Commit Graph

2034 Commits (c576b0ce12f82d12a49ed489fe5466706cc37738)

Author SHA1 Message Date
Anubhav Mishra 538973fc5e
Clarify sync wording.
Co-Authored-By: adilyse <rebecca@hashicorp.com>
2018-10-31 13:18:50 -07:00
Anubhav Mishra 98dcc32c53
Updating configuration wording.
Co-Authored-By: adilyse <rebecca@hashicorp.com>
2018-10-31 13:18:01 -07:00
Rebecca Zanzig 6e575b2671 Update Helm docs to include the `default` flag for catalog sync
Additionally fixes an issue with quotes on the related annotation.
2018-10-30 16:37:04 -07:00
Jack Pearkes 770d708494
website: clarify log file filename format (#4856)
Fixes #4697
2018-10-29 09:29:14 -07:00
Sébastien Portebois 1823a35325 website: broken partial rendering and missing id (#4862)
* Fix partial rendering in service command (CLI) help
* Fix sample JSON to be a valid json for service registration
* Add missing id field to make the complete document complete.
2018-10-29 01:41:25 -07:00
Martin Halder 988ceb697a website: fix minor typo in documentation (#4864) 2018-10-29 01:33:42 -07:00
Mitch Pronschinske 37466d6590 Spelling fix on K/V vs KV (#4860)
One of the mentions of KV store had a slash between K and V.  For consistency with the rest of the doc, I removed it.
2018-10-26 13:54:26 -07:00
Paul Banks 7742aec226 Correct prometheus docs (#4805) 2018-10-26 12:11:57 -07:00
Jeff Fraser be2aa9a219 Add the consult gem (#4832) 2018-10-26 12:11:40 -07:00
Jack Pearkes a8c1ebe6fb
Fix some broken links in docs (#4858)
* website: let curl make noise during website deploy

* website: fix a handful of broken links
2018-10-26 10:55:12 -07:00
Rebecca Zanzig 7ad6596454
Merge pull request #4828 from hashicorp/docs/helm-16-getting-started
Update the `join` command format in the k8s Running Consul section
2018-10-25 15:47:14 -07:00
Rebecca Zanzig 0aec555d8f
Merge pull request #4854 from hashicorp/docs/k8s+helm
Add connectInject `image` info into helm docs
2018-10-25 15:07:36 -07:00
Hans Hasselberg 787e90cebc
website: sync guides list with guides sidebar. (#4831) 2018-10-25 12:07:26 -07:00
Rebecca Zanzig 6fb2134e96 Add connectInject `image` info into helm docs
This field was added back into the helm chart, but it was not added
back to the documentation. This adds it, then additionally fixes a
few typos in the same file.
2018-10-25 08:41:59 -07:00
Yoann Fouquet a7f83b62f3 website: mention node name for "agent/force-leave" HTTP endpoint (#4542)
* Adjust documentation for agent/force-leave endpoint

A node must be specified when calling agent/force-leave.
See:
 - https://github.com/hashicorp/consul/blob/master/agent/http_oss.go#L25
 - https://github.com/hashicorp/consul/blob/master/agent/agent_endpoint.go#L323
 - https://github.com/hashicorp/consul/blob/master/agent/agent.go#L1442

However, the documentation does not specify it.
Note that Consul returns "301 Moved Permanently v1/agent/force-leave/" when sending PUT request on "v1/agent/force-leave".

* Switch from node id to node name
2018-10-24 08:20:05 -07:00
Raja Nadar e7629564ef docs: add return info for update and delete acl-token apis (#4584)
* Update Token API returns the ID of the token updated.
 * Delete Token API returns a raw text which is true for successful deletions
2018-10-24 11:11:51 -04:00
Raja Nadar 344d78dc54 website: update the response json fields for sessions (#4604)
Updated the response json with the true response from Consul 1.2.2
2018-10-24 07:33:25 -07:00
Matt Keeler a02a6be6b9
Implement CLI token cloning & special ID handling (#4827)
* Implement CLI token cloning & special ID handling

* Update a couple CLI commands to take some alternative options.

* Document the CLI.

