20599 Commits (f2b7b4591a95796c00a4c4453291492a7ab3ce73)

 

All Branches   

Search

Author	SHA1	Message	Date
Eric Haberkorn	f2b7b4591a	Fix Traffic Permissions Default Deny (#19028) ... Whenver a traffic permission exists for a given workload identity, turn on default deny. Previously, this was only working at the port level.	1 year ago
John Murret	d67e5c6e35	NET-5590 - authorization: check for identity:write in CA certs, xds server, and getting envoy bootstrap params (#19049) ... * NET-5590 - authorization: check for identity:write in CA certs, xds server, and getting envoy bootstrap params * gofmt file	1 year ago
Chris S. Kim	41e6f6cd8b	Reduce number of ports that consul test agents take (#19047)	1 year ago
R.B. Boyer	df930a59ac	chore: fix ce/ent drift in sdk and testing/deployer submodules (#19041)	1 year ago
Poonam Jadhav	6c92dd1359	NET-5600/container-test-acl-enabled (#18887) ... * feat: add container tests for resource http api with acl enabled * refactor: clean up	1 year ago
sarahalsmiller	9addd9ed7c	[NET-5788] Fix needed for JWTAuth in Consul Enterprise (#19038) ... change needed for fix in consul-enterprise	1 year ago
Chris S. Kim	2467660ab2	Remove explicit -p from CI tests (#18999)	1 year ago
cskh	a62cfd997b	docs: fix the description of meshgateway.mode=local in peering doc (#19042) ... docs: fix the description of meshgateway=local in peering doc	1 year ago
skpratt	21ea527089	TrafficPermissions: add ACL hooks (#19023) ... * add ACL hooks * add hooks for CTPs	1 year ago
Nitya Dhanushkodi	9a48266712	remove log (#19029)	1 year ago
Chris Thain	5e45db18b7	Include RequestTimeout in marshal/unmarshal of ServiceResolverConfigE… (#19031)	1 year ago
Eric Haberkorn	7ce6ebaeb3	Handle Traffic Permissions With Empty Sources Properly (#19024) ... Fix issues with empty sources * Validate that each permission on traffic permissions resources has at least one source. * Don't construct RBAC policies when there aren't any principals. This resulted in Envoy rejecting xDS updates with a validation error. ``` error= | rpc error: code = Internal desc = Error adding/updating listener(s) public_listener: Proto constraint validation failed (RBACValidationError.Rules: embedded message failed validation | caused by RBACValidationError.Policies[consul-intentions-layer4-1]: embedded message failed validation | caused by PolicyValidationError.Principals: value must contain at least 1 item(s)): rules { ```	1 year ago
David Yu	e6a111af1a	Update release notes to indicate folks should upgrade to to 1.16.2 or later (#19002) ... * Update v1_16_x.mdx * Update upgrade-specific.mdx * Update website/content/docs/upgrading/upgrade-specific.mdx Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>	1 year ago
Blake Covarrubias	fbc2b93bc4	docs: Rename Consul OSS to Consul CE (#19009) ... Rename references of Consul OSS to Consul Community Edition (CE). Co-authored-by: Tu Nguyen <im2nguyen@gmail.com>	1 year ago
Ashesh Vidyut	23062489c2	Fix type of datacenter in Service Resolvers Config Entry (#19004)	1 year ago
Matt Keeler	2240e746dd	Skip the catalog v2 upgrade test (#19005) ... We intentionally broke api compatibility here as we are not yet maintaining backwards compat for the v2 apis	1 year ago
John Murret	6f0df20d10	NET-5657 - consul-containers test for explicit upstreams (#18952) ... * Explicit container test * remove static resources * fix passing serviceBindPorts * WIP * fix explicit upstream test * use my image in CI until dataplane is fixed. * gofmt * fixing reference to v2beta1 in test-containers * WIP * remove bad references * add missing license headers * allow access internal/resource/resourcetest * fix check-allowed-imports to append array items * use preview image for dataplane * revert some inadverntent comment updates in peering_topology * add building local consul-dataplane image to compatibility-tests CI * fix substitution in CI * change upstreams to destinations based on incoming change * fixing use of upstreams in resource update * remove commented out lines and enable envoy concurrency on dataplane. * changes to addess PR feedback * small fixes --------- Co-authored-by: Eric <eric@haberkorn.co>	1 year ago
Iryna Shustava	d85fc535fb	acl: default tenancy with the no-auth ACL resolver (#19006) ... When using the no-auth acl resolver (the case for most controllers and the get-envoy-boostrap-params endpoint), ResolveTokenAndDefaultMeta method only returns an acl resolver. However, the resource service relies on the ent meta to be filled in to do the tenancy defaulting and inheriting it from the token when one is present. So this change makes sure that the ent meta defaulting always happens in the ACL resolver.	1 year ago
