consul

Commit Graph

Author	SHA1	Message	Date
FFMMM	745bd15b15	api: add PeeeringList, polish (#12934 )	3 years ago
Mark Anderson	6430af1c0e	Update mesh config tests Signed-off-by: Mark Anderson <manderson@hashicorp.com>	3 years ago
Mark Anderson	fee6c7a7b6	Fixup missed config entry Signed-off-by: Mark Anderson <manderson@hashicorp.com>	3 years ago
FFMMM	3b3f001580	[sync oss] api: add peering api module (#12911 )	3 years ago
Chris S. Kim	9791bad136	peering: Make Upstream peer-aware (#12900 ) Adds DestinationPeer field to Upstream. Adds Peer field to UpstreamID and its string conversion functions.	3 years ago
R.B. Boyer	1a491886fa	structs: ensure exported-services PeerName field can be addressed as peer_name (#12862 )	3 years ago
R.B. Boyer	f507f62f3c	peering: initial sync (#12842 ) - Add endpoints related to peering: read, list, generate token, initiate peering - Update node/service/check table indexing to account for peers - Foundational changes for pushing service updates to a peer - Plumb peer name through Health.ServiceNodes path see: ENT-1765, ENT-1280, ENT-1283, ENT-1283, ENT-1756, ENT-1739, ENT-1750, ENT-1679, ENT-1709, ENT-1704, ENT-1690, ENT-1689, ENT-1702, ENT-1701, ENT-1683, ENT-1663, ENT-1650, ENT-1678, ENT-1628, ENT-1658, ENT-1640, ENT-1637, ENT-1597, ENT-1634, ENT-1613, ENT-1616, ENT-1617, ENT-1591, ENT-1588, ENT-1596, ENT-1572, ENT-1555 Co-authored-by: R.B. Boyer <rb@hashicorp.com> Co-authored-by: freddygv <freddy@hashicorp.com> Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: Evan Culver <eculver@hashicorp.com> Co-authored-by: Nitya Dhanushkodi <nitya@hashicorp.com>	3 years ago
DanStough	95250e7915	Update go version to 1.18.1	3 years ago
Dhia Ayachi	09f2dd4d59	add queryBackend to the api query meta. (#12791 ) * add queryBackend to the api query meta. * add a changelog * use string type instead of int * Apply suggestions from code review Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>	3 years ago
Kyle Havlovitz	3e88f579fc	Fix namespace default field names in expanded token output	3 years ago
R.B. Boyer	25ba9c147a	xds: ensure that all connect timeout configs can apply equally to tproxy direct dial connections (#12711 ) Just like standard upstreams the order of applicability in descending precedence: 1. caller's `service-defaults` upstream override for destination 2. caller's `service-defaults` upstream defaults 3. destination's `service-resolver` ConnectTimeout 4. system default of 5s Co-authored-by: mrspanishviking <kcardenas@hashicorp.com>	3 years ago
R.B. Boyer	d06183ba7f	syncing changes back from enterprise (#12701 )	3 years ago
Kyle Havlovitz	b21b4346b4	Add expanded token read flag and endpoint option	3 years ago
R.B. Boyer	e79ce8ab03	xds: adding control of the mesh-wide min/max TLS versions and cipher suites from the mesh config entry (#12601 ) - `tls.incoming`: applies to the inbound mTLS targeting the public listener on `connect-proxy` and `terminating-gateway` envoy instances - `tls.outgoing`: applies to the outbound mTLS dialing upstreams from `connect-proxy` and `ingress-gateway` envoy instances Fixes #11966	3 years ago
R.B. Boyer	ac5bea862a	server: ensure that service-defaults meta is incorporated into the discovery chain response (#12511 ) Also add a new "Default" field to the discovery chain response to clients	3 years ago
Eric	02d8a11ff0	remove gogo from acl protobufs	3 years ago
John Eikenberry	2da701b90c	fix godoc comment for Namespaces client method Namespaces method godoc has same sentence as Operator method. Presumably a cut-n-paste error. Fix that.	3 years ago
R.B. Boyer	80dfcb1bcd	raft: update to v1.3.5 (#12325 ) This includes closing some leadership transfer gaps and adding snapshot restore progress logging.	3 years ago
Chris S. Kim	f5d816dace	Remove incorrect usage of url.PathEscape (#12184 ) When r.toHTTP is called, http.Request is built with the path already escaped. This removes all calls to url.PathEscape that would have led to double-escaped URLs.	3 years ago
Dao Thanh Tung	6765c0d965	Add api changes to agent endpoint for part 2 (#12150 )	3 years ago
R.B. Boyer	b60d89e7ef	bulk rewrite using this script set -euo pipefail unset CDPATH cd "$(dirname "$0")" for f in $(git grep '\brequire := require\.New(' \| cut -d':' -f1 \| sort -u); do echo "=== require: $f ===" sed -i '/require := require.New(t)/d' $f # require.XXX(blah) but not require.XXX(tblah) or require.XXX(rblah) sed -i 's/\brequire\.$[a-zA-Z0-9_]$($[^tr]$/require.\1(t,\2/g' $f # require.XXX(tblah) but not require.XXX(t, blah) sed -i 's/\brequire\.$[a-zA-Z0-9_]$($t[^,]$/require.\1(t,\2/g' $f # require.XXX(rblah) but not require.XXX(r, blah) sed -i 's/\brequire\.$[a-zA-Z0-9_]$($r[^,]$/require.\1(t,\2/g' $f gofmt -s -w $f done for f in $(git grep '\bassert := assert\.New(' \| cut -d':' -f1 \| sort -u); do echo "=== assert: $f ===" sed -i '/assert := assert.New(t)/d' $f # assert.XXX(blah) but not assert.XXX(tblah) or assert.XXX(rblah) sed -i 's/\bassert\.$[a-zA-Z0-9_]$($[^tr]$/assert.\1(t,\2/g' $f # assert.XXX(tblah) but not assert.XXX(t, blah) sed -i 's/\bassert\.$[a-zA-Z0-9_]$($t[^,]$/assert.\1(t,\2/g' $f # assert.XXX(rblah) but not assert.XXX(r, blah) sed -i 's/\bassert\.$[a-zA-Z0-9_]$($r[^,]$/assert.\1(t,\2/g' $f gofmt -s -w $f done	3 years ago
Dan Upton	ca3aca92c4	[OSS] Remove remaining references to master (#11827 )	3 years ago
VictorBac	31a39c9528	Add GRPC and GRPCUseTLS to api.HealthCheckDefinition (#12108 ) * Add GRPC to HealthCheckDefinition * add GRPC and GRPCUseTLS	3 years ago
Mike Morris	1b1a97e8f9	ingress: allow setting TLS min version and cipher suites in ingress gateway config entries (#11576 ) * xds: refactor ingress listener SDS configuration * xds: update resolveListenerSDS call args in listeners_test * ingress: add TLS min, max and cipher suites to GatewayTLSConfig * xds: implement envoyTLSVersions and envoyTLSCipherSuites * xds: merge TLS config * xds: configure TLS parameters with ingress TLS context from leaf * xds: nil check in resolveListenerTLSConfig validation * xds: nil check in makeTLSParameters* functions * changelog: add entry for TLS params on ingress config entries * xds: remove indirection for TLS params in TLSConfig structs * xds: return tlsContext, nil instead of ambiguous err Co-authored-by: Chris S. Kim <ckim@hashicorp.com> * xds: switch zero checks to types.TLSVersionUnspecified * ingress: add validation for ingress config entry TLS params * ingress: validate listener TLS config * xds: add basic ingress with TLS params tests * xds: add ingress listeners mixed TLS min version defaults precedence test * xds: add more explicit tests for ingress listeners inheriting gateway defaults * xds: add test for single TLS listener on gateway without TLS defaults * xds: regen golden files for TLSVersionInvalid zero value, add TLSVersionAuto listener test * types/tls: change TLSVersion to string * types/tls: update TLSCipherSuite to string type * types/tls: implement validation functions for TLSVersion and TLSCipherSuites, make some maps private * api: add TLS params to GatewayTLSConfig, add tests * api: add TLSMinVersion to ingress gateway config entry test JSON * xds: switch to Envoy TLS cipher suite encoding from types package * xds: fixup validation for TLSv1_3 min version with cipher suites * add some kitchen sink tests and add a missing struct tag * xds: check if mergedCfg.TLSVersion is in TLSVersionsWithConfigurableCipherSuites * xds: update connectTLSEnabled comment * xds: remove unsued resolveGatewayServiceTLSConfig function * xds: add makeCommonTLSContextFromLeafWithoutParams * types/tls: add LessThan comparator function for concrete values * types/tls: change tlsVersions validation map from string to TLSVersion keys * types/tls: remove unused envoyTLSCipherSuites * types/tls: enable chacha20 cipher suites for Consul agent * types/tls: remove insecure cipher suites from allowed config TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 and TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 are both explicitly listed as insecure and disabled in the Go source. Refs https://cs.opensource.google/go/go/+/refs/tags/go1.17.3:src/crypto/tls/cipher_suites.go;l=329-330 * types/tls: add ValidateConsulAgentCipherSuites function, make direct lookup map private * types/tls: return all unmatched cipher suites in validation errors * xds: check that Envoy API value matching TLS version is found when building TlsParameters * types/tls: check that value is found in map before appending to slice in MarshalEnvoyTLSCipherSuiteStrings * types/tls: cast to string rather than fmt.Printf in TLSCihperSuite.String() * xds: add TLSVersionUnspecified to list of configurable cipher suites * structs: update note about config entry warning * xds: remove TLS min version cipher suite unconfigurable test placeholder * types/tls: update tests to remove assumption about private map values Co-authored-by: R.B. Boyer <rb@hashicorp.com>	3 years ago
