5342 Commits (da8700f2168266d68b6e5c36f786ac80387f3dce)

Author	SHA1	Message	Date
Ronald	802122640b	[NET-5329] use acl templated policy under the hood for node/service identities (#18813)	1 year ago
skpratt	e5808d85f7	register traffic permission and workload identity types (#18704) ... * add workload identity and traffic permission protos * register new types * add generated pb code * fix exports.go path * add proto newlines * fix type name Co-authored-by: Eric Haberkorn <erichaberkorn@gmail.com> * address review * fix protos and add tests * fix validation constraints * add tests --------- Co-authored-by: Eric Haberkorn <erichaberkorn@gmail.com>	1 year ago
Chris S. Kim	d667cc3809	Fix flaky test (#18805)	1 year ago
Chris S. Kim	6748fac43d	Clean up resources in test (#18799)	1 year ago
Derek Menteer	02259ef964	Fix snapshot creation issue. (#18783) ... The renaming of files from oss -> ce caused incorrect snapshots to be created due to ce writes now happening prior to ent writes. When this happens various entities will attempt to be restored from the snapshot prior to a partition existing and will cause a panic to occur.	1 year ago
Chris S. Kim	4dfca64ded	Vault CA provider clean up previous default issuers (#18773)	1 year ago
Eric Haberkorn	12be06f8e5	Add V2 TCP traffic permissions (#18771) ... Add support for TCP traffic permissions	1 year ago
Chris S. Kim	d090668c37	Add workload identity ACL rules (#18769)	1 year ago
Nitya Dhanushkodi	78b170ad50	xds controller: setup watches for and compute leaf cert references in ProxyStateTemplate, and wire up leaf cert manager dependency (#18756) ... * Refactors the leafcert package to not have a dependency on agent/consul and agent/cache to avoid import cycles. This way the xds controller can just import the leafcert package to use the leafcert manager. The leaf cert logic in the controller: * Sets up watches for leaf certs that are referenced in the ProxyStateTemplate (which generates the leaf certs too). * Gets the leaf cert from the leaf cert cache * Stores the leaf cert in the ProxyState that's pushed to xds * For the cert watches, this PR also uses a bimapper + a thin wrapper to map leaf cert events to related ProxyStateTemplates Since bimapper uses a resource.Reference or resource.ID to map between two resource types, I've created an internal type for a leaf certificate to use for the resource.Reference, since it's not a v2 resource. The wrapper allows mapping events to resources (as opposed to mapping resources to resources) The controller tests: Unit: Ensure that we resolve leaf cert references Lifecycle: Ensure that when the CA is updated, the leaf cert is as well Also adds a new spiffe id type, and adds workload identity and workload identity URI to leaf certs. This is so certs are generated with the new workload identity based SPIFFE id. * Pulls out some leaf cert test helpers into a helpers file so it can be used in the xds controller tests. * Wires up leaf cert manager dependency * Support getting token from proxytracker * Add workload identity spiffe id type to the authorize and sign functions --------- Co-authored-by: John Murret <john.murret@hashicorp.com>	1 year ago
Chris Thain	4724a4e169	Add Envoy golden test for OTEL access logging extension (#18760)	1 year ago
John Murret	62062fd4fd	NET-5132 - Configure multiport routing for connect proxies in TProxy mode (#18606) ... * mesh-controller: handle L4 protocols for a proxy without upstreams * sidecar-controller: Support explicit destinations for L4 protocols and single ports. * This controller generates and saves ProxyStateTemplate for sidecar proxies. * It currently supports single-port L4 ports only. * It keeps a cache of all destinations to make it easier to compute and retrieve destinations. * It will update the status of the pbmesh.Upstreams resource if anything is invalid. * endpoints-controller: add workload identity to the service endpoints resource * small fixes * review comments * Address PR comments * sidecar-proxy controller: Add support for transparent proxy This currently does not support inferring destinations from intentions. * PR review comments * mesh-controller: handle L4 protocols for a proxy without upstreams * sidecar-controller: Support explicit destinations for L4 protocols and single ports. * This controller generates and saves ProxyStateTemplate for sidecar proxies. * It currently supports single-port L4 ports only. * It keeps a cache of all destinations to make it easier to compute and retrieve destinations. * It will update the status of the pbmesh.Upstreams resource if anything is invalid. * endpoints-controller: add workload identity to the service endpoints resource * small fixes * review comments * Make sure endpoint refs route to mesh port instead of an app port * Address PR comments * fixing copyright * tidy imports * sidecar-proxy controller: Add support for transparent proxy This currently does not support inferring destinations from intentions. * tidy imports * add copyright headers * Prefix sidecar proxy test files with source and destination. * Update controller_test.go * NET-5132 - Configure multiport routing for connect proxies in TProxy mode * formatting golden files * reverting golden files and adding changes in manually. build implicit destinations still has some issues. * fixing files that were incorrectly repeating the outbound listener * PR comments * extract AlpnProtocol naming convention to getAlpnProtocolFromPortName(portName) * removing address level filtering. * adding license to resources_test.go --------- Co-authored-by: Iryna Shustava <iryna@hashicorp.com> Co-authored-by: R.B. Boyer <rb@hashicorp.com> Co-authored-by: github-team-consul-core <github-team-consul-core@hashicorp.com>	1 year ago
Ronald	9776c10efb	[NET-5333] Add api to read/list and preview templated policies (#18748)	1 year ago
Dhia Ayachi	b1688ad856	Run copyright after running deep-copy as part of the Makefile/CI (#18741) ... * execute copyright headers after performing deep-copy generation. * fix copyright install * Apply suggestions from code review Co-authored-by: Semir Patel <semir.patel@hashicorp.com> * Apply suggestions from code review Co-authored-by: Semir Patel <semir.patel@hashicorp.com> * rename steps to match codegen naming * remove copywrite install category --------- Co-authored-by: Semir Patel <semir.patel@hashicorp.com>	1 year ago
R.B. Boyer	a69e901660	xds: update golden tests to be deterministic (#18707)	1 year ago
Iryna Shustava	1557e1d6a3	sidecar-proxy controller: Add support for transparent proxy (NET-5069) (#18458) ... This commit adds support for transparent proxy to the sidecar proxy controller. As we do not yet support inferring destinations from intentions, this assumes that all services in the cluster are destinations.	1 year ago