Iryna Shustava	06c15d0656	auth: register auth controllers with the server (#19000)	1 year ago
Iryna Shustava	3ea6afb4d4	mesh: rename Upstreams and UpstreamsConfiguration to Destinations* (#18995)	1 year ago
skpratt	202090e5d5	v2 explicit destination traffic permissions (#18823) ... * workload identity boilerplate * notes from discussion with Iryna * WIP traffic permissions controller poc * workload identity, traffic permissions validation, errors, types * traffic permissions mapper framing, traffic permissions controller updates. * more roughing out of the controller * cleanup * controller and mapper logic * tests * refactor mapper logic, add tests * clean up tenancy and integration test stubs * consolidate mapping * cleanup cache leak, revert bimapper changes * address review comments * test fix and rebase * use resource helper --------- Co-authored-by: John Landa <john.landa@hashicorp.com>	1 year ago
cskh	bd2fdb7f7d	grafana: fix a query metrics from ent and add consul version (#18998)	1 year ago
Tim Gross	e5f5fc9301	api: add `CheckRegisterOpts` method to Agent API (#18943) ... Ongoing work to support Nomad Workload Identity for authenticating with Consul will mean that Nomad's service registration sync with Consul will want to use Consul tokens scoped to individual workloads for registering services and checks. The `CheckRegister` method in the API doesn't have an option to pass the token in, which prevent us from sharing the same Consul connection for all workloads. Add a `CheckRegisterOpts` to match the behavior of `ServiceRegisterOpts`.	1 year ago
Tim Gross	aedc03b7ae	api: add Token field to ServiceRegisterOpts (#18983) ... Ongoing work to support Nomad Workload Identity for authenticating with Consul will mean that Nomad's service registration sync with Consul will want to use Consul tokens scoped to individual workloads for registering services and checks. The `ServiceRegisterOpts` type in the API doesn't have an option to pass the token in, which prevent us from sharing the same Consul connection for all workloads. Add a `Token` field to match the behavior of `ServiceDeregisterOpts`.	1 year ago
Nitya Dhanushkodi	58d06175ab	docs: add changelog (#18994)	1 year ago
R.B. Boyer	ca7533850c	mesh: update various protobuf comments for mesh types (#18993)	1 year ago
Iryna Shustava	e6b724d062	catalog,mesh,auth: Move resource types to the proto-public module (#18935)	1 year ago
R.B. Boyer	9e48607893	mesh: compute more of the xRoute features into ComputedRoutes (#18980) ... Convert more of the xRoutes features that were skipped in an earlier PR into ComputedRoutes and make them work: - DestinationPolicy defaults - more timeouts - load balancer policy - request/response header mutations - urlrewrite - GRPCRoute matches	1 year ago
Dhia Ayachi	d3bb5ff21a	Add CLI support for json (#18991) ... * add cli support for json format * add tests for json parsing * make owner and id pointers. * add copyright header * remove print --------- Co-authored-by: Poonam Jadhav <poonam.jadhav@hashicorp.com>	1 year ago
R.B. Boyer	11d6b0df45	mesh: store bound reference pointers on a ComputedRoutes resource and use during reconcile (#18965) ... xRoute resource types contain a slice of parentRefs to services that they manipulate traffic for. All xRoutes that have a parentRef to given Service will be merged together to generate a ComputedRoutes resource name-aligned with that Service. This means that a write of an xRoute with 2 parent ref pointers will cause at most 2 reconciles for ComputedRoutes. If that xRoute's list of parentRefs were ever to be reduced, or otherwise lose an item, that subsequent map event will only emit events for the current set of refs. The removed ref will not cause the generated ComputedRoutes related to that service to be re-reconciled to omit the influence of that xRoute. To combat this, we will store on the ComputedRoutes resource a BoundResources []*pbresource.Reference field with references to all resources that were used to influence the generated output. When the routes controller reconciles, it will use a bimapper to index this influence, and the dependency mappers for the xRoutes will look themselves up in that index to discover additional (former) ComputedRoutes that need to be notified as well.	1 year ago
