4960 Commits (c833464daf95b7a3e965c497afa0e766038d0ec5)

Author	SHA1	Message	Date
John Maguire	c833464daf	Update normalization of route refs (#16789) ... * Use merge of enterprise meta's rather than new custom method * Add merge logic for tcp routes * Add changelog * Normalize certificate refs on gateways * Fix infinite call loop * Explicitly call enterprise meta	2 years ago
Michael Wilkerson	e5d58c59c9	changes to support new PQ enterprise fields (#16793)	2 years ago
Semir Patel	440f11203f	Resource service List(..) endpoint (#16753)	2 years ago
Dhia Ayachi	10df4d83aa	add ip rate limiter controller OSS parts (#16790)	2 years ago
Kyle Havlovitz	42c5b29713	Allocate virtual ip for resolver/router/splitter config entries (#16760)	2 years ago
Semir Patel	032aba3175	WatchList(..) endpoint for the resource service (#16726)	2 years ago
John Maguire	351bdc3c0d	Fix struct tags for TCPService enterprise meta (#16781) ... * Fix struct tags for TCPService enterprise meta * Add changelog	2 years ago
Semir Patel	3415689eb6	Read(...) endpoint for the resource service (#16655)	2 years ago
Derek Menteer	2236975011	Change partition for peers in discovery chain targets (#16769) ... This commit swaps the partition field to the local partition for discovery chains targeting peers. Prior to this change, peer upstreams would always use a value of default regardless of which partition they exist in. This caused several issues in xds / proxycfg because of id mismatches. Some prior fixes were made to deal with one-off id mismatches that this PR also cleans up, since they are no longer needed.	2 years ago
John Eikenberry	0b1dc4ec36	tests instantiating clients w/o shutting down (#16755) ... noticed via their port still in use messages.	2 years ago
Poonam Jadhav	3df271959c	fix: remove unused tenancy category from rate limit spec (#16740)	2 years ago
Dhia Ayachi	3ba0eb5074	delete config when nil (#16690) ... * delete config when nil * fix mock interface implementation * fix handler test to use the right assertion * extract DeleteConfig as a separate API. * fix mock limiter implementation to satisfy the new interface * fix failing tests * add test comments	2 years ago
Eric Haberkorn	495ad4c7ef	add enterprise xds tests (#16738)	2 years ago
Eric Haberkorn	3c5c53aa80	fix bug where pqs that failover to a cluster peer dont un-fail over (#16729)	2 years ago
cskh	7f6f6891f7	fix: gracefully fail on invalid port number (#16721)	2 years ago
John Maguire	8dd1d73874	Remove unused are hosts set check (#16691) ... * Remove unused are hosts set check * Remove all traces of unused 'AreHostsSet' parameter * Remove unused Hosts attribute * Remove commented out use of snap.APIGateway.Hosts	2 years ago
Nitya Dhanushkodi	b9bd2c3780	peering: peering partition failover fixes (#16673) ... add local source partition for peered upstreams	2 years ago
John Maguire	1ef9f4dade	Fix route subscription when using namespaces (#16677) ... * Fix route subscription when using namespaces * Update changelog * Fix changelog entry to reference that the bug was enterprise only	2 years ago
Melisa Griffin	606f8fbbab	Adds check to verify that the API Gateway is being created with at least one listener	2 years ago
Poonam Jadhav	9c64731a56	feat: add category annotation to RPC and gRPC methods (#16646)	2 years ago
Eric Haberkorn	7477f52a16	add sameness groups to discovery chains (#16671)	2 years ago
Andrew Stucki	501b87fd31	[API Gateway] Fix invalid cluster causing gateway programming delay (#16661) ... * Add test for http routes * Add fix * Fix tests * Add changelog entry * Refactor and fix flaky tests	2 years ago
Eric Haberkorn	eaa39f4ef5	add sameness group support to service resolver failover and redirects (#16664)	2 years ago
Eric Haberkorn	57e034b746	fix confusing spiffe ids in golden tests (#16643)	2 years ago
wangxinyi7	152c75349e	net 2731 ip config entry OSS version (#16642) ... * ip config entry * name changing * move to ent * ent version * renaming * change format * renaming * refactor * add default values	2 years ago
John Maguire	ff5887a99e	Update e2e tests for namespaces (#16627) ... * Refactored "NewGatewayService" to handle namespaces, fixed TestHTTPRouteFlattening test * Fixed existing http_route tests for namespacing * Squash aclEnterpriseMeta for ResourceRefs and HTTPServices, accept namespace for creating connect services and regular services * Use require instead of assert after creating namespaces in http_route_tests * Refactor NewConnectService and NewGatewayService functions to use cfg objects to reduce number of method args * Rename field on SidecarConfig in tests from `SidecarServiceName` to `Name` to avoid stutter	2 years ago
Freddy	724b752ca7	Backport ENT-4704 (#16612)	2 years ago
