consul

Commit Graph

Author	SHA1	Message	Date
hc-github-team-consul-core	6350270b7c	Backport of [NET-8367] security: upgrade google.golang.org/protobuf to 1.33.0 into release/1.16.x (#20804 ) * backport of commit `a407616755` * backport of commit `455f67fa57` --------- Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>	9 months ago
NicoletaPopoviciu	79dcd6f72b	[NET-7948] Bump Envoy version on 1.16.x to address multiple CVEs (#20586 ) security: Bump Envoy versions to address CVEs	10 months ago
Chris S. Kim	7649e1f6af	[1.16.x] Skip filter chain created by permissive mtls (#20432 )	10 months ago
hc-github-team-es-release-engineering	057c8db74b	[DO NOT MERGE UNTIL EOY] EOY license fixes 1.16.x (#19782 )	11 months ago
hc-github-team-consul-core	b0d3141cc5	Backport of [NET-7009] security: update x/crypto to 0.17.0 into release/1.16.x (#20028 ) backport of commit `d8a33b4e72` Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>	11 months ago
Chris Thain	eb75ac24f1	release/1.16.x - Update supported Envoy versions (#19273 )	1 year ago
hc-github-team-consul-core	4617e0a8da	Backport of [NET-5944] security: Update Go version to 1.20.10 and `x/net` to 0.17.0 into release/1.16.x (#19234 ) * backport of commit `d7d9de9564` * backport of commit `0794b1ce74` --------- Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>	1 year ago
Poonam Jadhav	7a454cb953	fix: go sum revert (#18389 )	1 year ago
Poonam Jadhav	d8700d94b7	release: sdk version bump to v0.14.1 and api version bump to v1.24.0 in envoyextensions module	1 year ago
hc-github-team-consul-core	a014854065	Backport of [NET-5146] security: Update Go version to 1.20.7 and `x/net` to 0.13.0 into release/1.16.x (#18363 ) backport of commit `905e371607` Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>	1 year ago
hc-github-team-consul-core	7500200376	Backport of [NET-4703] Prevent partial application of Envoy extensions into release/1.16.x (#18332 ) backport of commit `a920c7195b` Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>	1 year ago
Michael Zalimeni	383da7c0a9	[NET-4904] Update list of Envoy versions on 1.16.x (#18303 ) Update list of Envoy versions Update supported envoy versions to 1.23.12, 1.24.10, 1.25.9, 1.26.4.	1 year ago
hc-github-team-consul-core	dc58b454a7	Backport of Update submodules to latest following 1.16.0 into release/1.16.x (#18198 ) Update submodules to latest following 1.16.0 Align all our internal use of submodules on the latest versions. Manual backport of `235d9c5ca5`.	1 year ago
hc-github-team-consul-core	f9482b6620	Backport of [NET-4865] Bump golang.org/x/net to 0.12.0 into release/1.16.x (#18189 ) Bump golang.org/x/net to 0.12.0 While not necessary to directly address CVE-2023-29406 (which should be handled by using a patched version of Go when building), an accompanying change to HTTP/2 error handling does impact agent code. See https://go-review.googlesource.com/c/net/+/506995 for the HTTP/2 change. Bump this dependency across our submodules as well for the sake of potential indirect consumers of `x/net/http`. Manual backport of `84cbf09185`.	1 year ago
hc-github-team-consul-core	16eeb8e328	backport of commit `6fc8624ccf` (#17632 ) Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>	1 year ago
Michael Zalimeni	2d7a3d292d	Update envoyextensions submodule dependencies Bump api, sdk versions to latest.	1 year ago
hc-github-team-consul-core	9cb6679386	backport of commit `2735bbe60f` (#17613 ) Co-authored-by: Eric <eric@haberkorn.co>	1 year ago
Matt Keeler	77f44fa878	Various bits of cleanup detected when using Go Workspaces (#17462 ) TLDR with many modules the versions included in each diverged quite a bit. Attempting to use Go Workspaces produces a bunch of errors. This commit: 1. Fixes envoy-library-references.sh to work again 2. Ensures we are pulling in go-control-plane@v0.11.0 everywhere (previously it was at that version in some modules and others were much older) 3. Remove one usage of golang/protobuf that caused us to have a direct dependency on it. 4. Remove deprecated usage of the Endpoint field in the grpc resolver.Target struct. The current version of grpc (v1.55.0) has removed that field and recommended replacement with URL.Opaque and calls to the Endpoint() func when needing to consume the previous field. 4. `go work init <all the paths to go.mod files>` && `go work sync`. This syncrhonized versions of dependencies from the main workspace/root module to all submodules 5. Updated .gitignore to ignore the go.work and go.work.sum files. This seems to be standard practice at the moment. 6. Update doc comments in protoc-gen-consul-rate-limit to be go fmt compatible 7. Upgraded makefile infra to perform linting, testing and go mod tidy on all modules in a flexible manner. 8. Updated linter rules to prevent usage of golang/protobuf 9. Updated a leader peering test to account for an extra colon in a grpc error message.	1 year ago
