21244 Commits (c1e25c56dbffeccb08e4614ff3e43063a00d4ca9)

 

All Branches   

Search

Author	SHA1	Message	Date
skpratt	57bad0df85	add traffic permissions excludes and tests (#20453) ... * add traffic permissions tests * review fixes * Update internal/mesh/internal/controllers/sidecarproxy/builder/local_app.go Co-authored-by: John Landa <jonathanlanda@gmail.com> --------- Co-authored-by: John Landa <jonathanlanda@gmail.com>	10 months ago
Eric Haberkorn	1bd253021b	V1 Compat Exported Services Controller Optimizations (#20517) ... V1 compat exported services controller optimizations * Don't start the v2 exported services controller in v1 mode. * Use the controller cache.	10 months ago
Matt Keeler	3ca4f39fa1	Register the multicluster types for the catalogtest integration tests (#20516) ... In particular the failover controller needs these in Consul Enterprise	10 months ago
wangxinyi7	ab8f23478a	add more integration tests (#20479) ... * add more integration tests	10 months ago
John Maguire	24e9603d9b	Fix Gatewayproxy Controller and Re-Enable APIGW v2 Controller (#20508) ... re-enable apigw controller, fix typo in key name for metadata for gatewayproxy	10 months ago
Matt Keeler	49e6c0232d	Panic for unregistered types (#20476) ... * Panic when controllers attempt to make invalid requests to the resource service This will help to catch bugs in tests that could cause infinite errors to be emitted. * Disable the API GW v2 controller With the previous commit, this would cause a server to panic due to watching a type which has not yet been created/registered. * Ensure that a test server gets the full type registry instead of constructing its own * Skip TestServer_ControllerDependencies * Fix peering tests so that they use the full resource registry.	10 months ago
Dan Stough	fcc43a9a36	feat(v2dns): catalog v2 SOA and NS support (#20480)	10 months ago
John Maguire	54c974748e	[NET-7280] Add APIGW support to the gatewayproxy controller (#20484) ... * Add APIGW support to the gatewayproxy controller * update copywrite headers	10 months ago
John Murret	3bf999e46b	NET-7631 - Fix Node records that point to external/ non-IP addresses (#20491) ... * NET-7630 - Fix TXT record creation on node queries * NET-7631 - Fix Node records that point to external/ non-IP addresses * NET-7630 - Fix TXT record creation on node queries	10 months ago
John Murret	7d4deda640	NET-7630 - Fix TXT record creation on node queries (#20483)	10 months ago
Ashesh Vidyut	cffb5d7c6e	Fix audit-log encoding issue (CC-7337) (#20345) ... * add changes * added changelog * change update * CE chnages * Removed gzip size fix * fix changelog * Update .changelog/20345.txt Co-authored-by: Hans Hasselberg <hans@hashicorp.com> * Adding comments --------- Co-authored-by: Abhishek Sahu <abhishek.sahu@hashicorp.com> Co-authored-by: Hans Hasselberg <hans@hashicorp.com> Co-authored-by: srahul3 <rahulsharma@hashicorp.com>	10 months ago
Tauhid Anjum	88b8a1cc36	NET-6776 - Update Routes controller to use ComputedFailoverPolicy CE (#20496) ... Update Routes controller to use ComputedFailoverPolicy	10 months ago
Tauhid Anjum	0c509a60a4	Exported services CLI and docs (#20331) ... * Exported services CLI and docs * Changelog added * Added format option for pretty print * Update command/exportedservices/exported_services.go Co-authored-by: Ashesh Vidyut <134911583+absolutelightning@users.noreply.github.com> * Addressing PR comments, moving the command under services category * Add consumer peer and partition filter * Adding bexpr filter, change format of data --------- Co-authored-by: Ashesh Vidyut <134911583+absolutelightning@users.noreply.github.com>	10 months ago
Derek Menteer	922844b8e0	Fix issue with persisting proxy-defaults (#20481) ... Fix issue with persisting proxy-defaults This resolves an issue introduced in hashicorp/consul#19829 where the proxy-defaults configuration entry with an HTTP protocol cannot be updated after it has been persisted once and a router exists. This occurs because the protocol field is not properly pre-computed before being passed into validation functions.	10 months ago