Derek Menteer	8f75d99299	Fix issue with trust bundle read ACL check. (#16630) ... This commit fixes an issue where trust bundles could not be read by services in a non-default namespace, unless they had excessive ACL permissions given to them. Prior to this change, `service:write` was required in the default namespace in order to read the trust bundle. Now, `service:write` to a service in any namespace is sufficient.	2 years ago
Chris S. Kim	d5677e5680	Preserve CARoots when updating Vault CA configuration (#16592) ... If a CA config update did not cause a root change, the codepath would return early and skip some steps which preserve its intermediate certificates and signing key ID. This commit re-orders some code and prevents updates from generating new intermediate certificates.	2 years ago
Derek Menteer	f2902e6608	Add sameness-group configuration entry. (#16608) ... This commit adds a sameness-group config entry to the API and structs packages. It includes some validation logic and a new memdb index that tracks the default sameness-group for each partition. Sameness groups will simplify the effort of managing failovers / intentions / exports for peers and partitions. Note that this change purely to introduce the configuration entry and does not include the full functionality of sameness-groups.	2 years ago
Ashvitha	f95ffe0355	Allow HCP metrics collection for Envoy proxies ... Co-authored-by: Ashvitha Sridharan <ashvitha.sridharan@hashicorp.com> Co-authored-by: Freddy <freddygv@users.noreply.github.com> Add a new envoy flag: "envoy_hcp_metrics_bind_socket_dir", a directory where a unix socket will be created with the name `<namespace>_<proxy_id>.sock` to forward Envoy metrics. If set, this will configure: - In bootstrap configuration a local stats_sink and static cluster. These will forward metrics to a loopback listener sent over xDS. - A dynamic listener listening at the socket path that the previously defined static cluster is sending metrics to. - A dynamic cluster that will forward traffic received at this listener to the hcp-metrics-collector service. Reasons for having a static cluster pointing at a dynamic listener: - We want to secure the metrics stream using TLS, but the stats sink can only be defined in bootstrap config. With dynamic listeners/clusters we can use the proxy's leaf certificate issued by the Connect CA, which isn't available at bootstrap time. - We want to intelligently route to the HCP collector. Configuring its addreess at bootstrap time limits our flexibility routing-wise. More on this below. Reasons for defining the collector as an upstream in `proxycfg`: - The HCP collector will be deployed as a mesh service. - Certificate management is taken care of, as mentioned above. - Service discovery and routing logic is automatically taken care of, meaning that no code changes are required in the xds package. - Custom routing rules can be added for the collector using discovery chain config entries. Initially the collector is expected to be deployed to each admin partition, but in the future could be deployed centrally in the default partition. These config entries could even be managed by HCP itself.	2 years ago
Eric Haberkorn	e298f506a5	Add Peer Locality to Discovery Chains (#16588) ... Add peer locality to discovery chains	2 years ago
Eric Haberkorn	57e2493415	allow setting locality on services and nodes (#16581)	2 years ago
Semir Patel	176945aa86	GRPC stub for the ResourceService (#16528)	2 years ago
Andrew Stucki	040647e0ba	auto-updated agent/uiserver/dist/ from commit 63204b518 (#16587) ... Co-authored-by: hc-github-team-consul-core <github-team-consul-core@hashicorp.com>	2 years ago
Eric Haberkorn	89de91b263	fix bug that can lead to peering service deletes impacting the state of local services (#16570)	2 years ago
Eric Haberkorn	dbaf8bf49c	add agent locality and replicate it across peer streams (#16522)	2 years ago
John Eikenberry	f5641ffccc	support vault auth config for alicloud ca provider ... Add support for using existing vault auto-auth configurations as the provider configuration when using Vault's CA provider with AliCloud. AliCloud requires 2 extra fields to enable it to use STS (it's preferred auth setup). Our vault-plugin-auth-alicloud package contained a method to help generate them as they require you to make an http call to a faked endpoint proxy to get them (url and headers base64 encoded).	2 years ago
Melisa Griffin	fc232326a0	NET-2904 Fixes API Gateway Route Service Weight Division Error	2 years ago
Melisa Griffin	129eca8fdb	NET-2903 Normalize weight for http routes (#16512) ... * NET-2903 Normalize weight for http routes * Update website/content/docs/connect/gateways/api-gateway/configuration/http-route.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>	2 years ago