Nathan Coleman	ed79c60e78	NET-5530 Generate deep-copy code (#18730) ... * Generate deep-copy code * Undo license header removal	1 year ago
Ronald	40d7ebc318	[NET-5330] Support templated policies in Binding rules (#18719) ... * [NET-5330] Support templated policies in Binding rules * changelog for templated policy support in binding rules	1 year ago
Semir Patel	576ffdf705	fix: emit consul version metric on a regular interval (#18724)	1 year ago
Nathan Coleman	e5d26a13cd	NET-5530 Support response header modifiers on http-route config entry (#18646) ... * Add response header filters to http-route config entry definitions * Map response header filters from config entry when constructing route destination * Support response header modifiers at the service level as well * Update protobuf definitions * Update existing unit tests * Add response filters to route consolidation logic * Make existing unit tests more robust * Add missing docstring * Add changelog entry * Add response filter modifiers to existing integration test * Add more robust testing for response header modifiers in the discovery chain * Add more robust testing for request header modifiers in the discovery chain * Modify test to verify that service filter modifiers take precedence over rule filter modifiers	1 year ago
Jeremy Jacobson	876c662e36	[CC-6039] Update builtin policy descriptions (#18705)	1 year ago
Iryna Shustava	bbc2763b9f	Instantiate secure resource service client after the grpc server (#18712)	1 year ago
Ronald	bbef879f85	[NET-5325] ACL templated policies support in tokens and roles (#18708) ... * [NET-5325] ACL templated policies support in tokens and roles - Add API support for creating tokens/roles with templated-policies - Add CLI support for creating tokens/roles with templated-policies * adding changelog	1 year ago
Gerard Nguyen	56d6e54ac7	fix: NET-1521 show latest config in /v1/agent/self (#18681) ... * fix: NET-1521 show latest config in /v1/agent/self	1 year ago
John Maguire	2c244b6f42	[APIGW] NET-5017 JWT Cleanup/Status Conditions (#18700) ... * Fixes issues in setting status * Update golden files for changes to xds generation to not use deprecated methods * Fixed default for validation of JWT for route	1 year ago
Iryna Shustava	3c70e14713	sidecar-proxy controller: L4 controller with explicit upstreams (NET-3988) (#18352) ... * This controller generates and saves ProxyStateTemplate for sidecar proxies. * It currently supports single-port L4 ports only. * It keeps a cache of all destinations to make it easier to compute and retrieve destinations. * It will update the status of the pbmesh.Upstreams resource if anything is invalid. * This commit also changes service endpoints to include workload identity. This made the implementation a bit easier as we don't need to look up as many workloads and instead rely on endpoints data.	1 year ago
Iryna Shustava	4eb2197e82	dataplane: Allow getting bootstrap parameters when using V2 APIs (#18504) ... This PR enables the GetEnvoyBootstrapParams endpoint to construct envoy bootstrap parameters from v2 catalog and mesh resources. * Make bootstrap request and response parameters less specific to services so that we can re-use them for workloads or service instances. * Remove ServiceKind from bootstrap params response. This value was unused previously and is not needed for V2. * Make access logs generation generic so that we can generate them using v1 or v2 resources.	1 year ago
Derek Menteer	56917eb4c9	Add support for querying tokens by service name. (#18667) ... Add support for querying tokens by service name The consul-k8s endpoints controller has a workflow where it fetches all tokens. This is not performant for large clusters, where there may be a sizable number of tokens. This commit attempts to alleviate that problem and introduces a new way to query by the token's service name.	1 year ago
Phil Porada	7ea986783d	Add TCP+TLS Healthchecks (#18381) ... * Begin adding TCPUseTLS * More TCP with TLS plumbing * Making forward progress * Keep on adding TCP+TLS support for healthchecks * Removed too many lines * Unit tests for TCP+TLS * Update tlsutil/config.go Co-authored-by: Samantha <hello@entropy.cat> * Working on the tcp+tls unit test * Updated the runtime integration tests * Progress * Revert this file back to HEAD * Remove debugging lines * Implement TLS enabled TCP socket server and make a successful TCP+TLS healthcheck on it * Update docs * Update agent/agent_test.go Co-authored-by: Samantha <hello@entropy.cat> * Update website/content/docs/ecs/configuration-reference.mdx Co-authored-by: Samantha <hello@entropy.cat> * Update website/content/docs/ecs/configuration-reference.mdx Co-authored-by: Samantha <hello@entropy.cat> * Update agent/checks/check.go Co-authored-by: Samantha <hello@entropy.cat> * Address comments * Remove extraneous bracket * Update agent/agent_test.go Co-authored-by: Samantha <hello@entropy.cat> * Update agent/agent_test.go Co-authored-by: Samantha <hello@entropy.cat> * Update website/content/docs/ecs/configuration-reference.mdx Co-authored-by: Samantha <hello@entropy.cat> * Update the mockTLSServer * Remove trailing newline * Address comments * Fix merge problem * Add changelog entry --------- Co-authored-by: Samantha <hello@entropy.cat>	1 year ago
Derek Menteer	a698142325	Add extra logging for mesh health endpoints. (#18647)	1 year ago
Derek Menteer	b56fbc7a62	[NET-4958] Fix issue where envoy endpoints would fail to populate after snapshot restore (#18636) ... Fix issue where agentless endpoints would fail to populate after snapshot restore. Fixes an issue that was introduced in #17775. This issue happens because a long-lived pointer to the state store is held, which is unsafe to do. Snapshot restorations will swap out this state store, meaning that the proxycfg watches would break for agentless.	1 year ago
Semir Patel	b96cff7436	resource: Require scope for resource registration (#18635)	1 year ago
John Maguire	9876923e23	Add the plumbing for APIGW JWT work (#18609) ... * Add the plumbing for APIGW JWT work * Remove unneeded import * Add deep equal function for HTTPMatch * Added plumbing for status conditions * Remove unneeded comment * Fix comments * Add calls in xds listener for apigateway to setup listener jwt auth	1 year ago
Semir Patel	7b9e243297	resource: Allow nil tenancy (#18618)	1 year ago
Dhia Ayachi	f8d77f027a	delete all v2 resources type when deleting a namespace (CE) (#18621) ... * add namespace scope to ServiceV1Alpha1Type * add CE portion of namespace deletion	1 year ago
