consul

Commit Graph

Author	SHA1	Message	Date
hc-github-team-consul-core	dd7b57883d	Backport of Explicitly enable WebSocket upgrades into release/1.16.x (#18211 ) This PR explicitly enables WebSocket upgrades in Envoy's UpgradeConfig for all proxy types. (API Gateway, Ingress, and Sidecar.) Fixes #8283 Co-authored-by: Blake Covarrubias <blake@covarrubi.as>	1 year ago
hc-github-team-consul-core	90ff41f662	backport of commit `c0afba3a0c` (#17975 ) Co-authored-by: Chris S. Kim <ckim@hashicorp.com>	1 year ago
hc-github-team-consul-core	7b2bb3343c	Backport of ext-authz Envoy extension: support `localhost` as a valid target URI. into release/1.16.x (#17837 ) * backport of commit `391db7e58b` * backport of commit `f204d5b52a` --------- Co-authored-by: Chris Thain <chris.m.thain@gmail.com>	1 year ago
hc-github-team-consul-core	499a58622c	backport of commit `649e551f7d` (#17697 ) Co-authored-by: Chris Thain <chris.m.thain@gmail.com>	1 year ago
hc-github-team-consul-core	9cb6679386	backport of commit `2735bbe60f` (#17613 ) Co-authored-by: Eric <eric@haberkorn.co>	1 year ago
Michael Zalimeni	ad03a5d0f2	Avoid panic applying TProxy Envoy extensions (#17537 ) When UpstreamEnvoyExtender was introduced, some code was left duplicated between it and BasicEnvoyExtender. One path in that code panics when a TProxy listener patch is attempted due to no upstream data in RuntimeConfig matching the local service (which would only happen in rare cases). Instead, we can remove the special handling of upstream VIPs from BasicEnvoyExtender entirely, greatly simplifying the listener filter patch code and avoiding the panic. UpstreamEnvoyExtender, which needs this code to function, is modified to ensure a panic does not occur. This also fixes a second regression in which the Lua extension was not applied to TProxy outbound listeners.	2 years ago
Eric Haberkorn	d99312b86e	Add Upstream Service Targeting to Property Override Extension (#17517 ) * add upstream service targeting to property override extension * Also add baseline goldens for service specific property override extension. * Refactor the extension framework to put more logic into the templates. * fix up the golden tests	2 years ago
Chris Thain	65b8ccdc1b	Enable Network filters for Wasm Envoy Extension (#17505 )	2 years ago
Michael Zalimeni	e1df0f28bd	Support `Listener` and `ClusterLoadAssignment` in `property-override` (#17497 ) * Support Listener in Property Override Add support for patching `Listener` resources via the builtin `property-override` extension. Refactor existing listener patch code in `BasicEnvoyExtender` to simplify addition of resource support. * Support ClusterLoadAssignment in Property Override Add support for patching `ClusterLoadAssignment` resources via the builtin `property-override` extension.	2 years ago
Michael Zalimeni	5a46a8c604	Add `builtin/property-override` Envoy Extension (#17487 ) `property-override` is an extension that allows for arbitrarily patching Envoy resources based on resource matching filters. Patch operations resemble a subset of the JSON Patch spec with minor differences to facilitate patching pre-defined (protobuf) schemas. See Envoy Extension product documentation for more details. Co-authored-by: Eric Haberkorn <eric.haberkorn@hashicorp.com> Co-authored-by: Kyle Havlovitz <kyle@hashicorp.com>	2 years ago
Chris Thain	516eb4febc	Add `builtin/ext-authz` Envoy Extension (#17495 )	2 years ago
Michael Zalimeni	b8d2640429	Disable remote proxy patching except AWS Lambda (#17415 ) To avoid unintended tampering with remote downstreams via service config, refactor BasicEnvoyExtender and RuntimeConfig to disallow typical Envoy extensions from being applied to non-local proxies. Continue to allow this behavior for AWS Lambda and the read-only Validate builtin extensions. Addresses CVE-2023-2816.	2 years ago
Chris Thain	175bb1a303	Wasm Envoy HTTP extension (#16877 )	2 years ago
cskh	e91bc9c058	feat: envoy extension - http local rate limit (#16196 ) - http local rate limit - Apply rate limit only to local_app - unit test and integ test	2 years ago
Derek Menteer	06338c8ee7	Add unit test and update golden files. (#16115 )	2 years ago
Nitya Dhanushkodi	8728a4496c	troubleshoot: service to service validation (#16096 ) * Add Tproxy support to Envoy Extensions (this is needed for service to service validation) * Add validation for Envoy configuration for an upstream service * Use both /config_dump and /cluster to validate Envoy configuration This is because of a bug in Envoy where the EndpointsConfigDump does not include a cluster_name, making it impossible to match an endpoint to verify it exists. This removes endpoints support for builtin extensions since only the validate plugin was using it, and it is no longer used. It also removes test cases for endpoint validation. Endpoints validation now only occurs in the top level test from config_dump and clusters json files. Co-authored-by: Eric <eric@haberkorn.co>	2 years ago
Michael Wilkerson	a1498b015d	Mw/lambda envoy extension parse region (#4107 ) (#16069 ) * updated builtin extension to parse region directly from ARN - added a unit test - added some comments/light refactoring * updated golden files with proper ARNs - ARNs need to be right format now that they are being processed * updated tests and integration tests - removed 'region' from all EnvoyExtension arguments - added properly formatted ARN which includes the same region found in the removed "Region" field: 'us-east-1'	2 years ago
Eric Haberkorn	8d923c1789	Add the Lua Envoy extension (#15906 )	2 years ago

18 Commits (ea5bcde903322310eea88d6f53384b4fdcf5a35c)