consul

History

Freddy c58f86a00f Fixup authz for data imported from peers (#15347 ) There are a few changes that needed to be made to to handle authorizing reads for imported data: - If the data was imported from a peer we should not attempt to read the data using the traditional authz rules. This is because the name of services/nodes in a peer cluster are not equivalent to those of the importing cluster. - If the data was imported from a peer we need to check whether the token corresponds to a service, meaning that it has service:write permissions, or to a local read only token that can read all nodes/services in a namespace. This required changes at the policyAuthorizer level, since that is the only view available to OSS Consul, and at the enterprise partition/namespace level.		2 years ago
..
config_entry.go	proxycfg: watch service-defaults config entries (#15025 )	2 years ago
config_entry_test.go	proxycfg: server-local config entry data sources	2 years ago
discovery_chain.go	proxycfg-glue: server-local compiled discovery chain data source	2 years ago
discovery_chain_test.go	proxycfg-glue: server-local compiled discovery chain data source	2 years ago
exported_peered_services.go	Fixup authz for data imported from peers (#15347 )	2 years ago
exported_peered_services_test.go	Prevent consul peer-exports by discovery chain.	2 years ago
federation_state_list_mesh_gateways.go	proxycfg-glue: server-local implementation of `FederationStateListMeshGateways`	2 years ago
federation_state_list_mesh_gateways_test.go	proxycfg-glue: server-local implementation of `FederationStateListMeshGateways`	2 years ago
gateway_services.go	proxycfg-glue: server-local implementation of `GatewayServices`	2 years ago
gateway_services_test.go	proxycfg-glue: server-local implementation of `GatewayServices`	2 years ago
glue.go	Prevent consul peer-exports by discovery chain.	2 years ago
health.go	proxycfg-glue: server-local implementation of the `Health` interface	2 years ago
health_test.go	proxycfg-glue: server-local implementation of the `Health` interface	2 years ago
helpers_test.go	proxycfg-glue: server-local implementation of `ExportedPeeredServices`	2 years ago
intention_upstreams.go	proxycfg-glue: server-local implementation of IntentionUpstreamsDestination	2 years ago
intention_upstreams_test.go	proxycfg-glue: server-local compiled discovery chain data source	2 years ago
intentions.go	proxycfg: terminate stream on irrecoverable errors	2 years ago
intentions_ent_test.go	proxycfg-glue: server-local compiled discovery chain data source	2 years ago
intentions_oss.go	proxycfg: server-local intentions data source	2 years ago
intentions_test.go	feat: xDS updates for peerings control plane through mesh gw	2 years ago
internal_service_dump.go	Fixup authz for data imported from peers (#15347 )	2 years ago
internal_service_dump_test.go	proxycfg-glue: server-local implementation of InternalServiceDump	2 years ago
peered_upstreams.go	sync more acl enforcement	2 years ago
peered_upstreams_test.go	sync more acl enforcement	2 years ago
peering_list.go	feat: xDS updates for peerings control plane through mesh gw	2 years ago
peering_list_test.go	feat: xDS updates for peerings control plane through mesh gw	2 years ago
resolved_service_config.go	proxycfg-glue: server-local implementation of ResolvedServiceConfig	2 years ago
resolved_service_config_test.go	proxycfg-glue: server-local implementation of ResolvedServiceConfig	2 years ago
service_http_checks.go	Service http checks data source for agentless proxies (#14924 )	2 years ago
service_http_checks_test.go	Service http checks data source for agentless proxies (#14924 )	2 years ago
service_list.go	proxycfg-glue: server-local implementation of `ServiceList`	2 years ago
service_list_test.go	proxycfg-glue: server-local implementation of `ServiceList`	2 years ago
trust_bundle.go	sync more acl enforcement	2 years ago
trust_bundle_test.go	fix: persist peering CA updates to dialing clusters (#15243 )	2 years ago