e37f702d92
Fix typo in Envoy extensions doc ( #18284 )
2023-07-26 17:02:41 +00:00
d147c3e5cd
docs: Consul on Kubernetes specific upgrade info ( #18230 )
...
* Compatibility page - dataplanes mention
* Upgrading higher-level dataplane mention
* `exec=` string callout
* More visible for upgrade page
* Apply suggestions from code review
Co-authored-by: Tu Nguyen <im2nguyen@users.noreply.github.com>
---------
Co-authored-by: Tu Nguyen <im2nguyen@users.noreply.github.com>
Co-authored-by: John Murret <john.murret@hashicorp.com>
2023-07-26 07:03:07 -07:00
02cf17758d
docs: Update ext-authz documentation for kubernetes ( #18281 )
...
Update ext-authz documentation for kubernetes
2023-07-26 00:38:39 +00:00
9b540e29bc
go-tests: disable s390x ( #18273 )
2023-07-25 10:58:12 -07:00
31d2813714
member cli: add -filter expression to flags ( #18223 )
...
* member cli: add -filter expression to flags
* changelog
* update doc
* Add test cases
* use quote
2023-07-25 13:54:52 -04:00
090e869a55
fix typos, style, and improper links ( #18269 )
2023-07-24 16:37:00 -07:00
319a2239d3
NET-4897 - update comment to include the current issue url from the go team. ( #18263 )
2023-07-24 21:27:19 +00:00
9a82df27ba
[NET-3700] Backfill changelog entry for c2bbe67 and 7402d06 ( #18259 )
...
Backfill changelog entry for c2bbe67
2023-07-24 14:30:45 -04:00
4d3f9a1ee2
grafana: add the panel resource usage of connect injector ( #18247 )
2023-07-24 13:10:22 -04:00
b7cdd18575
NET-1825: More new ACL token creation docs ( #18063 )
...
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
2023-07-24 16:53:00 +00:00
b162c51523
Fix some inconsistencies in jwt docs ( #18234 )
2023-07-24 16:36:26 +00:00
efb45fe851
resource: Add scope to resource type registration [NET-4976] ( #18214 )
...
Enables querying a resource type's registration to determine if a resource is cluster, partition, or partition and namespace scoped.
2023-07-24 11:34:30 -05:00
639210e28d
Revert "NET-4996 - filter go-tests and test-integration workflows from running on docs only and ui only changes" ( #18248 )
...
Revert "NET-4996 - filter go-tests and test-integration workflows from running on docs only and ui only changes (#18236 )"
This reverts commit a11dba710e
2023-07-24 10:05:43 -06:00
8b46bac36d
Align build arch matrix with enterprise ( #18235 )
...
Ensure that OSS remains in sync w/ Enterprise by aligning the format of
arch matrix args for various build jobs.
2023-07-24 11:22:34 -04:00
a11dba710e
NET-4996 - filter go-tests and test-integration workflows from running on docs only and ui only changes ( #18236 )
2023-07-23 13:08:15 -06:00
2b0d64ee27
Fix Github Workflow File ( #18241 )
...
