186 Commits (f956e662072fe1f403c973a8acfdde5fb7650bde)

Author	SHA1	Message	Date
Luke Kysow	1dcdd2516c	Update config entry docs for CRDs (#10407) ... * Update mesh, proxy-defaults and service-defaults docs to properly document Kubernetes YAML. Co-authored-by: David Yu <dyu@hashicorp.com>	3 years ago
Nitya Dhanushkodi	b72ad40286	docs: upgrading to tproxy (/docs/upgrades/upgrade-specific) (#10416) ... * docs: update tproxy docs Co-authored-by: Blake Covarrubias <blake@covarrubi.as> Co-authored-by: Iryna Shustava <ishustava@users.noreply.github.com> Co-authored-by: David Yu <dyu@hashicorp.com>	4 years ago
Nitya Dhanushkodi	7494b25c1e	docs: update tproxy docs (/docs/connect/transparent-proxy) (#10415) ... * docs: update tproxy docs * add examples * links	4 years ago
Blake Covarrubias	d9add7c2c3	docs: Remove beta tag for 1.10 features ... Remove beta tag for 1.10 features which are now GA.	4 years ago
R.B. Boyer	24a9402390	docs: mention that service defaults upstream config sections should not contain wildcards (#10451)	4 years ago
Blake Covarrubias	64d122b0a2	docs: Add example of escaping tracing JSON using jq	4 years ago
Freddy	ffb13f35f1	Rename CatalogDestinationsOnly (#10397) ... CatalogDestinationsOnly is a passthrough that would enable dialing addresses outside of Consul's catalog. However, when this flag is set to true only _connect_ endpoints for services can be dialed. This flag is being renamed to signal that non-Connect endpoints can't be dialed by transparent proxies when the value is set to true.	4 years ago
R.B. Boyer	dbca996c3c	docs: update envoy docs for changes related to xDS v2->v3 and SoTW->Incremental (#10166) ... Fixes #10098	4 years ago
Freddy	429f9d8bb8	Add flag for transparent proxies to dial individual instances (#10329)	4 years ago
Mark Anderson	1bf3dc5a5f	Docs for Unix Domain Sockets (#10252) ... * Docs for Unix Domain Sockets There are a number of cases where a user might wish to either 1) expose a service through a Unix Domain Socket in the filesystem ('downstream') or 2) connect to an upstream service by a local unix domain socket (upstream). As of Consul (1.10-beta2) we've added new syntax and support to configure the Envoy proxy to support this To connect to a service via local Unix Domain Socket instead of a port, add local_bind_socket_path and optionally local_bind_socket_mode to the upstream config for a service: upstreams = [ { destination_name = "service-1" local_bind_socket_path = "/tmp/socket_service_1" local_bind_socket_mode = "0700" ... } ... ] This will cause Envoy to create a socket with the path and mode provided, and connect that to service-1 The mode field is optional, and if omitted will use the default mode for Envoy. This is not applicable for abstract sockets. See https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/address.proto#envoy-v3-api-msg-config-core-v3-pipe for details NOTE: These options conflict the local_bind_socket_port and local_bind_socket_address options. We can bind to an port or we can bind to a socket, but not both. To expose a service listening on a Unix Domain socket to the service mesh use either the 'socket_path' field in the service definition or the 'local_service_socket_path' field in the proxy definition. These fields are analogous to the 'port' and 'service_port' fields in their respective locations. services { name = "service-2" socket_path = "/tmp/socket_service_2" ... } OR proxy { local_service_socket_path = "/tmp/socket_service_2" ... } There is no mode field since the service is expected to create the socket it is listening on, not the Envoy proxy. Again, the socket_path and local_service_socket_path fields conflict with address/port and local_service_address/local_service_port configuration entries. Set up a simple service mesh with dummy services: socat -d UNIX-LISTEN:/tmp/downstream.sock,fork UNIX-CONNECT:/tmp/upstream.sock socat -v tcp-l:4444,fork exec:/bin/cat services { name = "sock_forwarder" id = "sock_forwarder.1" socket_path = "/tmp/downstream.sock" connect { sidecar_service { proxy { upstreams = [ { destination_name = "echo-service" local_bind_socket_path = "/tmp/upstream.sock" config { passive_health_check { interval = "10s" max_failures = 42 } } } ] } } } } services { name = "echo-service" port = 4444 connect = { sidecar_service {} } Kind = "ingress-gateway" Name = "ingress-service" Listeners = [ { Port = 8080 Protocol = "tcp" Services = [ { Name = "sock_forwarder" } ] } ] consul agent -dev -enable-script-checks -config-dir=./consul.d consul connect envoy -sidecar-for sock_forwarder.1 consul connect envoy -sidecar-for echo-service -admin-bind localhost:19001 consul config write ingress-gateway.hcl consul connect envoy -gateway=ingress -register -service ingress-service -address '{{ GetInterfaceIP "eth0" }}:8888' -admin-bind localhost:19002 netcat 127.0.0.1 4444 netcat 127.0.0.1 8080 Signed-off-by: Mark Anderson <manderson@hashicorp.com> * fixup Unix capitalization Signed-off-by: Mark Anderson <manderson@hashicorp.com> * Update website/content/docs/connect/registration/service-registration.mdx Co-authored-by: Blake Covarrubias <blake@covarrubi.as> * Provide examples in hcl and json Signed-off-by: Mark Anderson <manderson@hashicorp.com> * Apply suggestions from code review Co-authored-by: Blake Covarrubias <blake@covarrubi.as> * One more fixup for docs Signed-off-by: Mark Anderson <manderson@hashicorp.com> Co-authored-by: Blake Covarrubias <blake@covarrubi.as>	4 years ago
Paul Banks	8233328e48	Fix doc note since we switched authorization mechanism in 1.9 (#10266)	4 years ago
R.B. Boyer	3b50a55533	connect: update supported envoy versions to 1.18.3, 1.17.3, 1.16.4, and 1.15.5 (#10231)	4 years ago