Ashvitha	0f48b7af5e	[HCP Telemetry] Move first TelemetryConfig Fetch into the TelemetryConfigProvider (#18318) ... * Add Enabler interface to turn sink on/off * Use h for hcpProviderImpl vars, fix PR feeback and fix errors * Keep nil check in exporter and fix tests * Clarify comment and fix function name * Use disable instead of enable * Fix errors nit in otlp_transform * Add test for refreshInterval of updateConfig * Add disabled field in MetricsConfig struct * Fix PR feedback: improve comment and remove double colons * Fix deps test which requires a maybe * Update hcp-sdk-go to v0.61.0 * use disabled flag in telemetry_config.go * Handle 4XX errors in telemetry_provider * Fix deps test * Check 4XX instead * Run make go-mod-tidy	1 year ago
Hardik Shingala	58e5658810	Added OpenTelemetry Access Logging Envoy extension (#18336)	1 year ago
Ashwin Venkatesh	797e42dc24	Watch the ProxyTracker from xDS controller (#18611)	1 year ago
John Murret	0e606504bc	NET-4944 - wire up controllers with proxy tracker (#18603) ... Co-authored-by: github-team-consul-core <github-team-consul-core@hashicorp.com>	1 year ago
Joshua Timmons	48c8a834f5	Reduce the frequency of metric exports to minutely (#18584)	1 year ago
Chris S. Kim	ecdcde4309	CE commit (#18583)	1 year ago
John Murret	051f250edb	NET-5338 - NET-5338 - Run a v2 mode xds server (#18579) ... * NET-5338 - NET-5338 - Run a v2 mode xds server * fix linting	1 year ago
Semir Patel	2225bf0550	resource: Make resource writestatus tenancy aware (#18577)	1 year ago
John Maguire	59ab57f350	NET-5147: Added placeholder structs for JWT functionality (#18575) ... * Added placeholder structs for JWT functionality * Added watches for CE vs ENT * Add license header * Undo plumbing work * Add context arg	1 year ago
Semir Patel	067a0112e2	resource: Make resource listbyowner tenancy aware (#18566)	1 year ago
Chris S. Kim	82993fcc4f	CE port of enterprise extension (#18572) ... CE commit	1 year ago
cskh	b37587bb2c	bug: prevent go routine leakage due to existing DeferCheck (#18558) ... * bug: prevent go routine leakage due to existing DeferCheck * add changelog	1 year ago
R.B. Boyer	8a931241f2	chore: fix missing/incorrect license headers (#18555)	1 year ago
Ashwin Venkatesh	4f9955d91e	Update trust bundle into proxy-state-template (#18550)	1 year ago
Semir Patel	53e28a4963	OSS -> CE (community edition) changes (#18517)	1 year ago
Semir Patel	6d22179625	resource: Make resource watchlist tenancy aware (#18539)	1 year ago
John Murret	217d305b38	NET-4943 - Implement ProxyTracker (#18535)	1 year ago
John Murret	9ea182f6ad	NET-4858 - xds v2 - implement base connect proxy functionality for routes (#18501) ... * NET-4853 - xds v2 - implement base connect proxy functionality for clusters * NET-4853 - xds v2 - implement base connect proxy functionality for clusters * NET-4932 - xds v2 - implement base connect proxy functionality for endpoints * Update endpoints_test.go * gofmt * NET-4858 - Make connect proxy route tests pass using xds v2 * Update endpoints_test.go * Update naming.go * use alsoRunTestForV2 * remove unused makeAddress * gofmt * fixing clusters	1 year ago
John Murret	92cfb4a07e	NET-4932 - xds v2 - implement base connect proxy functionality for endpoints (#18500) ... * NET-4853 - xds v2 - implement base connect proxy functionality for clusters * NET-4853 - xds v2 - implement base connect proxy functionality for clusters * NET-4932 - xds v2 - implement base connect proxy functionality for endpoints * Update endpoints_test.go * gofmt * Update naming.go	1 year ago
John Murret	b80c5258fa	NET-4853 - xds v2 - implement base connect proxy functionality for clusters (#18499)	1 year ago
Semir Patel	e6c1c479b7	resource: Make resource delete tenancy aware (#18476) ... resource: Make resource delete tenancy awarae	1 year ago
Semir Patel	217107f627	resource: Make resource list tenancy aware (#18475)	1 year ago
Nitya Dhanushkodi	6b7ccd06cf	[NET-4799] [OSS] xdsv2: listeners L4 support for connect proxies (#18436) ... * refactor to avoid future import cycles	1 year ago
hashicorp-copywrite[bot]	5fb9df1640	[COMPLIANCE] License changes (#18443) ... * Adding explicit MPL license for sub-package This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository. * Adding explicit MPL license for sub-package This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository. * Updating the license from MPL to Business Source License Going forward, this project will be licensed under the Business Source License v1.1. Please see our blog post for more details at <Blog URL>, FAQ at www.hashicorp.com/licensing-faq, and details of the license at www.hashicorp.com/bsl. * add missing license headers * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 --------- Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com>	1 year ago
John Maguire	df11e4e7b4	APIGW: Update HTTPRouteConfigEntry for JWT Auth (#18422) ... * Updated httproute config entry for JWT Filters * Added manual deepcopy method for httproute jwt filter * Fix test * Update JWTFilter to be in oss file * Add changelog * Add build tags for deepcopy oss file	1 year ago
John Maguire	6c8ca0f89d	NET-4984: Update APIGW Config Entries for JWT Auth (#18366) ... * Added oss config entries for Policy and JWT on APIGW * Updated structs for config entry * Updated comments, ran deep-copy * Move JWT configuration into OSS file * Add in the config entry OSS file for jwts * Added changelog * fixing proto spacing * Moved to using manually written deep copy method * Use pointers for override/default fields in apigw config entries * Run gen scripts for changed types	1 year ago
Michael Zalimeni	05604eeec1	[NET-5217] [OSS] Derive sidecar proxy locality from parent service (#18437) ... * Add logging to locality policy application In OSS, this is currently a no-op. * Inherit locality when registering sidecars When sidecar locality is not explicitly configured, inherit locality from the proxied service.	1 year ago
Semir Patel	bee12c6b1f	resource: Make resource write tenancy aware (#18423)	1 year ago
wangxinyi7	facd5b0ec1	fix the error in ent repo (#18421) ... fix the error in ent repo	1 year ago
sarahalsmiller	e235c8be3c	NET-5115 Add retry + timeout filters for api-gateway (#18324) ... * squash, implement retry/timeout in consul core * update tests	1 year ago
cskh	43d8898e08	bump testcontainers-go from 0.22.0 and remove pinned go version in in… (#18395) ... * bump testcontainers-go from 0.22.0 and remove pinned go version in integ test * go mod tidy * Replace deprecated target.Authority with target.URL.Host	1 year ago
Semir Patel	63cc037110	resource: Make resource read tenancy aware (#18397)	1 year ago
Ashesh Vidyut	417ae9fc39	Fix #17730 - Dev mode has new line (#18367) ... * adding new line only in case of pretty in url not in dev mode * change log added	1 year ago
wangxinyi7	1f28ac2664	expose grpc as http endpoint (#18221) ... expose resource grpc endpoints as http endpoints	1 year ago