* [CONSUL-382] Support openssl in unique test dockerfile (#43 )
* [CONSUL-405] Add bats to single container (#44 )
* [CONSUL-414] Run Prometheus Test Cases and Validate Changes (#46 )
* [CONSUL-410] Run Jaeger in Single container (#45 )
* [CONSUL-412] Run test-sds-server in single container (#48 )
* [CONSUL-408] Clean containers (#47 )
* [CONSUL-384] Rebase and sync fork (#50 )
* [CONSUL-415] Create Scenarios Troubleshooting Docs (#49 )
* [CONSUL-417] Update Docs Single Container (#51 )
* [CONSUL-428] Add Socat to single container (#54 )
* [CONSUL-424] Replace pkill in kill_envoy function (#52 )
* [CONSUL-434] Modify Docker run functions in Helper script (#53 )
* [CONSUL-435] Replace docker run in set_ttl_check_state & wait_for_agent_service_register functions (#55 )
* [CONSUL-438] Add netcat (nc) in the Single container Dockerfile (#56 )
* [CONSUL-429] Replace Docker run with Docker exec (#57 )
* [CONSUL-436] Curl timeout and run tests (#58 )
* [CONSUL-443] Create dogstatsd Function (#59 )
* [CONSUL-431] Update Docs Netcat (#60 )
* [CONSUL-439] Parse nc Command in function (#61 )
* [CONSUL-463] Review curl Exec and get_ca_root Func (#63 )
* [CONSUL-453] Docker hostname in Helper functions (#64 )
* [CONSUL-461] Test wipe volumes without extra cont (#66 )
* [CONSUL-454] Check ports in the Server and Agent containers (#65 )
* [CONSUL-441] Update windows dockerfile with version (#62 )
* [CONSUL-466] Review case-grpc Failing Test (#67 )
* [CONSUL-494] Review case-cfg-resolver-svc-failover (#68 )
* [CONSUL-496] Replace docker_wget & docker_curl (#69 )
* [CONSUL-499] Cleanup Scripts - Remove nanoserver (#70 )
* [CONSUL-500] Update Troubleshooting Docs (#72 )
* [CONSUL-502] Pull & Tag Envoy Windows Image (#73 )
* [CONSUL-504] Replace docker run in docker_consul (#76 )
* [CONSUL-505] Change admin_bind
* [CONSUL-399] Update envoy to 1.23.1 (#78 )
* [CONSUL-510] Support case-wanfed-gw on Windows (#79 )
* [CONSUL-506] Update troubleshooting Documentation (#80 )
* [CONSUL-512] Review debug_dump_volumes Function (#81 )
* [CONSUL-514] Add zipkin to Docker Image (#82 )
* [CONSUL-515] Update Documentation (#83 )
* [CONSUL-529] Support case-consul-exec (#86 )
* [CONSUL-530] Update Documentation (#87 )
* [CONSUL-530] Update default consul version 1.13.3
* [CONSUL-539] Cleanup (#91 )
* [CONSUL-546] Scripts Clean-up (#92 )
* [CONSUL-491] Support admin_access_log_path value for Windows (#71 )
* [CONSUL-519] Implement mkfifo Alternative (#84 )
* [CONSUL-542] Create OS Specific Files for Envoy Package (#88 )
* [CONSUL-543] Create exec_supported.go (#89 )
* [CONSUL-544] Test and Build Changes (#90 )
* Implement os.DevNull
* using mmap instead of disk files
* fix import in exec-unix
* fix nmap open too many arguemtn
* go fmt on file
* changelog file
* fix go mod
* Update .changelog/17694.txt
Co-authored-by: Dhia Ayachi <dhia@hashicorp.com>
* different mmap library
* fix bootstrap json
* some fixes
* chocolatey version fix and image fix
* using different library
* fix Map funciton call
* fix mmap call
* fix tcp dump
* fix tcp dump
* windows tcp dump
* Fix docker run
* fix tests
* fix go mod
* fix version 16.0
* fix version
* fix version dev
* sleep to debug
* fix sleep
* fix permission issue
* fix permission issue
* fix permission issue
* fix command
* fix command
* fix funciton
* fix assert config entry status command not found
* fix command not found assert_cert_has_cn
* fix command not found assert_upstream_missing
* fix command not found assert_upstream_missing_once
* fix command not found get_upstream_endpoint
* fix command not found get_envoy_public_listener_once
* fix command not found
* fix test cases
* windows integration test workflow github
* made code similar to unix using npipe
* fix go.mod
* fix dialing of npipe
* dont wait
* check size of written json
* fix undefined n
* running
* fix dep
* fix syntax error
* fix workflow file
* windows runner
* fix runner
* fix from json
* fix runs on
* merge connect envoy
* fix cin path
* build
* fix file name
* fix file name
* fix dev build
* remove unwanted code
* fix upload
* fix bin name
* fix path
* checkout current branch
* fix path
* fix tests
* fix shell bash for windows sh files
* fix permission of run-test.sh
* removed docker dev
* added shell bash for tests
* fix tag
* fix win=true
* fix cd
* added dev
* fix variable undefined
* removed failing tests
* fix tcp dump image
* fix curl
* fix curl
* tcp dump path
* fix tcpdump path
* fix curl
* fix curl install
* stop removing intermediate containers
* fix tcpdump docker image
* revert -rm
* --rm=false
* makeing docker image before
* fix tcpdump
* removed case consul exec
* removed terminating gateway simple
* comment case wasm
* removed data dog
* comment out upload coverage
* uncomment case-consul-exec
* comment case consul exec
* if always
* logs
* using consul 1.17.0
* fix quotes
* revert quotes
* redirect to dev null
* Revert version
* revert consul connect
* fix version
* removed envoy connect
* not using function
* change log
* docker logs
* fix logs
* restructure bad authz
* rmeoved dev null
* output
* fix file descriptor
* fix cacert
* fix cacert
* fix ca cert
* cacert does not work in windows curl
* fix func
* removed docker logs
* added sleep
* fix tls
* commented case-consul-exec
* removed echo
* retry docker consul
* fix upload bin
* uncomment consul exec
* copying consul.exe to docker image
* copy fix
* fix paths
* fix path
* github workspace path
* latest version
* Revert "latest version"
This reverts commit 5a7d7b82d97013d15a23
2023-07-22 04:18:42 +00:00
7ce539e5f6
Clarify license reporting timing and GDPR compliance ( #18237 )
...