littlestar642	634c72d22f	add path escape and unescape to path params	3 years ago
Chris S. Kim	71bad67a4d	Add partitions to prettyformatters (#11789 )	3 years ago
R.B. Boyer	aa9a22a8fe	fix test failures	3 years ago
freddygv	9b44861ce4	Update api module and decoding tests	3 years ago
Freddy	a725f06c83	Merge pull request #11739 from hashicorp/ap/exports-rename	3 years ago
freddygv	ed6076db26	Rename partition-exports to exported-services Using a name less tied to partitions gives us more flexibility to use this config entry in OSS for exports between datacenters/meshes.	3 years ago
freddygv	3e5400c4c5	Clarify feature name in partition docstring	3 years ago
freddygv	7811edd055	Rename internal AdminPartition references This commit finishes replacing references to "AdminPartition" with "Partition". This now matches other uses in the codebase such as the CLI command, HTTP API, and the query parameter.	3 years ago
Dan Upton	1e47e3c82b	Groundwork for exposing when queries are filtered by ACLs (#11569 )	3 years ago
R.B. Boyer	c46f9f9f31	agent: add variation of force-leave that exclusively works on the WAN (#11722 ) Fixes #6548	3 years ago
Dan Upton	bf56a2c495	Rename `agent_master` ACL token in the API and CLI (#11669 )	3 years ago
R.B. Boyer	e6956893fb	api: ensure new partition fields are omit empty for back compat (#11585 )	3 years ago
R.B. Boyer	1e02460bd1	re-run gofmt on 1.17 (#11579 ) This should let freshly recompiled golangci-lint binaries using Go 1.17 pass 'make lint'	3 years ago
R.B. Boyer	eb21649f82	partitions: various refactors to support partitioning the serf LAN pool (#11568 )	3 years ago
freddygv	4c9c1b52ce	Support partitions in connect expose cmd	3 years ago
freddygv	a6d985040f	Fixup shared oss/ent tests	3 years ago
freddygv	e5b7c4713f	Accept partition for ingress services	3 years ago
Dhia Ayachi	98735a6d12	KV refactoring, part 2 (#11512 ) * add partition to the kv get pretty print * fix failing test * add test for kvs RPC endpoint	3 years ago
FFMMM	4ddf973a31	add root_cert_ttl option for consul connect, vault ca providers (#11428 ) * add root_cert_ttl option for consul connect, vault ca providers Signed-off-by: FFMMM <FFMMM@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Chris S. Kim <ckim@hashicorp.com> * add changelog, pr feedback Signed-off-by: FFMMM <FFMMM@users.noreply.github.com> * Update .changelog/11428.txt, more docs Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> * Update website/content/docs/agent/options.mdx Co-authored-by: Kyle Havlovitz <kylehav@gmail.com> Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> Co-authored-by: Kyle Havlovitz <kylehav@gmail.com>	3 years ago
Daniel Nephin	51d8417545	Merge pull request #10690 from tarat44/h2c-support-in-ping-checks add support for h2c in h2 ping health checks	3 years ago
Daniel Upton	d47b7311b8	Support Check-And-Set deletion of config entries (#11419 ) Implements #11372	3 years ago
Dhia Ayachi	2801785710	regenerate expired certs (#11462 ) * regenerate expired certs * add documentation to generate tests certificates	3 years ago
R.B. Boyer	61361c2e5d	cli: update consul members output to display partitions and sort the results usefully (#11446 )	3 years ago
Mark Anderson	977be77493	Fix back compat issues with UDS config (#11318 ) SocketPath needs to be omitted when empty to avoid confusing older versions of Consul Signed-off-by: Mark Anderson <manderson@hashicorp.com>	3 years ago
sidzi	29f192a130	Refactor requireHttpCodes for segregated error handling (#11287 )	3 years ago
freddygv	4c45cafce2	Update filename to match entry kind - mesh	3 years ago
freddygv	5c24ed61a8	Rename service-exports to partition-exports Existing config entries prefixed by service- are specific to individual services. Since this config entry applies to partitions it is being renamed. Additionally, the Partition label was changed to Name because using Partition at the top-level and in the enterprise meta was leading to the enterprise meta partition being dropped by msgpack.	3 years ago
Daniel Nephin	4ae2c8de9d	Merge pull request #11232 from hashicorp/dnephin/acl-legacy-remove-docs acl: add docs and changelog for the removal of the legacy ACL system	3 years ago
Kyle Havlovitz	04cd2c983e	Add new service-exports config entry	3 years ago
Mike Morris	55659f3c9d	deps: update consul-api and consul-sdk (#11361 ) * deps: update consul/sdk in api/go.mod * deps: update consul/api to v1.11.0	3 years ago
Daniel Nephin	dc58a8c339	api: remove the test for TestAPI_RulesTranslate_Raw The API endpoint was removed in a previous commit, so we can no longer test this deprecated method.	3 years ago
tarat44	c1ed3a9a94	change config option to H2PingUseTLS	3 years ago
tarat44	3c9f5a73d9	add support for h2c in h2 ping health checks	3 years ago
FFMMM	8bb6d8571c	wrap few doRequest calls for error handling (#11158 )	3 years ago
Paul Banks	7b4cbe3143	Final readability tweaks from review	3 years ago
Paul Banks	b5345ea878	Add changelog; Add API package support for new fields.	3 years ago
FFMMM	377c3a9b0b	add StatusError to api package (#11054 ) * add require http codes in api and use in operator_autopilot health check * add StatusError type in api package Signed-off-by: FFMMM <FFMMM@users.noreply.github.com>	3 years ago
R.B. Boyer	2af8e16ef9	api: add partition field to acl structs (#11080 )	3 years ago
Evan Culver	c4c833fd0e	sso/oidc: add support for acr_values request parameter (#11026 ) Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>	3 years ago
freddygv	e0a7900f52	Fixup api config and Envoy test	3 years ago
freddygv	886f873fa4	Trim newlines before parenthesis end	3 years ago
Daniel Nephin	1f9479603c	Add failures_before_warning to checks (#10969 ) Signed-off-by: Jakub Sokołowski <jakub@status.im> * agent: add failures_before_warning setting The new setting allows users to specify the number of check failures that have to happen before a service status us updated to be `warning`. This allows for more visibility for detected issues without creating alerts and pinging administrators. Unlike the previous behavior, which caused the service status to not update until it reached the configured `failures_before_critical` setting, now Consul updates the Web UI view with the `warning` state and the output of the service check when `failures_before_warning` is breached. The default value of `FailuresBeforeWarning` is the same as the value of `FailuresBeforeCritical`, which allows for retaining the previous default behavior of not triggering a warning. When `FailuresBeforeWarning` is set to a value higher than that of `FailuresBeforeCritical it has no effect as `FailuresBeforeCritical` takes precedence. Resolves: https://github.com/hashicorp/consul/issues/10680 Signed-off-by: Jakub Sokołowski <jakub@status.im> Co-authored-by: Jakub Sokołowski <jakub@status.im>	3 years ago
