136 Commits (c78f7ecb27175f50bc4d04cca261cf7379f4c0a6)

Author	SHA1	Message	Date
Matt Keeler	caafc02449	hcs-1936: Prepare for adding license auto-retrieval to auto-config in enterprise	4 years ago
R.B. Boyer	3b50a55533	connect: update supported envoy versions to 1.18.3, 1.17.3, 1.16.4, and 1.15.5 (#10231)	4 years ago
Daniel Nephin	426565b68c	fix failing integration tests ... The new IDs include a leading slash for the partition ID section	4 years ago
R.B. Boyer	abc1dc0fe9	connect: update supported envoy versions to 1.18.2, 1.17.2, 1.16.3, and 1.15.4 (#10101) ... The only thing that needed fixing up pertained to this section of the 1.18.x release notes: > grpc_stats: the default value for stats_for_all_methods is switched from true to false, in order to avoid possible memory exhaustion due to an untrusted downstream sending a large number of unique method names. The previous default value was deprecated in version 1.14.0. This only changes the behavior when the value is not set. The previous behavior can be used by setting the value to true. This behavior change by be overridden by setting runtime feature envoy.deprecated_features.grpc_stats_filter_enable_stats_for_all_methods_by_default. For now to maintain status-quo I'm explicitly setting `stats_for_all_methods=true` in all versions to avoid relying upon the default. Additionally the naming of the emitted metrics for these gRPC requests changed slightly so the integration test assertions for `case-grpc` needed adjusting.	4 years ago
R.B. Boyer	71d45a3460	Support Incremental xDS mode (#9855) ... This adds support for the Incremental xDS protocol when using xDS v3. This is best reviewed commit-by-commit and will not be squashed when merged. Union of all commit messages follows to give an overarching summary: xds: exclusively support incremental xDS when using xDS v3 Attempts to use SoTW via v3 will fail, much like attempts to use incremental via v2 will fail. Work around a strange older envoy behavior involving empty CDS responses over incremental xDS. xds: various cleanups and refactors that don't strictly concern the addition of incremental xDS support Dissolve the connectionInfo struct in favor of per-connection ResourceGenerators instead. Do a better job of ensuring the xds code uses a well configured logger that accurately describes the connected client. xds: pull out checkStreamACLs method in advance of a later commit xds: rewrite SoTW xDS protocol tests to use protobufs rather than hand-rolled json strings In the test we very lightly reuse some of the more boring protobuf construction helper code that is also technically under test. The important thing of the protocol tests is testing the protocol. The actual inputs and outputs are largely already handled by the xds golden output tests now so these protocol tests don't have to do double-duty. This also updates the SoTW protocol test to exclusively use xDS v2 which is the only variant of SoTW that will be supported in Consul 1.10. xds: default xds.Server.AuthCheckFrequency at use-time instead of construction-time	4 years ago
R.B. Boyer	52205ac201	test: switch envoy integration tests to use pkill instead of ps+grep+awk+kill (#10097)	4 years ago
Freddy	a11ea6254e	Check for optionally prepended namespace in upstream assertion (#10049)	4 years ago
Yong Wen Chua	516335e415	Update assertion to not check for port	4 years ago
Yong Wen Chua	409768d6e5	Merge branch 'master' of github.com:hashicorp/consul into tg-rewrite	4 years ago
R.B. Boyer	398b766532	xds: default to speaking xDS v3, but allow for v2 to be spoken upon request (#9658) ... - Also add support for envoy 1.17.0	4 years ago
Yong Wen Chua	ec8fecbf61	Add integration test check	4 years ago
R.B. Boyer	3b6ffc447b	xds: remove deprecated usages of xDS (#9602) ... Note that this does NOT upgrade to xDS v3. That will come in a future PR. Additionally: - Ignored staticcheck warnings about how github.com/golang/protobuf is deprecated. - Shuffled some agent/xds imports in advance of a later xDS v3 upgrade. - Remove support for envoy 1.13.x but don't add in 1.17.x yet. We have to wait until the xDS v3 support is added in a follow-up PR. Fixes #8425	4 years ago
R.B. Boyer	39effd620c	xds: only try to create an ipv6 expose checks listener if ipv6 is supported by the kernel (#9765) ... Fixes #9311 This only fails if the kernel has ipv6 hard-disabled. It is not sufficient to merely not provide an ipv6 address for a network interface.	4 years ago
Alvin Huang	bf5b76851a	remove reference to docker/ path for old docker mirror (#9783)	4 years ago
Michele Degges	fee295b685	Remove jfrog references (#9782)	4 years ago
R.B. Boyer	6eeccc93ce	connect: update supported envoy point releases to 1.16.2, 1.15.3, 1.14.6, 1.13.7 (#9737)	4 years ago
s-christoff	97facc994e	docs: Update load test documentation and minor clean ups (#9548)	4 years ago
Daniel Nephin	79284b41ea	Pin alpine/socat image to a version. ... To fix failing integration tests. The latest version (`1.7.4.0-r0`) appears to not be catting all the bytes, so the expected metrics are missing in the output.	4 years ago
s-christoff	bc520a4fc8	Up testing threshold for Circle (#9418)	4 years ago
s-christoff	b9a9f395d6	Minor load test fixes (#9394)	4 years ago
s-christoff	348766166e	Allow consul version/consul download url to be inputted via Terraform (#9267)	4 years ago
