4016 Commits (fcd5f668957baa0fd774de02e2c4fadabb46271c)

Author	SHA1	Message	Date
R.B. Boyer	424f3cdd2c	proxycfg: introduce explicit UpstreamID in lieu of bare string (#12125) ... The gist here is that now we use a value-type struct proxycfg.UpstreamID as the map key in ConfigSnapshot maps where we used to use "upstream id-ish" strings. These are internal only and used just for bidirectional trips through the agent cache keyspace (like the discovery chain target struct). For the few places where the upstream id needs to be projected into xDS, that's what (proxycfg.UpstreamID).EnvoyID() is for. This lets us ALWAYS inject the partition and namespace into these things without making stuff like the golden testdata diverge.	3 years ago
Dan Upton	ca3aca92c4	[OSS] Remove remaining references to master (#11827)	3 years ago
VictorBac	31a39c9528	Add GRPC and GRPCUseTLS to api.HealthCheckDefinition (#12108) ... * Add GRPC to HealthCheckDefinition * add GRPC and GRPCUseTLS	3 years ago
Evan Culver	e35dd08a63	connect: Upgrade Envoy 1.20 to 1.20.1 (#11895)	3 years ago
Daniel Nephin	f31e0b8b1a	Merge pull request #11661 from hashicorp/dnephin/ca-remove-one-call-to-active-root ... ca: remove one call to Provider.ActiveRoot	3 years ago
Kyle Havlovitz	0db874c38b	Add virtual IP generation for term gateway backed services	3 years ago
Chris S. Kim	98ea6d1cf1	Fix race with tags (#12041)	3 years ago
Chris S. Kim	a0acf9978f	Fix races in anti-entropy tests (#12028)	3 years ago
Mike Morris	1b1a97e8f9	ingress: allow setting TLS min version and cipher suites in ingress gateway config entries (#11576) ... * xds: refactor ingress listener SDS configuration * xds: update resolveListenerSDS call args in listeners_test * ingress: add TLS min, max and cipher suites to GatewayTLSConfig * xds: implement envoyTLSVersions and envoyTLSCipherSuites * xds: merge TLS config * xds: configure TLS parameters with ingress TLS context from leaf * xds: nil check in resolveListenerTLSConfig validation * xds: nil check in makeTLSParameters* functions * changelog: add entry for TLS params on ingress config entries * xds: remove indirection for TLS params in TLSConfig structs * xds: return tlsContext, nil instead of ambiguous err Co-authored-by: Chris S. Kim <ckim@hashicorp.com> * xds: switch zero checks to types.TLSVersionUnspecified * ingress: add validation for ingress config entry TLS params * ingress: validate listener TLS config * xds: add basic ingress with TLS params tests * xds: add ingress listeners mixed TLS min version defaults precedence test * xds: add more explicit tests for ingress listeners inheriting gateway defaults * xds: add test for single TLS listener on gateway without TLS defaults * xds: regen golden files for TLSVersionInvalid zero value, add TLSVersionAuto listener test * types/tls: change TLSVersion to string * types/tls: update TLSCipherSuite to string type * types/tls: implement validation functions for TLSVersion and TLSCipherSuites, make some maps private * api: add TLS params to GatewayTLSConfig, add tests * api: add TLSMinVersion to ingress gateway config entry test JSON * xds: switch to Envoy TLS cipher suite encoding from types package * xds: fixup validation for TLSv1_3 min version with cipher suites * add some kitchen sink tests and add a missing struct tag * xds: check if mergedCfg.TLSVersion is in TLSVersionsWithConfigurableCipherSuites * xds: update connectTLSEnabled comment * xds: remove unsued resolveGatewayServiceTLSConfig function * xds: add makeCommonTLSContextFromLeafWithoutParams * types/tls: add LessThan comparator function for concrete values * types/tls: change tlsVersions validation map from string to TLSVersion keys * types/tls: remove unused envoyTLSCipherSuites * types/tls: enable chacha20 cipher suites for Consul agent * types/tls: remove insecure cipher suites from allowed config TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 and TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 are both explicitly listed as insecure and disabled in the Go source. Refs https://cs.opensource.google/go/go/+/refs/tags/go1.17.3:src/crypto/tls/cipher_suites.go;l=329-330 * types/tls: add ValidateConsulAgentCipherSuites function, make direct lookup map private * types/tls: return all unmatched cipher suites in validation errors * xds: check that Envoy API value matching TLS version is found when building TlsParameters * types/tls: check that value is found in map before appending to slice in MarshalEnvoyTLSCipherSuiteStrings * types/tls: cast to string rather than fmt.Printf in TLSCihperSuite.String() * xds: add TLSVersionUnspecified to list of configurable cipher suites * structs: update note about config entry warning * xds: remove TLS min version cipher suite unconfigurable test placeholder * types/tls: update tests to remove assumption about private map values Co-authored-by: R.B. Boyer <rb@hashicorp.com>	3 years ago