Chris S. Kim	5b658d2f39	Sync partition fields from enterprise (#11021 )	3 years ago
Dhia Ayachi	ad914e16c2	acl-tokens table partitioning (#11020 ) * convert `Policies` index to use `indexerMulti` * remove non used indexer * fix oss policy Get * add oss tests * remove reference to partition in oss test * convert `Roles` index to use `indexerMulti` * add role test in oss * fix oss to use the right index func * convert `Roles` index to use `indexerSingle` * split authmethod write indexer to oss and ent * add auth method unit tests * add index locality * move intFromBool to be available for oss * add expiry indexes * add api tests * fix rebase * use Bool func * preallocate slice * rename variable	3 years ago
Paul Banks	a9bf4c9b82	Add Changelog entry and api package support for HTTP Header manip	3 years ago
Dhia Ayachi	bc0e4f2f46	partition dicovery chains (#10983 ) * partition dicovery chains * fix default partition for OSS	3 years ago
Paul Ewing	1a45e96307	Revert early out errors in license API (#10952 ) Licensing recently changed in Consul v1.10 and along with those changes the client API was updated such that PutLicense and ResetLicense both immediately return an error to avoid an unecessary round trip that will inevitably fail. For reference, see: `08eb600ee5` Unfortunately, this change broke forward compatibility such that a v1.10 client can no longer make these requests to a v1.9 server which is a valid use case. This commit reintroduces these requests to fix this compatibility breakage but leaves the deprecation notices in tact.	3 years ago
Freddy	d2e50fd130	Sync partitions support in api module (#10938 )	3 years ago
Dhia Ayachi	1950ebbe1f	oss portion of ent #1069 (#10883 )	3 years ago
R.B. Boyer	097e1645e3	agent: ensure that most agent behavior correctly respects partition configuration (#10880 )	3 years ago
Daniel Nephin	4359e38114	debug: restore cancel on SigInt Some previous changes broke interrupting the debug on SigInterupt. This change restores the original behaviour by passing a context to requests. Since a new API client function was required to pass the context, I had it also return an io.ReadCloser, so that output can be streamed to files instead of fully buffering in process memory.	3 years ago
R.B. Boyer	310e775a8a	state: partition nodes and coordinates in the state store (#10859 ) Additionally: - partitioned the catalog indexes appropriately for partitioning - removed a stray reference to a non-existent index named "node.checks"	3 years ago
Daniel Nephin	de3439b2cc	api: remove client library tests for old API endpoints These methods are being kept around in the api module for now to allow the api module to work with older versions of the HTTP API, but we are no longer able to test them. Since the endpoints are removed there is no way for them to change, so there does not appear to be a need to keep running the tests.	3 years ago
Kyle Havlovitz	073b6c8411	oss: Rename default partition	3 years ago
Mark Anderson	d3cebbd32c	Fixup to support unix domain socket via command line (#10758 ) Missed the need to add support for unix domain socket config via api/command line. This is a variant of the problems described in it is easy to drop one. Signed-off-by: Mark Anderson <manderson@hashicorp.com>	3 years ago
Daniel Nephin	d3325b0253	Merge pull request #10612 from bigmikes/acl-replication-fix acl: acl replication routine to report the last error message	3 years ago
Giulio Micheloni	d4a3fe33e8	String type instead of error type and changelog.	3 years ago
Daniel Nephin	97fed47708	Merge pull request #10632 from hashicorp/pairing/acl-authorizer-when-acl-disabled acls: Update ACL authorizer to return meaningful permission when ACLs are disabled	3 years ago
Blake Covarrubias	c919f2d9ea	api: Support QueryOptions on additional agent endpoints (#10691 ) Add support for setting QueryOptions on the following agent API endpoints: - /agent/health/service/name/:name - /agent/health/service/id/:id - /agent/service/maintenance/:id This follows the same pattern used in #9903 to support query options for other agent API endpoints. Resolves #9710	3 years ago
Evan Culver	4c4bbfb7c0	Fix api/agent test	3 years ago
Evan Culver	f2d30bbc88	Fix api/agent test	3 years ago
Daniel Nephin	c3149ec0fd	debug: use the new metrics stream in debug command	3 years ago
R.B. Boyer	96b97d6554	replumbing a bunch of api and agent structs for partitions (#10681 )	3 years ago
R.B. Boyer	fc9b1a277d	sync changes to oss files made in enterprise (#10670 )	3 years ago
Evan Culver	0527dcff57	acls: Show `AuthMethodNamespace` when reading/listing ACL token meta (#10598 )	3 years ago
Kyle Havlovitz	77a2f38677	http: add partition query param parsing	3 years ago
Evan Culver	8fce7083c1	tests: skip cases that depend on test server when -short flag set (#10576 )	3 years ago
Evan Culver	13bd86527b	Add support for returning ACL secret IDs for accessors with acl:write (#10546 )	3 years ago
Daniel Nephin	ec6da0859d	Merge pull request #10570 from hashicorp/copy-of-master Changes that were accidentally merged into the old master branch	3 years ago
Jared Kirschner	e517e744af	Merge pull request #10559 from jkirschner-hashicorp/fix-autopilot-config-post-default-values Fix defaults for autopilot config update	3 years ago
Jared Kirschner	14059c2653	Fix defaults for autopilot config update Previously, for a POST request to the /v1/operator/autopilot/configuration endpoint, any fields not included in the payload were set to a zero-initialized value rather than the documented default value. Now, if an optional field is not included in the payload, it will be set to its documented default value: - CleanupDeadServers: true - LastContactThreshold: "200ms" - MaxTrailingLogs: 250 - MinQuorum: 0 - ServerStabilizationTime: "10s" - RedundancyZoneTag: "" - DisableUpgradeMigration: false - UpgradeVersionTag: ""	3 years ago
Daniel Nephin	3a045cca8d	ca: remove unused RotationPeriod field This field was never used. Since it is persisted as part of a map[string]interface{} it is pretty easy to remove it.	3 years ago
Kyle Nusbaum	e72a703041	api: change io.Discard to ioutil.Discard	3 years ago
Daniel Nephin	6ac9149c3f	api: properly close the response body reads resp.Body until EOF, so that the http client is able to re-use the TCP connection.	3 years ago
Freddy	ffb13f35f1	Rename CatalogDestinationsOnly (#10397 ) CatalogDestinationsOnly is a passthrough that would enable dialing addresses outside of Consul's catalog. However, when this flag is set to true only _connect_ endpoints for services can be dialed. This flag is being renamed to signal that non-Connect endpoints can't be dialed by transparent proxies when the value is set to true.	4 years ago
Freddy	429f9d8bb8	Add flag for transparent proxies to dial individual instances (#10329 )	4 years ago
Dhia Ayachi	4c7f5f31c7	debug: remove the CLI check for debug_enabled (#10273 ) * debug: remove the CLI check for debug_enabled The API allows collecting profiles even debug_enabled=false as long as ACLs are enabled. Remove this check from the CLI so that users do not need to set debug_enabled=true for no reason. Also: - fix the API client to return errors on non-200 status codes for debug endpoints - improve the failure messages when pprof data can not be collected Co-Authored-By: Dhia Ayachi <dhia@hashicorp.com> * remove parallel test runs parallel runs create a race condition that fail the debug tests * Add changelog Co-authored-by: Daniel Nephin <dnephin@hashicorp.com>	4 years ago
Rémi Lapeyre	213524a657	Always set the Content-Type header when a body is present (#10204 ) * Always set the Content-Type header when a body is present Closes https://github.com/hashicorp/consul/issues/10011 * Add Changelog entry * Add more Content-Type exceptions * Fix tests	4 years ago
Matt Keeler	08eb600ee5	Deprecate API driven licensing. The two methods in the API client to Put or Reset a license will now always return an error.	4 years ago