Freddy	fe728855ed	Add DC and NS support for Envoy metrics (#9207) ... This PR updates the tags that we generate for Envoy stats. Several of these come with breaking changes, since we can't keep two stats prefixes for a filter.	4 years ago
Mike Morris	7af643ac37	ci: update to Go 1.15.4 and alpine:3.12 (#9036) ... * ci: stop building darwin/386 binaries Go 1.15 drops support for 32-bit binaries on Darwin https://golang.org/doc/go1.15#darwin * tls: ConnectionState::NegotiatedProtocolIsMutual is deprecated in Go 1.15, this value is always true * correct error messages that changed slightly * Completely regenerate some TLS test data Co-authored-by: R.B. Boyer <rb@hashicorp.com>	4 years ago
R.B. Boyer	5afd04897c	test: use direct service registration in envoy integration tests (#9138) ... This has the biggest impact on enterprise test cases that use namespaced registrations, which prior to this change sometimes failed the initial registration because the namespace was not yet created.	4 years ago
R.B. Boyer	8baf158ea8	Revert "Add namespace support for metrics (OSS) (#9117)" (#9124) ... This reverts commit 06b3b017d3.	4 years ago
Freddy	06b3b017d3	Add namespace support for metrics (OSS) (#9117)	4 years ago
Aaron Lane	ef90db1943	Merge pull request #9112 from hashicorp/aaron-lane-patch-2 ... Update loadtest AMI name, description	4 years ago
Aaron Lane	78de48ef42	Update loadtest AMI name, description ... This commit updates the Packer properties `ami_name` and `ami_description` for the loadtest image to reflect the image intent.	4 years ago
Aaron Lane	665019e884	Link to packer directory from terraform ReadMe	4 years ago
R.B. Boyer	44bd8bd2ae	use the docker proxy for more envoy integration test containers (#9085)	4 years ago
R.B. Boyer	957293d884	wait_for_namespace should take two args (#9086)	4 years ago
Alvin Huang	ae6185a554	use hashicorp docker mirror in envoy helper (#9080)	4 years ago
R.B. Boyer	d7b37e3c6e	fix envoy integ test wait_for_namespace to actually work on CI (#9082)	4 years ago
Alvin Huang	ea88956c9c	use hashicorp docker mirror to prevent rate limit (#9070)	4 years ago
R.B. Boyer	a66c4591d7	agent: introduce path allow list for requests going through the metrics proxy (#9059) ... Added a new option `ui_config.metrics_proxy.path_allowlist`. This defaults to `["/api/v1/query", "/api/v1/query_range"]` when the metrics provider is set to `prometheus`. Requests that do not use one of the allow-listed paths (via exact match) get a 403 Forbidden response instead.	4 years ago
R.B. Boyer	b724e096c2	add namespace waiting function to envoy integration tests (#9051)	4 years ago
R.B. Boyer	8e70c3fc25	missed adding the test delay to the l7-intentions envoy integration test (#9052)	4 years ago
R.B. Boyer	d7c7858d87	Fix even more test flakes in intentions related envoy integration tests (#9013) ... The key thing here is to use `curl --no-keepalive` so that envoy pre-1.15 tests will reliably use the latest listener every time. Extra: - Switched away from editing line-item intentions the legacy way. - Removed some teardown scripts, as we don't share anything between cases anyway - Removed unnecessary use of `run` in some places.	4 years ago
R.B. Boyer	934c65ad77	fix flaky envoy integration tests involving intentions (#8996) ... There is a delay between an intentions change being made, and it being reflected in the Envoy runtime configuration. Now that the enforcement happens inside of Envoy instead of over in the agent, our tests need to explicitly wait until the xDS reconfiguration is complete before attempting to assert intentions worked. Also remove a few double retry loops.	4 years ago
R.B. Boyer	a2c50d3303	connect: add support for envoy 1.16.0, drop support for 1.12.x, and bump point releases as well (#8944) ... Supported versions will be: "1.16.0", "1.15.2", "1.14.5", "1.13.6"	4 years ago
R.B. Boyer	0bf62246e5	speed up envoy integration tests by removing docker-compose (#8982) ... This speeds up individual envoy integration test runs from ~23m to ~14m. It's also a pre-req for possibly switching to doing the tests entirely within Go (no shell-outs).	4 years ago
R.B. Boyer	da4ec9ff27	restore the discovery of tests cases by file system existence (#8983)	4 years ago
R.B. Boyer	a68c0ce1e7	speed up envoy integ tests by not politely stopping containers before destroying them (#8969) ... In local testing this sped up the stop_services call from 11s to 1s per test.	4 years ago
R.B. Boyer	1b413b0444	connect: support defining intentions using layer 7 criteria (#8839) ... Extend Consul’s intentions model to allow for request-based access control enforcement for HTTP-like protocols in addition to the existing connection-based enforcement for unspecified protocols (e.g. tcp).	4 years ago
s-christoff	5da640b287	Add load testing framework (#8571)	4 years ago
R.B. Boyer	9801ef8eb1	agent: enable enable_central_service_config by default (#8746)	4 years ago
Jack	9e1c6727f9	Add http2 and grpc support to ingress gateways (#8458)	4 years ago
R.B. Boyer	74d5df7c7a	xds: use envoy's rbac filter to handle intentions entirely within envoy (#8569)	4 years ago
R.B. Boyer	c599a2f5f4	xds: add support for envoy 1.15.0 and drop support for 1.11.x (#8424) ... Related changes: - hard-fail the xDS connection attempt if the envoy version is known to be too old to be supported - remove the RouterMatchSafeRegex proxy feature since all supported envoy versions have it - stop using --max-obj-name-len (due to: envoyproxy/envoy#11740)	4 years ago
Hans Hasselberg	496fb5fc5b	add support for envoy 1.14.4, 1.13.4, 1.12.6 (#8216)	4 years ago