Daniel Nephin	f6580400dc	docs: document the current state of built-in and native	4 years ago
Daniel Nephin	583850e9d4	docs: remove name field from Mesh config entry ... Also document the name of these config entries in the API docs, so that users know how to query for them. And fix the name of mesh on the index page.	4 years ago
Freddy	2ca3f481f8	Only consider virtual IPs for transparent proxies (#10162) ... Initially we were loading every potential upstream address into Envoy and then routing traffic to the logical upstream service. The downside of this behavior is that traffic meant to go to a specific instance would be load balanced across ALL instances. Traffic to specific instance IPs should be forwarded to the original destination and if it's a destination in the mesh then we should ensure the appropriate certificates are used. This PR makes transparent proxying a Kubernetes-only feature for now since support for other environments requires generating virtual IPs, and Consul does not do that at the moment.	4 years ago
R.B. Boyer	abc1dc0fe9	connect: update supported envoy versions to 1.18.2, 1.17.2, 1.16.3, and 1.15.4 (#10101) ... The only thing that needed fixing up pertained to this section of the 1.18.x release notes: > grpc_stats: the default value for stats_for_all_methods is switched from true to false, in order to avoid possible memory exhaustion due to an untrusted downstream sending a large number of unique method names. The previous default value was deprecated in version 1.14.0. This only changes the behavior when the value is not set. The previous behavior can be used by setting the value to true. This behavior change by be overridden by setting runtime feature envoy.deprecated_features.grpc_stats_filter_enable_stats_for_all_methods_by_default. For now to maintain status-quo I'm explicitly setting `stats_for_all_methods=true` in all versions to avoid relying upon the default. Additionally the naming of the emitted metrics for these gRPC requests changed slightly so the integration test assertions for `case-grpc` needed adjusting.	4 years ago
Freddy	078c40425f	Rename "cluster" config entry to "mesh" (#10127) ... This config entry is being renamed primarily because in k8s the name cluster could be confusing given that the config entry applies across federated datacenters. Additionally, this config entry will only apply to Consul as a service mesh, so the more generic "cluster" name is not needed.	4 years ago
David Yu	b7cc83fde0	docs - Adding json formatting to TProxy HCL examples (#10088) ... formatting	4 years ago
Freddy	8b8c3c1992	Add docs for transparent proxy mode and config (#10038) ... Add docs for transparent proxy mode and config Co-authored-by: Nitya Dhanushkodi <nitya@hashicorp.com> Co-authored-by: Blake Covarrubias <blake@covarrubi.as> Co-authored-by: Iryna Shustava <ishustava@users.noreply.github.com> Co-authored-by: Jeff Escalante <jescalan@users.noreply.github.com>	4 years ago
Zachary Shilton	8671762474	website: implement mktg 032 (#9953) ... * website: migrate to new nav-data format * website: clean up unused intro content * website: remove deprecated sidebar_title from frontmatter * website: add react-content to fix global style import issue	4 years ago
Nitya Dhanushkodi	147628859d	Add metrics documentation (#9848)	4 years ago
woz5999	ea33c390ce	update docs and add changelog	4 years ago
Luke Kysow	a1d5e1fb41	docs: rename SourceAddress to SourceIP (#9878) ... SourceAddress was probably renamed to SourceIP but the docs weren't updated.	4 years ago
Mike Wickett	8f72c17248	fix: syntax issue	4 years ago
Freddy	555961e036	Merge pull request #9770 from hashicorp/docs/fix-terminating-gateway-config-entry ... Docs: Update terminating-gateway-config-entry	4 years ago
R.B. Boyer	398b766532	xds: default to speaking xDS v3, but allow for v2 to be spoken upon request (#9658) ... - Also add support for envoy 1.17.0	4 years ago
R.B. Boyer	3b6ffc447b	xds: remove deprecated usages of xDS (#9602) ... Note that this does NOT upgrade to xDS v3. That will come in a future PR. Additionally: - Ignored staticcheck warnings about how github.com/golang/protobuf is deprecated. - Shuffled some agent/xds imports in advance of a later xDS v3 upgrade. - Remove support for envoy 1.13.x but don't add in 1.17.x yet. We have to wait until the xDS v3 support is added in a follow-up PR. Fixes #8425	4 years ago
Christoph Puhl	45a569d935	Update terminating-gateway.mdx ... fix crds support reference and adding ACL clarification for linked services.	4 years ago
Preetha	4174bc4330	Add docs section on regenerating expired CA certificates (#9709) ... * Updated docs on regenerating built in CA * review feedback * Add sentence about expected behavior after update CA endpoint is used.	4 years ago
R.B. Boyer	6eeccc93ce	connect: update supported envoy point releases to 1.16.2, 1.15.3, 1.14.6, 1.13.7 (#9737)	4 years ago
Luke Kysow	9f006fdcc8	Document proxy-defaults config for prometheus (#9640)	4 years ago
Chris Boulton	8a35df81c7	connect: add local_request_timeout_ms to configure local_app http timeouts (#9554)	4 years ago
Chulki Lee	8be5a4b38a	Fix link markup in docs/connect/ca/vault	4 years ago
Luke Kysow	b6d7bf1243	Move cfg entry docs to under connect from agent (#9533) ... Since all config entries are currently related to service mesh it's a much more natural place to look for them under Service Mesh than under Agent.	4 years ago
Jeff Escalante	ef900cdb5c	update deps, restore search	4 years ago
Jeff Escalante	582dce9d8f	maintenance complete, pending markdown-page component addition	4 years ago