Iryna Shustava	d7d44f6ae7	Save exposed ports in agent's store and expose them via API (#10173 ) * Save exposed HTTP or GRPC ports to the agent's store * Add those the health checks API so we can retrieve them from the API * Change redirect-traffic command to also exclude those ports from inbound traffic redirection when expose.checks is set to true.	4 years ago
Daniel Nephin	0f53d6e119	api: fix mesh config entry tests for default namespace	4 years ago
Mark Anderson	f808a25a73	Fixup checksums for tests Signed-off-by: Mark Anderson <manderson@hashicorp.com>	4 years ago
Mark Anderson	4d0346bc46	Fixup filtering tests Missed annotations for SocketPath, LocalSocketPath, LocalServiceSocketPath Signed-off-by: Mark Anderson <manderson@hashicorp.com>	4 years ago
Daniel Nephin	347f3d2128	Merge pull request #10155 from hashicorp/dnephin/config-entry-remove-fields config-entry: remove Kind and Name field from Mesh config entry	4 years ago
Daniel Nephin	c8c85523e1	config-entries: add a test for the API client Also fixes a bug with listing kind=mesh config entries. ValidateConfigEntryKind was only being used by the List endpoint, and was yet another place where we have to enumerate all the kinds. This commit removes ValidateConfigEntryKind and uses MakeConfigEntry instead. This change removes the need to maintain two separate functions at the cost of creating an instance of the config entry which will be thrown away immediately.	4 years ago
Mark Anderson	8040f91a43	Add support for downstreams Enhance config by adding SocketPath and LocalSocketPath config values Supports syntax of the form: ``` services { name = "sock_forwarder" id = "sock_forwarder.1" socket_path = "/tmp/downstream_3.sock" connect { sidecar_service { proxy { local_service_socket_path = "/tmp/downstream.sock" } } } } ``` Signed-off-by: Mark Anderson <manderson@hashicorp.com>	4 years ago
Mark Anderson	583ae65d5b	Convert mode to string representation Signed-off-by: Mark Anderson <manderson@hashicorp.com>	4 years ago
Mark Anderson	8b1217417a	First changes for unix domain sockets upstreams Start making structure changes to support unix domain socket address for upstreams upstreams = [ { destination_name = "echo-service" local_bind_socket_path = "/tmp/upstream.sock" config { passive_health_check { interval = "10s" max_failures = 42 } } } Signed-off-by: Mark Anderson <manderson@hashicorp.com>	4 years ago
Daniel Nephin	a07a58a873	config-entry: use custom MarshalJSON for mesh type So that the Kind field is added to the JSON object.	4 years ago
Daniel Nephin	62efaaab21	config-entry: remove Kind and Name field from Mesh config entry No config entry needs a Kind field. It is only used to determine the Go type to target. As we introduce new config entries (like this one) we can remove the kind field and have the GetKind method return the single supported value. In this case (similar to proxy-defaults) the Name field is also unnecessary. We always use the same value. So we can omit the name field entirely.	4 years ago
Freddy	078c40425f	Rename "cluster" config entry to "mesh" (#10127 ) This config entry is being renamed primarily because in k8s the name cluster could be confusing given that the config entry applies across federated datacenters. Additionally, this config entry will only apply to Consul as a service mesh, so the more generic "cluster" name is not needed.	4 years ago
R.B. Boyer	4db8b78854	connect: update centralized upstreams representation in service-defaults (#10015 )	4 years ago
freddygv	7cb3f32672	Convert new tproxy structs in api module into ptrs This way we avoid serializing these when empty. Otherwise users of the latest version of the api submodule cannot interact with older versions of Consul, because a new api client would send keys that the older Consul doesn't recognize yet.	4 years ago
freddygv	7bd51ff536	Replace TransparentProxy bool with ProxyMode This PR replaces the original boolean used to configure transparent proxy mode. It was replaced with a string mode that can be set to: - "": Empty string is the default for when the setting should be defaulted from other configuration like config entries. - "direct": Direct mode is how applications originally opted into the mesh. Proxy listeners need to be dialed directly. - "transparent": Transparent mode enables configuring Envoy as a transparent proxy. Traffic must be captured and redirected to the inbound and outbound listeners. This PR also adds a struct for transparent proxy specific configuration. Initially this is not stored as a pointer. Will revisit that decision before GA.	4 years ago
freddygv	98ba582797	Fixup mesh gateway docs	4 years ago
Freddy	a02245b75a	Merge pull request #9976 from hashicorp/centralized-upstream-fixups	4 years ago
freddygv	d6db67ef86	Fixup test	4 years ago
Daniel Nephin	5d21d4d77f	Merge pull request #9925 from hashicorp/dnephin/update-memberlist Update memberlist to v0.2.3	4 years ago
freddygv	ab752c1c86	Avoid sending zero-value upstream defaults from api	4 years ago
R.B. Boyer	499fee73b3	connect: add toggle to globally disable wildcard outbound network access when transparent proxy is enabled (#9973 ) This adds a new config entry kind "cluster" with a single special name "cluster" where this can be controlled.	4 years ago
Daniel Nephin	46279547ec	Update memberlist to v0.2.3 To pickup data race fixes	4 years ago
Seth Hoenig	cd1cd4febd	api: enable query options on agent endpoints This PR adds support for setting QueryOptions on a few agent API endpoints. Nomad needs to be able to set the Namespace field on these endpoints to: - query for services / checks in a namespace - deregister services / checks in a namespace - update TTL status on checks in a namespace	4 years ago
Freddy	8207b832df	Add TransparentProxy option to proxy definitions	4 years ago
Freddy	c664938bae	Add per-upstream configuration to service-defaults	4 years ago
Christopher Broglie	f0307c73e5	Add support for configuring TLS ServerName for health checks Some TLS servers require SNI, but the Golang HTTP client doesn't include it in the ClientHello when connecting to an IP address. This change adds a new TLSServerName field to health check definitions to optionally set it. This fixes #9473.	4 years ago
freddygv	6090cfcf68	PR comments	4 years ago
freddygv	8b46d8dcbb	Restore old Envoy prefix on escape hatches This is done because after removing ID and NodeName from ServiceConfigRequest we will no longer know whether a request coming in is for a Consul client earlier than v1.10.	4 years ago
freddygv	41b2ba1e58	Add omitempty across the board for UpstreamConfig	4 years ago
Matt Keeler	30903db442	AutopilotServerHealth now handles the 429 status code (#8599 ) AutopilotServerHealthy now handles the 429 status code Previously we would error out and not parse the response. Now either a 200 or 429 status code are considered expected statuses and will result in the method returning the reply allowing API consumers to not only see if the system is healthy or not but which server is unhealthy.	4 years ago
freddygv	23ffa3d3f3	And another test fix	4 years ago
Kyle Havlovitz	1e87c7183a	Merge pull request #9672 from hashicorp/ca-force-skip-xc connect/ca: Allow ForceWithoutCrossSigning for all providers	4 years ago
freddygv	6fd30d0384	Add TransparentProxy opt to proxy definition	4 years ago
freddygv	e3dc2a49df	Turn Limits and PassiveHealthChecks into pointers	4 years ago
freddygv	87cde19b4c	Create new types for service-defaults upstream cfg	4 years ago
