consul

Commit Graph

Author	SHA1	Message	Date
Tauhid Anjum	b37fe80eee	Net 6774 Make Sameness Groups Work With Traffic Permissions CE (#20316 ) * Make Sameness Groups Work With Traffic Permissions * Fix controller dependency	10 months ago
Matt Keeler	123bc95e1a	Add Common Controller Caching Infrastructure (#19767 ) * Add Common Controller Caching Infrastructure	12 months ago
Semir Patel	c1bbda8128	resource: block default namespace deletion + test refactorings (#19822 )	12 months ago
Ganesh S	c061168aca	Add tests for traffic permissions controller (#19672 )	1 year ago
skpratt	896d8f5ec5	temporarily disallow L7 traffic permissions (#19322 )	1 year ago
Matt Keeler	5698353652	Resource Hook Pre-Decode Utilities (#18548 ) Add some generic type hook wrappers to first decode the data There seems to be a pattern for Validation, Mutation and Write Authorization hooks where they first need to decode the Any data before doing the domain specific work. This PR introduces 3 new functions to generate wrappers around the other hooks to pre-decode the data into a DecodedResource and pass that in instead of the original pbresource.Resource. This PR also updates the various catalog data types to use the new hook generators.	1 year ago
Iryna Shustava	105ebfdd00	catalog, mesh: implement missing ACL hooks (#19143 ) This change adds ACL hooks to the remaining catalog and mesh resources, excluding any computed ones. Those will for now continue using the default operator:x permissions. It refactors a lot of the common testing functions so that they can be re-used between resources. There are also some types that we don't yet support (e.g. virtual IPs) that this change adds ACL hooks to for future-proofing.	1 year ago
Chris S. Kim	b43cde5d19	Add workload identity hooks (#19045 )	1 year ago
Eric Haberkorn	f2b7b4591a	Fix Traffic Permissions Default Deny (#19028 ) Whenver a traffic permission exists for a given workload identity, turn on default deny. Previously, this was only working at the port level.	1 year ago
skpratt	21ea527089	TrafficPermissions: add ACL hooks (#19023 ) * add ACL hooks * add hooks for CTPs	1 year ago
Eric Haberkorn	7ce6ebaeb3	Handle Traffic Permissions With Empty Sources Properly (#19024 ) Fix issues with empty sources * Validate that each permission on traffic permissions resources has at least one source. * Don't construct RBAC policies when there aren't any principals. This resulted in Envoy rejecting xDS updates with a validation error. ``` error= \| rpc error: code = Internal desc = Error adding/updating listener(s) public_listener: Proto constraint validation failed (RBACValidationError.Rules: embedded message failed validation \| caused by RBACValidationError.Policies[consul-intentions-layer4-1]: embedded message failed validation \| caused by PolicyValidationError.Principals: value must contain at least 1 item(s)): rules { ```	1 year ago
skpratt	202090e5d5	v2 explicit destination traffic permissions (#18823 ) * workload identity boilerplate * notes from discussion with Iryna * WIP traffic permissions controller poc * workload identity, traffic permissions validation, errors, types * traffic permissions mapper framing, traffic permissions controller updates. * more roughing out of the controller * cleanup * controller and mapper logic * tests * refactor mapper logic, add tests * clean up tenancy and integration test stubs * consolidate mapping * cleanup cache leak, revert bimapper changes * address review comments * test fix and rebase * use resource helper --------- Co-authored-by: John Landa <john.landa@hashicorp.com>	1 year ago
Iryna Shustava	e6b724d062	catalog,mesh,auth: Move resource types to the proto-public module (#18935 )	1 year ago
Eric Haberkorn	4d6ff29392	Traffic Permissions Validations (#18907 ) add TP validations and mutation and add CTP validations	1 year ago
Iryna Shustava	d88888ee8b	catalog,mesh,auth: Bump versions to v2beta1 (#18930 )	1 year ago
Eric Haberkorn	170417ac97	Honor Default Traffic Permissions in V2 (#18886 ) wire up v2 default traffic permissions	1 year ago
skpratt	e5808d85f7	register traffic permission and workload identity types (#18704 ) * add workload identity and traffic permission protos * register new types * add generated pb code * fix exports.go path * add proto newlines * fix type name Co-authored-by: Eric Haberkorn <erichaberkorn@gmail.com> * address review * fix protos and add tests * fix validation constraints * add tests --------- Co-authored-by: Eric Haberkorn <erichaberkorn@gmail.com>	1 year ago

17 Commits (cf917109c2cbec86bbb3d87c140615aa791d1fb8)