11596 Commits (ecbedd5109bc061f726b29add81b9965fb5bd367)

 

All Branches   

Search

Author	SHA1	Message	Date
Kyle Havlovitz	b2a0251f66	Add a check for custom host to ingress TLS integration test	5 years ago
Chris Piraino	0c22eacca8	Add TLS field to ingress API structs ... - Adds test in api and command/config/write packages	5 years ago
Chris Piraino	30792e933b	Add test for adding DNSSAN for ConnectCALeaf cache type	5 years ago
Kyle Havlovitz	d452769d92	Add TLS integration test for ingress gateway ... - Pull Consul Root CA from API in order to verify certificate chain - Assert on the DNSSAN as well to ensure it is correct	5 years ago
Chris Piraino	0b9ba9660d	Validate hosts input in ingress gateway config entry ... We can only allow host names that are valid domain names because we put these hosts into a DNSSAN. In addition, we validate that the wildcard specifier '*' is only present as the leftmost label to allow for a wildcard DNSSAN and associated wildcard Host routing in the ingress gateway proxy.	5 years ago
Kyle Havlovitz	f14c54e25e	Add TLS option and DNS SAN support to ingress config ... xds: Only set TLS context for ingress listener when requested	5 years ago
R.B. Boyer	db870ba92b	test: make auth method cli crud test helper ignore the default namespace (#7799)	5 years ago
Chris Piraino	01e89f03ea	Merge pull request #7678 from hashicorp/ingress/host-header-routing ... Allow ingress gateways to route traffic based on Host header	5 years ago
Chris Piraino	905279f5d1	A proxy-default config entry only exists in the default namespace	5 years ago
Chris Piraino	d498a0afc9	Correctly set a namespace label in the required domain for xds routes ... If an upstream is not in the default namespace, we expect DNS requests to be served over "<service-name>.ingress.<namespace>.*"	5 years ago
Chris Piraino	114a18e890	Remove outdated comment	5 years ago
Chris Piraino	d8517bd6fd	Better document wildcard specifier interactions	5 years ago
Chris Piraino	45e635286a	Re-add comment on connect-proxy virtual hosts	5 years ago
Kyle Havlovitz	f9672f9bf1	Make sure IngressHosts isn't parsed during JSON decode	5 years ago
Chris Piraino	c44f877758	Comment why it is ok to expect upstreams slice to not be empty	5 years ago
Chris Piraino	881760f701	xds: Use only the port number as the configured route name ... This removes duplication of protocol from the stats_prefix	5 years ago
Kyle Havlovitz	89e6b16815	Filter wildcard gateway services to match listener protocol ... This now requires some type of protocol setting in ingress gateway tests to ensure the services are not filtered out. - small refactor to add a max(x, y) function - Use internal configEntryTxn function and add MaxUint64 to lib	5 years ago
Chris Piraino	f40833d094	Allow Hosts field to be set on an ingress config entry ... - Validate that this cannot be set on a 'tcp' listener nor on a wildcard service. - Add Hosts field to api and test in consul config write CLI - xds: Configure envoy with user-provided hosts from ingress gateways	5 years ago
Chris Piraino	b73a13fc9e	Remove service_subset field from ingress config entry ... We decided that this was not a useful MVP feature, and just added unnecessary complexity	5 years ago
Kyle Havlovitz	711d1389aa	Support multiple listeners referencing the same service in gateway definitions	5 years ago
Kyle Havlovitz	247f9eaf13	Allow ingress gateways to route traffic based on Host header ... This commit adds the necessary changes to allow an ingress gateway to route traffic from a single defined port to multiple different upstream services in the Consul mesh. To do this, we now require all HTTP requests coming into the ingress gateway to specify a Host header that matches "<service-name>.*" in order to correctly route traffic to the correct service. - Differentiate multiple listener's route names by port - Adds a case in xds for allowing default discovery chains to create a route configuration when on an ingress gateway. This allows default services to easily use host header routing - ingress-gateways have a single route config for each listener that utilizes domain matching to route to different services.	5 years ago
