13 Commits (c7307cae6ff4689a11fd5363754ce60801edf8b5)

Author	SHA1	Message	Date
skpratt	896d8f5ec5	temporarily disallow L7 traffic permissions (#19322)	1 year ago
Matt Keeler	5698353652	Resource Hook Pre-Decode Utilities (#18548) ... Add some generic type hook wrappers to first decode the data There seems to be a pattern for Validation, Mutation and Write Authorization hooks where they first need to decode the Any data before doing the domain specific work. This PR introduces 3 new functions to generate wrappers around the other hooks to pre-decode the data into a DecodedResource and pass that in instead of the original pbresource.Resource. This PR also updates the various catalog data types to use the new hook generators.	1 year ago
Iryna Shustava	105ebfdd00	catalog, mesh: implement missing ACL hooks (#19143) ... This change adds ACL hooks to the remaining catalog and mesh resources, excluding any computed ones. Those will for now continue using the default operator:x permissions. It refactors a lot of the common testing functions so that they can be re-used between resources. There are also some types that we don't yet support (e.g. virtual IPs) that this change adds ACL hooks to for future-proofing.	1 year ago
Chris S. Kim	b43cde5d19	Add workload identity hooks (#19045)	1 year ago
Eric Haberkorn	f2b7b4591a	Fix Traffic Permissions Default Deny (#19028) ... Whenver a traffic permission exists for a given workload identity, turn on default deny. Previously, this was only working at the port level.	1 year ago
skpratt	21ea527089	TrafficPermissions: add ACL hooks (#19023) ... * add ACL hooks * add hooks for CTPs	1 year ago
Eric Haberkorn	7ce6ebaeb3	Handle Traffic Permissions With Empty Sources Properly (#19024) ... Fix issues with empty sources * Validate that each permission on traffic permissions resources has at least one source. * Don't construct RBAC policies when there aren't any principals. This resulted in Envoy rejecting xDS updates with a validation error. ``` error= | rpc error: code = Internal desc = Error adding/updating listener(s) public_listener: Proto constraint validation failed (RBACValidationError.Rules: embedded message failed validation | caused by RBACValidationError.Policies[consul-intentions-layer4-1]: embedded message failed validation | caused by PolicyValidationError.Principals: value must contain at least 1 item(s)): rules { ```	1 year ago
skpratt	202090e5d5	v2 explicit destination traffic permissions (#18823) ... * workload identity boilerplate * notes from discussion with Iryna * WIP traffic permissions controller poc * workload identity, traffic permissions validation, errors, types * traffic permissions mapper framing, traffic permissions controller updates. * more roughing out of the controller * cleanup * controller and mapper logic * tests * refactor mapper logic, add tests * clean up tenancy and integration test stubs * consolidate mapping * cleanup cache leak, revert bimapper changes * address review comments * test fix and rebase * use resource helper --------- Co-authored-by: John Landa <john.landa@hashicorp.com>	1 year ago
Iryna Shustava	e6b724d062	catalog,mesh,auth: Move resource types to the proto-public module (#18935)	1 year ago
Eric Haberkorn	4d6ff29392	Traffic Permissions Validations (#18907) ... add TP validations and mutation and add CTP validations	1 year ago
Iryna Shustava	d88888ee8b	catalog,mesh,auth: Bump versions to v2beta1 (#18930)	1 year ago
Eric Haberkorn	170417ac97	Honor Default Traffic Permissions in V2 (#18886) ... wire up v2 default traffic permissions	1 year ago
skpratt	e5808d85f7	register traffic permission and workload identity types (#18704) ... * add workload identity and traffic permission protos * register new types * add generated pb code * fix exports.go path * add proto newlines * fix type name Co-authored-by: Eric Haberkorn <erichaberkorn@gmail.com> * address review * fix protos and add tests * fix validation constraints * add tests --------- Co-authored-by: Eric Haberkorn <erichaberkorn@gmail.com>	1 year ago