consul

Commit Graph

Author	SHA1	Message	Date
Daniel Nephin	8ba760a2fc	acl: remove id and revision from Policy constructors The fields were removed in a previous commit. Also remove an unused constructor for PolicyMerger	3 years ago
Daniel Nephin	7c679c11e6	acl: remove Policy.ID and Policy.Revision These two fields do not appear to be used anywhere. We use the structs.ACLPolicy ID in the ACLResolver cache, but the acl.Policy ID and revision are not used.	3 years ago
R.B. Boyer	c7c5013edd	rename helper method to reflect the non-deprecated terminology (#11509 )	3 years ago
Luke Kysow	5caee36a76	Document default storage class requirements (#11492 )	3 years ago
Kenia	4c2fa322a1	ui: Topology view with no dependencies (#11280 )	3 years ago
Connor	efe4b21287	Support Vault Namespaces explicitly in CA config (#11477 ) * Support Vault Namespaces explicitly in CA config If there is a Namespace entry included in the Vault CA configuration, set it as the Vault Namespace on the Vault client Currently the only way to support Vault namespaces in the Consul CA config is by doing one of the following: 1) Set the VAULT_NAMESPACE environment variable which will be picked up by the Vault API client 2) Prefix all Vault paths with the namespace Neither of these are super pleasant. The first requires direct access and modification to the Consul runtime environment. It's possible and expected, not super pleasant. The second requires more indepth knowledge of Vault and how it uses Namespaces and could be confusing for anyone without that context. It also infers that it is not supported * Add changelog * Remove fmt.Fprint calls * Make comment clearer * Add next consul version to website docs * Add new test for default configuration * go mod tidy * Add skip if vault not present * Tweak changelog text	3 years ago
trujillo-adam	b4abd242e8	applied feedback	3 years ago
FFMMM	fdb0ee6093	change vault ca docs to mention root cert ttl config (#11488 ) Signed-off-by: FFMMM <FFMMM@users.noreply.github.com>	3 years ago
R.B. Boyer	44c023a302	segments: ensure that the serf_lan_allowed_cidrs applies to network segments (#11495 )	3 years ago
R.B. Boyer	e9ca2e091e	add changelog entry (#11494 )	3 years ago
Mark Anderson	7e8228a20b	Remove some usage of md5 from the system (#11491 ) * Remove some usage of md5 from the system OSS side of https://github.com/hashicorp/consul-enterprise/pull/1253 This is a potential security issue because an attacker could conceivably manipulate inputs to cause persistence files to collide, effectively deleting the persistence file for one of the colliding elements. Signed-off-by: Mark Anderson <manderson@hashicorp.com>	3 years ago
FFMMM	61bd417a82	plumb thru root cert tll to the aws ca provider (#11449 ) * plumb thru root cert ttl to the aws ca provider Signed-off-by: FFMMM <FFMMM@users.noreply.github.com> * Update .changelog/11449.txt Co-authored-by: Dhia Ayachi <dhia@hashicorp.com> Co-authored-by: Dhia Ayachi <dhia@hashicorp.com>	3 years ago
John Cowen	25961355c1	ui: Only show partition / partition selector if enabled (#11484 ) I missed that partitions should never display if you can't use them, not just if you can't choose them.	3 years ago
John Cowen	72be2dd204	ui: Ensure we check intention service prefix permissions for per service (#11409 ) Port of: Ensure we check intention service prefix permissions for per service (#11270) Previously, when showing some action buttons for 'per service intentions' we used a global 'can I do something with any intention' permission to decide whether to show a certain button or not. If a user has a token that does not have 'global' intention permissions, but does have intention permissions on one or more specific services (for example via service / service_prefix), this meant that we did not show them certain buttons required to create/edit the intentions for this specific service. This PR adds that extra permissions check so we now check the intentions permissions per service instead of using the 'global' "can I edit intentions" question/request. Notes: - If a HTML button is `disabled` this means tippy.js doesn't adopt the popover properly and subsequently hide it from the user, so aswell as just disabling the button so you can't active the popover, we also don't