Mark Anderson	b9d22f48cd	Add fields to the /acl/auth-methods endpoint. (#9741 ) * A GET of the /acl/auth-method/:name endpoint returns the fields MaxTokenTTL and TokenLocality, while a LIST (/acl/auth-methods) does not. The list command returns a filtered subset of the full set. This is somewhat deliberate, so that secrets aren't shown, but the TTL and Locality fields aren't (IMO) security critical, and it is useful for the front end to be able to show them. For consistency these changes mirror the 'omit empty' and string representation choices made for the GET call. This includes changes to the gRPC and API code in the client. The new output looks similar to this curl 'http://localhost:8500/v1/acl/auth-methods' \| jq '.' { "MaxTokenTTL": "8m20s", "Name": "minikube-ttl-local2", "Type": "kubernetes", "Description": "minikube auth method", "TokenLocality": "local", "CreateIndex": 530, "ModifyIndex": 530, "Namespace": "default" } ] Signed-off-by: Mark Anderson <manderson@hashicorp.com> * Add changelog Signed-off-by: Mark Anderson <manderson@hashicorp.com>	4 years ago
Kyle Havlovitz	7dac583863	connect/ca: Allow ForceWithoutCrossSigning for all providers This allows setting ForceWithoutCrossSigning when reconfiguring the CA for any provider, in order to forcibly move to a new root in cases where the old provider isn't reachable or able to cross-sign for whatever reason.	4 years ago
Conor Mongey	7a368bd2b6	Move header methods from config to client	4 years ago
Conor Mongey	eb65e59741	Only override headers if they're set	4 years ago
Conor Mongey	f647569b84	Prefer http.Header over map[string]string to allow for multi-valued headers	4 years ago
Conor Mongey	cdc8cd7b0e	Allow setting arbitrary headers in API client	4 years ago
Daniel Nephin	5a7f4c0dea	Merge pull request #8609 from hashicorp/dnephin/add-query-options-to-ServiceRegister api: Add a context to ServiceRegisterOpts	4 years ago
Mike Morris	ab927d5480	Merge pull request #9270 from hashicorp/release/1.9.0 merge: release/1.9.0 back into 1.9.x	4 years ago
R.B. Boyer	7c7a3e5165	command: when generating envoy bootstrap configs use the datacenter returned from the agent services endpoint (#9229 ) Fixes #9215	4 years ago
Matt Keeler	66fd23d67f	Refactor to call non-voting servers read replicas (#9191 ) Co-authored-by: Kit Patella <kit@jepsen.io>	4 years ago
Freddy	fe728855ed	Add DC and NS support for Envoy metrics (#9207 ) This PR updates the tags that we generate for Envoy stats. Several of these come with breaking changes, since we can't keep two stats prefixes for a filter.	4 years ago
Matt Keeler	7f87adbcf4	Remove this constant as it is soon to be changing and we want to prevent backwards compat issues (#9193 )	4 years ago
R.B. Boyer	61eac21f1a	agent: return the default ACL policy to callers as a header (#9101 ) Header is: X-Consul-Default-ACL-Policy=<allow\|deny> This is of particular utility when fetching matching intentions, as the fallthrough for a request that doesn't match any intentions is to enforce using the default acl policy.	4 years ago
Matt Keeler	7ef9b04f90	Add a CLI command for retrieving the autopilot configuration. (#9142 )	4 years ago
Matt Keeler	c048e86bb2	Switch to using the external autopilot module	4 years ago
R.B. Boyer	8baf158ea8	Revert "Add namespace support for metrics (OSS) (#9117 )" (#9124 ) This reverts commit `06b3b017d3`.	4 years ago
Freddy	06b3b017d3	Add namespace support for metrics (OSS) (#9117 )	4 years ago
R.B. Boyer	e113dc0fe2	upstream some differences from enterprise (#8902 )	4 years ago
Matt Keeler	38f5ddce2a	Add per-agent reconnect timeouts (#8781 ) This allows for client agent to be run in a more stateless manner where they may be abruptly terminated and not expected to come back. If advertising a per-agent reconnect timeout using the advertise_reconnect_timeout configuration when that agent leaves, other agents will wait only that amount of time for the agent to come back before reaping it. This has the advantageous side effect of causing servers to deregister the node/services/checks for that agent sooner than if the global reconnect_timeout was used.	4 years ago
R.B. Boyer	0c9177f6a5	api: unflake some intention-related api tests (#8857 )	4 years ago
R.B. Boyer	1b413b0444	connect: support defining intentions using layer 7 criteria (#8839 ) Extend Consul’s intentions model to allow for request-based access control enforcement for HTTP-like protocols in addition to the existing connection-based enforcement for unspecified protocols (e.g. tcp).	4 years ago
R.B. Boyer	a2a8e9c783	connect: intentions are now managed as a new config entry kind "service-intentions" (#8834 ) - Upgrade the ConfigEntry.ListAll RPC to be kind-aware so that older copies of consul will not see new config entries it doesn't understand replicate down. - Add shim conversion code so that the old API/CLI method of interacting with intentions will continue to work so long as none of these are edited via config entry endpoints. Almost all of the read-only APIs will continue to function indefinitely. - Add new APIs that operate on individual intentions without IDs so that the UI doesn't need to implement CAS operations. - Add a new serf feature flag indicating support for intentions-as-config-entries. - The old line-item intentions way of interacting with the state store will transparently flip between the legacy memdb table and the config entry representations so that readers will never see a hiccup during migration where the results are incomplete. It uses a piece of system metadata to control the flip. - The primary datacenter will begin migrating intentions into config entries on startup once all servers in the datacenter are on a version of Consul with the intentions-as-config-entries feature flag. When it is complete the old state store representations will be cleared. We also record a piece of system metadata indicating this has occurred. We use this metadata to skip ALL of this code the next time the leader starts up. - The secondary datacenters continue to run the old intentions replicator until all servers in the secondary DC and primary DC support intentions-as-config-entries (via serf flag). Once this condition it met the old intentions replicator ceases. - The secondary datacenters replicate the new config entries as they are migrated in the primary. When they detect that the primary has zeroed it's old state store table it waits until all config entries up to that point are replicated and then zeroes its own copy of the old state store table. We also record a piece of system metadata indicating this has occurred. We use this metadata to skip ALL of this code the next time the leader starts up.	4 years ago
R.B. Boyer	d2eb27e0a3	api: support GetMeta() and GetNamespace() on all config entry kinds (#8764 ) Fixes #8755 Since I was updating the interface, i also added the missing `GetNamespace()`. Depending upon how you look at it, this is a breaking change since it adds methods to the exported interface `api.ConfigEntry`. Given that you cannot define your own config entry kinds, and all of the machinery of the `api.Client` acts like a factory to construct the canned ones from the rest of the module, this feels like it's not a problematic change as it would only break someone who had reimplemented the `ConfigEntry` interface themselves for no apparent utility?	4 years ago
freddygv	7b9d1b41d5	Resolve conflicts against master	4 years ago
freddygv	768dbaa68d	Add session flag to cookie config	4 years ago
freddygv	eab90ea9fa	Revert EnvoyConfig nesting	4 years ago
Seth Hoenig	9fab3fe990	api: create fresh http client for unix sockets (#8602 ) Co-authored-by: Matt Keeler <mkeeler@users.noreply.github.com>	4 years ago
Freddy	c9c9e4face	Make LockDelay configurable in api locks (#8621 )	4 years ago
Daniel Nephin	d083d4717b	api: Add a context to ServiceRegisterOpts So that operations can timeout instead of hanging forever	4 years ago
freddygv	eaa250cc80	Ensure resolver node with LB isn't considered default	4 years ago
freddygv	f81fe6a1a1	Remove LB infix and move injection to xds	4 years ago
R.B. Boyer	119e945c3e	connect: all config entries pick up a meta field (#8596 ) Fixes #8595	4 years ago
