111 Commits (cf1c030043e877de3b6f6714c7c13fb2dd11d6ab)

Author	SHA1	Message	Date
R.B. Boyer	ef6f2494c7	resource: allow for the ACLs.Read hook to request the entire data payload to perform the authz check (#18925) ... The ACLs.Read hook for a resource only allows for the identity of a resource to be passed in for use in authz consideration. For some resources we wish to allow for the current stored value to dictate how to enforce the ACLs (such as reading a list of applicable services from the payload and allowing service:read on any of them to control reading the enclosing resource). This change update the interface to usually accept a *pbresource.ID, but if the hook decides it needs more data it returns a sentinel error and the resource service knows to defer the authz check until after fetching the data from storage.	1 year ago
Matt Keeler	53fcc5d9a5	Add protoc generator to emit resource type variables (#18957) ... The annotations include a little more data than is strictly necessary because we will also have a protoc generator for openapi output.	1 year ago
R.B. Boyer	d574473fd1	mesh: make FailoverPolicy work in xdsv2 and ProxyStateTemplate (#18900) ... Ensure that configuring a FailoverPolicy for a service that is reachable via a xRoute or a direct upstream causes an envoy aggregate cluster to be created for the original cluster name, but with separate clusters for each one of the possible destinations.	1 year ago
R.B. Boyer	07d916e84f	resource: ensure resource.AuthorizerContext properly strips the local… (#18908) ... resource: ensure resource.AuthorizerContext properly strips the local peer name	1 year ago
Eric Haberkorn	170417ac97	Honor Default Traffic Permissions in V2 (#18886) ... wire up v2 default traffic permissions	1 year ago
Semir Patel	62796a1454	resource: mutate and validate before acls on write (#18868)	1 year ago
Dhia Ayachi	4435e4a420	add v2 tenancy bridge Flag and v2 Tenancy Bridge initial implementation (#18830) ... * add v2 tenancy bridge and a feature flag for v2 tenancy * move tenancy bridge v2 under resource package	1 year ago
skpratt	1fda2965e8	Allow empty data writes for resources (#18819) ... * allow nil data writes for resources * update demo to test valid type with no data	1 year ago
Semir Patel	d3dad14030	resource: default peername to "local" for now (#18822)	1 year ago
R.B. Boyer	66e1cdf40c	mesh: Wire ComputedRoutes into the ProxyStateTemplate via the sidecar controller (#18752) ... Reworks the sidecar controller to accept ComputedRoutes as an input and use it to generate appropriate ProxyStateTemplate resources containing L4/L7 mesh configuration.	1 year ago
R.B. Boyer	07f54fe3b8	resource: add helper to normalize inner Reference tenancy during mutate (#18765) ... When one resource contains an inner field that is of type *pbresource.Reference we want the Tenancy to be reasonably defaulted by the following rules: 1. The final values will be limited by the scope of the referenced type. 2. Values will be inferred from the parent's tenancy, and if that is insufficient then using the default tenancy for the type's scope. 3. Namespace will only be used from a parent if the reference and the parent share a partition, otherwise the default namespace will be used. Until we tackle peering, this hard codes an assumption of peer name being local. The logic for defaulting may need adjustment when that is addressed.	1 year ago
Nitya Dhanushkodi	78b170ad50	xds controller: setup watches for and compute leaf cert references in ProxyStateTemplate, and wire up leaf cert manager dependency (#18756) ... * Refactors the leafcert package to not have a dependency on agent/consul and agent/cache to avoid import cycles. This way the xds controller can just import the leafcert package to use the leafcert manager. The leaf cert logic in the controller: * Sets up watches for leaf certs that are referenced in the ProxyStateTemplate (which generates the leaf certs too). * Gets the leaf cert from the leaf cert cache * Stores the leaf cert in the ProxyState that's pushed to xds * For the cert watches, this PR also uses a bimapper + a thin wrapper to map leaf cert events to related ProxyStateTemplates Since bimapper uses a resource.Reference or resource.ID to map between two resource types, I've created an internal type for a leaf certificate to use for the resource.Reference, since it's not a v2 resource. The wrapper allows mapping events to resources (as opposed to mapping resources to resources) The controller tests: Unit: Ensure that we resolve leaf cert references Lifecycle: Ensure that when the CA is updated, the leaf cert is as well Also adds a new spiffe id type, and adds workload identity and workload identity URI to leaf certs. This is so certs are generated with the new workload identity based SPIFFE id. * Pulls out some leaf cert test helpers into a helpers file so it can be used in the xds controller tests. * Wires up leaf cert manager dependency * Support getting token from proxytracker * Add workload identity spiffe id type to the authorize and sign functions --------- Co-authored-by: John Murret <john.murret@hashicorp.com>	1 year ago