even put the popover on the page - If `ability.item` or `ability.item.Resources` are empty then assume no access We don't try to disable service > right hand side intention actions here Whether you can create intentions for a service depends on the _destination_ of the intention you would like to create. For the topology view going from the LHS to the center, this is straightforwards as we only need to know the permissions for the central service, as when you are going from the LHS to the center, the center is the _destination_. When going from the center to the RHS the _destination[s]_ are on the RHS. This means we need to know the permissions for potentially 1000s of services all in one go in order to know when to show a button or not. We can't realistically discover the permissions for service > RHS services as we'd have either make a HTTP request per right hand service, or potentially make an incredibly large POST request for all the potentially 1000s of services on the right hand side (more preferable to 1000s of HTTP requests). Therefore for the moment at least we keep the old functionality (thin client) for the middle to RHS here. If you do go to click on the button and you don't have permissions to update the intention you will still not be able to update it, only you won't know this until you click the button (at which point you'll get a UI visible 403 error) Note: We reversed the conditional here between 1.10 and 1.11 So this make 100% sense that the port is different here to 1.11	3 years ago
David Yu	8f8055352d	docs: consul-k8s uninstall with namespace (#11478 ) * docs: consul-k8s uninstall with namespace Uninstall with namespace * change release name to consul in uninstall * Update website/content/docs/k8s/operations/uninstall.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * add --create-namespace command to install for custom values file Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>	3 years ago
trujillo-adam	e09744adde	changed 'segments' in this page to 'resource labels' to disambiguate from 'network segments'	3 years ago
Kevin Wang	7e80484013	chore: react-subnav (#11486 )	3 years ago
Daniel Nephin	7ed6e3b790	Merge pull request #10822 from hashicorp/krarey/patch-replication-policy Update namespaced replication token example	3 years ago
Kyle Rarey	a775e9a274	Update namespaced replication token example	3 years ago
FFMMM	6004a21f35	fix aws pca certs (#11470 ) Signed-off-by: FFMMM <FFMMM@users.noreply.github.com>	3 years ago
99	6b6557cb2b	Add rpm signing workflow	3 years ago
Thomas Eckert	875fa920c9	Update Helm Docs for v0.36.0 Consul K8s release (#11483 ) Co-authored-by: David Yu <dyu@hashicorp.com>	3 years ago
Luke Kysow	9b680b3f81	Add quick-link for users coming from UI (#11403 ) The Consul UI topology view has an icon with the text "Configure metrics dashboard" that links to this page. Add a notice at the top of the page that links them directly to the relevant section.	3 years ago
Luke Kysow	c61208146d	Use "Open dashboard" everywhere (#11406 ) Previously we had "Open metrics Dashboard" and "Configure metrics dashboard" in the topology cards and then we had "Open Dashboard" in the top nav when the dashboard was configured. Now we use "Open dashboard" and "Configure dashboard". This change was made for consistency in wording and casing. In addition, the dashboard could be used for metrics but also other dashboards so there's no need to scope it only to metrics. Also the config is: ```hcl ui_config { dashboard_url_templates } ``` Which does not mention metrics	3 years ago
Mathew Estafanous	8fb90aacef	Convert (some) test endpoints to use ServeHTTP instead of direct calls to handlers. (#11445 )	3 years ago
trujillo-adam	3ffa05495e	Merge pull request #11307 from hashicorp/docs/admin-partitions-cli-v1.11.0 admin partition docs part 1 - cli	3 years ago
Luke Kysow	7eb32cdb73	Remove Name/Namespace fields from upstream default (#11456 ) The UpstreamConfig.Defaults field does not support setting Name or Namespace because the purpose is to apply defaults to all upstreams. I think this was just missed in the docs since those fields would error if set under Defaults. i.e. this is not supported: ``` UpstreamConfig { Defaults { Name = "foo" Namespace = "bar" # Defaults config here } } ```	3 years ago