Jeremy Jacobson	8e5e16de60	Fix policy lookup to allow for slashes (#18347) ... * Fix policy lookup to allow for slashes * Fix suggestions * Fix other test * Revert some lines	1 year ago
Dan Stough	284e3bdb54	[OSS] test: xds coverage for routes (#18369) ... test: xds coverage for routes	1 year ago
Ashvitha	828567c62e	[HCP Telemetry] Periodic Refresh for Dynamic Telemetry Configuration (#18168) ... * OTElExporter now uses an EndpointProvider to discover the endpoint * OTELSink uses a ConfigProvider to obtain filters and labels configuration * improve tests for otel_sink * Regex logic is moved into client for a method on the TelemetryConfig object * Create a telemetry_config_provider and update deps to use it * Fix conversion * fix import newline * Add logger to hcp client and move telemetry_config out of the client.go file * Add a telemetry_config.go to refactor client.go * Update deps * update hcp deps test * Modify telemetry_config_providers * Check for nil filters * PR review updates * Fix comments and move around pieces * Fix comments * Remove context from client struct * Moved ctx out of sink struct and fixed filters, added a test * Remove named imports, use errors.New if not fformatting * Remove HCP dependencies in telemetry package * Add success metric and move lock only to grab the t.cfgHahs * Update hash * fix nits * Create an equals method and add tests * Improve telemetry_config_provider.go tests * Add race test * Add missing godoc * Remove mock for MetricsClient * Avoid goroutine test panics * trying to kick CI lint issues by upgrading mod * imprve test code and add hasher for testing * Use structure logging for filters, fix error constants, and default to allow all regex * removed hashin and modify logic to simplify * Improve race test and fix PR feedback by removing hash equals and avoid testing the timer.Ticker logic, and instead unit test * Ran make go-mod-tidy * Use errtypes in the test * Add changelog * add safety check for exporter endpoint * remove require.Contains by using error types, fix structure logging, and fix success metric typo in exporter * Fixed race test to have changing config values * Send success metric before modifying config * Avoid the defer and move the success metric under	1 year ago
Jeremy Jacobson	6424ef6a56	[CC-5719] Add support for builtin global-read-only policy (#18319) ... * [CC-5719] Add support for builtin global-read-only policy * Add changelog * Add read-only to docs * Fix some minor issues. * Change from ReplaceAll to Sprintf * Change IsValidPolicy name to return an error instead of bool * Fix PolicyList test * Fix other tests * Apply suggestions from code review Co-authored-by: Paul Glass <pglass@hashicorp.com> * Fix state store test for policy list. * Fix naming issues * Update acl/validation.go Co-authored-by: Chris Thain <32781396+cthain@users.noreply.github.com> * Update agent/consul/acl_endpoint.go --------- Co-authored-by: Paul Glass <pglass@hashicorp.com> Co-authored-by: Chris Thain <32781396+cthain@users.noreply.github.com>	1 year ago
Michael Zalimeni	b1b05f0bac	[NET-4703] Prevent partial application of Envoy extensions (#18068) ... Prevent partial application of Envoy extensions Ensure that non-required extensions do not change xDS resources before exiting on failure by cloning proto messages prior to applying each extension. To support this change, also move `CanApply` checks up a layer and make them prior to attempting extension application, s.t. we avoid unnecessary copies where extensions can't be applied. Last, ensure that we do not allow panics from `CanApply` or `Extend` checks to escape the attempted extension application.	1 year ago
cui fliter	18a5edd232	docs: Fix some comments (#17118) ... Signed-off-by: cui fliter <imcusg@gmail.com>	1 year ago
Ronald	356b29bf35	Stop JWT provider from being written in non default namespace (#18325)	1 year ago
Florian Apolloner	6ada2e05ff	Fix topology view when displaying mixed connect-native/normal services. (#13023) ... * Fix topoloy intention with mixed connect-native/normal services. If a service is registered twice, once with connect-native and once without, the topology views would prune the existing intentions. This change brings the code more in line with the transparent proxy behavior. * Dedupe nodes in the ServiceTopology ui endpoint (like done with tags). * Consider a service connect-native as soon as one instance is.	1 year ago
Nathan Coleman	5caa0ae3f5	api-gateway: subscribe to bound-api-gateway only after receiving api-gateway (#18291) ... * api-gateway: subscribe to bound-api-gateway only after receiving api-gateway This fixes a race condition due to our dependency on having the listener(s) from the api-gateway config entry in order to fully and properly process the resources on the bound-api-gateway config entry. * Apply suggestions from code review * Add changelog entry	1 year ago
cskh	31d2813714	member cli: add -filter expression to flags (#18223) ... * member cli: add -filter expression to flags * changelog * update doc * Add test cases * use quote	1 year ago
Dan Stough	8e3a1ddeb6	[OSS] Improve xDS Code Coverage - Endpoints and Misc (#18222) ... test: improve xDS endpoints code coverage	1 year ago
Jeremy Jacobson	6671d7ebd7	[CC-5718] Remove HCP token requirement during bootstrap (#18140) ... * [CC-5718] Remove HCP token requirement during bootstrap * Re-add error for loading HCP management token * Remove old comment * Add changelog entry * Remove extra validation line * Apply suggestions from code review Co-authored-by: lornasong <lornasong@users.noreply.github.com> --------- Co-authored-by: lornasong <lornasong@users.noreply.github.com>	1 year ago
Dan Stough	2793761702	[OSS] Improve xDS Code Coverage - Clusters (#18165) ... test: improve xDS cluster code coverage	1 year ago
cskh	5cd287660a	docs: fix the description of client rpc (#18206)	1 year ago
Blake Covarrubias	2c5a09bb0a	Explicitly enable WebSocket upgrades (#18150) ... This PR explicitly enables WebSocket upgrades in Envoy's UpgradeConfig for all proxy types. (API Gateway, Ingress, and Sidecar.) Fixes #8283	1 year ago
Semir Patel	ada767fc9f	resource: Pass resource to Write ACL hook instead of just resource Id [NET-4908] (#18192)	1 year ago
Ronald	18bc04165c	Improve XDS test coverage: JWT auth edition (#18183) ... * Improve XDS test coverage: JWT auth edition more tests * test: xds coverage for jwt listeners --------- Co-authored-by: DanStough <dan.stough@hashicorp.com>	1 year ago
Semir Patel	003370ded0	Call resource mutate hook before validate hook (NET-4907) (#18178)	1 year ago
Dan Stough	33d898b857	[OSS] test: improve xDS listener code coverage (#18138) ... test: improve xDS listener code coverage	1 year ago