John Murret	0d434dafac	Do not parallelize DNS tests because they consume too many ports (#20482)	10 months ago
John Murret	602e3c4fd5	DNS V2 - Revise discovery result to have service and node name and address fields. (#20468) ... * DNS V2 - Revise discovery result to have service and node name and address fields. * NET-7488 - dns v2 add support for prepared queries in catalog v1 data model (#20470) NET-7488 - dns v2 add support for prepared queries in catalog v1 data model.	10 months ago
Dan Stough	9602b43183	feat(v2dns): catalog v2 workload query support (#20466)	10 months ago
R.B. Boyer	deca6a49bd	catalog: improve the bound workload identity encoding on services (#20458) ... The endpoints controller currently encodes the list of unique workload identities referenced by all workload matched by a Service into a special data-bearing status condition on that Service. This allows a downstream controller to avoid an expensive watch on the ServiceEndpoints type just to get this data. The current encoding does not lend itself well to machine parsing, which is what the field is meant for, so this PR simplifies the encoding from: "blah blah: " + strings.Join(ids, ",") + "." to strings.Join(ids, ",") It also provides an exported utility function to easily extract this data.	10 months ago
Nick Ethier	9d4ad74a63	internal/hcp: prevent write loop on telemetrystate resource updates (#20435) ... * internal/hcp: prevent write loop on telemetrystate resource updates * Update controller.go Co-authored-by: Nick Cellino <nick.cellino@hashicorp.com> * internal/hcp: add assertion for looping controller --------- Co-authored-by: Nick Cellino <nick.cellino@hashicorp.com>	10 months ago
R.B. Boyer	c029b20615	v2: ensure the controller caches are fully populated before first use (#20421) ... The new controller caches are initialized before the DependencyMappers or the Reconciler run, but importantly they are not populated. The expectation is that when the WatchList call is made to the resource service it will send an initial snapshot of all resources matching a single type, and then perpetually send UPSERT/DELETE events afterward. This initial snapshot will cycle through the caching layer and will catch it up to reflect the stored data. Critically the dependency mappers and reconcilers will race against the restoration of the caches on server startup or leader election. During this time it is possible a mapper or reconciler will use the cache to lookup a specific relationship and not find it. That very same reconciler may choose to then recompute some persisted resource and in effect rewind it to a prior computed state. Change - Since we are updating the behavior of the WatchList RPC, it was aligned to match that of pbsubscribe and pbpeerstream using a protobuf oneof instead of the enum+fields option. - The WatchList rpc now has 3 alternating response events: Upsert, Delete, EndOfSnapshot. When set the initial batch of "snapshot" Upserts sent on a new watch, those operations will be followed by an EndOfSnapshot event before beginning the never-ending sequence of Upsert/Delete events. - Within the Controller startup code we will launch N+1 goroutines to execute WatchList queries for the watched types. The UPSERTs will be applied to the nascent cache only (no mappers will execute). - Upon witnessing the END operation, those goroutines will terminate. - When all cache priming routines complete, then the normal set of N+1 long lived watch routines will launch to officially witness all events in the system using the primed cached.	10 months ago
Derek Menteer	266f6548f9	Debug failing CICD tests (#20455) ... Fix CICD test flakes by locking container socket.	10 months ago
wangxinyi7	fb2b696c0e	missing prefix / (#20447) ... * missing prefix / and fix typos	10 months ago
Eric Haberkorn	543c6a30af	Trigger the V1 Compat exported-services Controller when V1 Config Entries are Updated (#20456) ... * Trigger the v1 compat exported-services controller when the v1 config entry is modified. * Hook up exported-services config entries to the event publisher. * Add tests to the v2 exported services shim. * Use the local materializer trigger updates on the v1 compat exported services controller when exported-services config entries are modified. * stop sleeping when context is cancelled	10 months ago
