17481 Commits (ce3d49237d2da2d85bd8f6c4c31c0c227ca660bd)

 

All Branches   

Search

Author	SHA1	Message	Date
Nathan Coleman	ce3d49237d	Merge pull request #13333 from hashicorp/docs/capig-instances-config ... docs: Consul API Gateway scaling config	3 years ago
Mike Morris	e971ea2e69	Update website/content/docs/api-gateway/consul-api-gateway-install.mdx ... Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>	3 years ago
Mike Morris	a9137aba36	Update website/content/docs/api-gateway/consul-api-gateway-install.mdx ... Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>	3 years ago
Dhia Ayachi	5ec3274ae5	Egress gtw/connect destination intentions (#13341) ... * update gateway-services table with endpoints * fix failing test * remove unneeded config in test * rename "endpoint" to "destination" * more endpoint renaming to destination in tests * update isDestination based on service-defaults config entry creation * use a 3 state kind to be able to set the kind to unknown (when neither a service or a destination exist) * set unknown state to empty to avoid modifying alot of tests * fix logic to set the kind correctly on CRUD * fix failing tests * add missing tests and fix service delete * fix failing test * Apply suggestions from code review Co-authored-by: Dan Stough <dan.stough@hashicorp.com> * fix a bug with kind and add relevant test * fix compile error * fix failing tests * add kind to clone * fix failing tests * fix failing tests in catalog endpoint * fix service dump test * Apply suggestions from code review Co-authored-by: Dan Stough <dan.stough@hashicorp.com> * remove duplicate tests * first draft of destinations intention in connect proxy * remove ServiceDestinationList * fix failing tests * fix agent/consul failing tests * change to filter intentions in the state store instead of adding a field. * fix failing tests * fix comment * fix comments * store service kind destination and add relevant tests * changes based on review * filter on destinations when querying source match * Apply suggestions from code review Co-authored-by: alex <8968914+acpana@users.noreply.github.com> * fix style * Apply suggestions from code review Co-authored-by: Dan Stough <dan.stough@hashicorp.com> * rename destinationType to targetType. Co-authored-by: Dan Stough <dan.stough@hashicorp.com> Co-authored-by: alex <8968914+acpana@users.noreply.github.com> Co-authored-by: github-team-consul-core <github-team-consul-core@hashicorp.com>	3 years ago
Evan Culver	596432fe38	ci: Add package verifications to build workflow (#13294) ... Co-authored-by: cskh <hui.kang@hashicorp.com>	3 years ago
R.B. Boyer	321e236891	test: retry the compat tests as often as other tests (#13369) ... The upgrade compatibility tests need frequent retrying to pass because they are slightly flaky. To alleviate manual work borrow similar gotestsum logic from the main go tests CI job to rerun them automatically here.	3 years ago
R.B. Boyer	fbee9eda08	test: break dep on main consul module (#13373) ... The main consul module is not a great library and complicates some oss/ent module issues. This undoes #13371	3 years ago
R.B. Boyer	ab758b7b32	peering: allow mesh gateways to proxy L4 peered traffic (#13339) ... Mesh gateways will now enable tcp connections with SNI names including peering information so that those connections may be proxied. Note: this does not change the callers to use these mesh gateways.	3 years ago
Fulvio	d457d8b6ce	UDP check for service stanza #12221 (#12722) ... * UDP check for service stanza #12221 * add pass status on timeout condition * delete useless files * Update check_test.go improve comment in test * fix test * fix requested changes and update TestRuntimeConfig_Sanitize.golden * add freeport to TestCheckUDPCritical * improve comment for CheckUDP struct * fix requested changes * fix requested changes * fix requested changes * add UDP to proto * add UDP to proto and add a changelog * add requested test on agent_endpoint_test.go * add test for given endpoints * fix failing tests * add documentation for udp healthcheck * regenerate proto using buf * Update website/content/api-docs/agent/check.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * Update website/content/api-docs/agent/check.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * Update website/content/docs/discovery/checks.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * Update website/content/docs/ecs/configuration-reference.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * Update website/content/docs/ecs/configuration-reference.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * add debug echo * add debug circle-ci * add debug circle-ci bash * use echo instead of status_stage * remove debug and status from devtools script and use echo instead * Update website/content/api-docs/agent/check.mdx Co-authored-by: Jared Kirschner <85913323+jkirschner-hashicorp@users.noreply.github.com> * fix test * replace status_stage with status * replace functions with echo Co-authored-by: Dhia Ayachi <dhia@hashicorp.com> Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> Co-authored-by: Jared Kirschner <85913323+jkirschner-hashicorp@users.noreply.github.com>	3 years ago