* Update the policy list and set-agent-token synopsis
2018-10-24 10:24:29 -04:00
Martin Logan 999cb0a49f website: Update deprecated script tag in example. (#4790)
Signed-off-by: Martin Logan <mlogan@fanatics.com>
2018-10-24 07:21:20 -07:00
Andreas Sommer 994a3ece63 website: explain script exit code 1 in health check introduction guide (#4769) 2018-10-24 07:09:41 -07:00
Matt Keeler 2b4d3eabfe
Fix some uuids and make it clear that the SecretID is used for agent tokens (#4845) 2018-10-24 09:47:55 -04:00
Rebecca Zanzig 6b132da961 Update the `join` command format in the k8s Running Consul section
Based on info from consul-helm issue 16, the formatting of the helm
chart value for joining an external cluster needs to be specified
as a yaml array. This updates the documentation to reflect this.
2018-10-22 14:08:13 -07:00
Jack Pearkes 87a2b2020d website: add link to rc announce 2018-10-19 13:37:47 -07:00
Matt Keeler 1ac888aa8c ACL documentation (#4824)
* Updating the ACL guide.

* Update the docs correctly

* Finish updating the ACL docs - for now.
2018-10-19 13:26:31 -07:00
Matt Keeler 18b29c45c4
New ACLs (#4791)
This PR is almost a complete rewrite of the ACL system within Consul. It brings the features more in line with other HashiCorp products. Obviously there is quite a bit left to do here but most of it is related docs, testing and finishing the last few commands in the CLI. I will update the PR description and check off the todos as I finish them over the next few days/week.
Description

At a high level this PR is mainly to split ACL tokens from Policies and to split the concepts of Authorization from Identities. A lot of this PR is mostly just to support CRUD operations on ACLTokens and ACLPolicies. These in and of themselves are not particularly interesting. The bigger conceptual changes are in how tokens get resolved, how backwards compatibility is handled and the separation of policy from identity which could lead the way to allowing for alternative identity providers.

On the surface and with a new cluster the ACL system will look very similar to that of Nomads. Both have tokens and policies. Both have local tokens. The ACL management APIs for both are very similar. I even ripped off Nomad's ACL bootstrap resetting procedure. There are a few key differences though.

    Nomad requires token and policy replication where Consul only requires policy replication with token replication being opt-in. In Consul local tokens only work with token replication being enabled though.
    All policies in Nomad are globally applicable. In Consul all policies are stored and replicated globally but can be scoped to a subset of the datacenters. This allows for more granular access management.
    Unlike Nomad, Consul has legacy baggage in the form of the original ACL system. The ramifications of this are:
        A server running the new system must still support other clients using the legacy system.
        A client running the new system must be able to use the legacy RPCs when the servers in its datacenter are running the legacy system.
        The primary ACL DC's servers running in legacy mode needs to be a gate that keeps everything else in the entire multi-DC cluster running in legacy mode.

So not only does this PR implement the new ACL system but has a legacy mode built in for when the cluster isn't ready for new ACLs. Also detecting that new ACLs can be used is automatic and requires no configuration on the part of administrators. This process is detailed more in the "Transitioning from Legacy to New ACL Mode" section below.
2018-10-19 12:04:07 -04:00
Jack Pearkes 34d01e6254
website: minor notes about 1.4.0 (#4820) 2018-10-19 08:52:56 -07:00
Pierre Souchay fab55bee2b dns: implements prefix lookups for DNS TTL (#4605)
This will fix https://github.com/hashicorp/consul/issues/4509 and allow forinstance lb-* to match services lb-001 or lb-service-007.
2018-10-19 08:41:04 -07:00
Aestek c4d6d19d8e website: add service weights documentation in API doc (#4776)
Adds weights documentation to the following API routes :
* Agent: List Services
* Agent Register Service
* Health: List Nodes for Service
2018-10-19 08:41:03 -07:00
Jack Pearkes bfa1a912ab website: note Envoy support in Nomad guide (#4787) 2018-10-19 08:41:03 -07:00
Jack Pearkes 8c684db488 New command: consul debug (#4754)
* agent/debug: add package for debugging, host info

* api: add v1/agent/host endpoint

* agent: add v1/agent/host endpoint

* command/debug: implementation of static capture

* command/debug: tests and only configured targets

* agent/debug: add basic test for host metrics

* command/debug: add methods for dynamic data capture

* api: add debug/pprof endpoints

* command/debug: add pprof

* command/debug: timing, wg, logs to disk

* vendor: add gopsutil/disk

* command/debug: add a usage section

* website: add docs for consul debug

* agent/host: require operator:read

* api/host: improve docs and no retry timing

* command/debug: fail on extra arguments

* command/debug: fixup file permissions to 0644

* command/debug: remove server flags

* command/debug: improve clarity of usage section

* api/debug: add Trace for profiling, fix profile

* command/debug: capture profile and trace at the same time

* command/debug: add index document

* command/debug: use "clusters" in place of members

* command/debug: remove address in output

* command/debug: improve comment on metrics sleep

* command/debug: clarify usage

* agent: always register pprof handlers and protect

This will allow us to avoid a restart of a target agent
for profiling by always registering the pprof handlers.

