2241 Commits (d72f72dcd5534e466df31dddf712274cee919551)

Author	SHA1	Message	Date
Freddy	d72f72dcd5	Notify alias checks when aliased service is [de]registered (#8456)	4 years ago
Daniel Nephin	3d96c5b651	Merge pull request #8469 from hashicorp/dnephin/config-source ... config: make Source an interface to avoid the marshal/unmarshal cycle in auto-config	4 years ago
Hans Hasselberg	aacf0fd777	Merge pull request #8471 from hashicorp/local_only ... thread local-only through the layers	4 years ago
Freddy	875816d0d3	Internal endpoint to query intentions associated with a gateway (#8400)	4 years ago
Kyle Havlovitz	635952681e	Fix a state store comment about version	4 years ago
Kyle Havlovitz	c39a275666	fsm: Fix snapshot bug with restoring node/service/check indexes	4 years ago
Hans Hasselberg	aff02198d7	Refactor keyring ops: ... * changes some functions to return data instead of modifying pointer arguments * renames globalRPC() to keyringRPCs() to make its purpose more clear * restructures KeyringOperation() to make it more understandable	4 years ago
Hans Hasselberg	07261db64d	thread local-only through the layers ... $ consul keyring -list -local-only ==> Gathering installed encryption keys... dc1 (LAN): aUlAW4ST3+vwseI61so24CoORkyjZofcmHk+j7QPSYQ= [1/1]	4 years ago
Daniel Nephin	4297a8ba07	auto-config: Avoid the marshal/unmarshal cycle in auto-config ... Use a LiteralConfig and return a config.Config from translate.	4 years ago
Daniel Nephin	38980ebb4c	config: Make Source an interface ... This will allow us to accept config from auto-config without needing to go through a serialziation cycle.	4 years ago
Mike Morris	ff37af1129	changelog: Update for 1.8.2, 1.7.6, 1.7.5 and 1.6.7 (#8462) ... * update bindata_assetfs.go * Release v1.8.2 * Putting source back into Dev Mode * changelog: add entries for 1.7.6, 1.7.5 and 1.6.7 Co-authored-by: hashicorp-ci <hashicorp-ci@users.noreply.github.com>	4 years ago
Matt Keeler	67dec3b609	Require token replication to be enabled in secondary dcs when ACLs are enabled with AutoConfig (#8451) ... AutoConfig will generate local tokens for clients and the ability to use local tokens is gated off of token replication being enabled and being configured with a replication token. Therefore we already have a hard requirement on having token replication enabled, this commit just makes sure to surface that to the operator instead of having to discern what the issue is from RPC errors.	4 years ago
Hans Hasselberg	d316cd06c1	auto_config implies connect (#8433)	4 years ago
Hans Hasselberg	51a8e15cf8	Mark its own cluster as healthy when rebalancing. (#8406) ... This code started as an optimization to avoid doing an RPC Ping to itself. But in a single server cluster the rebalancing was led to believe that there were no healthy servers because foundHealthyServer was not set. Now this is being set properly. Fixes #8401 and #8403.	4 years ago
Daniel Nephin	ae382805bd	Merge pull request #8404 from hashicorp/dnephin/remove-log-output-field ... Use Logger consistently, instead of LogOutput	4 years ago
Daniel Nephin	3b82ad0955	Rename NewClient/NewServer ... Now that duplicate constructors have been removed we can use the shorter names for the single constructor.	4 years ago
Daniel Nephin	0420d91cdd	Remove LogOutput from Agent ... Now that it is no longer used, we can remove this unnecessary field. This is a pre-step in cleanup up RuntimeConfig->Consul.Config, which is a pre-step to adding a gRPCHandler component to Server for streaming. Removing this field also allows us to remove one of the return values from logging.Setup.	4 years ago
Daniel Nephin	5acf01ceeb	Remove LogOutput from Server	4 years ago
Daniel Nephin	0c5428eea8	Remove LogOutput from Client	4 years ago
Daniel Nephin	e8ee2cf2f7	Pass a logger to ConnPool and yamux, instead of an io.Writer ... Allowing us to remove the LogOutput field from config.	4 years ago
Daniel Nephin	ed8210fe4d	api: Use a Logger instead of an io.Writer in api.Watch ... So that we can pass around only a Logger, not a LogOutput	4 years ago
Daniel Nephin	1e17a0c3e1	config: Remove unused field	4 years ago
Daniel Nephin	ba3ace1219	Return nil value on error. ... The main bug was fixed in cb050b280c, but the return value of 'result' is still misleading. Change the return value to nil to make the code more clear.	4 years ago
R.B. Boyer	c599a2f5f4	xds: add support for envoy 1.15.0 and drop support for 1.11.x (#8424) ... Related changes: - hard-fail the xDS connection attempt if the envoy version is known to be too old to be supported - remove the RouterMatchSafeRegex proxy feature since all supported envoy versions have it - stop using --max-obj-name-len (due to: envoyproxy/envoy#11740)	4 years ago
Freddy	f1e8addbdf	Avoid panics during shutdown routine (#8412)	4 years ago
