277 Commits (f45e495e3862b735bf4dfd8ddce2371ea19616aa)

Author	SHA1	Message	Date
Paul Banks	8ae3447447	Pull go-discover to fix Sirupsen/logrus (#5598) ... * Pull go-discover to fix Sirupsen/logrus * Actually rename Sirupsen -> sirupsen in vendor (despite macOS) * Actually _actually_ rename Sirupsen -> sirupsen in vendor (despite macOS)	6 years ago
Hans Hasselberg	ac45b17482	fix remaining CI failures after Go 1.12.1 Upgrade (#5576)	6 years ago
Jeff Mitchell	db7817c42a	Bump vendor to take in new sdk/api versions (#5574)	6 years ago
Jeff Mitchell	4243c3ae42	Move internal/ to sdk/ (#5568) ... * Move internal/ to sdk/ * Add a readme to the SDK folder	6 years ago
Jeff Mitchell	28c84845bf	Update vendoring from go mod. (#5566)	6 years ago
R.B. Boyer	cd96af4fc0	acl: reduce complexity of token resolution process with alternative singleflighting (#5480) ... acl: reduce complexity of token resolution process with alternative singleflighting Switches acl resolution to use golang.org/x/sync/singleflight. For the identity/legacy lookups this is a drop-in replacement with the same overall approach to request coalescing. For policies this is technically a change in behavior, but when considered holistically is approximately performance neutral (with the benefit of less code). There are two goals with this blob of code (speaking specifically of policy resolution here): 1) Minimize cross-DC requests. 2) Minimize client-to-server LAN requests. The previous iteration of this code was optimizing for the case of many possibly different tokens being resolved concurrently that have a significant overlap in linked policies such that deduplication would be worth the complexity. While this is laudable there are some things to consider that can help to adjust expectations: 1) For v1.4+ policies are always replicated, and once a single policy shows up in a secondary DC the replicated data is considered authoritative for requests made in that DC. This means that our earlier concerns about minimizing cross-DC requests are irrelevant because there will be no cross-DC policy reads that occur. 2) For Server nodes the in-memory ACL policy cache is capped at zero, meaning it has no caching. Only Client nodes run with a cache. This means that instead of having an entire DC's worth of tokens (what a Server might see) that can have policy resolutions coalesced these nodes will only ever be seeing node-local token resolutions. In a reasonable worst-case scenario where a scheduler like Kubernetes has "filled" a node with Connect services, even that will only schedule ~100 connect services per node. If every service has a unique token there will only be 100 tokens to coalesce and even then those requests have to occur concurrently AND be hitting an empty consul cache. Instead of seeing a great coalescing opportunity for cutting down on redundant Policy resolutions, in practice it's far more likely given node densities that you'd see requests for the same token concurrently than you would for two tokens sharing a policy concurrently (to a degree that would warrant the overhead of the current variation of singleflighting. Given that, this patch switches the Policy resolution process to only singleflight by requesting token (but keeps the cache as by-policy).	6 years ago
petems	a505e6e9da	Update go-discover vendor ... * Adds note about use of ENV variables for auto-join on Azure	6 years ago
Pierre Souchay	bfcfcc06d0	Revendor memberlist to Fix #3217 ... Upgrade leads to protocol version (2) is incompatible: [1, 0] (#5313) This is fixed in https://github.com/hashicorp/memberlist/pull/178, bump memberlist to fix possible split brain in Consul.	6 years ago
Matt Keeler	8f0d622a54	Revendor serf to pull in keyring list truncation changes. (#5251)	6 years ago
Pierre Souchay	1618d79518	Allow `"disable_host_node_id": false` to work on Linux as non-root. (#4926) ... Bump `shirou/gopsutil` to include https://github.com/shirou/gopsutil/pull/603 This will allow to have consistent node-id even when machine is reinstalled when using `"disable_host_node_id": false` It will fix https://github.com/hashicorp/consul/issues/4914 and allow having the same node-id even when reinstalling a node from scratch. However, it is only compatible with a single OS (installing to Windows will change the node-id, but it seems acceptable).	6 years ago
R.B. Boyer	b96391ecff	update github.com/hashicorp/{serf,memberlist,go-sockaddr} (#5189) ... This activates large-cluster improvements in the gossip layer from https://github.com/hashicorp/memberlist/pull/167	6 years ago
Jack Pearkes	0358c7a063	vendor: upgrade to latest version of gopsutil	6 years ago
