consul

Commit Graph

Author	SHA1	Message	Date
mrspanishviking	b8e11507b1	Merge pull request #11543 from hashicorp/envoy-token docs: added more information to help endusers with proxies and ACL	3 years ago
mrspanishviking	f1b4a10c83	Update website/content/docs/connect/proxies/integrate.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>	3 years ago
Dan Upton	50329bf5f6	changelog: entry for enterprise licensing bug fix (#11551 )	3 years ago
John Cowen	6557f52962	ui: Bump our browser support (#11505 ) Bumps our browser support to a "rough ~2 years back" approach.	3 years ago
John Cowen	66f1dd9425	ui: [Port] Ensure the tokens default nspace (and partition) is passed thru to the auth endpoint (#11490 ) Most HTTP API calls will use the default namespace of the calling token to additionally filter/select the data used for the response if one is not specified by the frontend. The internal permissions/authorize endpoint does not do this (you can ask for permissions from different namespaces in on request). Therefore this PR adds the tokens default namespace in the frontend only to our calls to the authorize endpoint. I tried to do it in a place that made it feel like it's getting added in the backend, i.e. in a place which was least likely to ever require changing or thinking about. Note: We are probably going to change this internal endpoint to also inspect the tokens default namespace on the backend. At which point we can revert this commit/PR. * Add the same support for the tokens default partition	3 years ago
Kenia	37de276350	ui: Add Consul API Gateway as an external source (#11371 )	3 years ago
Freddy	3e486cae86	Merge pull request #11546 from hashicorp/ui/bug/revert-11328 ui: Revert #11328 allow-${}-style-interpolation due, to browser support	3 years ago
mrspanishviking	34e1c2b8d2	Merge pull request #11542 from hashicorp/vault-ca docs: added link to the Learn tutorial in Vault CA integration page	3 years ago
mrspanishviking	42ab9e8aa4	Update website/content/docs/connect/ca/vault.mdx Co-authored-by: Daniel Nephin <dnephin@hashicorp.com>	3 years ago
David Yu	f1d1c12ad5	docs: provide more example CLI commands and reference Vault (#11528 ) * docs: provide more example CLI commands and reference Vault * Extra formatting * Update website/content/docs/k8s/operations/gossip-encryption-key-rotation.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * Update website/content/docs/k8s/operations/gossip-encryption-key-rotation.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * Update website/content/docs/k8s/operations/gossip-encryption-key-rotation.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * Update website/content/docs/k8s/operations/gossip-encryption-key-rotation.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * Update website/content/docs/k8s/operations/gossip-encryption-key-rotation.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * Update website/content/docs/k8s/operations/gossip-encryption-key-rotation.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * adding more detail around gossip encryption rotation precautions * Update website/content/docs/k8s/operations/gossip-encryption-key-rotation.mdx Co-authored-by: Matt Keeler <mkeeler@users.noreply.github.com> Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> Co-authored-by: Matt Keeler <mkeeler@users.noreply.github.com>	3 years ago
99	0c5fdb167d	Add changelog entry (#11549 )	3 years ago
Freddy	09ef65d053	Merge pull request #11545 from hashicorp/spiffe-assertion Use ClusterID to check for readiness	3 years ago
freddygv	d6c26ea598	Bump retry time for cross-DC RPC The secondary DC now takes longer to populate the MGW snapshot because it needs to wait for the secondary CA to be initialized before it can receive roots and generate xDS config. Previously MGWs could receive empty roots before the CA was initialized. This wasn't necessarily a problem since the cluster ID in the trust domain isn't verified.	3 years ago
John Cowen	537c4f32f7	Revert "Merge pull request #11328 from radiantly/ui/feature/allow-${}-style-interpolation" This reverts commit `cd55c0cda3`, reversing changes made to `14af8cb7a9`.	3 years ago
freddygv	400697507b	Move assertion to after config fetch	3 years ago
freddygv	da5bcc574e	Use ClusterID to check for readiness The TrustDomain is populated from the Host() method which includes the hard-coded "consul" domain. This means that despite having an empty cluster ID, the TrustDomain won't be empty.	3 years ago
Freddy	aca0576cd1	Merge pull request #11541 from hashicorp/secondary-exports OSS Backport: Prevent writing partition-exports entries to secondary DCs	3 years ago
trujillo-adam	17ccead352	Merge pull request #11487 from hashicorp/docs/admin-partitions-feedback-acl-policies-redux changed 'segments' in this page to 'resource labels' to disambiguate from 'network segments updated the code snippets to use CodeBlock component and to include JSON	3 years ago
Karl Cardenas	50ff9e8a6e	docs: added more information to help endusers with proxies and ACL tokens	3 years ago