R.B. Boyer	a854e4d9c5	acl: oss plumbing to support auth method namespace rules in enterprise (#7794) ... This includes website docs updates.	5 years ago
Preetha	760368bf1b	Merge pull request #7792 from hashicorp/changelog-fixup ... Remove duplicated entries in CHANGELOG.md	5 years ago
Preetha	1d5f2fe9b0	Remove duplicated entries in CHANGELOG.md ... Remove some duplicated entries in the unreleased section of the changelog that were released in 1.7.3	5 years ago
Hans Hasselberg	1d5f12e823	Update CHANGELOG.md	5 years ago
Luke Kysow	c33a241438	Merge pull request #7724 from hashicorp/helm-repo ... Update k8s instructions for new helm repo	5 years ago
R.B. Boyer	3242d0816d	test: make the kube auth method test helper use freeport (#7788)	5 years ago
Hans Hasselberg	aa121bc8d2	segments: oss changes for enterprise network area changes (#7786) ... OSS code changes for network segments	5 years ago
Hans Hasselberg	096a2f2f02	network_segments: stop advertising segment tags	5 years ago
Hans Hasselberg	995a24b8e4	agent: refactor to use a single addrFn	5 years ago
Hans Hasselberg	6994c0d47f	agent: rename local/global to src/dst	5 years ago
Chris Piraino	7361e11bc5	Update CHANGELOG.md	5 years ago
Chris Piraino	69b44fb942	Construct a default destination if one does not exist for service-router (#7783)	5 years ago
Matt Keeler	9eafa36fa9	Update CHANGELOG.md	5 years ago
Matt Keeler	50c2297aaa	Update CHANGELOG.md	5 years ago
Mike Morris	291e6af33a	vendor: revert golang.org/x/sys bump to avoid FreeBSD regression (#7780)	5 years ago
Iryna Shustava	543568fd9a	docs: add Helm docs for external servers and bootstrapToken (#7725)	5 years ago
R.B. Boyer	04671ed1b5	update changelog	5 years ago
R.B. Boyer	22eb016153	acl: add MaxTokenTTL field to auth methods (#7779) ... When set to a non zero value it will limit the ExpirationTime of all tokens created via the auth method.	5 years ago
s-christoff	08b335d8d6	Update CHANGELOG.md	5 years ago
s-christoff	f9956c1c46	cli: Add -config flag to "acl authmethod update/create" (#7776)	5 years ago
R.B. Boyer	68499f0204	update changelog	5 years ago
R.B. Boyer	ca52ba7068	acl: add DisplayName field to auth methods (#7769) ... Also add a few missing acl fields in the api.	5 years ago
Hans Hasselberg	b5eab19183	vendor: fix case issue (#7777)	5 years ago
Hans Hasselberg	c4093c87cc	agent: don't let left nodes hold onto their node-id (#7747)	5 years ago
Matt Keeler	daec810e34	Merge pull request #7714 from hashicorp/oss-sync/msp-agent-token	5 years ago
Matt Keeler	55050beedb	Update go-discover dependency (#7731)	5 years ago
Matt Keeler	cbe3a70f56	Update enterprise configurations to be in OSS ... This will emit warnings about the configs not doing anything but still allow them to be parsed. This also added the warnings for enterprise fields that we already had in OSS but didn’t change their enforcement behavior. For example, attempting to use a network segment will cause a hard error in OSS.	5 years ago
R.B. Boyer	9533451a63	acl: refactor the authmethod.Validator interface (#7760) ... This is a collection of refactors that make upcoming PRs easier to digest. The main change is the introduction of the authmethod.Identity struct. In the one and only current auth method (type=kubernetes) all of the trusted identity attributes are both selectable and projectable, so they were just passed around as a map[string]string. When namespaces were added, this was slightly changed so that the enterprise metadata can also come back from the login operation, so login now returned two fields. Now with some upcoming auth methods it won't be true that all identity attributes will be both selectable and projectable, so rather than update the login function to return 3 pieces of data it seemed worth it to wrap those fields up and give them a proper name.	5 years ago
R.B. Boyer	e17a43553e	update changelog	5 years ago