Ronald	bcc6a9d752	Use JWT-auth filter in metadata mode & Delegate validation to RBAC filter (#18062) ... ### Description <!-- Please describe why you're making this change, in plain English. --> - Currently the jwt-auth filter doesn't take into account the service identity when validating jwt-auth, it only takes into account the path and jwt provider during validation. This causes issues when multiple source intentions restrict access to an endpoint with different JWT providers. - To fix these issues, rather than use the JWT auth filter for validation, we use it in metadata mode and allow it to forward the successful validated JWT token payload to the RBAC filter which will make the decisions. This PR ensures requests with and without JWT tokens successfully go through the jwt-authn filter. The filter however only forwards the data for successful/valid tokens. On the RBAC filter level, we check the payload for claims and token issuer + existing rbac rules. ### Testing & Reproduction steps <!-- * In the case of bugs, describe how to replicate * If any manual tests were done, document the steps and the conditions to replicate * Call out any important/ relevant unit tests, e2e tests or integration tests you have added or are adding --> - This test covers a multi level jwt requirements (requirements at top level and permissions level). It also assumes you have envoy running, you have a redis and a sidecar proxy service registered, and have a way to generate jwks with jwt. I mostly use: https://www.scottbrady91.com/tools/jwt for this. - first write your proxy defaults ``` Kind = "proxy-defaults" name = "global" config { protocol = "http" } ``` - Create two providers ``` Kind = "jwt-provider" Name = "auth0" Issuer = "https://ronald.local" JSONWebKeySet = { Local = { JWKS = "eyJrZXlzIjog....." } } ``` ``` Kind = "jwt-provider" Name = "okta" Issuer = "https://ronald.local" JSONWebKeySet = { Local = { JWKS = "eyJrZXlzIjogW3...." } } ``` - add a service intention ``` Kind = "service-intentions" Name = "redis" JWT = { Providers = [ { Name = "okta" }, ] } Sources = [ { Name = "*" Permissions = [{ Action = "allow" HTTP = { PathPrefix = "/workspace" } JWT = { Providers = [ { Name = "okta" VerifyClaims = [ { Path = ["aud"] Value = "my_client_app" }, { Path = ["sub"] Value = "5be86359073c434bad2da3932222dabe" } ] }, ] } }, { Action = "allow" HTTP = { PathPrefix = "/" } JWT = { Providers = [ { Name = "auth0" }, ] } }] } ] ``` - generate 3 jwt tokens: 1 from auth0 jwks, 1 from okta jwks with different claims than `/workspace` expects and 1 with correct claims - connect to your envoy (change service and address as needed) to view logs and potential errors. You can add: `-- --log-level debug` to see what data is being forwarded ``` consul connect envoy -sidecar-for redis1 -grpc-addr 127.0.0.1:8502 ``` - Make the following requests: ``` curl -s -H "Authorization: Bearer $Auth0_TOKEN" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v RBAC filter denied curl -s -H "Authorization: Bearer $Okta_TOKEN_with_wrong_claims" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v RBAC filter denied curl -s -H "Authorization: Bearer $Okta_TOKEN_with_correct_claims" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v Successful request ``` ### TODO * [x] Update test coverage * [ ] update integration tests (follow-up PR) * [x] appropriate backport labels added	1 year ago
Poonam Jadhav	5930518489	fix: update delegateMock used in ENT (#18149) ... ### Description <!-- Please describe why you're making this change, in plain English. --> The mock is used in `http_ent_test` file which caused lint failures. For OSS->ENT parity adding the same change here. ### Links <!-- Include any links here that might be helpful for people reviewing your PR (Tickets, GH issues, API docs, external benchmarks, tools docs, etc). If there are none, feel free to delete this section. Please be mindful not to leak any customer or confidential information. HashiCorp employees may want to use our internal URL shortener to obfuscate links. --> Identified in OSS->ENT [merge PR](https://github.com/hashicorp/consul-enterprise/pull/6328) ### PR Checklist * [ ] ~updated test coverage~ * [ ] ~external facing docs updated~ * [x] appropriate backport labels added * [ ] ~not a security concern~	1 year ago
wangxinyi7	e7194787a7	re org resource type registry (#18133)	1 year ago
John Murret	691bc9673a	add a conditional around setting LANFilter.AllSegments to make sure it is valid (#18139) ... ### Description This is to correct a code problem because this assumes all segments, but when you get to Enterprise, you can be in partition that is not the default partition, in which case specifying all segments does not validate and fails. This is to correct the setting of this filter with `AllSegments` to `true` to only occur when in the the `default` partition. ### Testing & Reproduction steps <!-- * In the case of bugs, describe how to replicate * If any manual tests were done, document the steps and the conditions to replicate * Call out any important/ relevant unit tests, e2e tests or integration tests you have added or are adding --> ### Links <!-- Include any links here that might be helpful for people reviewing your PR (Tickets, GH issues, API docs, external benchmarks, tools docs, etc). If there are none, feel free to delete this section. Please be mindful not to leak any customer or confidential information. HashiCorp employees may want to use our internal URL shortener to obfuscate links. --> ### PR Checklist * [ ] updated test coverage * [ ] external facing docs updated * [ ] appropriate backport labels added * [ ] not a security concern	1 year ago
Chris S. Kim	747a4c73c1	Fix bug with Vault CA provider (#18112) ... Updating RootPKIPath but not IntermediatePKIPath would not update leaf signing certs with the new root. Unsure if this happens in practice but manual testing showed it is a bug that would break mesh and agent connections once the old root is pruned.	1 year ago
Poonam Jadhav	5208ea90e4	NET-4657/add resource service client (#18053) ... ### Description <!-- Please describe why you're making this change, in plain English. --> Dan had already started on this [task](https://github.com/hashicorp/consul/pull/17849) which is needed to start building the HTTP APIs. This just needed some cleanup to get it ready for review. Overview: - Rename `internalResourceServiceClient` to `insecureResourceServiceClient` for name consistency - Configure a `secureResourceServiceClient` with auth enabled ### PR Checklist * [ ] ~updated test coverage~ * [ ] ~external facing docs updated~ * [x] appropriate backport labels added * [ ] ~not a security concern~	1 year ago