Karl Cardenas	5644edae5c	docs: added link to the Learn tutorial in Vault CA integration page	3 years ago
Nitya Dhanushkodi	139c4eb844	command/redirect_traffic: Redirect DNS requests to Consul if -consul-dns-ip is passed in (#11480 ) * command/redirect_traffic: add rules to redirect DNS to Consul. Currently uses a hack to get the consul dns service ip, and this hack only works when the service is deployed in the same namespace as consul. * command/redirect_traffic: redirect DNS to Consul when -consul-dns-ip is passed in * Add unit tests to Consul DNS IP table redirect rules Co-authored-by: Ashwin Venkatesh <ashwin@hashicorp.com> Co-authored-by: Iryna Shustava <ishustava@users.noreply.github.com>	3 years ago
John Cowen	aeaa0a6c96	ui: Temporarily force all UI capabilities (#11520 ) Temporarily revert to pre-1.10 UI functionality by overwriting frontend permissions. These are used to hide certain UI elements, but they are still enforced on the backend. This temporary measure should be removed again once https://github.com/hashicorp/consul/issues/11098 has been resolved	3 years ago
trujillo-adam	9333fad1e3	added json versions for all hcl examples	3 years ago
freddygv	a17f20be04	Add changelog entry	3 years ago
freddygv	6976044bc4	Prevent replicating partition-exports	3 years ago
freddygv	5c121d7a48	handle error scenario of empty local DC	3 years ago
freddygv	af29cda415	Restrict DC for partition-exports writes There are two restrictions: - Writes from the primary DC which explicitly target a secondary DC. - Writes to a secondary DC that do not explicitly target the primary DC. The first restriction is because the config entry is not supported in secondary datacenters. The second restriction is to prevent the scenario where a user writes the config entry to a secondary DC, the write gets forwarded to the primary, but then the config entry does not apply in the secondary. This makes the scope more explicit.	3 years ago
Freddy	00b5b0a0a2	Update filter chain creation for sidecar/ingress listeners (#11245 ) The duo of `makeUpstreamFilterChainForDiscoveryChain` and `makeListenerForDiscoveryChain` were really hard to reason about, and led to concealing a bug in their branching logic. There were several issues here: - They tried to accomplish too much: determining filter name, cluster name, and whether RDS should be used. - They embedded logic to handle significantly different kinds of upstream listeners (passthrough, prepared query, typical services, and catch-all) - They needed to coalesce different data sources (Upstream and CompiledDiscoveryChain) Rather than handling all of those tasks inside of these functions, this PR pulls out the RDS/clusterName/filterName logic. This refactor also fixed a bug with the handling of [UpstreamDefaults](https://www.consul.io/docs/connect/config-entries/service-defaults#defaults). These defaults get stored as UpstreamConfig in the proxy snapshot with a DestinationName of "", since they apply to all upstreams. However, this wildcard destination name must not be used when creating the name of the associated upstream cluster. The coalescing logic in the original functions here was in some situations creating clusters with a `.` prefix, which is not a valid destination.	3 years ago
mrspanishviking	6880551c21	Merge pull request #11521 from hashicorp/broken-link docs: removed broken link to Ambassador	3 years ago
99	80edd040e7	Merge pull request #11485 from hashicorp/add_rpm_signing Add rpm signing workflow	3 years ago
John Cowen	1515c3e667	ui: Filter global intentions list by selected partition (#11475 ) * ui: Filter global intentions list by namespace and partition Filters global intention listing by the current partition rather than trying to use a wildcard.	3 years ago
Kyle Havlovitz	6c0bd0550f	Merge pull request #11461 from deblasis/feature/empty_client_addr_warning config: warn the user if client_addr is empty	3 years ago
Mark Anderson	adb7510a7e	Fixup changelog filename (#11501 ) Signed-off-by: Mark Anderson <manderson@hashicorp.com>	3 years ago
Daniel Upton	50a1f20ff9	xds: prefer fed state gateway definitions if they're fresher (#11522 ) Fixes an issue described in #10132, where if two DCs are WAN federated over mesh gateways, and the gateway in the non-primary DC is terminated and receives a new IP address (as is commonly the case when running them on ephemeral compute instances) the primary DC is unable to re-establish its connection until the agent running on its own gateway is restarted. This was happening because we always preferred gateways discovered by the `Internal.ServiceDump` RPC (which would fail because there's no way to dial the remote DC) over those discovered in the federation state, which is replicated as long as the primary DC's gateway is reachable.	3 years ago
Karl Cardenas	5522610615	docs: added link to Ambassador tutorial in k8s section	3 years ago
99	8fb999b2e0	Update .release/ci.hcl Co-authored-by: Scott Macfarlane <36851+smacfarlane@users.noreply.github.com>	3 years ago