freddygv	63f79e5f9b	Restructure structs and other PR comments	4 years ago
freddygv	0236e169bb	Add documentation for resolver LB cfg	4 years ago
freddygv	ff56a64b08	Add LB policy to service-resolver	4 years ago
Jack	9e1c6727f9	Add http2 and grpc support to ingress gateways (#8458 )	4 years ago
Matt Keeler	7c3914d89e	Add helpers to the API client to help with getting information from `AgentMember` tags (#8575 ) Lots of constants were added for various tags that would concern users and are not already parsed out. Additionally two methods on the AgentMember type were added to ask a member what its ACL Mode is and whether its a server or not.	4 years ago
Hans Hasselberg	a932aafc91	add primary keys to list keyring (#8522 ) During gossip encryption key rotation it would be nice to be able to see if all nodes are using the same key. This PR adds another field to the json response from `GET v1/operator/keyring` which lists the primary keys in use per dc. That way an operator can tell when a key was successfully setup as primary key. Based on https://github.com/hashicorp/serf/pull/611 to add primary key to list keyring output: ```json [ { "WAN": true, "Datacenter": "dc2", "Segment": "", "Keys": { "0OuM4oC3Os18OblWiBbZUaHA7Hk+tNs/6nhNYtaNduM=": 6, "SINm887hKTzmMWeBNKTJReaTLX3mBEJKriDyt88Ad+g=": 6 }, "PrimaryKeys": { "SINm887hKTzmMWeBNKTJReaTLX3mBEJKriDyt88Ad+g=": 6 }, "NumNodes": 6 }, { "WAN": false, "Datacenter": "dc2", "Segment": "", "Keys": { "0OuM4oC3Os18OblWiBbZUaHA7Hk+tNs/6nhNYtaNduM=": 8, "SINm887hKTzmMWeBNKTJReaTLX3mBEJKriDyt88Ad+g=": 8 }, "PrimaryKeys": { "SINm887hKTzmMWeBNKTJReaTLX3mBEJKriDyt88Ad+g=": 8 }, "NumNodes": 8 }, { "WAN": false, "Datacenter": "dc1", "Segment": "", "Keys": { "0OuM4oC3Os18OblWiBbZUaHA7Hk+tNs/6nhNYtaNduM=": 3, "SINm887hKTzmMWeBNKTJReaTLX3mBEJKriDyt88Ad+g=": 8 }, "PrimaryKeys": { "SINm887hKTzmMWeBNKTJReaTLX3mBEJKriDyt88Ad+g=": 8 }, "NumNodes": 8 } ] ``` I intentionally did not change the CLI output because I didn't find a good way of displaying this information. There are a couple of options that we could implement later: * add a flag to show the primary keys * add a flag to show json output Fixes #3393.	4 years ago
Daniel Nephin	d68edcecf4	testing: Remove all the defer os.Removeall Now that testutil uses t.Cleanup to remove the directory the caller no longer has to manage the removal	4 years ago
Mike Morris	48e7c07cf9	api: bump consul/api to v1.6.0 and consul/sdk to v0.6.0 (#8460 ) * api: bump consul/sdk dependency to v0.6.0 * api: bump dependency to v1.6.0	4 years ago
Daniel Nephin	ed8210fe4d	api: Use a Logger instead of an io.Writer in api.Watch So that we can pass around only a Logger, not a LogOutput	4 years ago
Mike Morris	85ef7ba943	api: restore Leader() and Peers() to avoid breaking function signatures (#8395 ) api: add TestAPI_StatusLeaderWithQueryOptions and TestAPI_StatusPeersWithQueryOptions api: make TestAPI_Status* error messages more verbose	4 years ago
spooner	c34b088583	Added QueryOptions for status api (#7818 ) * Added QueryOptions & Tests for status api	4 years ago
R.B. Boyer	e853368c23	gossip: Avoid issue where two unique leave events for the same node could lead to infinite rebroadcast storms (#8343 ) bump serf to v0.9.3 to include fix for https://github.com/hashicorp/serf/pull/606	4 years ago
Daniel Nephin	51efba2c7d	testutil: NewLogBuffer - buffer logs until a test fails Replaces #7559 Running tests in parallel, with background goroutines, results in test output not being associated with the correct test. `go test` does not make any guarantees about output from goroutines being attributed to the correct test case. Attaching log output from background goroutines also cause data races. If the goroutine outlives the test, it will race with the test being marked done. Previously this was noticed as a panic when logging, but with the race detector enabled it is shown as a data race. The previous solution did not address the problem of correct test attribution because test output could still be hidden when it was associated with a test that did not fail. You would have to look at all of the log output to find the relevant lines. It also made debugging test failures more difficult because each log line was very long. This commit attempts a new approach. Instead of printing all the logs, only print when a test fails. This should work well when there are a small number of failures, but may not work well when there are many test failures at the same time. In those cases the failures are unlikely a result of a specific test, and the log output is likely less useful. All of the logs are printed from the test goroutine, so they should be associated with the correct test. Also removes some test helpers that were not used, or only had a single caller. Packages which expose many functions with similar names can be difficult to use correctly. Related: https://github.com/golang/go/issues/38458 (may be fixed in go1.15) https://github.com/golang/go/issues/38382#issuecomment-612940030	4 years ago
Freddy	e72af87918	Add api mod support for /catalog/gateway-services (#8278 )	4 years ago
Seth Hoenig	95f46eb3ed	api/agent: enable setting SuccessBeforePassing and FailuresBeforeCritical in API (#7949 ) Fixes #7764 Until now these two fields could only be set through on-disk agent configuration. This change adds the fields to the agent API struct definition so that they can be set using the agent HTTP API.	4 years ago
R.B. Boyer	462f0f37ed	connect: various changes to make namespaces for intentions work more like for other subsystems (#8194 ) Highlights: - add new endpoint to query for intentions by exact match - using this endpoint from the CLI instead of the dump+filter approach - enforcing that OSS can only read/write intentions with a SourceNS or DestinationNS field of "default". - preexisting OSS intentions with now-invalid namespace fields will delete those intentions on initial election or for wildcard namespaces an attempt will be made to downgrade them to "default" unless one exists. - also allow the '-namespace' CLI arg on all of the intention subcommands - update lots of docs	4 years ago
freddygv	c791fbc79c	Update namespaces subject-verb agreement	4 years ago
s-christoff	818d00fda3	Add AgentMemberStatus const (#8110 ) * Add AgentMemberStatus const	4 years ago
Daniel Nephin	5afcf5c1bc	Merge pull request #8034 from hashicorp/dnephin/add-linter-staticcheck-4 ci: enable SA4006 staticcheck check and add ineffassign	5 years ago
Daniel Nephin	068b43df90	Enable gofmt simplify Code changes done automatically with 'gofmt -s -w'	5 years ago
Daniel Nephin	cb050b280c	ci: enable SA4006 staticcheck check And fix the 'value not used' issues. Many of these are not bugs, but a few are tests not checking errors, and one appears to be a missed error in non-test code.	5 years ago
Matt Keeler	d3881dd754	ACL Node Identities (#7970 ) A Node Identity is very similar to a service identity. Its main targeted use is to allow creating tokens for use by Consul agents that will grant the necessary permissions for all the typical agent operations (node registration, coordinate updates, anti-entropy). Half of this commit is for golden file based tests of the acl token and role cli output. Another big updates was to refactor many of the tests in agent/consul/acl_endpoint_test.go to use the same style of tests and the same helpers. Besides being less boiler plate in the tests it also uses a common way of starting a test server with ACLs that should operate without any warnings regarding deprecated non-uuid master tokens etc.	5 years ago