Vijay	2f20c77e4d	Displays Consul version of each nodes in UI nodes section (#17754) ... * update UINodes and UINodeInfo response with consul-version info added as NodeMeta, fetched from serf members * update test cases TestUINodes, TestUINodeInfo * added nil check for map * add consul-version in local agent node metadata * get consul version from serf member and add this as node meta in catalog register request * updated ui mock response to include consul versions as node meta * updated ui trans and added version as query param to node list route * updates in ui templates to display consul version with filter and sorts * updates in ui - model class, serializers,comparators,predicates for consul version feature * added change log for Consul Version Feature * updated to get version from consul service, if for some reason not available from serf * updated changelog text * updated dependent testcases * multiselection version filter * Update agent/consul/state/catalog.go comments updated Co-authored-by: Jared Kirschner <85913323+jkirschner-hashicorp@users.noreply.github.com> --------- Co-authored-by: Jared Kirschner <85913323+jkirschner-hashicorp@users.noreply.github.com>	1 year ago
Tom Davies	f472164f05	Pass configured role name to Vault for AWS auth in Connect CA (#17885)	1 year ago
Dan Stough	da79997f3d	test: fix FIPS inline cert test message (#18076)	1 year ago
Dan Stough	1b08626358	[OSS] Fix initial_fetch_timeout to wait for all xDS resources (#18024) ... * fix(connect): set initial_fetch_time to wait indefinitely * changelog * PR feedback 1	1 year ago
Fulvio	f4b08040fd	Add verify server hostname to tls default (#17155)	1 year ago
Ronald	ada3938115	Add first integration test for jwt auth with intention (#18005)	1 year ago
Poonam Jadhav	8af4ad178c	feat: include nodes count in operator usage endpoint and cli command (#17939) ... * feat: update operator usage api endpoint to include nodes count * feat: update operator usange cli command to includes nodes count	1 year ago
Derek Menteer	0094dbf312	Fix incorrect protocol for transparent proxy upstreams. (#17894) ... This PR fixes a bug that was introduced in: https://github.com/hashicorp/consul/pull/16021 A user setting a protocol in proxy-defaults would cause tproxy implicit upstreams to not honor the upstream service's protocol set in its `ServiceDefaults.Protocol` field, and would instead always use the proxy-defaults value. Due to the fact that upstreams configured with "tcp" can successfully contact upstream "http" services, this issue was not recognized until recently (a proxy-defaults with "tcp" and a listening service with "http" would make successful requests, but not the opposite). As a temporary work-around, users experiencing this issue can explicitly set the protocol on the `ServiceDefaults.UpstreamConfig.Overrides`, which should take precedence. The fix in this PR removes the proxy-defaults protocol from the wildcard upstream that tproxy uses to configure implicit upstreams. When the protocol was included, it would always overwrite the value during discovery chain compilation, which was not correct. The discovery chain compiler also consumes proxy defaults to determine the protocol, so simply excluding it from the wildcard upstream config map resolves the issue.	1 year ago
Ronald	80394278b8	Expose JWKS cluster config through JWTProviderConfigEntry (#17978) ... * Expose JWKS cluster config through JWTProviderConfigEntry * fix typos, rename trustedCa to trustedCA	1 year ago
Chris Thain	0b1299c28d	Remove duplicate and unused newDecodeConfigEntry func (#17979)	1 year ago
Chris S. Kim	50a9d1b696	Remove POC code (#17974)	1 year ago
Ashesh Vidyut	2af6bc434a	feature - [NET - 4005] - [Supportability] Reloadable Configuration - enable_debug (#17565) ... * # This is a combination of 9 commits. # This is the 1st commit message: init without tests # This is the commit message #2: change log # This is the commit message #3: fix tests # This is the commit message #4: fix tests # This is the commit message #5: added tests # This is the commit message #6: change log breaking change # This is the commit message #7: removed breaking change # This is the commit message #8: fix test # This is the commit message #9: keeping the test behaviour same * # This is a combination of 12 commits. # This is the 1st commit message: init without tests # This is the commit message #2: change log # This is the commit message #3: fix tests # This is the commit message #4: fix tests # This is the commit message #5: added tests # This is the commit message #6: change log breaking change # This is the commit message #7: removed breaking change # This is the commit message #8: fix test # This is the commit message #9: keeping the test behaviour same # This is the commit message #10: made enable debug atomic bool # This is the commit message #11: fix lint # This is the commit message #12: fix test true enable debug * parent 10f500e895 author absolutelightning <ashesh.vidyut@hashicorp.com> 1687352587 +0530 committer absolutelightning <ashesh.vidyut@hashicorp.com> 1687352592 +0530 init without tests change log fix tests fix tests added tests change log breaking change removed breaking change fix test keeping the test behaviour same made enable debug atomic bool fix lint fix test true enable debug using enable debug in agent as atomic bool test fixes fix tests fix tests added update on correct locaiton fix tests fix reloadable config enable debug fix tests fix init and acl 403 * revert commit	1 year ago
Ronald	1512ea307e	Dynamically create jwks clusters for jwt-providers (#17944)	1 year ago
Ranjandas	1b1f33f224	Fixes Secondary ConnectCA update (#17846) ... This fixes a bug that was identified which resulted in subsequent ConnectCA configuration update not to persist in the cluster.	1 year ago
John Maguire	67a239a821	Ensure RSA keys are at least 2048 bits in length (#17911) ... * Ensure RSA keys are at least 2048 bits in length * Add changelog * update key length check for FIPS compliance * Fix no new variables error and failing to return when error exists from validating * clean up code for better readability * actually return value	1 year ago
Ronald	767ef2dd4c	Allow service identity tokens the ability to read jwt-providers (#17893) ... * Allow service identity tokens the ability to read jwt-providers * more tests * service_prefix tests	1 year ago
Alex Simenduev	33a2d90852	Fix a bug that wrongly trims domains when there is an overlap with DC name (#17160) ... * Fix a bug that wrongly trims domains when there is an overlap with DC name Before this change, when DC name and domain/alt-domain overlap, the domain name incorrectly trimmed from the query. Example: Given: datacenter = dc-test, alt-domain = test.consul. Querying for "test-node.node.dc-test.consul" will faile, because the code was trimming "test.consul" instead of just ".consul" This change, fixes the issue by adding dot (.) before trimming * trimDomain: ensure domain trimmed without modyfing original domains * update changelog --------- Co-authored-by: Dhia Ayachi <dhia@hashicorp.com>	1 year ago