Poonam Jadhav	4e77482e95	feat: remove resource api client from api module (#18984) ... * feat: remove resource api client from api module * fix: go mod clean up	1 year ago
Eric Haberkorn	4d6ff29392	Traffic Permissions Validations (#18907) ... add TP validations and mutation and add CTP validations	1 year ago
R.B. Boyer	633c6c9458	mesh: add ACL checks for xRoute resources (#18926) ... xRoute resources are not name-aligned with the Services they control. They have a list of "parent ref" services that they alter traffic flow for, and they contain a list of "backend ref" services that they direct that traffic to. The ACLs should be: - list: (default) - read: - ALL service:<parent_ref_service>:read - write: - ALL service:<parent_ref_service>:write - ALL service:<backend_ref_service>:read	1 year ago
R.B. Boyer	43a8dbb188	mesh: add ACL checks for DestinationPolicy resources (#18920) ... DestinationPolicy resources are name-aligned with the Service they control. The ACLs should be: - list: (default) - read: service:<resource_name>:read - write: service:<resource_name>:write	1 year ago
R.B. Boyer	7688178ad2	peerstream: fix flaky test related to autopilot integration (#18979)	1 year ago
R.B. Boyer	c814bb014e	remove now orphaned generated v1alpha1 pb.go files (#18982)	1 year ago
Ronald	20b86ce0c8	[Docs] Add note to jwt docs to specify the need for ACLs (#18942)	1 year ago
Iryna Shustava	d88888ee8b	catalog,mesh,auth: Bump versions to v2beta1 (#18930)	1 year ago
R.B. Boyer	de231bbbdd	catalog: fix for new method argument (#18978)	1 year ago
R.B. Boyer	ec6189fd2f	catalog: add ACL checks for FailoverPolicy resources (#18919) ... FailoverPolicy resources are name-aligned with the Service they control. They also contain a list of possible failover destinations that are References to other Services. The ACLs should be: - list: (default) - read: service:<resource_name>:read - write: service:<resource_name>:write + service:<destination_name>:read (for any destination)	1 year ago
R.B. Boyer	ef6f2494c7	resource: allow for the ACLs.Read hook to request the entire data payload to perform the authz check (#18925) ... The ACLs.Read hook for a resource only allows for the identity of a resource to be passed in for use in authz consideration. For some resources we wish to allow for the current stored value to dictate how to enforce the ACLs (such as reading a list of applicable services from the payload and allowing service:read on any of them to control reading the enclosing resource). This change update the interface to usually accept a *pbresource.ID, but if the hook decides it needs more data it returns a sentinel error and the resource service knows to defer the authz check until after fetching the data from storage.	1 year ago
Ashesh Vidyut	5b3ab2eaed	Fix docs for log file name changes (#18913) ... * fix docs * Update website/content/docs/agent/config/cli-flags.mdx Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com> * Update website/content/docs/agent/config/cli-flags.mdx Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com> * Update website/content/docs/agent/config/cli-flags.mdx Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com> --------- Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>	1 year ago
Derek Menteer	eb7e20307c	[NET-5589] Add jitter to xds v2 leaf cert watches (#18940) ... Add jitter to xds v2 leaf cert watches.	1 year ago
Semir Patel	d2be7577b9	tenancy: split up tenancy `types.go` into CE version (#18966)	1 year ago
Nitya Dhanushkodi	0a11499588	net-5689 fix disabling panic threshold logic (#18958)	1 year ago
Blake Covarrubias	5d0edec01f	docs: Replace unicode quotes with ASCII quotes (#18950) ... Replaces unicode quotation marks with ASCII quotation marks. For code examples, this fixes HCL decoding errors that would otherwise be raised when attempting to read the file.	1 year ago
Blake Covarrubias	4e1e18fe66	docs: Change heading to filename in CodeBlockConfig (#18951) ... Change various CodeBlockConfig objects to use the `filename` attribute instead of `heading` when the code block references a named file.	1 year ago
Matt Keeler	53fcc5d9a5	Add protoc generator to emit resource type variables (#18957) ... The annotations include a little more data than is strictly necessary because we will also have a protoc generator for openapi output.	1 year ago
Chris S. Kim	565e79344f	Dump response body on fail (#18962)	1 year ago
Anita Akaeze	f5985fedce	do not trigger integration tests (#18948)	1 year ago