Given this is a potentially sensitive path, it is protected
with an operator:read ACL and enable debug being
set to true on the target agent. enable_debug still requires
a restart.

If ACLs are disabled, enable_debug is sufficient.

* command/debug: use trace.out instead of .prof

More in line with golang docs.

* agent: fix comment wording

* agent: wrap table driven tests in t.run()
2018-10-19 08:41:03 -07:00
Kyle Havlovitz c617326470 re-add Connect multi-dc config changes
This reverts commit 8bcfbaffb6.
2018-10-19 08:41:03 -07:00
Rebecca Zanzig 58fc4a7cbc Add additional formatting detail to the Helm `join` command
In response to consul-helm issue 16.
2018-10-17 12:53:44 -07:00
Assel Meher f912bf0fcd typo: s/checks/services (#4783) 2018-10-11 18:48:51 +01:00
Jack Pearkes 8bcfbaffb6 Revert "Connect multi-dc config" (#4784) 2018-10-11 17:32:45 +01:00
danielehc 40017f5e59
Update creating-certificates.html.md (#4780)
In case `verify_server_hostname` is set in the configuration, Consul checks the certificate against  `server.<datacenter>.<domain>`.

The name suggested by the guide generates errors like the following:
```
2018/10/10 12:42:20 [ERR] consul: Failed to confirm peer status for consul-3: rpc error getting client: failed to get conn: x509: certificate is valid for server.node.consul.labs, localhost, not server.consul.labs. Retrying in 16s...
```

Removing the `node` part from the certificate permits them to work also when that option is set.
2018-10-11 14:23:51 +02:00
Aestek 25f04fbd21 [Security] Add finer control over script checks (#4715)
* Add -enable-local-script-checks options

These options allow for a finer control over when script checks are enabled by
giving the option to only allow them when they are declared from the local
file system.

* Add documentation for the new option

* Nitpick doc wording
2018-10-11 13:22:11 +01:00
Paul Banks f951dcfb9d
Be more explicit about rolling upgrade process 2018-10-11 11:44:20 +01:00
Paul Banks 5952804334
Move 1.0.6 upgrade docs that were added in the wrong place 2018-10-11 11:38:55 +01:00
Paul Banks 51c0001aad
[WIP] Initial draft of Sidecar Service and Managed Proxy deprecation docs (#4752)
* Initial draft of Sidecar Service and Managed Proxy deprecation docs

* Service definition deprecation notices and sidecar service

* gRPC and sidecar service config options; Deprecate managed proxy options

* Envoy Docs: Basic envoy command; envoy getting started/intro

* Remove change that snuck in

* Envoy custom config example

* Add agent/service API docs; deprecate proxy config endpoint

* Misc grep cleanup for managed proxies; capitalize Envoy

* Updates to getting started guide

* Add missing link

* Refactor Envoy guide into a separate guide and add bootstrap reference notes.

* Add limitations to Envoy docs; Highlight no fixes for known managed proxy issues on deprecation page; clarify snake cae stuff; Sidecar Service lifecycle
2018-10-11 10:44:42 +01:00
Pierre Souchay 251156eb68 Added SOA configuration for DNS settings. (#4714)
This will allow to fine TUNE SOA settings sent by Consul in DNS responses,
for instance to be able to control negative ttl.

Will fix: https://github.com/hashicorp/consul/issues/4713

# Example

Override all settings:

* min_ttl: 0 => 60s
* retry: 600 (10m) => 300s (5 minutes),
* expire: 86400 (24h) => 43200 (12h)
* refresh: 3600 (1h) => 1800 (30 minutes)

```
consul agent -dev -hcl 'dns_config={soa={min_ttl=60,retry=300,expire=43200,refresh=1800}}'
```