Dan Upton	b117eb0126	resource: enforce consistent naming of resource types (#17611) ... For consistency, resource type names must follow these rules: - `Group` must be snake case, and in most cases a single word. - `GroupVersion` must be lowercase, start with a "v" and end with a number. - `Kind` must be pascal case. These were chosen because they map to our protobuf type naming conventions.	1 year ago
cskh	f16c5d87ab	watch: support -filter for consul watch: checks, services, nodes, service (#17780) ... * watch: support -filter for watch checks * Add filter for watch nodes, services, and service - unit test added - Add changelog - update doc	1 year ago
Chris Thain	366bd6f89f	ext-authz Envoy extension: support `localhost` as a valid target URI. (#17821)	1 year ago
Chris S. Kim	a4653de8da	CA provider doc updates and Vault provider minor update (#17831) ... Update CA provider docs Clarify that providers can differ between primary and secondary datacenters Provide a comparison chart for consul vs vault CA providers Loosen Vault CA provider validation for RootPKIPath Update Vault CA provider documentation	1 year ago
George Bolo	82441a27fa	fixes #17732 - AccessorID in request body should be optional when updating ACL token (#17739) ... * AccessorID in request body should be optional when updating ACL token * add a test case * fix test case * add changelog entry for PR #17739	1 year ago
Eric Haberkorn	a3ba559149	Make locality aware routing xDS changes (#17826)	1 year ago
Paul Glass	d2363eb711	Test permissive mTLS filter chain not configured with tproxy disabled (#17747)	1 year ago
chappie	5352ccf8ed	HCP Add node id/name to config (#17750)	1 year ago
Ronald	5f95f5f6d8	Stop referenced jwt providers from being deleted (#17755) ... * Stop referenced jwt providers from being deleted	1 year ago
Michael Zalimeni	265c003033	Add Patch index to Prop Override validation errors (#17777) ... When a patch is found invalid, include its index for easier debugging when multiple patches are provided.	1 year ago
Michael Zalimeni	f9aa7aebb3	Property Override validation improvements (#17759) ... * Reject inbound Prop Override patch with Services Services filtering is only supported for outbound TrafficDirection patches. * Improve Prop Override unexpected type validation - Guard against additional invalid parent and target types - Add specific error handling for Any fields (unsupported)	1 year ago
Derek Menteer	04edace1de	Fix issue with streaming service health watches. (#17775) ... Fix issue with streaming service health watches. This commit fixes an issue where the health streams were unaware of service export changes. Whenever an exported-services config entry is modified, it is effectively an ACL change. The bug would be triggered by the following situation: - no services are exported - an upstream watch to service X is spawned - the streaming backend filters out data for service X (due to lack of exports) - service X is finally exported In the situation above, the streaming backend does not trigger a refresh of its data. This means that any events that were supposed to have been received prior to the export are NOT backfilled, and the watches never see service X spawning. We currently have decided to not trigger a stream refresh in this situation due to the potential for a thundering herd effect (touching exports would cause a re-fetch of all watches for that partition, potentially). Therefore, a local blocking-query approach was added by this commit for agentless. It's also worth noting that the streaming subscription is currently bypassed most of the time with agentful, because proxycfg has a `req.Source.Node != ""` which prevents the `streamingEnabled` check from passing. This means that while agents should technically have this same issue, they don't experience it with mesh health watches. Note that this is a temporary fix that solves the issue for proxycfg, but not service-discovery use cases.	1 year ago
Eric Haberkorn	0994ccf162	validate localities on agent configs and registration endpoints (#17712)	1 year ago
chappie	7ab287c1d5	Add truncation to body (#17723)	1 year ago
Chris Thain	9289e680d6	OSS merge: Update error handling login when applying extensions (#17740)	1 year ago
Ashesh Vidyut	fa40654885	[NET-3865] [Supportability] Additional Information in the output of 'consul operator raft list-peers' (#17582) ... * init * fix tests * added -detailed in docs * added change log * fix doc * checking for entry in map * fix tests * removed detailed flag * removed detailed flag * revert unwanted changes * removed unwanted changes * updated change log * pr review comment changes * pr comment changes single API instead of two * fix change log * fix tests * fix tests * fix test operator raft endpoint test * Update .changelog/17582.txt Co-authored-by: Semir Patel <semir.patel@hashicorp.com> * nits * updated docs --------- Co-authored-by: Semir Patel <semir.patel@hashicorp.com>	1 year ago
R.B. Boyer	72f991d8d3	agent: remove agent cache dependency from service mesh leaf certificate management (#17075) ... * agent: remove agent cache dependency from service mesh leaf certificate management This extracts the leaf cert management from within the agent cache. This code was produced by the following process: 1. All tests in agent/cache, agent/cache-types, agent/auto-config, agent/consul/servercert were run at each stage. - The tests in agent matching .*Leaf were run at each stage. - The tests in agent/leafcert were run at each stage after they existed. 2. The former leaf cert Fetch implementation was extracted into a new package behind a "fake RPC" endpoint to make it look almost like all other cache type internals. 3. The old cache type was shimmed to use the fake RPC endpoint and generally cleaned up. 4. I selectively duplicated all of Get/Notify/NotifyCallback/Prepopulate from the agent/cache.Cache implementation over into the new package. This was renamed as leafcert.Manager. - Code that was irrelevant to the leaf cert type was deleted (inlining blocking=true, refresh=false) 5. Everything that used the leaf cert cache type (including proxycfg stuff) was shifted to use the leafcert.Manager instead. 6. agent/cache-types tests were moved and gently replumbed to execute as-is against a leafcert.Manager. 7. Inspired by some of the locking changes from derek's branch I split the fat lock into N+1 locks. 8. The waiter chan struct{} was eventually replaced with a singleflight.Group around cache updates, which was likely the biggest net structural change. 9. The awkward two layers or logic produced as a byproduct of marrying the agent cache management code with the leaf cert type code was slowly coalesced and flattened to remove confusion. 10. The .*Leaf tests from the agent package were copied and made to work directly against a leafcert.Manager to increase direct coverage. I have done a best effort attempt to port the previous leaf-cert cache type's tests over in spirit, as well as to take the e2e-ish tests in the agent package with Leaf in the test name and copy those into the agent/leafcert package to get more direct coverage, rather than coverage tangled up in the agent logic. There is no net-new test coverage, just coverage that was pushed around from elsewhere.	1 year ago