Chris Piraino	91ab89dd48	Move ingress param to a new endpoint (#8081 ) In discussion with team, it was pointed out that query parameters tend to be filter mechanism, and that semantically the "/v1/health/connect" endpoint should return "all healthy connect-enabled endpoints (e.g. could be side car proxies or native instances) for this service so I can connect with mTLS". That does not fit an ingress gateway, so we remove the query parameter and add a new endpoint "/v1/health/ingress" that semantically means "all the healthy ingress gateway instances that I can connect to to access this connect-enabled service without mTLS"	5 years ago
Chris Piraino	496e683360	Merge pull request #8064 from hashicorp/ingress/health-query-param Add API query parameter ?ingress to allow users to find ingress gateways associated to a service	5 years ago
Chris Piraino	5e0cd7ede5	Remove unnecessary defer from api.health_test.go We do not need to deregister services because every test gets its own instance of the client agent and the tmp directories are all deleted at the end.	5 years ago
Daniel Nephin	08f1ed16b4	Merge pull request #7900 from hashicorp/dnephin/add-linter-staticcheck-2 intentions: fix a bug in Intention.SetHash	5 years ago
Chris Piraino	4837069fe0	api: update api module with health.Ingress() method	5 years ago
Daniel Nephin	caa692deea	ci: Enabled SA2002 staticcheck check And handle errors in the main test goroutine	5 years ago
Daniel Nephin	ce6cc094a1	intentions: fix a bug in Intention.SetHash Found using staticcheck. binary.Write does not accept int types without a size. The error from binary.Write was ignored, so we never saw this error. Casting the data to uint64 produces a correct hash. Also deprecate the Default{Addr,Port} fields, and prevent them from being encoded. These fields will always be empty and are not used. Removing these would break backwards compatibility, so they are left in place for now. Co-authored-by: Hans Hasselberg <me@hans.io>	5 years ago
R.B. Boyer	833211c14c	acl: allow auth methods created in the primary datacenter to optionally create global tokens (#7899 )	5 years ago
R.B. Boyer	ffb9c7d6f7	acl: remove the deprecated `acl_enforce_version_8` option (#7991 ) Fixes #7292	5 years ago
Jono Sosulska	c554ba9e10	Replace whitelist/blacklist terminology with allowlist/denylist (#7971 ) * Replace whitelist/blacklist terminology with allowlist/denylist	5 years ago
Daniel Nephin	c88fae0aac	ci: Add staticcheck and fix most errors Three of the checks are temporarily disabled to limit the size of the diff, and allow us to enable all the other checks in CI. In a follow up we can fix the issues reported by the other checks one at a time, and enable them.	5 years ago
Daniel Nephin	8ced4300c8	Add alias struct tags for new decode hook	5 years ago
Daniel Nephin	600645b5f9	Add unconvert linter To find unnecessary type convertions	5 years ago
R.B. Boyer	1efafd7523	acl: add auth method for JWTs (#7846 )	5 years ago
Kyle Havlovitz	136549205c	Merge pull request #7759 from hashicorp/ingress/tls-hosts Add TLS option for Ingress Gateway listeners	5 years ago
Chris Piraino	5105bf3d67	Require individual services in ingress entry to match protocols (#7774 ) We require any non-wildcard services to match the protocol defined in the listener on write, so that we can maintain a consistent experience through ingress gateways. This also helps guard against accidental misconfiguration by a user. - Update tests that require an updated protocol for ingress gateways	5 years ago
Chris Piraino	0c22eacca8	Add TLS field to ingress API structs - Adds test in api and command/config/write packages	5 years ago
Chris Piraino	d8517bd6fd	Better document wildcard specifier interactions	5 years ago
Chris Piraino	f40833d094	Allow Hosts field to be set on an ingress config entry - Validate that this cannot be set on a 'tcp' listener nor on a wildcard service. - Add Hosts field to api and test in consul config write CLI - xds: Configure envoy with user-provided hosts from ingress gateways	5 years ago
Chris Piraino	b73a13fc9e	Remove service_subset field from ingress config entry We decided that this was not a useful MVP feature, and just added unnecessary complexity	5 years ago
R.B. Boyer	a854e4d9c5	acl: oss plumbing to support auth method namespace rules in enterprise (#7794 ) This includes website docs updates.	5 years ago
R.B. Boyer	22eb016153	acl: add MaxTokenTTL field to auth methods (#7779 ) When set to a non zero value it will limit the ExpirationTime of all tokens created via the auth method.	5 years ago
R.B. Boyer	ca52ba7068	acl: add DisplayName field to auth methods (#7769 ) Also add a few missing acl fields in the api.	5 years ago
Freddy	137a2c32c6	TLS Origination for Terminating Gateways (#7671 )	5 years ago
Chris Piraino	115d2d5db5	Expect default enterprise metadata in gateway tests (#7664 ) This makes it so that both OSS and enterprise tests pass correctly In the api tests, explicitly set namespace to empty string so that tests can be shared.	5 years ago
Matt Keeler	d24b65b8f0	Update API module to include the licensed modules in its output (#7661 )	5 years ago
Kyle Havlovitz	e9e8c0e730	Ingress Gateways for TCP services (#7509 ) * Implements a simple, tcp ingress gateway workflow This adds a new type of gateway for allowing Ingress traffic into Connect from external services. Co-authored-by: Chris Piraino <cpiraino@hashicorp.com>	5 years ago
Chris Piraino	3d2de925d8	Add support for ingress-gateway in CLI command (#7618 ) * Add support for ingress-gateway in CLI command - Supports -register command - Creates a static Envoy listener that exposes only the /ready API so that we can register a TCP healthcheck against the ingress gateway itself - Updates ServiceAddressValue.String() to be more in line with Value()	5 years ago
Daniel Nephin	6b860c926f	Merge pull request #7608 from hashicorp/dnephin/grpc-default-scheme command/envoy: enable TLS when CONSUL_HTTP_ADDR=https://...	5 years ago
Freddy	9eb1867fbb	Terminating gateway discovery (#7571 ) * Enable discovering terminating gateways * Add TerminatingGatewayServices to state store * Use GatewayServices RPC endpoint for ingress/terminating	5 years ago
Daniel Nephin	0888c6575b	Step 3: fix a bug in api.NewClient and fix the tests The api client should never rever to HTTP if the user explicitly requested TLS. This change broke some tests because the tests always use an non-TLS http server, but some tests explicitly enable TLS.	5 years ago
Pierre Souchay	4d35816bee	tests: fixed unstable test TestAPI_AgentMonitor (#7561 ) Similar fix as https://github.com/hashicorp/consul/pull/7541	5 years ago
Freddy	90576060bc	Add config entry for terminating gateways (#7545 ) This config entry will be used to configure terminating gateways. It accepts the name of the gateway and a list of services the gateway will represent. For each service users will be able to specify: its name, namespace, and additional options for TLS origination. Co-authored-by: Kyle Havlovitz <kylehav@gmail.com> Co-authored-by: Chris Piraino <cpiraino@hashicorp.com>	5 years ago
Kyle Havlovitz	c911174327	Add config entry/state for Ingress Gateways (#7483 ) * Add Ingress gateway config entry and other relevant structs * Add api package tests for ingress gateways * Embed EnterpriseMeta into ingress service struct * Add namespace fields to api module and test consul config write decoding * Don't require a port for ingress gateways * Add snakeJSON and camelJSON cases in command test * Run Normalize on service's ent metadata Sadly cannot think of a way to test this in OSS. * Every protocol requires at least 1 service * Validate ingress protocols * Update agent/structs/config_entry_gateways.go Co-authored-by: Chris Piraino <cpiraino@hashicorp.com> Co-authored-by: Freddy <freddygv@users.noreply.github.com>	5 years ago
Pierre Souchay	f1f778ffcc	FIX flaky test: TestAPI_AgentMonitorJSON	5 years ago
Freddy	18d356899c	Enable CLI to register terminating gateways (#7500 ) * Enable CLI to register terminating gateways * Centralize gateway proxy configuration	5 years ago
Alejandro Baez	bafa69bb69	Add PolicyReadByName for API (#6615 )	5 years ago
