logic, add tests * clean up tenancy and integration test stubs * consolidate mapping * cleanup cache leak, revert bimapper changes * address review comments * test fix and rebase * use resource helper --------- Co-authored-by: John Landa <john.landa@hashicorp.com>	1 year ago
Iryna Shustava	e6b724d062	catalog,mesh,auth: Move resource types to the proto-public module (#18935)	1 year ago
R.B. Boyer	9e48607893	mesh: compute more of the xRoute features into ComputedRoutes (#18980) ... Convert more of the xRoutes features that were skipped in an earlier PR into ComputedRoutes and make them work: - DestinationPolicy defaults - more timeouts - load balancer policy - request/response header mutations - urlrewrite - GRPCRoute matches	1 year ago
R.B. Boyer	11d6b0df45	mesh: store bound reference pointers on a ComputedRoutes resource and use during reconcile (#18965) ... xRoute resource types contain a slice of parentRefs to services that they manipulate traffic for. All xRoutes that have a parentRef to given Service will be merged together to generate a ComputedRoutes resource name-aligned with that Service. This means that a write of an xRoute with 2 parent ref pointers will cause at most 2 reconciles for ComputedRoutes. If that xRoute's list of parentRefs were ever to be reduced, or otherwise lose an item, that subsequent map event will only emit events for the current set of refs. The removed ref will not cause the generated ComputedRoutes related to that service to be re-reconciled to omit the influence of that xRoute. To combat this, we will store on the ComputedRoutes resource a BoundResources []*pbresource.Reference field with references to all resources that were used to influence the generated output. When the routes controller reconciles, it will use a bimapper to index this influence, and the dependency mappers for the xRoutes will look themselves up in that index to discover additional (former) ComputedRoutes that need to be notified as well.	1 year ago
Eric Haberkorn	4d6ff29392	Traffic Permissions Validations (#18907) ... add TP validations and mutation and add CTP validations	1 year ago
R.B. Boyer	633c6c9458	mesh: add ACL checks for xRoute resources (#18926) ... xRoute resources are not name-aligned with the Services they control. They have a list of "parent ref" services that they alter traffic flow for, and they contain a list of "backend ref" services that they direct that traffic to. The ACLs should be: - list: (default) - read: - ALL service:<parent_ref_service>:read - write: - ALL service:<parent_ref_service>:write - ALL service:<backend_ref_service>:read	1 year ago
R.B. Boyer	43a8dbb188	mesh: add ACL checks for DestinationPolicy resources (#18920) ... DestinationPolicy resources are name-aligned with the Service they control. The ACLs should be: - list: (default) - read: service:<resource_name>:read - write: service:<resource_name>:write	1 year ago
Iryna Shustava	d88888ee8b	catalog,mesh,auth: Bump versions to v2beta1 (#18930)	1 year ago
R.B. Boyer	de231bbbdd	catalog: fix for new method argument (#18978)	1 year ago
R.B. Boyer	ec6189fd2f	catalog: add ACL checks for FailoverPolicy resources (#18919) ... FailoverPolicy resources are name-aligned with the Service they control. They also contain a list of possible failover destinations that are References to other Services. The ACLs should be: - list: (default) - read: service:<resource_name>:read - write: service:<resource_name>:write + service:<destination_name>:read (for any destination)	1 year ago
R.B. Boyer	ef6f2494c7	resource: allow for the ACLs.Read hook to request the entire data payload to perform the authz check (#18925) ... The ACLs.Read hook for a resource only allows for the identity of a resource to be passed in for use in authz consideration. For some resources we wish to allow for the current stored value to dictate how to enforce the ACLs (such as reading a list of applicable services from the payload and allowing service:read on any of them to control reading the enclosing resource). This change update the interface to usually accept a *pbresource.ID, but if the hook decides it needs more data it returns a sentinel error and the resource service knows to defer the authz check until after fetching the data from storage.	1 year ago
Derek Menteer	eb7e20307c	[NET-5589] Add jitter to xds v2 leaf cert watches (#18940) ... Add jitter to xds v2 leaf cert watches.	1 year ago