Derek Menteer	1fe0a87546	Fix SDK iptables.Config marshalling (#20451) ... This fixes behavior introduced by hashicorp/consul#20232 where a function was added to the iptables configuration struct. Since this struct is actually marshalled into json by consul-k8s, we should not be placing functions inside of it.	10 months ago
Chris Hut	22e6ce0df1	Add nav bar item to show HCP link status and encourage folks to link (#20370) ... * Convert consul-hcp to a simpler component * update existing test to use envStub helper * An hcp link item for the navbar * A method of linking to HCP * Hook up fetching linking status to the nav-item * Hooking up fetching link status to the hcp link friend * Adding some tests * remove a comment - but also fix padding justify-content * Fix the banner tests * Adding permission tests as well * some more sane formatting * Rename function with its now multipurpose use * Feature change: No more NEW Badge since it breaks padding - instead a linked badge * Removing unused class	10 months ago
Luke Kysow	49025105f0	Fix typo (#20441) ... Update establish-cluster-peering.mdx	10 months ago
natemollica-dev	2b07b326c4	Resolve Consul DNS in OpenShift (#20439)	10 months ago
Derek Menteer	70575760c7	Add known issue for GH-20360. (#20420)	10 months ago
Matt Keeler	24a7b17a6f	Controller testing docs (#20398) ... * Create testing.md * Update guide.md	10 months ago
Andrew Stucki	af0c4573bc	Rev VERSION for 1.19.0-dev (#20437)	10 months ago
Heat Hamilton	18a6804824	website: fix husky command (#20405) ... Update husky pre-commit to work in website, a sub-directory of the directory containing the .git dir	10 months ago
Eric Haberkorn	d0243b618d	Change the multicluster group to v2 (#20430)	10 months ago
Melisa Griffin	7c00d396cf	[NET-6417] Add validation of MeshGateway name + listeners (#20425) ... * Add validation of MeshGateway name + listeners * Adds test for ValidateMeshGateway * Fixes data fetcher test for gatewayproxy --------- Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com>	10 months ago
Chris S. Kim	b6f10bc58f	Skip filter chain created by permissive mtls (#20406)	10 months ago
wangxinyi7	3b44be530d	only forwarding the resource service traffic in client agent to server agent (#20347) ... * only forwarding the resource service traffic in client agent to server agent	10 months ago
Nick Ethier	383d92e9ab	hcp.v2.TelemetryState resource and controller implementation (#20257) ... * pbhcp: add TelemetryState resource * agent/hcp: add GetObservabilitySecrets to client * internal/hcp: add TelemetryState controller logic * hcp/telemetry-state: added config options for hcp sdk and debug key to skip deletion during reconcile * pbhcp: update proto documentation * hcp: address PR feedback, additional validations and code cleanup * internal/hcp: fix type sig change in test * update testdata/v2-resource-dependencies	10 months ago
Derek Menteer	3e8ec8d18e	Fix SAN matching on terminating gateways (#20417) ... Fixes issue: hashicorp/consul#20360 A regression was introduced in hashicorp/consul#19954 where the SAN validation matching was reduced from 4 potential types down to just the URI. Terminating gateways will need to match on many fields depending on user configuration, since they make egress calls outside of the cluster. Having more than one matcher behaves like an OR operation, where any match is sufficient to pass the certificate validation. To maintain backwards compatibility with the old untyped `match_subject_alt_names` Envoy behavior, we should match on all 4 enum types. https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/transport_sockets/tls/v3/common.proto#enum-extensions-transport-sockets-tls-v3-subjectaltnamematcher-santype	10 months ago
cskh	890332cacb	docs: Fix indention of wal object in agent config (#20399)	10 months ago
