10811 Commits (c26ede58c265f31d099676be4db1597118560b4c)

 

All Branches   

Search

Author	SHA1	Message	Date
Luke Kysow	b5cd6f83a3	Merge pull request #6683 from hashicorp/service-account-connect-inject-docs ... Document service account name requirements	5 years ago
Matt Keeler	440f6ea17a	Ensure that cache entries for tokens are prefixed “token-secret… (#6688) ... This will be necessary once we store other types of identities in here.	5 years ago
Matt Keeler	79f78632e1	Update the ACL Resolver to allow for Consul Enterprise specific hooks. (#6687)	5 years ago
Luke Kysow	3524ee0478	Document service account name requirements ... If ACLs are enabled, service account name must match the name of the service in Consul. Fixes https://github.com/hashicorp/consul-helm/issues/202	5 years ago
Matt Keeler	e4ea9b0a96	Updates to allow for Namespacing ACL resources in Consul Enterp… (#6675) ... Main Changes: • method signature updates everywhere to account for passing around enterprise meta. • populate the EnterpriseAuthorizerContext for all ACL related authorizations. • ACL resource listings now operate like the catalog or kv listings in that the returned entries are filtered down to what the token is allowed to see. With Namespaces its no longer all or nothing. • Modified the acl.Policy parsing to abstract away basic decoding so that enterprise can do it slightly differently. Also updated method signatures so that when parsing a policy it can take extra ent metadata to use during rules validation and policy creation. Secondary Changes: • Moved protobuf encoding functions out of the agentpb package to eliminate circular dependencies. • Added custom JSON unmarshalers for a few ACL resource types (to support snake case and to get rid of mapstructure) • AuthMethod validator cache is now an interface as these will be cached per-namespace for Consul Enterprise. • Added checks for policy/role link existence at the RPC API so we don’t push the request through raft to have it fail internally. • Forward ACL token delete request to the primary datacenter when the secondary DC doesn’t have the token. • Added a bunch of ACL test helpers for inserting ACL resource test data.	5 years ago
kaitlincarter-hc	749915ce0f	missed UTM parameter (#6679)	5 years ago
kaitlincarter-hc	73832ed80b	fixing ACL reset links (#6678)	5 years ago
Alvin Huang	3361bab1bc	modify netlify-cli installation (#6674) ... * modify netlify CLI installation * bump middleman-hashicorp to 0.3.40 to include ssh	5 years ago
Sarah Adams	0c9487ae72	regression tests for existing agent/ decoding behavior (#6624) ... tests for existing JSON decoding behavior	5 years ago
kaitlincarter-hc	30ae048f85	Top Navigation change (#6630) ... * Changed Guides to Learn in the top nav and added utm parameters to the guide index page * Update website/source/docs/guides/index.html.md * Update website/source/docs/guides/index.html.md * Update website/source/layouts/layout.erb	5 years ago
Sarah Christoff	b1f10663f2	Fix indention problems with stale.yml (#6663)	5 years ago
Sarah Christoff	3bb5ad4e56	chore: Add probot (#6642) ... * add stalebot	5 years ago
Matt Keeler	22e0b6c674	Update CHANGELOG.md	5 years ago
rerorero	86c8e48dd9	fix: incorrect struct tag and WaitGroup usage (#6649) ... * remove duplicated json tag * fix: incorrect wait group usage	5 years ago
R.B. Boyer	d0f14cb5c0	update changelog	5 years ago
R.B. Boyer	97aa050c20	agent: allow mesh gateways to initialize even if there are no connect services registered yet (#6576) ... Fixes #6543 Also improved some of the proxycfg tests to cover snapshot validity better.	5 years ago
R.B. Boyer	8c1b3f6a6e	update changelog	5 years ago
R.B. Boyer	8dcba472a2	xds: tcp services using the discovery chain should not assume RDS during LDS (#6623) ... Previously the logic for configuring RDS during LDS for L7 upstreams was overapplied to TCP proxies resulting in a cluster name of <emptystring> being used incorrectly. Fixes #6621	5 years ago
Freddy	895a82ed78	Update CHANGELOG.md	5 years ago
Freddy	60f6ec0c2f	Store check type in catalog (#6561)	5 years ago
R.B. Boyer	7a13850db2	update changelog	5 years ago
R.B. Boyer	274b5a46b3	sdk: ignore panics due to stray goroutines logging after a test completes (#6632) ... If there is imperfect goroutine lifespan tracking if we pipe our logs through testing.T.Logf there is a chance of a stray goroutine attempting to log after the test that spawned it completes. This results in a panic of: panic: Log in goroutine after TestLeader_SecondaryCA_Initialize has completed... This isn't great and should be fixed, but quickly runs into situations around externally cancelling blocking queries which isn't terribly possible at the moment. The concession here is to ignore these specific panics for now. This can be triggered easily when running some tests with a high `-count=YYY` value.	5 years ago
R.B. Boyer	3c58d29fad	update changelog	5 years ago
R.B. Boyer	de6ce5b1d9	server: ensure the primary dc and ACL dc match (#6634) ... This is mostly a sanity check for server tests that skip the normal config builder equivalent fixup.	5 years ago
R.B. Boyer	3aeb740430	unflake TestLeader_SecondaryCA_Initialize (#6631)	5 years ago
kaitlincarter-hc	4f9e639d49	updating broken link (#6633)	5 years ago