Matt Keeler	1a78cf9b4c	Ensure certificates retrieved through the cache get persisted with auto-config (#8409)	4 years ago
Matt Keeler	dbb461a5d3	Allow setting verify_incoming* when using auto_encrypt or auto_config (#8394) ... Ensure that enabling AutoConfig sets the tls configurator properly This also refactors the TLS configurator a bit so the naming doesn’t imply only AutoEncrypt as the source of the automatically setup TLS cert info.	4 years ago
Hans Hasselberg	054595b1f8	agent/cache test for cache throttling. (#8396)	4 years ago
Matt Keeler	34034b76f5	Agent Auto Config: Implement Certificate Generation (#8360) ... Most of the groundwork was laid in previous PRs between adding the cert-monitor package to extracting the logic of signing certificates out of the connect_ca_endpoint.go code and into a method on the server. This also refactors the auto-config package a bit to split things out into multiple files.	4 years ago
Matt Keeler	be01c4241d	Default Cache rate limiting options in New ... Also get rid of the TestCache helper which was where these defaults were happening previously.	4 years ago
Matt Keeler	83d09de230	Fix some broken code in master ... There were several PRs that while all passed CI independently, when they all got merged into the same branch caused compilation errors in test code. The main changes that caused issues where changing agent/cache.Cache.New to require a concrete options struct instead of a pointer. This broke the cert monitor tests and the catalog_list_services_test.go. Another change was made to unembed the http.Server from the agent.HTTPServer struct. That coupled with another change to add a test to ensure cache rate limiting coming from HTTP requests was working as expected caused compilation failures.	4 years ago
Pierre Souchay	505de6dc29	Added ratelimit to handle throtling cache (#8226) ... This implements a solution for #7863 It does: Add a new config cache.entry_fetch_rate to limit the number of calls/s for a given cache entry, default value = rate.Inf Add cache.entry_fetch_max_burst size of rate limit (default value = 2) The new configuration now supports the following syntax for instance to allow 1 query every 3s: command line HCL: -hcl 'cache = { entry_fetch_rate = 0.333}' in JSON { "cache": { "entry_fetch_rate": 0.333 } }	4 years ago
Matt Keeler	5c2c762106	Move connect root retrieval and cert signing logic out of the RPC endpoints (#8364) ... The code now lives on the Server type itself. This was done so that all of this could be shared with auto config certificate signing.	4 years ago
Matt Keeler	2ee9fe0a4d	Move generation of the CA Configuration from the agent code into a method on the RuntimeConfig (#8363) ... This allows this to be reused elsewhere.	4 years ago
Daniel Nephin	3d115a62fd	Merge pull request #8323 from hashicorp/dnephin/add-event-publisher-2 ... stream: close subscriptions on shutdown	4 years ago
Matt Keeler	2713c0e682	Refactor the agentpb package (#8362) ... First move the whole thing to the top-level proto package name. Secondly change some things around internally to have sub-packages.	4 years ago
Daniel Nephin	ed69feca6d	stream: close all subs when EventProcessor is shutdown.	4 years ago
Daniel Nephin	a99a4103bd	stream: fix overallocation in filter ... And add tests	4 years ago
Daniel Nephin	3570ce6566	Merge pull request #7948 from hashicorp/dnephin/buffer-test-logs ... testutil: NewLogBuffer - buffer logs until a test fails	4 years ago
Matt Keeler	3c09482864	Merge pull request #8311 from hashicorp/bugfix/auto-encrypt-token-update	4 years ago
Daniel Nephin	a33a7a6fe2	Merge pull request #8344 from hashicorp/dnephin/fix-flakes-in-stream ... stream: handle empty event in TestEventSnapshot	4 years ago
Daniel Nephin	51efba2c7d	testutil: NewLogBuffer - buffer logs until a test fails ... Replaces #7559 Running tests in parallel, with background goroutines, results in test output not being associated with the correct test. `go test` does not make any guarantees about output from goroutines being attributed to the correct test case. Attaching log output from background goroutines also cause data races. If the goroutine outlives the test, it will race with the test being marked done. Previously this was noticed as a panic when logging, but with the race detector enabled it is shown as a data race. The previous solution did not address the problem of correct test attribution because test output could still be hidden when it was associated with a test that did not fail. You would have to look at all of the log output to find the relevant lines. It also made debugging test failures more difficult because each log line was very long. This commit attempts a new approach. Instead of printing all the logs, only print when a test fails. This should work well when there are a small number of failures, but may not work well when there are many test failures at the same time. In those cases the failures are unlikely a result of a specific test, and the log output is likely less useful. All of the logs are printed from the test goroutine, so they should be associated with the correct test. Also removes some test helpers that were not used, or only had a single caller. Packages which expose many functions with similar names can be difficult to use correctly. Related: https://github.com/golang/go/issues/38458 (may be fixed in go1.15) https://github.com/golang/go/issues/38382#issuecomment-612940030	4 years ago