R.B. Boyer	979b9312ca	test: use a go mod replace trick for the compat test dependency on the main repo (#13371)	3 years ago
Evan Culver	7e750968bc	Add latest changelog entries (#13363)	3 years ago
alex	bbbc50815a	peering: send leader addr (#13342) ... Signed-off-by: acpana <8968914+acpana@users.noreply.github.com>	3 years ago
Riddhi Shah	7a039b46a2	[OSS] consul connect envoy command changes for agentless (#13361) ... Changes the sourcing of the envoy bootstrap configuration to not use agent APIs and instead use the catalog(server) API. This is done by passing a node-name flag to the command, (which can only be used with proxy-id). Also fixes a bug where the golden envoy bootstrap config files used for tests did not use the expected destination service name in certain places for connect proxy kind.	3 years ago
modrake	a56293c8a3	add codeowners to protect release dirs (#13261) ... * add codeowners to protect release dirs	3 years ago
Dan Upton	b168424398	xds: remove HTTPCheckFetcher dependency (#13366) ... This is the OSS portion of enterprise PR 1994 Rather than directly interrogating the agent-local state for HTTP checks using the `HTTPCheckFetcher` interface, we now rely on the config snapshot containing the checks. This reduces the number of changes required to support server xDS sessions. It's not clear why the fetching approach was introduced in 931d167ebb.	3 years ago
R.B. Boyer	019aeaa57d	peering: update how cross-peer upstreams and represented in proxycfg and rendered in xds (#13362) ... This removes unnecessary, vestigal remnants of discovery chains.	3 years ago
cskh	74158a8aa2	Add isLeader metric to track if a server is a leader (#13304) ... CTIA-21: sdd is_leader metric to track if a server is a leader Co-authored-by: alex <8968914+acpana@users.noreply.github.com>	3 years ago
Freddy	32f125cc0f	Merge pull request #13340 from hashicorp/peering/public-listener	3 years ago
alex	dc72659296	chore: remove broken link from pr template (#13343)	3 years ago
Kyle Schochenmaier	ce44f6f604	update multicluster docs (#13334)	3 years ago
Chris S. Kim	73af9e9737	Fix KVSGet method to handle QueryOptions properly (#13344)	3 years ago
Freddy	a09c776645	Update public listener with SPIFFE Validator ... Envoy's SPIFFE certificate validation extension allows for us to validate against different root certificates depending on the trust domain of the dialing proxy. If there are any trust bundles from peers in the config snapshot then we use the SPIFFE validator as the validation context, rather than the usual TrustedCA. The injected validation config includes the local root certificates as well.	3 years ago
freddygv	647c57a416	Add agent cache-type for TrustBundleListByService ... There are a handful of changes in this commit: * When querying trust bundles for a service we need to be able to specify the namespace of the service. * The endpoint needs to track the index because the cache watches use it. * Extracted bulk of the endpoint's logic to a state store function so that index tracking could be tested more easily. * Removed check for service existence, deferring that sort of work to ACL authz * Added the cache type	3 years ago
freddygv	8b58fa8afe	Update assumptions around exported-service config ... Given that the exported-services config entry can use wildcards, the precedence for wildcards is handled as with intentions. The most exact match is the match that applies for any given service. We do not take the union of all that apply. Another update that was made was to reflect that only one exported-services config entry applies to any given service in a partition. This is a pre-existing constraint that gets enforced by the Normalize() method on that config entry type.	3 years ago
Freddy	74ca6406ea	Configure upstream TLS context with peer root certs (#13321) ... For mTLS to work between two proxies in peered clusters with different root CAs, proxies need to configure their outbound listener to use different root certificates for validation. Up until peering was introduced proxies would only ever use one set of root certificates to validate all mesh traffic, both inbound and outbound. Now an upstream proxy may have a leaf certificate signed by a CA that's different from the dialing proxy's. This PR makes changes to proxycfg and xds so that the upstream TLS validation uses different root certificates depending on which cluster is being dialed.	3 years ago
Freddy	143dc75e0d	[OSS] Pull split ns/partition var out of testing file (#13337) ... The api module previously had defaultPartition and defaultNamespace vars for when we need default/empty split usage between ent/oss respectively. This commit moves those two variables out of test code so that they can be used for the service exports config entry's `GetNamespace()` method. Previously `GetNamespace()` would return "default" in both OSS and enterprise, which can trip up automation that passes the result of this method as the namespace to write a config entry. The split vars are kept private to prevent external usage, and prefixed with `split` for more clarity about their behavior.	3 years ago