Michael Zalimeni	ad03a5d0f2	Avoid panic applying TProxy Envoy extensions (#17537 ) When UpstreamEnvoyExtender was introduced, some code was left duplicated between it and BasicEnvoyExtender. One path in that code panics when a TProxy listener patch is attempted due to no upstream data in RuntimeConfig matching the local service (which would only happen in rare cases). Instead, we can remove the special handling of upstream VIPs from BasicEnvoyExtender entirely, greatly simplifying the listener filter patch code and avoiding the panic. UpstreamEnvoyExtender, which needs this code to function, is modified to ensure a panic does not occur. This also fixes a second regression in which the Lua extension was not applied to TProxy outbound listeners.	2 years ago
Eric Haberkorn	d99312b86e	Add Upstream Service Targeting to Property Override Extension (#17517 ) * add upstream service targeting to property override extension * Also add baseline goldens for service specific property override extension. * Refactor the extension framework to put more logic into the templates. * fix up the golden tests	2 years ago
Michael Zalimeni	e1df0f28bd	Support `Listener` and `ClusterLoadAssignment` in `property-override` (#17497 ) * Support Listener in Property Override Add support for patching `Listener` resources via the builtin `property-override` extension. Refactor existing listener patch code in `BasicEnvoyExtender` to simplify addition of resource support. * Support ClusterLoadAssignment in Property Override Add support for patching `ClusterLoadAssignment` resources via the builtin `property-override` extension.	2 years ago
Chris Thain	2740d12d44	ENT->OSS merge for Consolidate `ListEnvoyExtender` into `BasicEnvoyExtender` (#17491 )	2 years ago
Michael Zalimeni	b8d2640429	Disable remote proxy patching except AWS Lambda (#17415 ) To avoid unintended tampering with remote downstreams via service config, refactor BasicEnvoyExtender and RuntimeConfig to disallow typical Envoy extensions from being applied to non-local proxies. Continue to allow this behavior for AWS Lambda and the read-only Validate builtin extensions. Addresses CVE-2023-2816.	2 years ago
Chris Thain	b9102c295d	Add Network Filter Support for Envoy Extensions (#17325 )	2 years ago
John Maguire	e47f3216e5	APIGW Normalize Status Conditions (#16994 ) * normalize status conditions for gateways and routes * Added tests for checking condition status and panic conditions for validating combinations, added dummy code for fsm store * get rid of unneeded gateway condition generator struct * Remove unused file * run go mod tidy * Update tests, add conflicted gateway status * put back removed status for test * Fix linting violation, remove custom conflicted status * Update fsm commands oss * Fix incorrect combination of type/condition/status * cleaning up from PR review * Change "invalidCertificate" to be of accepted status * Move status condition enums into api package * Update gateways controller and generated code * Update conditions in fsm oss tests * run go mod tidy on consul-container module to fix linting * Fix type for gateway endpoint test * go mod tidy from changes to api * go mod tidy on troubleshoot * Fix route conflicted reason * fix route conflict reason rename * Fix text for gateway conflicted status * Add valid certificate ref condition setting * Revert change to resolved refs to be handled in future PR	2 years ago
Anita Akaeze	d4cacc7232	Merge pull request #5200 from hashicorp/NET-3758 (#17102 ) * Merge pull request #5200 from hashicorp/NET-3758 NET-3758: connect: update supported envoy versions to 1.26.0 * lint	2 years ago
Nathan Coleman	5410139575	Update list of Envoy versions (#16889 ) * Update list of Envoy versions * Update docs + CI + tests * Add changelog entry * Add newly-released Envoy versions 1.23.8 and 1.24.6 * Add newly-released Envoy version 1.22.11	2 years ago
