consul

History

Derek Menteer 418bd62c44 Fix mesh gateway configuration with proxy-defaults (#15186 ) * Fix mesh gateway proxy-defaults not affecting upstreams. * Clarify distinction with upstream settings Top-level mesh gateway mode in proxy-defaults and service-defaults gets merged into NodeService.Proxy.MeshGateway, and only gets merged with the mode attached to an an upstream in proxycfg/xds. * Fix mgw mode usage for peered upstreams There were a couple issues with how mgw mode was being handled for peered upstreams. For starters, mesh gateway mode from proxy-defaults and the top-level of service-defaults gets stored in NodeService.Proxy.MeshGateway, but the upstream watch for peered data was only considering the mesh gateway config attached in NodeService.Proxy.Upstreams[i]. This means that applying a mesh gateway mode via global proxy-defaults or service-defaults on the downstream would not have an effect. Separately, transparent proxy watches for peered upstreams didn't consider mesh gateway mode at all. This commit addresses the first issue by ensuring that we overlay the upstream config for peered upstreams as we do for non-peered. The second issue is addressed by re-using setupWatchesForPeeredUpstream when handling transparent proxy updates. Note that for transparent proxies we do not yet support mesh gateway mode per upstream, so the NodeService.Proxy.MeshGateway mode is used. * Fix upstream mesh gateway mode handling in xds This commit ensures that when determining the mesh gateway mode for peered upstreams we consider the NodeService.Proxy.MeshGateway config as a baseline. In absense of this change, setting a mesh gateway mode via proxy-defaults or the top-level of service-defaults will not have an effect for peered upstreams. * Merge service/proxy defaults in cfg resolver Previously the mesh gateway mode for connect proxies would be merged at three points: 1. On servers, in ComputeResolvedServiceConfig. 2. On clients, in MergeServiceConfig. 3. On clients, in proxycfg/xds. The first merge returns a ServiceConfigResponse where there is a top-level MeshGateway config from proxy/service-defaults, along with per-upstream config. The second merge combines per-upstream config specified at the service instance with per-upstream config specified centrally. The third merge combines the NodeService.Proxy.MeshGateway config containing proxy/service-defaults data with the per-upstream mode. This third merge is easy to miss, which led to peered upstreams not considering the mesh gateway mode from proxy-defaults. This commit removes the third merge, and ensures that all mesh gateway config is available at the upstream. This way proxycfg/xds do not need to do additional overlays. * Ensure that proxy-defaults is considered in wc Upstream defaults become a synthetic Upstream definition under a wildcard key "". Now that proxycfg/xds expect Upstream definitions to have the final MeshGateway values, this commit ensures that values from proxy-defaults/service-defaults are the default for this synthetic upstream. Add changelog. Co-authored-by: freddygv <freddy@hashicorp.com>		2 years ago
..
connect-proxy-exported-to-peers.latest.golden	…
connect-proxy-lb-in-resolver.latest.golden	…
connect-proxy-with-chain-and-failover-to-cluster-peer.latest.golden	…
connect-proxy-with-chain-and-failover.latest.golden	…
connect-proxy-with-chain-and-overrides.latest.golden	…
connect-proxy-with-chain-and-redirect-to-cluster-peer.latest.golden	…
connect-proxy-with-chain-external-sni.latest.golden	…
connect-proxy-with-chain.latest.golden	…
connect-proxy-with-peered-upstreams.latest.golden	…
connect-proxy-with-tcp-chain-double-failover-through-local-gateway-triggered.latest.golden	…
connect-proxy-with-tcp-chain-double-failover-through-local-gateway.latest.golden	…
connect-proxy-with-tcp-chain-double-failover-through-remote-gateway-triggered.latest.golden	…
connect-proxy-with-tcp-chain-double-failover-through-remote-gateway.latest.golden	…
connect-proxy-with-tcp-chain-failover-through-local-gateway-triggered.latest.golden	…
connect-proxy-with-tcp-chain-failover-through-local-gateway.latest.golden	…
connect-proxy-with-tcp-chain-failover-through-remote-gateway-triggered.latest.golden	…