R.B. Boyer	1b69366a39	build: ensure tools match go toolchain version (#13338)	3 years ago
R.B. Boyer	8e530701ce	test: regenerate golden files (#13336) ... make envoy-regen go test ./agent/config -update	3 years ago
R.B. Boyer	06ae7aa891	build: add 'make help' to simply list available make targets (#13322)	3 years ago
Mike Morris	f2f011c4f0	docs(consul-api-gateway): fixup code snippets in gateway scaling section	3 years ago
Mike Morris	f40563aa2c	docs(consul-api-gateway): fixup CLI prompt to match convention	3 years ago
Mike Morris	f4b8aea322	docs(consul-api-gateway): add Gateway scaling section	3 years ago
R.B. Boyer	487700d9fc	ci: nomad main is now on go 1.18 (#13329) ... The nomad integration tests that use main need to be updated to reflect hashicorp/nomad#13036	3 years ago
Mike Morris	83accbf0e3	docs(consul-api-gateway): gateway instances -> instances per gateway	3 years ago
Mike Morris	eb4bc313ee	docs(consul-api-gateway): add GatewayClassConfig deployment.maxInstances and deployment.minInstances	3 years ago
Mike Morris	4dc699ef19	docs(consul-api-gateway): add GatewayClassConfig deployment.defaultInstances	3 years ago
Chris S. Kim	fcdd031911	Revert getPathSuffixUnescaped (#13256)	3 years ago
Dan Upton	adeabed126	proxycfg: replace direct agent cache usage with interfaces (#13320) ... This is the OSS portion of enterprise PRs 1904, 1905, 1906, 1907, 1949, and 1971. It replaces the proxycfg manager's direct dependency on the agent cache with interfaces that will be implemented differently when serving xDS sessions from a Consul server.	3 years ago
Chris S. Kim	67860bd248	Reimplement fs.FileInfo interface (#13315) ... Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>	3 years ago
Michele Degges	2689eaed37	[Fix typo] Backport-reminder (#13313)	3 years ago
Chris S. Kim	3178a3cb7a	Fix broken CI step (#13314)	3 years ago
Dhia Ayachi	1b779240ae	update gateway-services table with endpoints (#13217) ... * update gateway-services table with endpoints * fix failing test * remove unneeded config in test * rename "endpoint" to "destination" * more endpoint renaming to destination in tests * update isDestination based on service-defaults config entry creation * use a 3 state kind to be able to set the kind to unknown (when neither a service or a destination exist) * set unknown state to empty to avoid modifying alot of tests * fix logic to set the kind correctly on CRUD * fix failing tests * add missing tests and fix service delete * fix failing test * Apply suggestions from code review Co-authored-by: Dan Stough <dan.stough@hashicorp.com> * fix a bug with kind and add relevant test * fix compile error * fix failing tests * add kind to clone * fix failing tests * fix failing tests in catalog endpoint * fix service dump test * Apply suggestions from code review Co-authored-by: Dan Stough <dan.stough@hashicorp.com> * remove duplicate tests * rename consts and fix kind when no destination is defined in the service-defaults. * rename Kind to ServiceKind and change switch to use .(type) Co-authored-by: Dan Stough <dan.stough@hashicorp.com>	3 years ago
Chris S. Kim	f0a9b30174	Update repo to use go:embed (#10996) ... Replace bindata packages with stdlib go:embed. Modernize some uiserver code with newer interfaces introduced in go 1.16 (mainly working with fs.File instead of http.File. Remove steps that are no longer used from our build files. Add Github Action to detect differences in agent/uiserver/dist and verify that the files are correct (by compiling UI assets and comparing contents).	3 years ago
DanStough	ee079eb4e3	chore(ci): add no-op jobs for branch protection rules	3 years ago
Riddhi Shah	1a901953e2	[OSS] Fix merge central config tests (#13309) ... Setting the right enterprise meta to fix the merge central config tests. Re-added the tests that were failing on the OSS to ENT merge.	3 years ago
freddygv	364758ef2f	Use embedded SpiffeID for peered upstreams	3 years ago
freddygv	c8edec0ab6	Remove intermediate representation of SPIFFE IDs ... xDS only ever uses the string representation, so we can avoid passing around connect.SpiffeIDService objects around.	3 years ago
freddygv	870e7c72d7	Return SPIFFE ID for connect proxies in PeerMeta ... Proxies dialing exporting services need to know the SPIFFE ID of services dialed so that the upstream's SANs can be validated. This commit attaches the SPIFFE ID to all connect proxies exported over the peering stream so that they are available to importing clusters. The data in the SPIFFE ID cannot be re-constructed in peer clusters because the partition of exported services is overwritten on imports.	3 years ago
Freddy	9427700270	[OSS] Add grpc endpoint to fetch a specific trust bundle (#13292) ... Co-authored-by: R.B. Boyer <rb@hashicorp.com>	3 years ago
Chris S. Kim	8e24a56134	Refactor some functions for better enterprise use (#13280)	3 years ago