Daniel Nephin	3f8578f1e1	ci: Use golangci-lint for linting Using golangci-lint has a number of advantages: - adding new linters becomes much easier, its a couple lines of yaml config instead of more bash scripting - it enables whitelisting of issues using inline comments or regex - when running multiple linters less work is done. The parsed source can be reused by multiple linters - linters are run in parallel to reduce CI runtime.	5 years ago
R.B. Boyer	6adad71125	wan federation via mesh gateways (#6884 ) This is like a Möbius strip of code due to the fact that low-level components (serf/memberlist) are connected to high-level components (the catalog and mesh-gateways) in a twisty maze of references which make it hard to dive into. With that in mind here's a high level summary of what you'll find in the patch: There are several distinct chunks of code that are affected: * new flags and config options for the server * retry join WAN is slightly different * retry join code is shared to discover primary mesh gateways from secondary datacenters * because retry join logic runs in the agent and the results of that operation for primary mesh gateways are needed in the server there are some methods like `RefreshPrimaryGatewayFallbackAddresses` that must occur at multiple layers of abstraction just to pass the data down to the right layer. * new cache type `FederationStateListMeshGatewaysName` for use in `proxycfg/xds` layers * the function signature for RPC dialing picked up a new required field (the node name of the destination) * several new RPCs for manipulating a FederationState object: `FederationState:{Apply,Get,List,ListMeshGateways}` * 3 read-only internal APIs for debugging use to invoke those RPCs from curl * raft and fsm changes to persist these FederationStates * replication for FederationStates as they are canonically stored in the Primary and replicated to the Secondaries. * a special derivative of anti-entropy that runs in secondaries to snapshot their local mesh gateway `CheckServiceNodes` and sync them into their upstream FederationState in the primary (this works in conjunction with the replication to distribute addresses for all mesh gateways in all DCs to all other DCs) * a "gateway locator" convenience object to make use of this data to choose the addresses of gateways to use for any given RPC or gossip operation to a remote DC. This gets data from the "retry join" logic in the agent and also directly calls into the FSM. * RPC (`:8300`) on the server sniffs the first byte of a new connection to determine if it's actually doing native TLS. If so it checks the ALPN header for protocol determination (just like how the existing system uses the type-byte marker). * 2 new kinds of protocols are exclusively decoded via this native TLS mechanism: one for ferrying "packet" operations (udp-like) from the gossip layer and one for "stream" operations (tcp-like). The packet operations re-use sockets (using length-prefixing) to cut down on TLS re-negotiation overhead. * the server instances specially wrap the `memberlist.NetTransport` when running with gateway federation enabled (in a `wanfed.Transport`). The general gist is that if it tries to dial a node in the SAME datacenter (deduced by looking at the suffix of the node name) there is no change. If dialing a DIFFERENT datacenter it is wrapped up in a TLS+ALPN blob and sent through some mesh gateways to eventually end up in a server's :8300 port. * a new flag when launching a mesh gateway via `consul connect envoy` to indicate that the servers are to be exposed. This sets a special service meta when registering the gateway into the catalog. * `proxycfg/xds` notice this metadata blob to activate additional watches for the FederationState objects as well as the location of all of the consul servers in that datacenter. * `xds:` if the extra metadata is in place additional clusters are defined in a DC to bulk sink all traffic to another DC's gateways. For the current datacenter we listen on a wildcard name (`server.<dc>.consul`) that load balances all servers as well as one mini-cluster per node (`<node>.server.<dc>.consul`) * the `consul tls cert create` command got a new flag (`-node`) to help create an additional SAN in certs that can be used with this flavor of federation.	5 years ago
Matt Keeler	80ed304e04	Run make update-vendor and fixup various go.sum files go mod tidy removes these lines because we have a replace directive	5 years ago
Matt Keeler	77074be9b8	Bump sdk module version to 0.4.0	5 years ago
Akshay Ganeshen	8beb716414	feat: support sending body in HTTP checks (#6602 )	5 years ago
Matt Keeler	d0cd092e3b	Catalog + Namespace OSS changes. (#7219 ) * Various Prepared Query + Namespace things * Last round of OSS changes for a namespaced catalog	5 years ago
Fouad Zaryouh	ef6399928d	api: add replace-existing-checks param to the api package (#7136 )	5 years ago
Matt Keeler	6855a778c2	Updates to the Txn API for namespaces (#7172 ) * Updates to the Txn API for namespaces * Update agent/consul/txn_endpoint.go Co-Authored-By: R.B. Boyer <rb@hashicorp.com> Co-authored-by: R.B. Boyer <public@richardboyer.net>	5 years ago
Chris Piraino	401221de58	Allow users to configure either unstructured or JSON logging (#7130 ) * hclog Allow users to choose between unstructured and JSON logging	5 years ago
Michel Vocks	6681be918a	api: add option to set TLS options in-memory for API client (#7093 ) This PR adds the option to set in-memory certificates to the API client instead of requiring the certificate to be stored on disk in a file. This allows us to define API client TLS options per Consul secret backend in Vault. Related issue hashicorp/vault#4800	5 years ago
Matt Keeler	b57c2b78fd	Unflake the TestAPI_AgentConnectCALeaf test (#7142 ) * Unflake the TestAPI_AgentConnectCALeaf test * Modify the WaitForActiveCARoot to actually verify that at least one root exists Also verify that the active root id field is set	5 years ago
Matt Keeler	c09693e545	Updates to Config Entries and Connect for Namespaces (#7116 )	5 years ago
Matt Keeler	bbc2eb1951	Add the v1/catalog/node-services/:node endpoint (#7115 ) The backing RPC already existed but the endpoint will be useful for other service syncing processes such as consul-k8s as this endpoint can return all services registered with a node regardless of namespacing.	5 years ago
R.B. Boyer	4af5c2d6dd	fix the submodule go.mod and go.sum files (#7098 )	5 years ago
Paul Banks	1807af552e	Fix TestAPI_DiscoveryChain_Get flake (#7082 )	5 years ago
Hans Hasselberg	804eb17094	connect: check if intermediate cert needs to be renewed. (#6835 ) Currently when using the built-in CA provider for Connect, root certificates are valid for 10 years, however secondary DCs get intermediates that are valid for only 1 year. There is no mechanism currently short of rotating the root in the primary that will cause the secondary DCs to renew their intermediates. This PR adds a check that renews the cert if it is half way through its validity period. In order to be able to test these changes, a new configuration option was added: IntermediateCertTTL which is set extremely low in the tests.	5 years ago
Aestek	ba8fd8296f	Add support for dual stack IPv4/IPv6 network (#6640 ) * Use consts for well known tagged adress keys * Add ipv4 and ipv6 tagged addresses for node lan and wan * Add ipv4 and ipv6 tagged addresses for service lan and wan * Use IPv4 and IPv6 address in DNS	5 years ago
neillyt	a2ab9b4aee	Fix Namespace Typo (#7030 )	5 years ago
Matt Keeler	34e6e23d43	Change how namespaces are specified for the CLI (#6960 )	5 years ago
Freddy	37dfe6d112	Add kv meta to namespaces api module (#6958 )	5 years ago
R.B. Boyer	7ac47d6f61	build: fix makefile and CI 'fmt' and 'vet' tasks (#6937 )	5 years ago

... 3 4 5 6 7 ...

919 Commits (dc02fa695f423d10ff173c325abcc44f934b8e83)