9585 Commits (f66f46cb1e480c4e230062383f3cd36e28bec42a)

 

All Branches   

Search

Author	SHA1	Message	Date
Jihoon Chung	d5e28bda56	ui: Fix typo in acl-migration guide link (#5135)	6 years ago
Rebecca Zanzig	fbb40d72c0	Merge pull request #5230 from hashicorp/docs/helm-formatting ... Docs/helm formatting	6 years ago
Rebecca Zanzig	ebba215891	Fix broken links	6 years ago
Rebecca Zanzig	df99f4a3ac	Indent code blocks further to fix list formatting	6 years ago
Rebecca Zanzig	388ff4caed	Merge pull request #5222 from hashicorp/docs/helm-0.5.0 ... Add documentation about the two additional Helm chart options	6 years ago
Chris Wang	1e3bda174d	Fix typo in k8s connect documentation (#5229)	6 years ago
Kyle Havlovitz	21380021af	txn: update existing txn api docs with new operations	6 years ago
kaitlincarter-hc	59c010eb3b	Update links for learn migration (#5223) ... * Stared updaing links for the learn migration * Language change cluster -> datacenter (#5212) * Updating the language from cluster to datacenter in the backup guide to be consistent and more accurate. * missed some clusters * updated three broken links for the sidebar nav	6 years ago
Hans Hasselberg	3c110d5c78	Sorting entries in Changelog for upcoming release	6 years ago
Rebecca Zanzig	98b3c13dbb	Merge pull request #5213 from hashicorp/docs/helm-security ... Add a security warning about the default Helm chart installation	6 years ago
Rebecca Zanzig	6de477ef96	Add documentation about the two additional Helm chart options ... Adds info about `k8stag` and `nodePortSyncType` options that were added in consul-helm v0.5.0. Additionally moves the k8sprefix to match the order in the Helm chart values file, while also clarifying that it only affects one sync direction.	6 years ago
Rebecca Zanzig	1c70407bd1	Add a security warning about the default Helm chart installation ... If a user installs the default Helm chart Consul on a Kubernetes cluster that is open to the internet, it is lacking some important security configurations.	6 years ago
kaitlincarter-hc	adcdc81f93	Language change cluster -> datacenter (#5212) ... * Updating the language from cluster to datacenter in the backup guide to be consistent and more accurate. * missed some clusters	6 years ago
Matt Keeler	6fe09aa23b	Update CHANGELOG.md	6 years ago
Matt Keeler	1ec5f2a27f	Store leaf cert indexes in raft and use for the ModifyIndex on the returned certs (#5211) ... * Store leaf cert indexes in raft and use for the ModifyIndex on the returned certs This ensures that future certificate signings will have a strictly greater ModifyIndex than any previous certs signed.	6 years ago
Matt Keeler	834e168f94	Update CHANGELOG.md	6 years ago
Aestek	4afbe792df	Improve blocking queries on services that do not exist (#4810) ... ## Background When making a blocking query on a missing service (was never registered, or is not registered anymore) the query returns as soon as any service is updated. On clusters with frequent updates (5~10 updates/s in our DCs) these queries virtually do not block, and clients with no protections againt this waste ressources on the agent and server side. Clients that do protect against this get updates later than they should because of the backoff time they implement between requests. ## Implementation While reducing the number of unnecessary updates we still want : * Clients to be notified as soon as when the last instance of a service disapears. * Clients to be notified whenever there's there is an update for the service. * Clients to be notified as soon as the first instance of the requested service is added. To reduce the number of unnecessary updates we need to block when a request to a missing service is made. However in the following case : 1. Client `client1` makes a query for service `foo`, gets back a node and X-Consul-Index 42 2. `foo` is unregistered 3. `client1`  makes a query for `foo` with `index=42` -> `foo` does not exist, the query blocks and `client1` is not notified of the change on `foo` We could store the last raft index when each service was last alive to know wether we should block on the incoming query or not, but that list could grow indefinetly. We instead store the last raft index when a service was unregistered and use it when a query targets a service that does not exist. When a service `srv` is unregistered this "missing service index" is always greater than any X-Consul-Index held by the clients while `srv` was up, allowing us to immediatly notify them. 1. Client `client1` makes a query for service `foo`, gets back a node and `X-Consul-Index: 42` 2. `foo` is unregistered, we set the "missing service index" to 43 3. `client1` makes a blocking query for `foo` with `index=42` -> `foo` does not exist, we check against the "missing service index" and return immediatly with `X-Consul-Index: 43` 4. `client1` makes a blocking query for `foo` with `index=43` -> we block 5. Other changes happen in the cluster, but foo still doesn't exist and "missing service index" hasn't changed, the query is still blocked 6. `foo` is registered again on index 62 -> `foo` exists and its index is greater than 43, we unblock the query	6 years ago
R.B. Boyer	4db60f8243	website: minor acl guide fixes (#5214)	6 years ago
Elghazal Ahmed	2e97a4858f	website: add autowire in Community Tools list (#5118) ... * add autowire in Community Tools list * put list in the right alphabetic order	6 years ago
Hans Hasselberg	f8112e7eaf	Update CHANGELOG.md	6 years ago
Hans Hasselberg	27738c77c0	Update CHANGELOG.md	6 years ago
Matt Keeler	052d68b5fb	Update CHANGELOG.md	6 years ago