Poonam Jadhav	264166fcc0	fix: write endpoint errors out gracefully (#18743)	1 year ago
Iryna Shustava	3c70e14713	sidecar-proxy controller: L4 controller with explicit upstreams (NET-3988) (#18352) ... * This controller generates and saves ProxyStateTemplate for sidecar proxies. * It currently supports single-port L4 ports only. * It keeps a cache of all destinations to make it easier to compute and retrieve destinations. * It will update the status of the pbmesh.Upstreams resource if anything is invalid. * This commit also changes service endpoints to include workload identity. This made the implementation a bit easier as we don't need to look up as many workloads and instead rely on endpoints data.	1 year ago
wangxinyi7	df9d12a56a	Net 2714/xw cli read command (#18462) ... enable `consul resource read` command in cli	1 year ago
Semir Patel	b96cff7436	resource: Require scope for resource registration (#18635)	1 year ago
Semir Patel	067a0112e2	resource: Make resource listbyowner tenancy aware (#18566)	1 year ago
R.B. Boyer	17667a1c75	mesh: adding type aliases for mesh resource usage (#18448) ... Introduces some simple type aliases for DecodedResource[*X] wrappers for each type which cut down on the verbosity	1 year ago
Semir Patel	53e28a4963	OSS -> CE (community edition) changes (#18517)	1 year ago
Matt Keeler	547f4f8395	Reduce required type arguments for DecodedResource (#18540)	1 year ago
Iryna Shustava	0b580ffd22	bimapper: fix data race (#18519)	1 year ago
Iryna Shustava	cc596ce772	bimapper: allow to untrack links and support reference or id (#18451)	1 year ago
Semir Patel	217107f627	resource: Make resource list tenancy aware (#18475)	1 year ago
Poonam Jadhav	f88d4fe28f	Net-2707/list resource endpoint (#18444) ... feat: list resources endpoint	1 year ago
wangxinyi7	cda884ac81	read endpoint (#18268) ... implement http read endpoint to expose resource grpc service read method	1 year ago
Poonam Jadhav	559c61e6b6	Net-2712/resource hcl parsing (#18250) ... * Initial protohcl implementation Co-authored-by: Matt Keeler <mkeeler@users.noreply.github.com> Co-authored-by: Daniel Upton <daniel@floppy.co> * resourcehcl: implement resource decoding on top of protohcl Co-authored-by: Daniel Upton <daniel@floppy.co> * fix: resolve ci failures * test: add additional unmarshalling tests * refactor: update function test to clean protohcl package imports --------- Co-authored-by: Matt Keeler <mkeeler@users.noreply.github.com> Co-authored-by: Daniel Upton <daniel@floppy.co>	1 year ago
Poonam Jadhav	5717cbd466	Net-2708/delete resource endpoint (#18420) ... * feat: add http delete endpoint for resource service * refactor: clean up	1 year ago
hashicorp-copywrite[bot]	5fb9df1640	[COMPLIANCE] License changes (#18443) ... * Adding explicit MPL license for sub-package This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository. * Adding explicit MPL license for sub-package This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository. * Updating the license from MPL to Business Source License Going forward, this project will be licensed under the Business Source License v1.1. Please see our blog post for more details at <Blog URL>, FAQ at www.hashicorp.com/licensing-faq, and details of the license at www.hashicorp.com/bsl. * add missing license headers * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 --------- Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com>	1 year ago
Semir Patel	bee12c6b1f	resource: Make resource write tenancy aware (#18423)	1 year ago
R.B. Boyer	42efc11b4e	catalog: adding a controller to reconcile FailoverPolicy resources (#18399) ... Add most of the semantic cross-resource validation for FailoverPolicy resources using a new controller.	1 year ago
Matt Keeler	91d331bbaa	Add ServiceEndpoints Mutation hook tests (#18404) ... * Add ServiceEndpoints Mutation hook tests * Move endpoint owner validation into the validation hook Also there were some minor changes to error validation to account for go-cmp not liking to peer through an errors.errorstring type that get created by errors.New	1 year ago
Semir Patel	63cc037110	resource: Make resource read tenancy aware (#18397)	1 year ago
R.B. Boyer	1ebd001a07	bimapper: fix a bug and add some more test coverage (#18387)	1 year ago
wangxinyi7	1f28ac2664	expose grpc as http endpoint (#18221) ... expose resource grpc endpoints as http endpoints	1 year ago