Add Alicia's edits to clarify log timing and other details
2023-07-21 16:08:37 -07:00
8e3a1ddeb6
[OSS] Improve xDS Code Coverage - Endpoints and Misc ( #18222 )
...
test: improve xDS endpoints code coverage
2023-07-21 17:48:25 -04:00
c138f24cfd
[NET-4122] Doc guidance for federation with externalServers ( #18207 )
...
Doc guidance for federation with externalServers
Add guidance for proper configuration when joining to a secondary
cluster using WAN fed with external servers also enabled.
Also clarify federation requirements and fix formatting for an
unrelated value.
Update both the Helm chart reference (synced from `consul-k8s`, see
hashicorp/consul-k8s#2583 ) and the docs on using `externalServers`.
2023-07-21 15:31:41 -04:00
6671d7ebd7
[CC-5718] Remove HCP token requirement during bootstrap ( #18140 )
...
* [CC-5718] Remove HCP token requirement during bootstrap
* Re-add error for loading HCP management token
* Remove old comment
* Add changelog entry
* Remove extra validation line
* Apply suggestions from code review
Co-authored-by: lornasong <lornasong@users.noreply.github.com>
---------
Co-authored-by: lornasong <lornasong@users.noreply.github.com>
2023-07-21 10:33:22 -07:00
7e01fcf5c0
ci: don't verify s390x ( #18224 )
2023-07-21 10:00:37 -07:00
c932d797a7
[OSS] proxystate: add proxystate protos ( #18216 )
...
* proxystate: add proxystate protos to pbmesh and resolve imports and conflicts between message names
2023-07-21 09:21:39 -07:00
926db9c8a6
fix typos and update ecs compat table ( #18215 )
...
* fix typos and update ecs compat table
* real info for the ecs compat matrix table
* Update website/content/docs/ecs/compatibility.mdx
Co-authored-by: Chris Thain <32781396+cthain@users.noreply.github.com>
---------
Co-authored-by: Chris Thain <32781396+cthain@users.noreply.github.com>
2023-07-21 15:21:25 +00:00
47d445d680
Envoy Integration Test Windows ( #18007 )
...