Matt Keeler	18b29c45c4	New ACLs (#4791) ... This PR is almost a complete rewrite of the ACL system within Consul. It brings the features more in line with other HashiCorp products. Obviously there is quite a bit left to do here but most of it is related docs, testing and finishing the last few commands in the CLI. I will update the PR description and check off the todos as I finish them over the next few days/week. Description At a high level this PR is mainly to split ACL tokens from Policies and to split the concepts of Authorization from Identities. A lot of this PR is mostly just to support CRUD operations on ACLTokens and ACLPolicies. These in and of themselves are not particularly interesting. The bigger conceptual changes are in how tokens get resolved, how backwards compatibility is handled and the separation of policy from identity which could lead the way to allowing for alternative identity providers. On the surface and with a new cluster the ACL system will look very similar to that of Nomads. Both have tokens and policies. Both have local tokens. The ACL management APIs for both are very similar. I even ripped off Nomad's ACL bootstrap resetting procedure. There are a few key differences though. Nomad requires token and policy replication where Consul only requires policy replication with token replication being opt-in. In Consul local tokens only work with token replication being enabled though. All policies in Nomad are globally applicable. In Consul all policies are stored and replicated globally but can be scoped to a subset of the datacenters. This allows for more granular access management. Unlike Nomad, Consul has legacy baggage in the form of the original ACL system. The ramifications of this are: A server running the new system must still support other clients using the legacy system. A client running the new system must be able to use the legacy RPCs when the servers in its datacenter are running the legacy system. The primary ACL DC's servers running in legacy mode needs to be a gate that keeps everything else in the entire multi-DC cluster running in legacy mode. So not only does this PR implement the new ACL system but has a legacy mode built in for when the cluster isn't ready for new ACLs. Also detecting that new ACLs can be used is automatic and requires no configuration on the part of administrators. This process is detailed more in the "Transitioning from Legacy to New ACL Mode" section below.	6 years ago
Jack Pearkes	8c684db488	New command: consul debug (#4754) ... * agent/debug: add package for debugging, host info * api: add v1/agent/host endpoint * agent: add v1/agent/host endpoint * command/debug: implementation of static capture * command/debug: tests and only configured targets * agent/debug: add basic test for host metrics * command/debug: add methods for dynamic data capture * api: add debug/pprof endpoints * command/debug: add pprof * command/debug: timing, wg, logs to disk * vendor: add gopsutil/disk * command/debug: add a usage section * website: add docs for consul debug * agent/host: require operator:read * api/host: improve docs and no retry timing * command/debug: fail on extra arguments * command/debug: fixup file permissions to 0644 * command/debug: remove server flags * command/debug: improve clarity of usage section * api/debug: add Trace for profiling, fix profile * command/debug: capture profile and trace at the same time * command/debug: add index document * command/debug: use "clusters" in place of members * command/debug: remove address in output * command/debug: improve comment on metrics sleep * command/debug: clarify usage * agent: always register pprof handlers and protect This will allow us to avoid a restart of a target agent for profiling by always registering the pprof handlers. Given this is a potentially sensitive path, it is protected with an operator:read ACL and enable debug being set to true on the target agent. enable_debug still requires a restart. If ACLs are disabled, enable_debug is sufficient. * command/debug: use trace.out instead of .prof More in line with golang docs. * agent: fix comment wording * agent: wrap table driven tests in t.run()	6 years ago
Paul Banks	1909a95118	xDS Server Implementation (#4731) ... * Vendor updates for gRPC and xDS server * xDS server implementation for serving Envoy as a Connect proxy * Address initial review comments * consistent envoy package aliases; typos fixed; override TLS and authz for custom listeners * Moar Typos * Moar typos	6 years ago
Mitchell Hashimoto	3237047e72	vendor: update mapstructure to v1.1.0 ... We require this change to support struct to struct decoding.	6 years ago
Matt Keeler	d1e52e5292	Update Raft Vendoring (#4539) ... Pulls in a fix for a potential memory leak regarding consistent reads that invoke VerifyLeader.	6 years ago
Mitchell Hashimoto	bbb13598bf	vendor k8s client lib	6 years ago
Mitchell Hashimoto	66e31f02f7	Update go-discover vendor	6 years ago
Shubheksha	fc3997f266	replace old fork of text package (#4501)	6 years ago