Dao Thanh Tung	88c7cfa578	URL-encode/decode resource names for HTTP API part 2 (#11957)	3 years ago
Daniel Nephin	abac8baa5d	ca: remove one call to provider.ActiveRoot ... ActiveRoot should not be called from the secondary DC, because there should not be a requirement to run the same Vault instance in a secondary DC. SignIntermediate is called in a secondary DC, so it should not call ActiveRoot We would also like to change the interface of ActiveRoot so that we can support using an intermediate cert as the primary CA in Consul. In preparation for making that change I am reducing the number of calls to ActiveRoot, so that there are fewer code paths to modify when the interface changes. This change required a change to the mockCAServerDelegate we use in tests. It was returning the RootCert for SignIntermediate, but that is not an accurate fake of production. In production this would also be a separate cert.	3 years ago
Daniel Nephin	eaa084fd41	ca: remove redundant append of an intermediate cert ... Immediately above this line we are already appending the full list of intermediates. The `provider.ActiveIntermediate` MUST be in this list of intermediates because it must be available to all the other non-leader Servers. If it was not in this list of intermediates then any proxy that received data from a non-leader would have the wrong certs. This is being removed now because we are planning on changing the `Provider.ActiveIntermediate` interface, and removing these extra calls ahead of time helps make that change easier.	3 years ago
Daniel Nephin	11f4cdaa49	ca: only generate a single private key for the whole test case ... Using tracing and cpu profiling I found that the majority of the time in these test cases is spent generating a private key. We really don't need separate private keys, so we can generate only one and use it for all cases. With this change the test runs much faster.	3 years ago
Daniel Nephin	b3ffe7ac72	ca: cleanup a test ... Fix the name to match the function it is testing Remove unused code Fix the signature, instead of returning (error, string) which should be (string, error) accept a testing.T to emit errors. Handle the error from encode.	3 years ago
Daniel Nephin	1fd6b16399	ca: use the new leaf signing lookup func in leader metrics	3 years ago
Blake Covarrubias	4bd92921f4	api: Return 404 when deregistering a non-existent check (#11950) ... Update the `/agent/check/deregister/` API endpoint to return a 404 HTTP response code when an attempt is made to de-register a check ID that does not exist on the agent. This brings the behavior of /agent/check/deregister/ in line with the behavior of /agent/service/deregister/ which was changed in #10632 to similarly return a 404 when de-registering non-existent services. Fixes #5821	3 years ago
Dhia Ayachi	1eac39ae9c	clone the service under lock to avoid a data race (#11940) ... * clone the service under lock to avoid a data race * add change log * create a struct and copy the pointer to mutate it to avoid a data race * fix failing test * revert added space * add comments, to clarify the data race.	3 years ago
Daniel Nephin	065f6f89fb	Merge pull request #11918 from hashicorp/dnephin/tob-followup ... Fix a few small bugs	3 years ago
Daniel Nephin	abfc1e4840	snapshot: return the error from replyFn ... The only function passed to SnapshotRPC today always returns a nil error, so there's no way to exercise this bug in practice. This change is being made for correctness so that it doesn't become a problem in the future, if we ever pass a different function to SnapshotRPC.	3 years ago
Daniel Nephin	0166b0839c	config: correctly capture all errors. ... Some calls to multierror.Append were not using the existing b.err, which meant we were losing all previous errors.	3 years ago
Chris S. Kim	4cd2542a3e	Fix test for ENT (#11946)	3 years ago
Chris S. Kim	e4bcaac08c	Fix test for ENT (#11941)	3 years ago
Dhia Ayachi	e653f81919	reset `coalesceTimer` to nil as soon as the event is consumed (#11924) ... * reset `coalesceTimer` to nil as soon as the event is consumed * add change log * refactor to add relevant test. * fix linter * Apply suggestions from code review Co-authored-by: Freddy <freddygv@users.noreply.github.com> * remove non needed check Co-authored-by: Freddy <freddygv@users.noreply.github.com>	3 years ago
