consul

Commit Graph

Author	SHA1	Message	Date
wangxinyi7	152c75349e	net 2731 ip config entry OSS version (#16642 ) * ip config entry * name changing * move to ent * ent version * renaming * change format * renaming * refactor * add default values	2 years ago
John Maguire	ff5887a99e	Update e2e tests for namespaces (#16627 ) * Refactored "NewGatewayService" to handle namespaces, fixed TestHTTPRouteFlattening test * Fixed existing http_route tests for namespacing * Squash aclEnterpriseMeta for ResourceRefs and HTTPServices, accept namespace for creating connect services and regular services * Use require instead of assert after creating namespaces in http_route_tests * Refactor NewConnectService and NewGatewayService functions to use cfg objects to reduce number of method args * Rename field on SidecarConfig in tests from `SidecarServiceName` to `Name` to avoid stutter	2 years ago
Eddie Rowe	48f0a2837b	Tune 404 checker to exclude false-positives and use intended file path (#16636 )	2 years ago
Paul Banks	e557fb4e8c	Add known issues to Raft WAL docs. (#16600 ) * Add known issues to Raft WAL docs. * Refactor update based on review feedback	2 years ago
Valeriia Ruban	ad25ba3068	feat: update typography to consume hds styles (#16577 )	2 years ago
Freddy	724b752ca7	Backport ENT-4704 (#16612 )	2 years ago
Semir Patel	5a3fec6238	Basic resource type registry (#16622 )	2 years ago
Derek Menteer	8f75d99299	Fix issue with trust bundle read ACL check. (#16630 ) This commit fixes an issue where trust bundles could not be read by services in a non-default namespace, unless they had excessive ACL permissions given to them. Prior to this change, `service:write` was required in the default namespace in order to read the trust bundle. Now, `service:write` to a service in any namespace is sufficient.	2 years ago
Bastien Dronneau	a915d0ca87	Docs discovery typo (#16628 ) * docs(discovery): typo * docs(discovery): EOF and trim lines --------- Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>	2 years ago
Ronald	9d21736e9f	Add UI copyright headers files (#16614 ) * Add copyright headers to UI files * Ensure copywrite file ignores external libs	2 years ago
Chris S. Kim	d5677e5680	Preserve CARoots when updating Vault CA configuration (#16592 ) If a CA config update did not cause a root change, the codepath would return early and skip some steps which preserve its intermediate certificates and signing key ID. This commit re-orders some code and prevents updates from generating new intermediate certificates.	2 years ago
Derek Menteer	f2902e6608	Add sameness-group configuration entry. (#16608 ) This commit adds a sameness-group config entry to the API and structs packages. It includes some validation logic and a new memdb index that tracks the default sameness-group for each partition. Sameness groups will simplify the effort of managing failovers / intentions / exports for peers and partitions. Note that this change purely to introduce the configuration entry and does not include the full functionality of sameness-groups.	2 years ago
Ronald	7cb2af17c6	Add copywrite setup file (#16602 )	2 years ago
Ashvitha	f95ffe0355	Allow HCP metrics collection for Envoy proxies Co-authored-by: Ashvitha Sridharan <ashvitha.sridharan@hashicorp.com> Co-authored-by: Freddy <freddygv@users.noreply.github.com> Add a new envoy flag: "envoy_hcp_metrics_bind_socket_dir", a directory where a unix socket will be created with the name `<namespace>_<proxy_id>.sock` to forward Envoy metrics. If set, this will configure: - In bootstrap configuration a local stats_sink and static cluster. These will forward metrics to a loopback listener sent over xDS. - A dynamic listener listening at the socket path that the previously defined static cluster is sending metrics to. - A dynamic cluster that will forward traffic received at this listener to the hcp-metrics-collector service. Reasons for having a static cluster pointing at a dynamic listener: - We want to secure the metrics stream using TLS, but the stats sink can only be defined in bootstrap config. With dynamic listeners/clusters we can use the proxy's leaf certificate issued by the Connect CA, which isn't available at bootstrap time. - We want to intelligently route to the HCP collector. Configuring its addreess at bootstrap time limits our flexibility routing-wise. More on this below. Reasons for defining the collector as an upstream in `proxycfg`: - The HCP collector will be deployed as a mesh service. - Certificate management is taken care of, as mentioned above. - Service discovery and routing logic is automatically taken care of, meaning that no code changes are required in the xds package. - Custom routing rules can be added for the collector using discovery chain config entries. Initially the collector is expected to be deployed to each admin partition, but in the future could be deployed centrally in the default partition. These config entries could even be managed by HCP itself.	2 years ago