Result:
```
dig +multiline @localhost -p 8600 service.consul

; <<>> DiG 9.12.1 <<>> +multiline @localhost -p 8600 service.consul
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 36557
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;service.consul.		IN A

;; AUTHORITY SECTION:
consul.			0 IN SOA ns.consul. hostmaster.consul. (
				1537959133 ; serial
				1800       ; refresh (30 minutes)
				300        ; retry (5 minutes)
				43200      ; expire (12 hours)
				60         ; minimum (1 minute)
				)

;; Query time: 4 msec
;; SERVER: 127.0.0.1#8600(127.0.0.1)
;; WHEN: Wed Sep 26 12:52:13 CEST 2018
;; MSG SIZE  rcvd: 93
```
2018-10-10 15:50:56 -04:00
Kyle Havlovitz e4349c5710 connect/ca: more OSS split for multi-dc 2018-10-10 12:17:59 -07:00
Kyle Havlovitz 56dc426227 agent: add primary_datacenter and connect replication config options 2018-10-10 12:17:59 -07:00
Kyle Havlovitz 46c829b879 docs: deprecate acl_datacenter and replace it with primary_datacenter 2018-10-10 12:16:47 -07:00
Paul Banks b83bbf248c Add Proxy Upstreams to Service Definition (#4639)
* Refactor Service Definition ProxyDestination.

This includes:
 - Refactoring all internal structs used
 - Updated tests for both deprecated and new input for:
   - Agent Services endpoint response
   - Agent Service endpoint response
   - Agent Register endpoint
     - Unmanaged deprecated field
     - Unmanaged new fields
     - Managed deprecated upstreams
     - Managed new
   - Catalog Register
     - Unmanaged deprecated field
     - Unmanaged new fields
     - Managed deprecated upstreams
     - Managed new
   - Catalog Services endpoint response
   - Catalog Node endpoint response
   - Catalog Service endpoint response
 - Updated API tests for all of the above too (both deprecated and new forms of register)

TODO:
 - config package changes for on-disk service definitions
 - proxy config endpoint
 - built-in proxy support for new fields

* Agent proxy config endpoint updated with upstreams

* Config file changes for upstreams.

* Add upstream opaque config and update all tests to ensure it works everywhere.

* Built in proxy working with new Upstreams config

* Command fixes and deprecations

* Fix key translation, upstream type defaults and a spate of other subtele bugs found with ned to end test scripts...

TODO: tests still failing on one case that needs a fix. I think it's key translation for upstreams nested in Managed proxy struct.

* Fix translated keys in API registration.
≈

* Fixes from docs
 - omit some empty undocumented fields in API
 - Bring back ServiceProxyDestination in Catalog responses to not break backwards compat - this was removed assuming it was only used internally.

* Documentation updates for Upstreams in service definition

* Fixes for tests broken by many refactors.

* Enable travis on f-connect branch in this branch too.

* Add consistent Deprecation comments to ProxyDestination uses

* Update version number on deprecation notices, and correct upstream datacenter field with explanation in docs
2018-10-10 16:55:34 +01:00
Paul Banks 88388d760d Support Agent Caching for Service Discovery Results (#4541)
* Add cache types for catalog/services and health/services and basic test that caching works

* Support non-blocking cache types with Cache-Control semantics.

* Update API docs to include caching info for every endpoint.

* Comment updates per PR feedback.

* Add note on caching to the 10,000 foot view on the architecture page to make the new data path more clear.

* Document prepared query staleness quirk and force all background requests to AllowStale so we can spread service discovery load across servers.
2018-10-10 16:55:34 +01:00
Mitchell Hashimoto 87e37ac758
Merge pull request #4766 from hashicorp/f-connect-inject
website: add docs for the Connect injection
2018-10-10 08:23:56 -07:00
Matt Ho 59f9d5ccd1 website: fix typo in connect example (#4774) 2018-10-10 11:01:57 +02:00
Mitchell Hashimoto 1b02b9e3c1
website: address PR feedback 2018-10-09 09:30:37 -07:00
Hannah Oppenheimer 6b487f80ff Clarify enable_tag_override explanation
In designing a potential UI for a configuration of `enable_tag_override`,
I found the documentation confusing and lengthy. Here, I've made an
attempt at re-writing this section to be more concise and clear.

I also made a few small changes to the organization of this file to map
explanations to the order of the properties listing at the top. I find
it easier to scan docs when explanations appear in the same order they
are listed at the top. For explanations that span multiple paragraphs, I
provided a subheading, which also helps in linking from other pages.

Finally, I removed a duplicated paragraph from the documentation.
2018-10-09 09:55:44 -05:00
Mitchell Hashimoto a4abd8dd76
website: note that env vars are set 2018-10-08 09:55:55 -07:00