* [CONSUL-395] Update check_hostport and Usage (#40 )
* [CONSUL-397] Copy envoy binary from Image (#41 )
* [CONSUL-382] Support openssl in unique test dockerfile (#43 )
* [CONSUL-405] Add bats to single container (#44 )
* [CONSUL-414] Run Prometheus Test Cases and Validate Changes (#46 )
* [CONSUL-410] Run Jaeger in Single container (#45 )
* [CONSUL-412] Run test-sds-server in single container (#48 )
* [CONSUL-408] Clean containers (#47 )
* [CONSUL-384] Rebase and sync fork (#50 )
* [CONSUL-415] Create Scenarios Troubleshooting Docs (#49 )
* [CONSUL-417] Update Docs Single Container (#51 )
* [CONSUL-428] Add Socat to single container (#54 )
* [CONSUL-424] Replace pkill in kill_envoy function (#52 )
* [CONSUL-434] Modify Docker run functions in Helper script (#53 )
* [CONSUL-435] Replace docker run in set_ttl_check_state & wait_for_agent_service_register functions (#55 )
* [CONSUL-438] Add netcat (nc) in the Single container Dockerfile (#56 )
* [CONSUL-429] Replace Docker run with Docker exec (#57 )
* [CONSUL-436] Curl timeout and run tests (#58 )
* [CONSUL-443] Create dogstatsd Function (#59 )
* [CONSUL-431] Update Docs Netcat (#60 )
* [CONSUL-439] Parse nc Command in function (#61 )
* [CONSUL-463] Review curl Exec and get_ca_root Func (#63 )
* [CONSUL-453] Docker hostname in Helper functions (#64 )
* [CONSUL-461] Test wipe volumes without extra cont (#66 )
* [CONSUL-454] Check ports in the Server and Agent containers (#65 )
* [CONSUL-441] Update windows dockerfile with version (#62 )
* [CONSUL-466] Review case-grpc Failing Test (#67 )
* [CONSUL-494] Review case-cfg-resolver-svc-failover (#68 )
* [CONSUL-496] Replace docker_wget & docker_curl (#69 )
* [CONSUL-499] Cleanup Scripts - Remove nanoserver (#70 )
* [CONSUL-500] Update Troubleshooting Docs (#72 )
* [CONSUL-502] Pull & Tag Envoy Windows Image (#73 )
* [CONSUL-504] Replace docker run in docker_consul (#76 )
* [CONSUL-505] Change admin_bind
* [CONSUL-399] Update envoy to 1.23.1 (#78 )
* [CONSUL-510] Support case-wanfed-gw on Windows (#79 )
* [CONSUL-506] Update troubleshooting Documentation (#80 )
* [CONSUL-512] Review debug_dump_volumes Function (#81 )
* [CONSUL-514] Add zipkin to Docker Image (#82 )
* [CONSUL-515] Update Documentation (#83 )
* [CONSUL-529] Support case-consul-exec (#86 )
* [CONSUL-530] Update Documentation (#87 )
* [CONSUL-530] Update default consul version 1.13.3
* [CONSUL-539] Cleanup (#91 )
* [CONSUL-546] Scripts Clean-up (#92 )
* [CONSUL-491] Support admin_access_log_path value for Windows (#71 )
* [CONSUL-519] Implement mkfifo Alternative (#84 )
* [CONSUL-542] Create OS Specific Files for Envoy Package (#88 )
* [CONSUL-543] Create exec_supported.go (#89 )
* [CONSUL-544] Test and Build Changes (#90 )
* Implement os.DevNull
* using mmap instead of disk files
* fix import in exec-unix
* fix nmap open too many arguemtn
* go fmt on file
* changelog file
* fix go mod
* Update .changelog/17694.txt
Co-authored-by: Dhia Ayachi <dhia@hashicorp.com>
* different mmap library
* fix bootstrap json
* some fixes
* chocolatey version fix and image fix
* using different library
* fix Map funciton call
* fix mmap call
* fix tcp dump
* fix tcp dump
* windows tcp dump
* Fix docker run
* fix tests
* fix go mod
* fix version 16.0
* fix version
* fix version dev
* sleep to debug
* fix sleep
* fix permission issue
* fix permission issue
* fix permission issue
* fix command
* fix command
* fix funciton
* fix assert config entry status command not found
* fix command not found assert_cert_has_cn
* fix command not found assert_upstream_missing
* fix command not found assert_upstream_missing_once
* fix command not found get_upstream_endpoint
* fix command not found get_envoy_public_listener_once
* fix command not found
* fix test cases
* windows integration test workflow github
* made code similar to unix using npipe
* fix go.mod
* fix dialing of npipe
* dont wait
* check size of written json
* fix undefined n
* running
* fix dep
* fix syntax error
* fix workflow file
* windows runner
* fix runner
* fix from json
* fix runs on
* merge connect envoy
* fix cin path
* build
* fix file name
* fix file name
* fix dev build
* remove unwanted code
* fix upload
* fix bin name
* fix path
* checkout current branch
* fix path
* fix tests
* fix shell bash for windows sh files
* fix permission of run-test.sh
* removed docker dev
* added shell bash for tests
* fix tag
* fix win=true
* fix cd
* added dev
* fix variable undefined
* removed failing tests
* fix tcp dump image
* fix curl
* fix curl
* tcp dump path
* fix tcpdump path
* fix curl
* fix curl install
* stop removing intermediate containers
* fix tcpdump docker image
* revert -rm
* --rm=false
* makeing docker image before
* fix tcpdump
* removed case consul exec
* removed terminating gateway simple
* comment case wasm
* removed data dog
* comment out upload coverage
* uncomment case-consul-exec
* comment case consul exec
* if always
* logs
* using consul 1.17.0
* fix quotes
* revert quotes
* redirect to dev null
* Revert version
* revert consul connect
* fix version
* removed envoy connect
* not using function
* change log
* docker logs
* fix logs
* restructure bad authz
* rmeoved dev null
* output
* fix file descriptor
* fix cacert
* fix cacert
* fix ca cert
* cacert does not work in windows curl
* fix func
* removed docker logs
* added sleep
* fix tls
* commented case-consul-exec
* removed echo
* retry docker consul
* fix upload bin
* uncomment consul exec
* copying consul.exe to docker image
* copy fix
* fix paths
* fix path
* github workspace path
* latest version
* Revert "latest version"
This reverts commit 5a7d7b82d97013d15a23
2023-07-21 20:26:00 +05:30
c2066b9b22
NET-4222 take config file consul container ( #18218 )
...