natemollica-dev	726c97b2bd	Consul WAN Fed with Vault Secrets Backend document updates (#16597 ) * Consul WAN Fed with Vault Secrets Backend document updates * Corrected dc1-consul.yaml and dc2-consul.yaml file highlights * Update website/content/docs/k8s/deployment-configurations/vault/wan-federation.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * Update website/content/docs/k8s/deployment-configurations/vault/wan-federation.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> --------- Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>	2 years ago
Eddie Rowe	a01920b0c0	Create a weekly 404 checker for all Consul docs content (#16603 )	2 years ago
trujillo-adam	51902695de	fixes for unsupported partitions field in CRD metadata block (#16604 ) * fixes for unsupported partitions field in CRD metadata block * Apply suggestions from code review Co-authored-by: Luke Kysow <1034429+lkysow@users.noreply.github.com> --------- Co-authored-by: Luke Kysow <1034429+lkysow@users.noreply.github.com>	2 years ago
Eric Haberkorn	e298f506a5	Add Peer Locality to Discovery Chains (#16588 ) Add peer locality to discovery chains	2 years ago
Eric Haberkorn	57e2493415	allow setting locality on services and nodes (#16581 )	2 years ago
David Yu	40312ac072	JIRA pr check: Filter out OSS/ENT merges (#16593 ) * jira pr check filter out dependabot and oss/ent merges	2 years ago
John Maguire	fa93a0d4f7	Add namespace file with build tag for OSS gateway tests (#16590 ) * Add namespace file with build tag for OSS tests * Remove TODO comment	2 years ago
Tyler Wendlandt	e6aeb31a26	UI: Fix htmlsafe errors throughout the app (#16574 ) * Upgrade ember-intl * Add changelog * Add yarn lock	2 years ago
Semir Patel	176945aa86	GRPC stub for the ResourceService (#16528 )	2 years ago
Andrew Stucki	040647e0ba	auto-updated agent/uiserver/dist/ from commit `63204b518` (#16587 ) Co-authored-by: hc-github-team-consul-core <github-team-consul-core@hashicorp.com>	2 years ago
Michael Wilkerson	47db3d7ab9	added a backport-checker GitHub action (#16567 ) * added a backport-checker GitHub action * Update .github/workflows/backport-checker.yml	2 years ago
Bryce Kalow	e2c4a787a5	website: adds content-check command and README update (#16579 )	2 years ago
Semir Patel	9a5cb20570	Bump submodules from latest 1.15.1 patch release (#16578 ) * Update changelog with Consul patch releases 1.13.7, 1.14.5, 1.15.1 * Bump submodules from latest patch release * Forgot one	2 years ago
Semir Patel	e5c2818ccc	Update changelog with patch releases (#16576 )	2 years ago
Eric Haberkorn	89de91b263	fix bug that can lead to peering service deletes impacting the state of local services (#16570 )	2 years ago
Anita Akaeze	280bdd3ea0	NET-2954: Improve integration tests CI execution time (#16565 ) * NET-2954: Improve integration tests CI execution time * fix ci * remove comments and modify config file	2 years ago
Eddie Rowe	3d75ab8a41	Broken link fixes (#16566 )	2 years ago
Paul Glass	58016d1aa2	docs: Document config entry permissions (#16556 )	2 years ago
Eric Haberkorn	dbaf8bf49c	add agent locality and replicate it across peer streams (#16522 )	2 years ago
cskh	b649a5e8e4	upgrade test: use retry with ModifyIndex and remove ent test file (#16553 )	2 years ago
Tu Nguyen	a5b8256111	Update docs to reflect functionality (#16549 ) * Update docs to reflect functionality * make consistent with other client runtimes	2 years ago
John Eikenberry	f5641ffccc	support vault auth config for alicloud ca provider Add support for using existing vault auto-auth configurations as the provider configuration when using Vault's CA provider with AliCloud. AliCloud requires 2 extra fields to enable it to use STS (it's preferred auth setup). Our vault-plugin-auth-alicloud package contained a method to help generate them as they require you to make an http call to a faked endpoint proxy to get them (url and headers base64 encoded).	2 years ago
Ronald	f135b14bdd	Fix flakey tests related to ACL token updates (#16545 ) * Fix flakey tests related to ACL token updates * update all acl token update tests * extra create_token function to its own thing	2 years ago
Valeriia Ruban	63204b5183	feat: update notification to use hds toast component (#16519 )	2 years ago
Ashlee M Boyer	7ea2bd6731	Delete test-link-rewrites.yml (#16546 )	2 years ago