Semir Patel	d2be7577b9	tenancy: split up tenancy `types.go` into CE version (#18966)	1 year ago
Matt Keeler	53fcc5d9a5	Add protoc generator to emit resource type variables (#18957) ... The annotations include a little more data than is strictly necessary because we will also have a protoc generator for openapi output.	1 year ago
Eric Haberkorn	f87ae3636c	Fix V2 Wildcard RBAC Regular Expressions (#18941) ... fix wildcard rbac regular expressions	1 year ago
Derek Menteer	d4ed3047f8	[NET-5589] Optimize leaf watch diff on xds controller. (#18921) ... Optimize leaf watch diff on xds controller.	1 year ago
John Murret	700d1bb37c	NET-5131 - support multiple ported upstreams tests (#18923) ... * add multiple upstream ports to golden file test for destination builder * NET-5131 - add unit tests for multiple ported upstreams * fix merge conflicts	1 year ago
Dhia Ayachi	341dc28ff9	Add namespace proto and registration (#18848) ... * add namespace proto and registration * fix proto generation * add missing copywrite headers * fix proto linter errors * fix exports and Type export * add mutate hook and more validation * add more validation rules and tests * Apply suggestions from code review Co-authored-by: Semir Patel <semir.patel@hashicorp.com> * fix owner error and add test * remove ACL for now * add tests around space suffix prefix. * only fait when ns and ap are default, add test for it --------- Co-authored-by: Semir Patel <semir.patel@hashicorp.com>	1 year ago
R.B. Boyer	d574473fd1	mesh: make FailoverPolicy work in xdsv2 and ProxyStateTemplate (#18900) ... Ensure that configuring a FailoverPolicy for a service that is reachable via a xRoute or a direct upstream causes an envoy aggregate cluster to be created for the original cluster name, but with separate clusters for each one of the possible destinations.	1 year ago
Nitya Dhanushkodi	3a2e62053a	v2: various fixes to make K8s tproxy multiport acceptance tests and manual explicit upstreams (single port) tests pass (#18874) ... Adding coauthors who mobbed/paired at various points throughout last week. Co-authored-by: Dan Stough <dan.stough@hashicorp.com> Co-authored-by: Iryna Shustava <iryna@hashicorp.com> Co-authored-by: John Murret <john.murret@hashicorp.com> Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com> Co-authored-by: Ashwin Venkatesh <ashwin@hashicorp.com> Co-authored-by: Michael Wilkerson <mwilkerson@hashicorp.com>	1 year ago
R.B. Boyer	07d916e84f	resource: ensure resource.AuthorizerContext properly strips the local… (#18908) ... resource: ensure resource.AuthorizerContext properly strips the local peer name	1 year ago
Eric Haberkorn	170417ac97	Honor Default Traffic Permissions in V2 (#18886) ... wire up v2 default traffic permissions	1 year ago
Iryna Shustava	212793a4ee	mesh: only build tproxy outbound listener once per destination (#18836) ... Previously, when using implicit upstreams, we'd build outbound listener per destination instead of one for all destinations. This will result in port conflicts when trying to send this config to envoy. This PR also makes sure that leaf and root references are always added (before we would only add it if there are inbound non-mesh ports). Also, black-hole traffic when there are no inbound ports other than mesh	1 year ago
Semir Patel	62796a1454	resource: mutate and validate before acls on write (#18868)	1 year ago
R.B. Boyer	dabbc9627b	mesh: normalize/default/validate tenancy components of mesh internal References (#18827) ... HTTPRoute, GRPCRoute, TCPRoute, and Upstreams resources contain inner Reference fields. We want to ensure that components of those reference Tenancy fields left unspecified are defaulted using the tenancy of the enclosing resource. As the underlying helper being used to do the normalization calls the function modified in #18822, it also means that the PeerName field will be set to "local" for now automatically to avoid "local" != "" issues downstream.	1 year ago
R.B. Boyer	696aa1bbd2	mesh: update xds controller to synthesize empty endpoints when no endpoints ref is found (#18835)	1 year ago