R.B. Boyer	e6bfcb0ca8	fix flaky multidc acl tests that failed to wait for token replication (#6628) ... If acls have not yet replicated to the secondary then authz requests will be remotely resolved by the primary. Now these tests explicitly wait until replication has caught up first.	5 years ago
R.B. Boyer	040f47c46e	appease the retry linter (#6629)	5 years ago
Matt Keeler	7f00fc60f1	Dependency: Update github.com/hashicorp/go-memdb to v1.0.3 (#6626)	5 years ago
Paul Banks	d7aa425339	Allow time for secondary CA to initialize (#6627)	5 years ago
Matt Keeler	973341a592	ACL Authorizer overhaul (#6620) ... * ACL Authorizer overhaul To account for upcoming features every Authorization function can now take an extra *acl.EnterpriseAuthorizerContext. These are unused in OSS and will always be nil. Additionally the acl package has received some thorough refactoring to enable all of the extra Consul Enterprise specific authorizations including moving sentinel enforcement into the stubbed structs. The Authorizer funcs now return an acl.EnforcementDecision instead of a boolean. This improves the overall interface as it makes multiple Authorizers easily chainable as they now indicate whether they had an authoritative decision or should use some other defaults. A ChainedAuthorizer was added to handle this Authorizer enforcement chain and will never itself return a non-authoritative decision. * Include stub for extra enterprise rules in the global management policy * Allow for an upgrade of the global-management policy	5 years ago
Paul Banks	6d645fe53c	Update CHANGELOG.md	5 years ago
PHBourquin	039615641e	Checks to passing/critical only after reaching a consecutive success/failure threshold (#5739) ... A check may be set to become passing/critical only if a specified number of successive checks return passing/critical in a row. Status will stay identical as before until the threshold is reached. This feature is available for HTTP, TCP, gRPC, Docker & Monitor checks.	5 years ago
kaitlincarter-hc	b0310364c6	[docs] Adding Links to Learn (#6611) ... * adding links to Learn * fixing a couple typos * adding utm paramaters * Update website/source/docs/connect/registration/sidecar-service.md * Update website/source/docs/connect/registration/sidecar-service.md * Update website/source/docs/acl/acl-system.html.md * Update website/source/docs/acl/acl-system.html.md * Update website/source/docs/agent/encryption.html.md Co-Authored-By: Judith Malnick <judith.patudith@gmail.com> * Update website/source/docs/connect/proxies/built-in.md Co-Authored-By: Judith Malnick <judith.patudith@gmail.com> * Update website/source/docs/connect/registration/sidecar-service.md Co-Authored-By: Judith Malnick <judith.patudith@gmail.com> * Update website/source/docs/install/index.html.md Co-Authored-By: Judith Malnick <judith.patudith@gmail.com> * Update website/source/docs/agent/kv.html.md * Update website/source/docs/connect/security.html.md * Update website/source/docs/connect/security.html.md * Update website/source/docs/internals/architecture.html.md	5 years ago
Blake Covarrubias	97953454c4	Add Consul's L7 features to Istio comparison ... Add text listing Consul's L7 features (via Envoy). Re-organize text to flow similarly to Istio section. Co-Authored-By: Judith Malnick <judith.patudith@gmail.com>	5 years ago
Sarah Christoff	194f5740ce	ui_content_path config option fix (#6601) ... * fix ui-content-path config option	5 years ago
Hans Hasselberg	b6499fe6b8	Do not surface left servers (#6420) ... * do not surface left servers in catalog	5 years ago
Alvin Huang	8d4b8eae38	add go cache to distro builds (#6600)	5 years ago
Alvin Huang	97af2b0929	add circleci and discuss badge (#6599)	5 years ago
Matt Keeler	a31e7a5d58	Remove `gox` usage (#6596)	5 years ago
R.B. Boyer	6439af86eb	agent: clients should only attempt to remove pruned nodes once per call (#6591)	5 years ago
Matt Keeler	7713d4a988	Update CHANGELOG.md	5 years ago
Matt Keeler	4a5ebb57b0	Add support for the Namespace HTTP API in the API Client (#6581)	5 years ago
Luke Kysow	17990aabf3	Document new annotations for Connect injections	5 years ago
Sarah Christoff	53f3962cab	Update CHANGELOG.md	5 years ago
Sarah Christoff	5e26971864	Prune Unhealthy Agents (#6571) ... * Add -prune flag to ForceLeave	5 years ago
R.B. Boyer	4d8e5a18bc	update changelog	5 years ago
R.B. Boyer	06ca8cd2d7	agent: updates to the agent token trigger anti-entropy full syncs (#6577)	5 years ago
Matt Keeler	d65bbbfd4e	Implement Leader Routine Management (#6580) ... * Implement leader routine manager Switch over the following to use it for go routine management: • Config entry Replication • ACL replication - tokens, policies, roles and legacy tokens • ACL legacy token upgrade • ACL token reaping • Intention Replication • Secondary CA Roots Watching • CA Root Pruning Also added the StopAll call into the Server Shutdown method to ensure all leader routines get killed off when shutting down. This should be mostly unnecessary as `revokeLeadership` should manually stop each one but just in case we really want these to go away (eventually).	5 years ago
Matt Keeler	28221f66f2	Use encoding/json instead of jsonpb even for protobuf types (#6572) ... This only works so long as we use simplistic protobuf types. Constructs such as oneof or Any types that require type annotations for decoding properly will fail hard but that is by design. If/when we want to use any of that we will probably need to consider a v2 API.	5 years ago