John Maguire	6166889d44	Update the consul-k8s cli docs for the new `proxy log` subcommand (#16458 ) * Update the consul-k8s cli docs for the new `proxy log` subcommand * Updated consul-k8s docs from PR feedback * Added proxy log command to release notes	2 years ago
cskh	94ecb9c5d5	upgrade test: discovery chain across partition (#16543 )	2 years ago
Anita Akaeze	9d8e00db24	Merge pull request #4573 from hashicorp/NET-2841 (#16544 ) * Merge pull request #4573 from hashicorp/NET-2841 NET-2841: PART 2 refactor upgrade tests to include version 1.15 * update upgrade versions	2 years ago
Chris S. Kim	8daddff08d	Follow-up fixes to consul connect envoy command (#16530 )	2 years ago
Ronald	bf501a337b	Improve ux around ACL token to help users avoid overwriting node/service identities (#16506 ) * Deprecate merge-node-identities and merge-service-identities flags * added tests for node identities changes * added changelog file and docs	2 years ago
Melisa Griffin	fc232326a0	NET-2904 Fixes API Gateway Route Service Weight Division Error	2 years ago
trujillo-adam	9e93a30f4d	fixes empty link in DNS usage page (#16534 )	2 years ago
Andrew Stucki	897e5ef2d3	Add some basic UI improvements for api-gateway services (#16508 ) * Add some basic ui improvements for api-gateway services * Add changelog entry * Use ternary for null check * Update gateway doc links * rename changelog entry for new PR * Fix test	2 years ago
Melisa Griffin	129eca8fdb	NET-2903 Normalize weight for http routes (#16512 ) * NET-2903 Normalize weight for http routes * Update website/content/docs/connect/gateways/api-gateway/configuration/http-route.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>	2 years ago
R.B. Boyer	9a485cdb49	proxycfg: ensure that an irrecoverable error in proxycfg closes the xds session and triggers a replacement proxycfg watcher (#16497 ) Receiving an "acl not found" error from an RPC in the agent cache and the streaming/event components will cause any request loops to cease under the assumption that they will never work again if the token was destroyed. This prevents log spam (#14144, #9738). Unfortunately due to things like: - authz requests going to stale servers that may not have witnessed the token creation yet - authz requests in a secondary datacenter happening before the tokens get replicated to that datacenter - authz requests from a primary TO a secondary datacenter happening before the tokens get replicated to that datacenter The caller will get an "acl not found" before the token exists, rather than just after. The machinery added above in the linked PRs will kick in and prevent the request loop from looping around again once the tokens actually exist. For `consul-dataplane` usages, where xDS is served by the Consul servers rather than the clients ultimately this is not a problem because in that scenario the `agent/proxycfg` machinery is on-demand and launched by a new xDS stream needing data for a specific service in the catalog. If the watching goroutines are terminated it ripples down and terminates the xDS stream, which CDP will eventually re-establish and restart everything. For Consul client usages, the `agent/proxycfg` machinery is ahead-of-time launched at service registration time (called "local" in some of the proxycfg machinery) so when the xDS stream comes in the data is already ready to go. If the watching goroutines terminate it should terminate the xDS stream, but there's no mechanism to re-spawn the watching goroutines. If the xDS stream reconnects it will see no `ConfigSnapshot` and will not get one again until the client agent is restarted, or the service is re-registered with something changed in it. This PR fixes a few things in the machinery: - there was an inadvertent deadlock in fetching snapshot from the proxycfg machinery by xDS, such that when the watching goroutine terminated the snapshots would never be fetched. This caused some of the xDS machinery to get indefinitely paused and not finish the teardown properly. - Every 30s we now attempt to re-insert all locally registered services into the proxycfg machinery. - When services are re-inserted into the proxycfg machinery we special case "dead" ones such that we unilaterally replace them rather that doing that conditionally.	2 years ago
John Eikenberry	8910002e8f	update connect/ca's vault AuthMethod conf section (#16346 ) Updated Params field to re-frame as supporting arguments specific to the supported vault-agent auth-auth methods with links to each methods "#configuration" section. Included a call out limits on parameters supported.	2 years ago

... 2 3 4 5 6 ...

19869 Commits (d07aac8d7e9548d74b3d1b848549310213c9f421) All Branches Search

19869 Commits (d07aac8d7e9548d74b3d1b848549310213c9f421)

All Branches