R.B. Boyer	9a485cdb49	proxycfg: ensure that an irrecoverable error in proxycfg closes the xds session and triggers a replacement proxycfg watcher (#16497) ... Receiving an "acl not found" error from an RPC in the agent cache and the streaming/event components will cause any request loops to cease under the assumption that they will never work again if the token was destroyed. This prevents log spam (#14144, #9738). Unfortunately due to things like: - authz requests going to stale servers that may not have witnessed the token creation yet - authz requests in a secondary datacenter happening before the tokens get replicated to that datacenter - authz requests from a primary TO a secondary datacenter happening before the tokens get replicated to that datacenter The caller will get an "acl not found" *before* the token exists, rather than just after. The machinery added above in the linked PRs will kick in and prevent the request loop from looping around again once the tokens actually exist. For `consul-dataplane` usages, where xDS is served by the Consul servers rather than the clients ultimately this is not a problem because in that scenario the `agent/proxycfg` machinery is on-demand and launched by a new xDS stream needing data for a specific service in the catalog. If the watching goroutines are terminated it ripples down and terminates the xDS stream, which CDP will eventually re-establish and restart everything. For Consul client usages, the `agent/proxycfg` machinery is ahead-of-time launched at service registration time (called "local" in some of the proxycfg machinery) so when the xDS stream comes in the data is already ready to go. If the watching goroutines terminate it should terminate the xDS stream, but there's no mechanism to re-spawn the watching goroutines. If the xDS stream reconnects it will see no `ConfigSnapshot` and will not get one again until the client agent is restarted, or the service is re-registered with something changed in it. This PR fixes a few things in the machinery: - there was an inadvertent deadlock in fetching snapshot from the proxycfg machinery by xDS, such that when the watching goroutine terminated the snapshots would never be fetched. This caused some of the xDS machinery to get indefinitely paused and not finish the teardown properly. - Every 30s we now attempt to re-insert all locally registered services into the proxycfg machinery. - When services are re-inserted into the proxycfg machinery we special case "dead" ones such that we unilaterally replace them rather that doing that conditionally.	2 years ago
John Eikenberry	56ffee6d42	add provider ca support for approle auth-method ... Adds support for the approle auth-method. Only handles using the approle role/secret to auth and it doesn't support the agent's extra management configuration options (wrap and delete after read) as they are not required as part of the auth (ie. they are vault agent things).	2 years ago
Andrew Stucki	cc0765b87d	Fix resolution of service resolvers with subsets for external upstreams (#16499) ... * Fix resolution of service resolvers with subsets for external upstreams * Add tests * Add changelog entry * Update view filter logic	2 years ago
Eric Haberkorn	5f81662066	Add support for failover policies (#16505)	2 years ago
Andrew Stucki	5deffbd95b	Fix issue where terminating gateway service resolvers weren't properly cleaned up (#16498) ... * Fix issue where terminating gateway service resolvers weren't properly cleaned up * Add integration test for cleaning up resolvers * Add changelog entry * Use state test and drop integration test	2 years ago
Andrew Stucki	4b661d1e0c	Add ServiceResolver RequestTimeout for route timeouts to make TerminatingGateway upstream timeouts configurable (#16495) ... * Leverage ServiceResolver ConnectTimeout for route timeouts to make TerminatingGateway upstream timeouts configurable * Regenerate golden files * Add RequestTimeout field * Add changelog entry	2 years ago
John Eikenberry	e8eec1fa80	add provider ca auth support for kubernetes ... Adds support for Kubernetes jwt/token file based auth. Only needs to read the file and save the contents as the jwt/token.	2 years ago
John Eikenberry	4211069080	add provider ca support for jwt file base auth ... Adds support for a jwt token in a file. Simply reads the file and sends the read in jwt along to the vault login. It also supports a legacy mode with the jwt string being passed directly. In which case the path is made optional.	2 years ago
Chris S. Kim	321439f5a7	Speed up test by registering services concurrently (#16509)	2 years ago
John Eikenberry	4f2d9a91e5	add provider ca auth-method support for azure ... Does the required dance with the local HTTP endpoint to get the required data for the jwt based auth setup in Azure. Keeps support for 'legacy' mode where all login data is passed on via the auth methods parameters. Refactored check for hardcoded /login fields.	2 years ago