Chris Thain	175bb1a303	Wasm Envoy HTTP extension (#16877 )	2 years ago
Ronald	b64674623e	Copyright headers for missing files/folders (#16708 ) * copyright headers for agent folder	2 years ago
Semir Patel	9a5cb20570	Bump submodules from latest 1.15.1 patch release (#16578 ) * Update changelog with Consul patch releases 1.13.7, 1.14.5, 1.15.1 * Bump submodules from latest patch release * Forgot one	2 years ago
Dan Stough	82b5b4cc92	fix: revert go mod compat for sdk,api to 1.19 (#16323 )	2 years ago
Dan Stough	f1436109ea	[OSS] security: update go to 1.20.1 (#16263 ) * security: update go to 1.20.1	2 years ago
Curt Bushko	1d9ee50681	[OSS] connect: Bump Envoy 1.22.5 to 1.22.7, 1.23.2 to 1.23.4, 1.24.0 to 1.24.2, add 1.25.1, remove 1.21.5 (#16274 ) * Bump Envoy 1.22.5 to 1.22.7, 1.23.2 to 1.23.4, 1.24.0 to 1.24.2, add 1.25.1, remove 1.21.5	2 years ago
Nitya Dhanushkodi	78a4b5fd6f	update the api in envoyextensions and troubleshoot modules (#16226 )	2 years ago
Nathan Coleman	72a73661c9	Implement APIGateway proxycfg snapshot (#16194 ) * Stub proxycfg handler for API gateway * Add Service Kind constants/handling for API Gateway * Begin stubbing for SDS * Add new Secret type to xDS order of operations * Continue stubbing of SDS * Iterate on proxycfg handler for API gateway * Handle BoundAPIGateway config entry subscription in proxycfg-glue * Add API gateway to config snapshot validation * Add API gateway to config snapshot clone, leaf, etc. * Subscribe to bound route + cert config entries on bound-api-gateway * Track routes + certs on API gateway config snapshot * Generate DeepCopy() for types used in watch.Map * Watch all active references on api-gateway, unwatch inactive * Track loading of initial bound-api-gateway config entry * Use proper proto package for SDS mapping * Use ResourceReference instead of ServiceName, collect resources * Fix typo, add + remove TODOs * Watch discovery chains for TCPRoute * Add TODO for updating gateway services for api-gateway * make proto * Regenerate deep-copy for proxycfg * Set datacenter on upstream ID from query source * Watch discovery chains for http-route service backends * Add ServiceName getter to HTTP+TCP Service structs * Clean up unwatched discovery chains on API Gateway * Implement watch for ingress leaf certificate * Collect upstreams on http-route + tcp-route updates * Remove unused GatewayServices update handler * Remove unnecessary gateway services logic for API Gateway * Remove outdate TODO * Use .ToIngress where appropriate, including TODO for cleaning up * Cancel before returning error * Remove GatewayServices subscription * Add godoc for handlerAPIGateway functions * Update terminology from Connect => Consul Service Mesh Consistent with terminology changes in https://github.com/hashicorp/consul/pull/12690 * Add missing TODO * Remove duplicate switch case * Rerun deep-copy generator * Use correct property on config snapshot * Remove unnecessary leaf cert watch * Clean up based on code review feedback * Note handler properties that are initialized but set elsewhere * Add TODO for moving helper func into structs pkg * Update generated DeepCopy code * gofmt * Generate DeepCopy() for API gateway listener types * Improve variable name * Regenerate DeepCopy() code * Fix linting issue * Temporarily remove the secret type from resource generation	2 years ago
Nitya Dhanushkodi	b8b37c2357	refactor: remove troubleshoot module dependency on consul top level module (#16162 ) Ensure nothing in the troubleshoot go module depends on consul's top level module. This is so we can import troubleshoot into consul-k8s and not import all of consul. * turns troubleshoot into a go module [authored by @curtbushko] * gets the envoy protos into the troubleshoot module [authored by @curtbushko] * adds a new go module `envoyextensions` which has xdscommon and extensioncommon folders that both the xds package and the troubleshoot package can import * adds testing and linting for the new go modules * moves the unit tests in `troubleshoot/validateupstream` that depend on proxycfg/xds into the xds package, with a comment describing why those tests cannot be in the troubleshoot package * fixes all the imports everywhere as a result of these changes Co-authored-by: Curt Bushko <cbushko@gmail.com>	2 years ago

36 Commits (cc017ed7ffdefb752d0b3380cc9c4e348c76b46e)