Matt Keeler	12acdd7481	Disable background cache refresh for Connect Leaf Certs ... The rationale behind removing them is that all of our own code (xDS, builtin connect proxy) use the cache notification mechanism. This ensures that the blocking fetch behind the scenes is always executing. Therefore the only way you might go to get a certificate and have to wait is when 1) the request has never been made for that cert before or 2) you are using the v1/agent/connect/ca/leaf API for retrieving the cert yourself. In the first case, the refresh change doesn’t alter the behavior. In the second case, it can be mitigated by using blocking queries with that API which just like normal cache notification mechanism will cause the blocking fetch to be initiated and to get leaf certs as soon as needed. If you are not using blocking queries, or Envoy/xDS, or the builtin connect proxy but are retrieving the certs yourself then the HTTP endpoint might take a little longer to respond. This also renames the RefreshTimeout field on the register options to QueryTimeout to more accurately reflect that it is used for any type that supports blocking queries.	4 years ago
Matt Keeler	9da8c51ac5	Fix issue with changing the agent token causing failure to renew the auto-encrypt certificate ... The fallback method would still work but it would get into a state where it would let the certificate expire for 10s before getting a new one. And the new one used the less secure RPC endpoint. This is also a pretty large refactoring of the auto encrypt code. I was going to write some tests around the certificate monitoring but it was going to be impossible to get a TestAgent configured in such a way that I could write a test that ran in less than an hour or two to exercise the functionality. Moving the certificate monitoring into its own package will allow for dependency injection and in particular mocking the cache types to control how it hands back certificates and how long those certificates should live. This will allow for exercising the main loop more than would be possible with it coupled so tightly with the Agent.	4 years ago
Daniel Nephin	1910e2a246	checks: wait for goroutine to complete ... CheckAlias already had a waitGroup, but the Add() call was happening too late, which was causing a race in tests. The add must happen before the goroutine is started. CheckHTTP did not have a waitGroup, so I added it to match CheckAlias. It looks like a lot of the implementation could be shared, and may not need all of channel, waitgroup and bool, but I will leave that refactor for another time.	4 years ago
Daniel Nephin	9482961b1c	stream: handle empty event in TestEventSnapshot ... When the race detector is enabled we see this test fail occasionally. The reordering of execution seems to make it possible for the snapshot splice to happen before any events are published to the topicBuffers. We can handle this case in the test the same way it is handled by a subscription, by proceeding to the next event.	4 years ago
Daniel Nephin	57e00b0fd5	Merge pull request #8245 from hashicorp/dnephin/use-not-modified-in-cache ... agent/cache: Use AllowNotModified in CatalogListServices	4 years ago
Daniel Nephin	29571465e1	Merge pull request #8290 from hashicorp/dnephin/watch-decode ... watch: fix script watches with single arg	4 years ago
Daniel Nephin	ecccb30690	state: update calls that are no longer state methods ... In a previous commit these methods were changed to functions, so remove the Store paramter.	4 years ago
Daniel Nephin	2008884241	state: un-method funcs that don't use their receiver ... This change was mostly automated with the following First generate a list of functions with: git grep -o 'Store) \([^(]\+\)(tx \*txn' ./agent/consul/state | awk '{print $2}' | grep -o '^[^(]\+' Then the list was curated a bit with trial/error to remove and add funcs as necessary. Finally the replacement was done with: dir=agent/consul/state file=${1-funcnames} while read fn; do echo "$fn" sed -i -e "s/(s \*Store) $fn(/$fn(/" $dir/*.go sed -i -e "s/s\.$fn(/$fn(/" $dir/*.go sed -i -e "s/s\.store\.$fn(/$fn(/" $dir/*.go done < $file	4 years ago