FFMMM	4ddf973a31	add root_cert_ttl option for consul connect, vault ca providers (#11428 ) * add root_cert_ttl option for consul connect, vault ca providers Signed-off-by: FFMMM <FFMMM@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Chris S. Kim <ckim@hashicorp.com> * add changelog, pr feedback Signed-off-by: FFMMM <FFMMM@users.noreply.github.com> * Update .changelog/11428.txt, more docs Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> * Update website/content/docs/agent/options.mdx Co-authored-by: Kyle Havlovitz <kylehav@gmail.com> Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> Co-authored-by: Kyle Havlovitz <kylehav@gmail.com>	3 years ago
Daniel Nephin	51d8417545	Merge pull request #10690 from tarat44/h2c-support-in-ping-checks add support for h2c in h2 ping health checks	3 years ago
Freddy	39023fb296	Prevent running build workflows on all PRs (#11469 )	3 years ago
Alessandro De Blasis	2238df6fa4	changelog Signed-off-by: Alessandro De Blasis <alex@deblasis.net>	3 years ago
Alessandro De Blasis	2f970555d9	config: warn the user if client_addr is empty if the provided value is empty string then the client services (DNS, HTTP, HTTPS, GRPC) are not listening and the user is not notified in any way about what's happening. Also, since a not provided client_addr defaults to 127.0.0.1, we make sure we are not getting unwanted warnings Signed-off-by: Alessandro De Blasis <alex@deblasis.net>	3 years ago
Daniel Nephin	b57cae94de	Merge pull request #10771 from hashicorp/dnephin/emit-telemetry-metrics-immediately telemetry: improve cert expiry metrics	3 years ago
Freddy	3f30afd26b	Merge pull request #11450 from hashicorp/ap/best-addr Ensure calls to BestAddress consider partition	3 years ago
freddygv	60066e5154	Exclude default partition from GatewayKey string This will behave the way we handle SNI and SPIFFE IDs, where the default partition is excluded. Excluding the default ensures that don't attempt to compare default.dc2 to dc2 in OSS.	3 years ago
freddygv	e3666b0bc4	Update GatewayKeys deduplication Federation states data is only keyed on datacenter, so it cannot be directly compared against keys for gateway groups.	3 years ago
freddygv	90ce897456	Store GatewayKey in proxycfg snapshot for re-use	3 years ago
freddygv	bbe46e9522	Update locality check in xds	3 years ago
freddygv	4d4ccedb3a	Update locality check in proxycfg	3 years ago
Peter M	697e97f57f	adding K8s page to subnav (#11467 ) * adding K8s page to subnav per request from HLT, updating use case tab to lead to K8s page instead of service mesh. * Update subnav.js	3 years ago
Melissa Kam	867077c48b	Merge pull request #11466 from hashicorp/cts-tls-typo docs/nia: Fix typo in TLS configs for CTS	3 years ago
Melissa Kam	c8240101dc	docs/nia: Fix typo in TLS configs for CTS	3 years ago
Daniel Nephin	7337cfd6dc	Merge pull request #11340 from hashicorp/dnephin/ca-manager-provider ca: split the Provider interface into Primary/Secondary	3 years ago
Daniel Nephin	eee598e91c	Merge pull request #11338 from hashicorp/dnephin/ca-manager-isolate-secondary ca: clearly identify methods that are primary-only or secondary-only	3 years ago
99	8d914003e8	Merge pull request #11417 from hashicorp/crt-migration-1.11.0-betax Crt migration 1.11.0 betax	3 years ago
Melissa Kam	e7cf8226a1	Merge pull request #11463 from hashicorp/docs-cts-tls docs/nia: Update TLS-related configurations for CTS	3 years ago
Daniel Upton	d47b7311b8	Support Check-And-Set deletion of config entries (#11419 ) Implements #11372	3 years ago
trujillo-adam	8ca5be47c8	Merge pull request #11441 from hashicorp/docs/admin-partitions-feedback-acl-policies admin partitions feedback related to ACLs; additional improvements to ACL rule docs	3 years ago
trujillo-adam	78e59170fa	Update website/content/docs/security/acl/acl-rules.mdx Co-authored-by: mrspanishviking <kcardenas@hashicorp.com>	3 years ago
Melissa Kam	0b744289b7	docs/nia: Update TLS-related configurations for CTS - Clarify file types and uses of the configurations - Update some wording to match between Consul and TFE TLS configs	3 years ago

... 2 3 4 5 6 ...

15869 Commits (ffca66d5df2b19e148e2767d7c112a0ba8916c5c) All Branches Search

15869 Commits (ffca66d5df2b19e148e2767d7c112a0ba8916c5c)

All Branches