R.B. Boyer	b4d5178e5c	catalog: normalize/default/validate tenancy components of FailoverPolicy internal References (#18825) ... FailoverPolicy resources contain inner Reference fields. We want to ensure that components of those reference Tenancy fields left unspecified are defaulted using the tenancy of the enclosing FailoverPolicy resource. As the underlying helper being used to do the normalization calls the function modified in #18822, it also means that the PeerName field will be set to "local" for now automatically to avoid "local" != "" issues downstream.	1 year ago
Dhia Ayachi	4435e4a420	add v2 tenancy bridge Flag and v2 Tenancy Bridge initial implementation (#18830) ... * add v2 tenancy bridge and a feature flag for v2 tenancy * move tenancy bridge v2 under resource package	1 year ago
Iryna Shustava	a89938e0c1	catalog: Default protocol to tcp in catalog.Service if unspecified (#18832)	1 year ago
R.B. Boyer	5cde50dee7	mesh: prevent writing a ComputedRoutes with no ported configs (#18833)	1 year ago
skpratt	1fda2965e8	Allow empty data writes for resources (#18819) ... * allow nil data writes for resources * update demo to test valid type with no data	1 year ago
Iryna Shustava	6838441c54	Default to tcp protocol when workload protocol is unspecified (#18824)	1 year ago
Eric Haberkorn	21fdbbabbc	Wire up traffic permissions (#18812) ... Wire up traffic permissions	1 year ago
Semir Patel	d3dad14030	resource: default peername to "local" for now (#18822)	1 year ago
R.B. Boyer	9c1a1ffcde	mesh: call the right mapper (#18818)	1 year ago
R.B. Boyer	66e1cdf40c	mesh: Wire ComputedRoutes into the ProxyStateTemplate via the sidecar controller (#18752) ... Reworks the sidecar controller to accept ComputedRoutes as an input and use it to generate appropriate ProxyStateTemplate resources containing L4/L7 mesh configuration.	1 year ago
skpratt	e5808d85f7	register traffic permission and workload identity types (#18704) ... * add workload identity and traffic permission protos * register new types * add generated pb code * fix exports.go path * add proto newlines * fix type name Co-authored-by: Eric Haberkorn <erichaberkorn@gmail.com> * address review * fix protos and add tests * fix validation constraints * add tests --------- Co-authored-by: Eric Haberkorn <erichaberkorn@gmail.com>	1 year ago
Dhia Ayachi	658c27a684	add fuzz tests to resourcehcl package and fix some panics (#18798) ... * add a simple fuzz test for the resourcehcl package and fix some panics uncovered by the test * fix default for null values	1 year ago
Iryna Shustava	7f2a1d9812	catalog: service endpoints inherits protocol from service when workload doesn't have one (#18792)	1 year ago
R.B. Boyer	07f54fe3b8	resource: add helper to normalize inner Reference tenancy during mutate (#18765) ... When one resource contains an inner field that is of type *pbresource.Reference we want the Tenancy to be reasonably defaulted by the following rules: 1. The final values will be limited by the scope of the referenced type. 2. Values will be inferred from the parent's tenancy, and if that is insufficient then using the default tenancy for the type's scope. 3. Namespace will only be used from a parent if the reference and the parent share a partition, otherwise the default namespace will be used. Until we tackle peering, this hard codes an assumption of peer name being local. The logic for defaulting may need adjustment when that is addressed.	1 year ago
Eric Haberkorn	12be06f8e5	Add V2 TCP traffic permissions (#18771) ... Add support for TCP traffic permissions	1 year ago
Nitya Dhanushkodi	78b170ad50	xds controller: setup watches for and compute leaf cert references in ProxyStateTemplate, and wire up leaf cert manager dependency (#18756) ... * Refactors the leafcert package to not have a dependency on agent/consul and agent/cache to avoid import cycles. This way the xds controller can just import the leafcert package to use the leafcert manager. The leaf cert logic in the controller: * Sets up watches for leaf certs that are referenced in the ProxyStateTemplate (which generates the leaf certs too). * Gets the leaf cert from the leaf cert cache * Stores the leaf cert in the ProxyState that's pushed to xds * For the cert watches, this PR also uses a bimapper + a thin wrapper to map leaf cert events to related ProxyStateTemplates Since bimapper uses a resource.Reference or resource.ID to map between two resource types, I've created an internal type for a leaf certificate to use for the resource.Reference, since it's not a v2 resource. The wrapper allows mapping events to resources (as opposed