Eric Haberkorn	0a1efe73f3	Refactor disco chain prioritize by locality structs (#17696) ... This includes prioritize by localities on disco chain targets rather than resolvers, allowing different targets within the same partition to have different policies.	1 year ago
Dan Stough	bba5cd8455	fix: stop peering delete routine on leader loss (#17483)	1 year ago
Chris Thain	a8f1350835	ENT merge of ext-authz extension updates (#17684)	1 year ago
Chris Thain	c04c122ef3	Default `ProxyType` for builtin extensions (#17657)	1 year ago
Nathan Coleman	1074252361	api-gateway: stop adding all header filters to virtual host when generating xDS (#17644) ... * Add header filter to api-gateway xDS golden test * Stop adding all header filters to virtual host when generating xDS for api-gateway * Regenerate xDS golden file for api-gateway w/ header filter	1 year ago
Matt Keeler	baaf6d84c7	Add generic experiments configuration and use it to enable catalog v2 resources (#17604) ... * Add generic experiments configuration and use it to enable catalog v2 resources * Run formatting with -s as CI will validate that this has been done	1 year ago
R.B. Boyer	ec347ef01d	sort some imports that are wonky between oss and ent (#17637)	1 year ago
Andrew Stucki	3cb70566a9	[API Gateway] Fix rate limiting for API gateways (#17631) ... * [API Gateway] Fix rate limiting for API gateways * Add changelog * Fix failing unit tests * Fix operator usage tests for api package	1 year ago
Andrew Stucki	9a4f503b2b	[API Gateway] Fix trust domain for external peered services in synthesis code (#17609) ... * [API Gateway] Fix trust domain for external peered services in synthesis code * Add changelog	1 year ago
Eric Haberkorn	779647b948	Add Envoy and Consul version constraints to Envoy extensions (#17612)	1 year ago
Ronald	8118aae5c1	Add writeAuditRPCEvent to agent_oss (#17607) ... * Add writeAuditRPCEvent to agent_oss * fix the other diffs * backport change log	2 years ago
Michael Zalimeni	1db02a0349	Disable terminating-gateway for property-override (#17605) ... More validation is needed to ensure this behaves as expected; in the meantime, align with docs and disable this proxy type.	2 years ago
R.B. Boyer	820cdf53da	fix some testing.T retry.R mixups (#17600) ... Fix some linter warnings before updating the lint-consul-retry code in hashicorp/lint-consul-retry#4	2 years ago
Dhia Ayachi	39d4aaf224	fix rate limiting mapping to be the same between api and struct packages (#17599)	2 years ago
skpratt	a35cafa728	update tests for fips (#17592)	2 years ago
Michael Zalimeni	2dd5551003	Fix Property Override Services parsing (#17584) ... Ensure that the embedded api struct is properly parsed when deserializing config containing a set ResourceFilter.Services field. Also enhance existing integration test to guard against bugs and exercise this field.	2 years ago
Andrew Stucki	f9d9d4db60	Fix subscribing/fetching objects not in the default partition (#17581) ... * Fix subscribing/fetching objects not in the default namespace * add changelog	2 years ago
Matt Keeler	77f44fa878	Various bits of cleanup detected when using Go Workspaces (#17462) ... TLDR with many modules the versions included in each diverged quite a bit. Attempting to use Go Workspaces produces a bunch of errors. This commit: 1. Fixes envoy-library-references.sh to work again 2. Ensures we are pulling in go-control-plane@v0.11.0 everywhere (previously it was at that version in some modules and others were much older) 3. Remove one usage of golang/protobuf that caused us to have a direct dependency on it. 4. Remove deprecated usage of the Endpoint field in the grpc resolver.Target struct. The current version of grpc (v1.55.0) has removed that field and recommended replacement with URL.Opaque and calls to the Endpoint() func when needing to consume the previous field. 4. `go work init <all the paths to go.mod files>` && `go work sync`. This syncrhonized versions of dependencies from the main workspace/root module to all submodules 5. Updated .gitignore to ignore the go.work and go.work.sum files. This seems to be standard practice at the moment. 6. Update doc comments in protoc-gen-consul-rate-limit to be go fmt compatible 7. Upgraded makefile infra to perform linting, testing and go mod tidy on all modules in a flexible manner. 8. Updated linter rules to prevent usage of golang/protobuf 9. Updated a leader peering test to account for an extra colon in a grpc error message.	2 years ago
malizz	8617f8af16	continue anti-entropy sync when failures exist (#17560)	2 years ago
Andrew Stucki	4ddb88ec7e	Fix up case where subscription is terminated due to ACLs changing or a snapshot restore occurring (#17566) ... * Fix up case where subscription is terminated due to ACLs changing or a snapshot restore occurring * Add changelog entry * Switch to use errors.Is	2 years ago
cskh	cf4059f3ce	chore: fix the error message format (#17554)	2 years ago
Michael Zalimeni	ad03a5d0f2	Avoid panic applying TProxy Envoy extensions (#17537) ... When UpstreamEnvoyExtender was introduced, some code was left duplicated between it and BasicEnvoyExtender. One path in that code panics when a TProxy listener patch is attempted due to no upstream data in RuntimeConfig matching the local service (which would only happen in rare cases). Instead, we can remove the special handling of upstream VIPs from BasicEnvoyExtender entirely, greatly simplifying the listener filter patch code and avoiding the panic. UpstreamEnvoyExtender, which needs this code to function, is modified to ensure a panic does not occur. This also fixes a second regression in which the Lua extension was not applied to TProxy outbound listeners.	2 years ago
Andrew Stucki	ca12ce926b	[API Gateway] Fix use of virtual resolvers in HTTPRoutes (#17055) ... * [API Gateway] Fix use of virtual resolvers in routes * Add changelog entry	2 years ago