Net 4222 take config file consul container
2023-07-20 21:30:22 -04:00
2793761702
[OSS] Improve xDS Code Coverage - Clusters ( #18165 )
...
test: improve xDS cluster code coverage
2023-07-20 18:02:21 -04:00
7e6ce76fcd
NET-4804: Add dashboard for monitoring consul-k8s ( #18208 )
2023-07-20 16:35:23 -04:00
5cd287660a
docs: fix the description of client rpc ( #18206 )
2023-07-20 16:34:36 -04:00
2c5a09bb0a
Explicitly enable WebSocket upgrades ( #18150 )
...
This PR explicitly enables WebSocket upgrades in Envoy's UpgradeConfig for all
proxy types. (API Gateway, Ingress, and Sidecar.)
Fixes #8283
2023-07-20 13:24:43 -07:00
ada767fc9f
resource: Pass resource to Write ACL hook instead of just resource Id [NET-4908] ( #18192 )
2023-07-20 12:06:29 -05:00
1c7fcdf188
Fix Backport Assistant PR commenting ( #18200 )
...
* Fix Backport Assistant failure PR commenting
For general comments on a PR, it looks like you have to use the `/issue`
endpoint rather than `/pulls`, which requires commit/other
review-specific target details.
This matches the endpoint used in `backport-reminder.yml`.
* Remove Backport Reminder workflow
This is noisy (even when adding multiple labels, individual comments per
label are generated), and likely no longer needed: we haven't had this
work in a long time due to an expired GH token, and we now have better
automation for backport PR assignment.
2023-07-20 11:39:01 -04:00
1ef5dfcfc6
SEC-090: Automated trusted workflow pinning (2023-07-18) ( #18174 )
...
Result of tsccr-helper -log-level=info -pin-all-workflows .
Co-authored-by: hashicorp-tsccr[bot] <hashicorp-tsccr[bot]@users.noreply.github.com>
2023-07-19 16:56:50 -07:00
72999bb735
Update submodules to latest following 1.16.0 ( #18197 )
...
Align all our internal use of submodules on the latest versions.
2023-07-19 18:57:34 -04:00
271e5af155
update readme.md ( #18191 )
...
u[date readme.md
2023-07-19 18:24:55 -04:00
18bc04165c
Improve XDS test coverage: JWT auth edition ( #18183 )
...
* Improve XDS test coverage: JWT auth edition
more tests
* test: xds coverage for jwt listeners
---------
Co-authored-by: DanStough <dan.stough@hashicorp.com>
2023-07-19 17:19:00 -04:00
e8dd04d662
[NET-4865] security: Update Go version to 1.20.6 ( #18190 )
...
Update Go version to 1.20.6
This resolves [CVE-2023-29406]
(https://nvd.nist.gov/vuln/detail/CVE-2023-29406 ) for uses of the
`net/http` standard library.
Note that until the follow-up to #18124 is done, the version of Go used
in those impacted tests will need to remain on 1.20.5.
2023-07-19 17:02:18 -04:00
003370ded0
Call resource mutate hook before validate hook (NET-4907) ( #18178 )
2023-07-19 13:10:57 -05:00
29cdb75d05
[NET-4865] Bump golang.org/x/net to 0.12.0 ( #18186 )
...