Freddy	7d95d90fce	Merge pull request #11514 from hashicorp/dnephin/ca-fix-secondary-init ca: properly handle the case where the secondary initializes after the primary	3 years ago
freddygv	44748bf234	Add changelog entry	3 years ago
freddygv	cc5a7ed36c	Avoid returning empty roots with uninitialized CA Currently getCARoots could return an empty object with an empty trust domain before the CA is initialized. This commit returns an error while there is no CA config or no trust domain. There could be a CA config and no trust domain because the CA config can be created in InitializeCA before initialization succeeds.	3 years ago
Dhia Ayachi	7916268c40	refactor session state store tables to use the new index pattern (#11525 ) * state: port KV and Tombstone tables to new pattern * go fmt'ed * handle wildcards for tombstones * Fix graveyard ent vs oss * fix oss compilation error * add partition to tombstones and kv state store indexes * refactor to use `indexWithEnterpriseIndexable` * Apply suggestions from code review Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> * add `singleValueID` implementation assertions * partition `tableSessions` table * fix sessions to use UUID and fix prefix index * fix oss build * clean up unused functions * fix oss compilation * add a partition indexer for sessions * Fix oss to not have partition index * fix oss tests * remove unused func `prefixIndexFromServiceNameAsString` * fix test error check * remove unused operations_ent.go and operations_oss.go func * remove unused const Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>	3 years ago
Dhia Ayachi	98735a6d12	KV refactoring, part 2 (#11512 ) * add partition to the kv get pretty print * fix failing test * add test for kvs RPC endpoint	3 years ago
Karl Cardenas	855925cd46	docs: removed broken link to Ambassador	3 years ago
Dhia Ayachi	520cb5858c	KV state store refactoring and partitioning (#11510 ) * state: port KV and Tombstone tables to new pattern * go fmt'ed * handle wildcards for tombstones * Fix graveyard ent vs oss * fix oss compilation error * add partition to tombstones and kv state store indexes * refactor to use `indexWithEnterpriseIndexable` * partition kvs indexID table * add `partitionedIndexEntryName` in oss for test purpose * Apply suggestions from code review Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> * add `singleValueID` implementation assertions * remove entmeta reference from oss Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>	3 years ago
Freddy	5e7eb85f2a	Fix caveat about resolvers operating at L4 (#11497 ) Service resolvers can specify L4 rules such as redirects, or L7 rules such as hash-based load balancing policies.	3 years ago
David Yu	6defa9ddb8	docs: add `brew install hashicorp/tap/consul-k8s` and re-order install and uninstall workflows (#11489 ) * docs: add `brew install hashicorp/tap/consul-k8s` * add consul k8s cli brew install to reference * Update k8s-cli.mdx * split home-brew commands into two steps * Update k8s-cli.mdx * slight changes on recommended way of installing Consul K8s for CLI or multi-DC * Update install.mdx * reorder cli and helm uninstall * Update website/content/docs/k8s/installation/install.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * Update website/content/docs/k8s/installation/install.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * Update website/content/docs/k8s/installation/install.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * Update website/content/docs/k8s/k8s-cli.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * Update website/content/docs/k8s/installation/install.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * Update website/content/docs/k8s/k8s-cli.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>	3 years ago
Daniel Nephin	d9110136f2	ca: Only initialize clusterID in the primary The secondary must get the clusterID from the primary	3 years ago
Daniel Nephin	01bd3d118d	ca: return an error when secondary fails to initialize Previously secondaryInitialize would return nil in this case, which prevented the deferred initialize from happening, and left the CA in an uninitialized state until a config update or root rotation. To fix this I extracted the common parts into the delegate implementation. However looking at this again, it seems like the handling in secondaryUpdateRoots is impossible, because that function should never be called before the secondary is initialzied. I beleive we can remove some of that logic in a follow up.	3 years ago
R.B. Boyer	d110d8735f	update changelog (#11513 )	3 years ago
Evan Culver	01c583431a	ci: Loosen apt source verification (#11493 )	3 years ago
Daniel Nephin	4e4439a2b2	Merge pull request #11415 from hashicorp/dnephin/acl-policy-id-and-revision acl: remove Policy.ID and Policy.Revision	3 years ago

1 2 3 4 5 ...

15869 Commits (ffca66d5df2b19e148e2767d7c112a0ba8916c5c) All Branches Search

15869 Commits (ffca66d5df2b19e148e2767d7c112a0ba8916c5c)

All Branches