Paul Banks	9ce10769ce	Update Serf and memberlist (#4511) ... This includes fixes that improve gossip scalability on very large (> 10k node) clusters. The Serf changes: - take snapshot disk IO out of the critical path for handling messages hashicorp/serf#524 - make snapshot compaction much less aggressive - the old fixed threshold caused snapshots to be constantly compacted (synchronously with request handling) on clusters larger than about 2000 nodes! hashicorp/serf#525 Memberlist changes: - prioritize handling alive messages over suspect/dead to improve stability, and handle queue in LIFO order to avoid acting on info that 's already stale in the queue by the time we handle it. hashicorp/memberlist#159 - limit the number of concurrent pushPull requests being handled at once to 128. In one test scenario with 10s of thousands of servers we saw channel and lock blocking cause over 3000 pushPulls at once which ballooned the memory of the server because each push pull contained a de-serialised list of all known 10k+ nodes and their tags for a total of about 60 million objects and 7GB of memory stuck. While the rest of the fixes here should prevent the same root cause from blocking in the same way, this prevents any other bug or source of contention from allowing pushPull messages to stack up and eat resources. hashicorp/memberlist#158	6 years ago
Siva Prasad	f4a1c381a5	Vendoring update for go-discover. (#4412) ... * New Providers added and updated vendoring for go-discover * Vendor.json formatted using make vendorfmt * Docs/Agent/auto-join: Added documentation for the new providers introduced in this PR * Updated the golang.org/x/sys/unix in the vendor directory * Agent: TestGoDiscoverRegistration updated to reflect the addition of new providers * Deleted terraform.tfstate from vendor. * Deleted terraform.tfstate.backup Deleted terraform state file artifacts from unknown runs. * Updated x/sys/windows vendor for Windows binary compilation	6 years ago
Matt Keeler	cf92110abd	Vendor golang.org/x/sys/windows/svc	6 years ago
mkeeler	6813a99081	Merge remote-tracking branch 'connect/f-connect'	7 years ago
Matt Keeler	98e98fa815	Remove build tags from vendored vault file to allow for this to merge properly into enterprise	7 years ago
Matt Keeler	01f82717b4	Vendor the vault api	7 years ago
Paul Banks	2f8c1d2059	Remove go-diff vendor as assert.JSONEq output is way better for our case	7 years ago
Leo Zhang	7f6d727aa5	Fix invalid vendor.json syntax for go-discover	7 years ago
Kyle Havlovitz	28e6f800d8	Add missing vendor dep github.com/stretchr/objx	7 years ago
Matt Keeler	701b2842a6	Remove bogus second yamux vendoring	7 years ago
Matt Keeler	2786ec979e	Update yamux vendoring ... Pulls in logging fixes.	7 years ago
Jack Pearkes	aa1c993806	Merge pull request #4013 from sethvargo/sethvargo/user_agent ... Add a helper for generating Consul's user-agent string	7 years ago
Matt Keeler	27fe219918	Merge pull request #4131 from pierresouchay/enable_full_dns_compression ... Enable full dns compression	7 years ago
Seth Vargo	3dc2cf793c	Update vendor for go-discover	7 years ago
Wim	1e0a2e25d0	Add github.com/coredns/coredns/plugin/pkg/dnsutil files	7 years ago
Wim	71dd83c62a	Add github.com/coredns/coredns/plugin/pkg/dnsutil to vendor.json	7 years ago
Pierre Souchay	4853733098	Bump DNS lib to 1.0.7 with 14bits Len() fix	7 years ago
Matt Keeler	efa9a564a3	Fix vendoring of two missed libs	7 years ago
Matt Keeler	b79db64ecf	Update prometheus indirect deps	7 years ago
Matt Keeler	52370a5b07	Update the various deps of miekg/dns in our vendor.json	7 years ago
Matt Keeler	3152fc2944	Pull in miekg/dns deps on the golang crypto ed25519 packages	7 years ago
Kyle Havlovitz	bd42da760b	vendor: pull in latest version of go-discover	7 years ago
Preetha Appan	fff532cf84	Update serf to pick up clean leave fix	7 years ago
Paul Banks	4de68fcb4b	Merge pull request #4016 from pierresouchay/support_for_prometheus ... Support for prometheus for metrics endpoint	7 years ago
Mitchell Hashimoto	3de62e0db3	vendor: add hashstructure and mock	7 years ago
Pierre Souchay	04cb007bed	Added dependency github.com/prometheus/client_golang/prometheus/promhttp	7 years ago
Pierre Souchay	5ce3c1587c	Bump github.com/armon/go-metrics to allow having prometheus support	7 years ago
Yoann	0f6e05d4c1	Add support for compression in http api ... The need has been spotted in issue https://github.com/hashicorp/consul/issues/3687. Using "NYTimes/gziphandler", the http api responses can now be compressed if required. The Go API requires compressed response if possible and handle the compressed response. We here change only the http api (not the UI for instance).	7 years ago
Paul Banks	ebbd11edbb	Actually add the `require` vendored files I intended to add in 0d5600ff60 ... Note that the vendor.json is already correct but the actual files were never checked in so report as missing: ``` $ govendor list | grep testify v github.com/stretchr/testify/assert m github.com/stretchr/testify/require ```	7 years ago
Preetha Appan	5702319c71	vendorfmt	7 years ago