Bump golang.org/x/net to 0.12.0
While not necessary to directly address CVE-2023-29406 (which should be
handled by using a patched version of Go when building), an
accompanying change to HTTP/2 error handling does impact agent code.
See https://go-review.googlesource.com/c/net/+/506995 for the HTTP/2
change.
Bump this dependency across our submodules as well for the sake of
potential indirect consumers of `x/net/http`.
2023-07-19 11:37:58 -04:00
2e326e2e5f
docs - remove Sentinel from enterprise features list ( #18176 )
...
* Update index.mdx
* Update kv.mdx
* Update docs-nav-data.json
* delete sentinel.mdx
* Update redirects.js
---------
Co-authored-by: Tu Nguyen <im2nguyen@users.noreply.github.com>
2023-07-19 00:30:01 +00:00
cd3fc9e1d0
add peering_commontopo tests [NET-3700] ( #17951 )
...
Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>
Co-authored-by: R.B. Boyer <rb@hashicorp.com>
Co-authored-by: Freddy <freddygv@users.noreply.github.com>
Co-authored-by: NiniOak <anita.akaeze@hashicorp.com>
2023-07-18 16:41:30 -07:00
548a5ca385
Add FIPS reference to consul enterprise docs ( #18028 )
...
* Add FIPS reference to consul enterprise docs
* Update website/content/docs/enterprise/index.mdx
Co-authored-by: David Yu <dyu@hashicorp.com>
* remove support for ecs client (fips)
---------
Co-authored-by: David Yu <dyu@hashicorp.com>
2023-07-18 20:35:27 +00:00
921445712e
[NET-4792] Add integrations tests for jwt-auth ( #18169 )
2023-07-18 14:59:01 -04:00
62005369b5
Add `testing/deployer` (neé `consul-topology`) [NET-4610] ( #17823 )
...
Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>
Co-authored-by: R.B. Boyer <rb@hashicorp.com>
Co-authored-by: Freddy <freddygv@users.noreply.github.com>
2023-07-17 15:15:22 -07:00
07fce869af
group and document make file ( #17943 )
...
* group and document make file
2023-07-17 12:27:24 -07:00
03cf37e7b8
Re-order expected/actual for assertContainerState in consul container tests ( #18157 )
...
Re-order expected/actual, consul container tests
2023-07-17 18:11:19 +00:00
33d898b857
[OSS] test: improve xDS listener code coverage ( #18138 )
...
test: improve xDS listener code coverage
2023-07-17 13:49:40 -04:00
e52ea0ee7a
Change docs to say 168h instead of 7d for server_rejoin_age_max ( #18154 )
...
### Description
Addresses
https://github.com/hashicorp/consul/pull/17171#issuecomment-1636930705
2023-07-17 16:53:36 +00:00
f7c5ba5f90
Support Consul Connect Envoy Command on Windows ( #17694 )
...
### Description
Add support for consul connect envoy command on windows. This PR fixes
the comments of PR - https://github.com/hashicorp/consul/pull/15114
### Testing
* Built consul.exe from this branch on windows and hosted here - [AWS
S3](https://asheshvidyut-bucket.s3.ap-southeast-2.amazonaws.com/consul.zip )
* Updated the
[tutorial](https://developer.hashicorp.com/consul/tutorials/developer-mesh/consul-windows-workloads )
and changed the `consul_url.default` value to [AWS
S3](https://asheshvidyut-bucket.s3.ap-southeast-2.amazonaws.com/consul.zip )
* Followed the steps in the tutorial and verified that everything is
working as described.
### PR Checklist
* [x] updated test coverage
* [ ] external facing docs updated
* [x] appropriate backport labels added
* [x] not a security concern
---------
Co-authored-by: Franco Bruno Lavayen <cocolavayen@gmail.com>
Co-authored-by: Jose Ignacio Lorenzo <74208929+joselo85@users.noreply.github.com>
Co-authored-by: Jose Ignacio Lorenzo <joseignaciolorenzo85@gmail.com>
Co-authored-by: Dhia Ayachi <dhia@hashicorp.com>
2023-07-17 21:40:07 +05:30
bcc6a9d752
Use JWT-auth filter in metadata mode & Delegate validation to RBAC filter ( #18062 )
...