to mapping resources to resources) The controller tests: Unit: Ensure that we resolve leaf cert references Lifecycle: Ensure that when the CA is updated, the leaf cert is as well Also adds a new spiffe id type, and adds workload identity and workload identity URI to leaf certs. This is so certs are generated with the new workload identity based SPIFFE id. * Pulls out some leaf cert test helpers into a helpers file so it can be used in the xds controller tests. * Wires up leaf cert manager dependency * Support getting token from proxytracker * Add workload identity spiffe id type to the authorize and sign functions --------- Co-authored-by: John Murret <john.murret@hashicorp.com>	1 year ago
R.B. Boyer	89e6725eee	mesh: create new routes-controller to reconcile xRoute types into a ComputedRoutes resource (#18460) ... This new controller produces an intermediate output (ComputedRoutes) that is meant to summarize all relevant xRoutes and related mesh configuration in an easier-to-use format for downstream use to construct the ProxyStateTemplate. It also applies status updates to the xRoute resource types to indicate that they are themselves semantically valid inputs.	1 year ago
Poonam Jadhav	264166fcc0	fix: write endpoint errors out gracefully (#18743)	1 year ago
John Murret	62062fd4fd	NET-5132 - Configure multiport routing for connect proxies in TProxy mode (#18606) ... * mesh-controller: handle L4 protocols for a proxy without upstreams * sidecar-controller: Support explicit destinations for L4 protocols and single ports. * This controller generates and saves ProxyStateTemplate for sidecar proxies. * It currently supports single-port L4 ports only. * It keeps a cache of all destinations to make it easier to compute and retrieve destinations. * It will update the status of the pbmesh.Upstreams resource if anything is invalid. * endpoints-controller: add workload identity to the service endpoints resource * small fixes * review comments * Address PR comments * sidecar-proxy controller: Add support for transparent proxy This currently does not support inferring destinations from intentions. * PR review comments * mesh-controller: handle L4 protocols for a proxy without upstreams * sidecar-controller: Support explicit destinations for L4 protocols and single ports. * This controller generates and saves ProxyStateTemplate for sidecar proxies. * It currently supports single-port L4 ports only. * It keeps a cache of all destinations to make it easier to compute and retrieve destinations. * It will update the status of the pbmesh.Upstreams resource if anything is invalid. * endpoints-controller: add workload identity to the service endpoints resource * small fixes * review comments * Make sure endpoint refs route to mesh port instead of an app port * Address PR comments * fixing copyright * tidy imports * sidecar-proxy controller: Add support for transparent proxy This currently does not support inferring destinations from intentions. * tidy imports * add copyright headers * Prefix sidecar proxy test files with source and destination. * Update controller_test.go * NET-5132 - Configure multiport routing for connect proxies in TProxy mode * formatting golden files * reverting golden files and adding changes in manually. build implicit destinations still has some issues. * fixing files that were incorrectly repeating the outbound listener * PR comments * extract AlpnProtocol naming convention to getAlpnProtocolFromPortName(portName) * removing address level filtering. * adding license to resources_test.go --------- Co-authored-by: Iryna Shustava <iryna@hashicorp.com> Co-authored-by: R.B. Boyer <rb@hashicorp.com> Co-authored-by: github-team-consul-core <github-team-consul-core@hashicorp.com>	1 year ago
Dhia Ayachi	b1688ad856	Run copyright after running deep-copy as part of the Makefile/CI (#18741) ... * execute copyright headers after performing deep-copy generation. * fix copyright install * Apply suggestions from code review Co-authored-by: Semir Patel <semir.patel@hashicorp.com> * Apply suggestions from code review Co-authored-by: Semir Patel <semir.patel@hashicorp.com> * rename steps to match codegen naming * remove copywrite install category --------- Co-authored-by: Semir Patel <semir.patel@hashicorp.com>	1 year ago
R.B. Boyer	a69e901660	xds: update golden tests to be deterministic (#18707)	1 year ago