Matt Keeler	baa8946ea6	cache: Pass through wait query param to the cache.Get (#5203) ... This adds a MaxQueryTime field to the connect ca leaf cache request type and populates it via the wait query param. The cache will then do the right thing and timeout the operation as expected if no new leaf cert is available within that time. Fixes #4462 The reproduction scenario in the original issue now times out appropriately.	6 years ago
Matt Keeler	27a9f51b24	Update CHANGELOG.md	6 years ago
Pierre Souchay	1618d79518	Allow `"disable_host_node_id": false` to work on Linux as non-root. (#4926) ... Bump `shirou/gopsutil` to include https://github.com/shirou/gopsutil/pull/603 This will allow to have consistent node-id even when machine is reinstalled when using `"disable_host_node_id": false` It will fix https://github.com/hashicorp/consul/issues/4914 and allow having the same node-id even when reinstalling a node from scratch. However, it is only compatible with a single OS (installing to Windows will change the node-id, but it seems acceptable).	6 years ago
Matt Keeler	8969b8d3e4	Update CHANGELOG.md	6 years ago
Aestek	c043de5381	[Security] Allow blocking Write endpoints on Agent using Network Addresses (#4719) ... * Add -write-allowed-nets option * Add documentation for the new write_allowed_nets option	6 years ago
Matt Keeler	1048f3d5e7	acl: Prevent tokens from deleting themselves (#5210) ... Fixes #4897 Also apparently token deletion could segfault in secondary DCs when attempting to delete non-existant tokens. For that reason both checks are wrapped within the non-nil check.	6 years ago
Paul Banks	315cfef08c	Update CHANGELOG.md	6 years ago
Paul Banks	82487d8f68	Update CHANGELOG.md	6 years ago
Paul Banks	0638e09b6e	connect: agent leaf cert caching improvements (#5091) ... * Add State storage and LastResult argument into Cache so that cache.Types can safely store additional data that is eventually expired. * New Leaf cache type working and basic tests passing. TODO: more extensive testing for the Root change jitter across blocking requests, test concurrent fetches for different leaves interact nicely with rootsWatcher. * Add multi-client and delayed rotation tests. * Typos and cleanup error handling in roots watch * Add comment about how the FetchResult can be used and change ca leaf state to use a non-pointer state. * Plumb test override of root CA jitter through TestAgent so that tests are deterministic again! * Fix failing config test	6 years ago
kaitlincarter-hc	2dfc9ae989	Re-worked the ACL guide into two docs and an updated guide. (#5093) ... * Re-worked the ACL guide into two docs and an updated guide. Co-Authored-By: kaitlincarter-hc <43049322+kaitlincarter-hc@users.noreply.github.com> * Updating syntax based on amayer5125's comments. * Missed one of amayer5125's comments * found a bad link in the acl system docs * fixing a link in the rules docs	6 years ago
Kyle Havlovitz	c07c5446a8	txn: clean up some state store/acl code	6 years ago
Erik R. Rygg	6580890f6e	Include information about multi-dc Connect	6 years ago
Matt Keeler	0e280b5a08	Update CHANGELOG.md	6 years ago
dawxy	238d430275	Fix data race (#5029) ... Fix #4357	6 years ago
Hans Hasselberg	067027230b	connect: add tls config for vault connect ca provider (#5125) ... * add tlsconfig for vault connect ca provider. * add options to the docs * add tests for new configuration	6 years ago
Hans Hasselberg	0fc1c203cc	snapshot: read meta.json correctly. (#5193) ... * snapshot: read meta.json correctly. Fixes #4452.	6 years ago
Alejandro Guirao Rodríguez	9f33353c14	agent/config: Fix typo in comment (#5202)	6 years ago
Paul Banks	a13e4b2090	Update CHANGELOG.md	6 years ago
Paul Banks	bb7145f27d	agent: add default weights to service in local state to prevent AE churn (#5126) ... * Add default weights when adding a service with no weights to local state to prevent constant AE re-sync. This fix was contributed by @42wim in https://github.com/hashicorp/consul/pull/5096 but was merged against the wrong base. This adds it to master and adds a test to cover the behaviour. * Fix tests that broke due to comparing internal state which now has default weights	6 years ago
Paul Banks	233ef4634b	Update CHANGELOG.md	6 years ago
Paul Banks	0589525ae9	agent: Don't leave old errors around in cache (#5094) ... * Fixes #4480. Don't leave old errors around in cache that can be hit in specific circumstances. * Move error reset to cover extreme edge case of nil Value, nil err Fetch	6 years ago
Jack Pearkes	96b877f79e	website: fixed ca provider references (#5185) ... Fixes https://github.com/hashicorp/consul/issues/5182.	6 years ago
Matt Keeler	62aa40872c	Update CHANGELOG.md	6 years ago
Pierre Souchay	ae7f88f995	Avoid to have infinite recursion in DNS lookups when resolving CNAMEs (#4918) ... * Avoid to have infinite recursion in DNS lookups when resolving CNAMEs This will avoid killing Consul when a Service.Address is using CNAME to a Consul CNAME that creates an infinite recursion. This will fix https://github.com/hashicorp/consul/issues/4907 * Use maxRecursionLevel = 3 to allow several recursions	6 years ago
Paul Banks	88d239818c	Update CHANGELOG.md	6 years ago
Paul Banks	b29bc906ee	bugfix: use ServiceTags to generate cache key hash (#4987) ... * bugfix: use ServiceTags to generate cahce key hash * update unit test * update * remote print log * Update .gitignore * Completely deprecate ServiceTag field internally for clarity * Add explicit test for CacheInfo cases	6 years ago
R.B. Boyer	0f22706af5	Update CHANGELOG.md	6 years ago
R.B. Boyer	b96391ecff	update github.com/hashicorp/{serf,memberlist,go-sockaddr} (#5189) ... This activates large-cluster improvements in the gossip layer from https://github.com/hashicorp/memberlist/pull/167	6 years ago