Nathan Coleman	74e4200d07	[NET-6429] Program ProxyStateTemplate to route cross-partition traffi… (#20410) ... [NET-6429] Program ProxyStateTemplate to route cross-partition traffic to the correct destination mesh gateway * Program mesh port to route wildcarded gateway SNI to the appropriate remote partition's mesh gateway * Update target + route ports in service endpoint refs when building PST * Use proper name of local datacenter when constructing SNI for gateway target * Use destination identities for TLS when routing L4 traffic through the mesh gateway * Use new constants, move comment to correct location * Use new constants for port names * Update test assertions * Undo debug logging change	10 months ago
John Murret	c82b78b088	NET-7165 - fix address and target setting (#20403)	10 months ago
Ronald	8799c36410	[NET-6231] Handle Partition traffic permissions when reconciling traffic permissions (#20408) ... [NET-6231] Partition traffic permissions Co-authored-by: Chris S. Kim <ckim@hashicorp.com>	10 months ago
NicoletaPopoviciu	b7b9bb0e83	Update Vault/Nomad versions. (#20322) ... Update Vault/Nomad versions to ensure we're testing all the latest versions. Update Vault/Nomad versions to ensure we're testing all the latest versions .	10 months ago
Chris S. Kim	7cc88a1577	Handle NamespaceTrafficPermissions when reconciling TrafficPermissions (#20407)	10 months ago
Nathan Coleman	21b3c18d5d	Use a full EndpointRef on ComputedRoutes targets instead of just the ID (#20400) ... * Use a full EndpointRef on ComputedRoutes targets instead of just the ID Today, the `ComputedRoutes` targets have the appropriate ID set for their `ServiceEndpoints` reference; however, the `MeshPort` and `RoutePort` are assumed to be that of the target when adding the endpoints reference in the sidecar's `ProxyStateTemplate`. This is problematic when the target lives behind a `MeshGateway` and the `Mesh/RoutePort` used in the sidecar's `ProxyStateTemplate` should be that of the `MeshGateway` instead of the target. Instead of assuming the `MeshPort` and `RoutePort` when building the `ProxyStateTemplate` for the sidecar, let's just add the full `EndpointRef` -- including the ID and the ports -- when hydrating the computed destinations. * Make sure the UID from the existing ServiceEndpoints makes it onto ComputedRoutes * Update test assertions * Undo confusing whitespace change * Remove one-line function wrapper * Use plural name for endpoints ref * Add constants for gateway name, kind and port names	10 months ago
Ronald	783f33db3b	[NET-7074] Exported Services typo fix (#20402)	10 months ago
wangxinyi7	3c5cb04b0f	refactor the resource client (#20343) ... * renaming files	10 months ago
wangxinyi7	2b89025eab	clean up http client (#20342) ... clean up http client	10 months ago
Ganesh S	4ca6573384	Add status for exported services controller (#20376)	10 months ago
Sooraj Sreekumar	eb6a59dd11	NET-6653 Enabling container logs when initConsulServers fails and ret… (#20396) ... NET-6653 Enabling container logs when initConsulServers fails and return an error (container logs during launch() failure) On branch NET-6653 modified: testing/deployer/sprawl/boot.go	10 months ago
Melissa Kam	b0e87dbe13	[CC-7049] Stop the HCP manager when link is deleted (#20351) ... * Add Stop method to telemetry provider Stop the main loop of the provider and set the config to disabled. * Add interface for telemetry provider Added for easier testing. Also renamed Run to Start, which better fits with Stop. * Add Stop method to HCP manager * Add manager interface, rename implementation Add interface for easier testing, rename existing Manager to HCPManager. * Stop HCP manager in link Finalizer * Attempt to cleanup if resource has been deleted The link should be cleaned up by the finalizer, but there's an edge case in a multi-server setup where the link is fully deleted on one server before the other server reconciles. This will cover the case where the reconcile happens after the resource is deleted. * Add a delete mananagement token function Passes a function to the HCP manager that deletes the management token that was initially created by the manager. * Delete token as part of stopping the manager * Lock around disabling config, remove descriptions	10 months ago