Mathew Estafanous	0fdd1318e9	Ensure consistency with error-handling across all handlers. (#11599)	3 years ago
Jared Kirschner	b393c90ce7	Clarify service and check error messages (use ID) ... Error messages related to service and check operations previously included the following substrings: - service %q - check %q From this error message, it isn't clear that the expected field is the ID for the entity, not the name. For example, if the user has a service named test, the error message would read 'Unknown service "test"'. This is misleading - a service with that *name* does exist, but not with that *ID*. The substrings above have been modified to make it clear that ID is needed, not name: - service with ID %q - check with ID %q	3 years ago
Jared Kirschner	a36ddc31c7	Merge pull request #11335 from littlestar642/url-encoded-args ... URL-encode/decode resource names for HTTP API	3 years ago
Chris S. Kim	30550f2c63	testing: Revert assertion for virtual IP flag (#11932)	3 years ago
Jared Kirschner	e0ddb9e4c5	Merge pull request #11820 from hashicorp/improve-ui-disabled-api-response ... http: improve UI not enabled response message	3 years ago
littlestar642	634c72d22f	add path escape and unescape to path params	3 years ago
Daniel Nephin	1683da66b0	Merge pull request #11796 from hashicorp/dnephin/cleanup-test-server ... testing: stop using an old version in testServer	3 years ago
freddygv	21f2c2e68d	Purge chain if it shouldn't be there	3 years ago
freddygv	fe85138453	additional test fixes	3 years ago
freddygv	d26b4860fd	Account for new upstreams constraint in tests	3 years ago
freddygv	2fe27b748d	Check ingress upstreams when gating chain watches	3 years ago
freddygv	6814e84459	Use ptr receiver in all Upstream methods	3 years ago
freddygv	6af9a0d8cf	Avoid storing chain without an upstream	3 years ago
freddygv	ba12dc215b	Clean up chains separately from their watches	3 years ago
freddygv	c5c290c503	Validate chains are associated with upstreams ... Previously we could get into a state where discovery chain entries were not cleaned up after the associated watch was cancelled. These changes add handling for that case where stray chain references are encountered.	3 years ago
freddygv	70d6358426	Store intention upstreams in snapshot	3 years ago
R.B. Boyer	81ea8129d7	proxycfg: ensure all of the watches are canceled if they are cancelable (#11824)	3 years ago
Jared Kirschner	f81dd817ff	Merge pull request #11818 from hashicorp/improve-url-not-found-response ... http: improve 404 Not Found response message	3 years ago
R.B. Boyer	4aabbe529c	proxycfg: use external addresses in tproxy when crossing partition boundaries (#11823)	3 years ago
Jared Kirschner	2de79abc00	http: improve 404 Not Found response message ... When a URL path is not found, return a non-empty message with the 404 status code to help the user understand what went wrong. If the URL path was not prefixed with '/v1/', suggest that may be the cause of the problem (which is a common mistake).	3 years ago
Freddy	85fe875d07	Use anonymousToken when querying by secret ID (#11813) ... Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: Dan Upton <daniel@floppy.co> This query has been incorrectly querying by accessor ID since New ACLs were added. However, the legacy token compat allowed this to continue to work, since it made a fallback query for the anonymousToken ID. PR #11184 removed this legacy token query, which means that the query by accessor ID is now the only check for the anonymous token's existence. This PR updates the GetBySecret call to use the secret ID of the token.	3 years ago
R.B. Boyer	631c649291	various partition related todos (#11822)	3 years ago
Jared Kirschner	34ea9ae8c9	http: improve UI not enabled response message ... Response now clearly indicates: - the UI is disabled - how to enable the UI	3 years ago
Kyle Havlovitz	b50ef696c6	Merge pull request #11812 from hashicorp/metrics-ui-acls ... oss: use wildcard partition in metrics proxy ui endpoint	3 years ago
Kyle Havlovitz	9dcaf0539c	Merge pull request #11798 from hashicorp/vip-goroutine-check ... leader: move the virtual IP version check into a goroutine	3 years ago
Kyle Havlovitz	018693b6ee	acl: use wildcard partition in metrics proxy ui endpoint	3 years ago
Kyle Havlovitz	80a4489844	state: fix freed VIP table id index	3 years ago