R.B. Boyer	13ce787a3f	resource: adding various helpers for working with resources (#18342) ... This is a bit of a grab bag of helpers that I found useful for working with them when authoring substantial Controllers. Subsequent PRs will make use of them.	1 year ago
Semir Patel	efb45fe851	resource: Add scope to resource type registration [NET-4976] (#18214) ... Enables querying a resource type's registration to determine if a resource is cluster, partition, or partition and namespace scoped.	1 year ago
Semir Patel	ada767fc9f	resource: Pass resource to Write ACL hook instead of just resource Id [NET-4908] (#18192)	1 year ago
Semir Patel	003370ded0	Call resource mutate hook before validate hook (NET-4907) (#18178)	1 year ago
Dan Upton	b117eb0126	resource: enforce consistent naming of resource types (#17611) ... For consistency, resource type names must follow these rules: - `Group` must be snake case, and in most cases a single word. - `GroupVersion` must be lowercase, start with a "v" and end with a number. - `Kind` must be pascal case. These were chosen because they map to our protobuf type naming conventions.	1 year ago
Dan Upton	48445dfa55	resource: add `AuthorizerContext` helper method (#17393)	1 year ago
Matt Keeler	37636eab71	Catalog V2 Container Based Integration Test (#17674) ... * Implement the Catalog V2 controller integration container tests This now allows the container tests to import things from the root module. However for now we want to be very restrictive about which packages we allow importing. * Add an upgrade test for the new catalog Currently this should be dormant and not executed. However its put in place to detect breaking changes in the future and show an example of how to do an upgrade test with integration tests structured like catalog v2. * Make testutil.Retry capable of performing cleanup operations These cleanup operations are executed after each retry attempt. * Move TestContext to taking an interface instead of a concrete testing.T This allows this to be used on a retry.R or generally anything that meets the interface. * Move to using TestContext instead of background contexts Also this forces all test methods to implement the Cleanup method now instead of that being an optional interface. Co-authored-by: Daniel Upton <daniel@floppy.co>	1 year ago
Matt Keeler	653a886689	Implement a Catalog Controllers Lifecycle Integration Test (#17435) ... * Implement a Catalog Controllers Lifecycle Integration Test * Prevent triggering the race detector. This allows defining some variables for protobuf constants and using those in comparisons. Without that, something internal in the fmt package ended up looking at the protobuf message size cache and triggering the race detector.	1 year ago
Matt Keeler	a5ba889034	Implement the service endpoints controller (#17216) ... * Add a ReplaceType dep mapper and move them into their own file * Implement the service endpoints controller * Implement a Catalog Controllers Integration Test	2 years ago
Matt Keeler	d37572bd44	Add a Node health controller (#17214) ... This will aggregate all HealthStatus objects owned by the Node and update the status of the Node with an overall health.	2 years ago
Matt Keeler	456156ebec	Add type validations for the catalog resources (#17211) ... Also adding some common resource validation error types to the internal/resource package.	2 years ago
Dan Upton	6c24a66f73	resource: optionally compare timestamps in `EqualStatus` (#17275)	2 years ago
Semir Patel	40eefaba18	Reaper controller for cascading deletes of owner resources (#17256)	2 years ago
Dan Upton	d53a1d4a27	resource: add helpers for more efficiently comparing IDs etc (#17224)	2 years ago
Dan Upton	6e1bc57469	Controller Runtime	2 years ago
Semir Patel	9fef1c7f17	Create tombstone on resource `Delete` (#17108)	2 years ago
Dan Upton	b9c485dcb8	Controller Supervision (#17016)	2 years ago
hashicorp-copywrite[bot]	9f81fc01e9	[COMPLIANCE] Add Copyright and License Headers (#16854) ... Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com> Co-authored-by: Ronald <roncodingenthusiast@users.noreply.github.com>	2 years ago
Semir Patel	2f7d591702	Tenancy wildcard validaton for `Write`, `Read`, and `Delete` endpoints (#17004)	2 years ago
Semir Patel	b8c9e133be	Add mutate hook to `Write` endpoint (#16958)	2 years ago
Semir Patel	3b83c7ee9a	Enforce ACLs on resource `Write` and `Delete` endpoints (#16956)	2 years ago
Dan Upton	d595e6ade9	resource: `WriteStatus` endpoint (#16886)	2 years ago
Semir Patel	317240fca7	Resource validation hook for `Write` endpoint (#16950)	2 years ago
Semir Patel	686f49346c	Check acls on resource `Read`, `List`, and `WatchList` (#16842)	2 years ago
Dan Upton	4fa2537b3b	Resource `Write` endpoint (#16786)	2 years ago
Ronald	b64674623e	Copyright headers for missing files/folders (#16708) ... * copyright headers for agent folder	2 years ago
Semir Patel	5a3fec6238	Basic resource type registry (#16622)	2 years ago