### Description
<!-- Please describe why you're making this change, in plain English.
-->
- Currently the jwt-auth filter doesn't take into account the service
identity when validating jwt-auth, it only takes into account the path
and jwt provider during validation. This causes issues when multiple
source intentions restrict access to an endpoint with different JWT
providers.
- To fix these issues, rather than use the JWT auth filter for
validation, we use it in metadata mode and allow it to forward the
successful validated JWT token payload to the RBAC filter which will
make the decisions.
This PR ensures requests with and without JWT tokens successfully go
through the jwt-authn filter. The filter however only forwards the data
for successful/valid tokens. On the RBAC filter level, we check the
payload for claims and token issuer + existing rbac rules.
### Testing & Reproduction steps
<!--
* In the case of bugs, describe how to replicate
* If any manual tests were done, document the steps and the conditions
to replicate
* Call out any important/ relevant unit tests, e2e tests or integration
tests you have added or are adding
-->
- This test covers a multi level jwt requirements (requirements at top
level and permissions level). It also assumes you have envoy running,
you have a redis and a sidecar proxy service registered, and have a way
to generate jwks with jwt. I mostly use:
https://www.scottbrady91.com/tools/jwt for this.
- first write your proxy defaults
```
Kind = "proxy-defaults"
name = "global"
config {
protocol = "http"
}
```
- Create two providers
```
Kind = "jwt-provider"
Name = "auth0"
Issuer = "https://ronald.local "
JSONWebKeySet = {
Local = {
JWKS = "eyJrZXlzIjog....."
}
}
```
```
Kind = "jwt-provider"
Name = "okta"
Issuer = "https://ronald.local "
JSONWebKeySet = {
Local = {
JWKS = "eyJrZXlzIjogW3...."
}
}
```
- add a service intention
```
Kind = "service-intentions"
Name = "redis"
JWT = {
Providers = [
{
Name = "okta"
},
]
}
Sources = [
{
Name = "*"
Permissions = [{
Action = "allow"
HTTP = {
PathPrefix = "/workspace"
}
JWT = {
Providers = [
{
Name = "okta"
VerifyClaims = [
{
Path = ["aud"]
Value = "my_client_app"
},
{
Path = ["sub"]
Value = "5be86359073c434bad2da3932222dabe"
}
]
},
]
}
},
{
Action = "allow"
HTTP = {
PathPrefix = "/"
}
JWT = {
Providers = [
{
Name = "auth0"
},
]
}
}]
}
]
```
- generate 3 jwt tokens: 1 from auth0 jwks, 1 from okta jwks with
different claims than `/workspace` expects and 1 with correct claims
- connect to your envoy (change service and address as needed) to view
logs and potential errors. You can add: `-- --log-level debug` to see
what data is being forwarded
```
consul connect envoy -sidecar-for redis1 -grpc-addr 127.0.0.1:8502
```
- Make the following requests:
```
curl -s -H "Authorization: Bearer $Auth0_TOKEN" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v
RBAC filter denied
curl -s -H "Authorization: Bearer $Okta_TOKEN_with_wrong_claims" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v
RBAC filter denied
curl -s -H "Authorization: Bearer $Okta_TOKEN_with_correct_claims" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v
Successful request
```
### TODO
* [x] Update test coverage
* [ ] update integration tests (follow-up PR)
* [x] appropriate backport labels added
2023-07-17 11:32:49 -04:00
5930518489
fix: update delegateMock used in ENT ( #18149 )
...
### Description
<!-- Please describe why you're making this change, in plain English.
-->
The mock is used in `http_ent_test` file which caused lint failures. For
OSS->ENT parity adding the same change here.
### Links
<!--
Include any links here that might be helpful for people reviewing your
PR (Tickets, GH issues, API docs, external benchmarks, tools docs, etc).
If there are none, feel free to delete this section.
Please be mindful not to leak any customer or confidential information.
HashiCorp employees may want to use our internal URL shortener to
obfuscate links.
-->
Identified in OSS->ENT [merge
PR](https://github.com/hashicorp/consul-enterprise/pull/6328 )
### PR Checklist
* [ ] ~updated test coverage~
* [ ] ~external facing docs updated~
* [x] appropriate backport labels added
* [ ] ~not a security concern~
2023-07-17 09:44:49 -04:00
Michael Zalimeni