connect-proxy-with-tcp-chain-failover-through-remote-gateway.latest.golden	…
connect-proxy-with-tls-outgoing-cipher-suites.latest.golden	…
connect-proxy-with-tls-outgoing-max-version.latest.golden	…
connect-proxy-with-tls-outgoing-min-version-auto.latest.golden	…
connect-proxy-with-tls-outgoing-min-version.latest.golden	…
custom-limits-max-connections-only.latest.golden	…
custom-limits-set-to-zero.latest.golden	…
custom-limits.latest.golden	…
custom-local-app.latest.golden	…
custom-max-inbound-connections.latest.golden	…
custom-passive-healthcheck.latest.golden	…
custom-timeouts.latest.golden	…
custom-upstream-default-chain.latest.golden	…
custom-upstream.latest.golden	…
defaults.latest.golden	…
downstream-service-with-unix-sockets.latest.golden	…
expose-paths-grpc-new-cluster-http1.latest.golden	…
expose-paths-local-app-paths.latest.golden	…
expose-paths-new-cluster-http2.latest.golden	…
ingress-gateway-nil-config-entry.latest.golden	…
ingress-gateway-no-services.latest.golden	…
ingress-gateway-with-tls-outgoing-cipher-suites.latest.golden	…
ingress-gateway-with-tls-outgoing-max-version.latest.golden	…
ingress-gateway-with-tls-outgoing-min-version.latest.golden	…
ingress-gateway.latest.golden	…
ingress-lb-in-resolver.latest.golden	…
ingress-multiple-listeners-duplicate-service.latest.golden	…
ingress-splitter-with-resolver-redirect.latest.golden	…
ingress-with-chain-and-failover-to-cluster-peer.latest.golden	…
ingress-with-chain-and-failover.latest.golden	…
ingress-with-chain-external-sni.latest.golden	…
ingress-with-chain.latest.golden	…
ingress-with-defaults-service-max-connections.latest.golden	…
ingress-with-overwrite-defaults-service-max-connections.latest.golden	…
ingress-with-service-max-connections.latest.golden	…
ingress-with-tcp-chain-double-failover-through-local-gateway-triggered.latest.golden	…
ingress-with-tcp-chain-double-failover-through-local-gateway.latest.golden	…
ingress-with-tcp-chain-double-failover-through-remote-gateway-triggered.latest.golden	…
ingress-with-tcp-chain-double-failover-through-remote-gateway.latest.golden	…
ingress-with-tcp-chain-failover-through-local-gateway-triggered.latest.golden	…
ingress-with-tcp-chain-failover-through-local-gateway.latest.golden	…
ingress-with-tcp-chain-failover-through-remote-gateway-triggered.latest.golden	…
ingress-with-tcp-chain-failover-through-remote-gateway.latest.golden	…
local-mesh-gateway-with-peered-upstreams.latest.golden	Fix mesh gateway configuration with proxy-defaults (#15186 )	2 years ago
mesh-gateway-hash-lb-ignored.latest.golden	…
mesh-gateway-ignore-extra-resolvers.latest.golden	…
mesh-gateway-no-services.latest.golden	…
mesh-gateway-non-hash-lb-injected.latest.golden	…
mesh-gateway-peering-control-plane.latest.golden	…
mesh-gateway-service-subsets.latest.golden	…
mesh-gateway-service-timeouts.latest.golden	…
mesh-gateway-tcp-keepalives.latest.golden	…
mesh-gateway-using-federation-states.latest.golden	…
mesh-gateway-with-exported-peered-services-http-with-router.latest.golden	…
mesh-gateway-with-exported-peered-services-http.latest.golden	…
mesh-gateway-with-exported-peered-services.latest.golden	…
mesh-gateway-with-imported-peered-services.latest.golden	…
mesh-gateway-with-peer-through-mesh-gateway-enabled.latest.golden	…
mesh-gateway.latest.golden	…
splitter-with-resolver-redirect.latest.golden	…
terminating-gateway-hostname-service-subsets.latest.golden	…
terminating-gateway-http2-upstream-subsets.latest.golden	…
terminating-gateway-http2-upstream.latest.golden	…
terminating-gateway-ignore-extra-resolvers.latest.golden	…
terminating-gateway-lb-config.latest.golden	…
terminating-gateway-no-services.latest.golden	…
terminating-gateway-service-subsets.latest.golden	…
terminating-gateway-sni.latest.golden	…
terminating-gateway-tcp-keepalives.latest.golden	…
terminating-gateway.latest.golden	…
transparent-proxy-catalog-destinations-only.latest.golden	…
transparent-proxy-destination-http.latest.golden	…
transparent-proxy-destination.latest.golden	…
transparent-proxy-dial-instances-directly.latest.golden	…
transparent-proxy-terminating-gateway-destinations-only.latest.golden	…
transparent-proxy-with-peered-upstreams.latest.golden	…
transparent-proxy.latest.golden	…