consul

History

R.B. Boyer 8e22d80e35 connect: fix failover through a mesh gateway to a remote datacenter (#6259 ) Failover is pushed entirely down to the data plane by creating envoy clusters and putting each successive destination in a different load assignment priority band. For example this shows that normally requests go to 1.2.3.4:8080 but when that fails they go to 6.7.8.9:8080: - name: foo load_assignment: cluster_name: foo policy: overprovisioning_factor: 100000 endpoints: - priority: 0 lb_endpoints: - endpoint: address: socket_address: address: 1.2.3.4 port_value: 8080 - priority: 1 lb_endpoints: - endpoint: address: socket_address: address: 6.7.8.9 port_value: 8080 Mesh gateways route requests based solely on the SNI header tacked onto the TLS layer. Envoy currently only lets you configure the outbound SNI header at the cluster layer. If you try to failover through a mesh gateway you ideally would configure the SNI value per endpoint, but that's not possible in envoy today. This PR introduces a simpler way around the problem for now: 1. We identify any target of failover that will use mesh gateway mode local or remote and then further isolate any resolver node in the compiled discovery chain that has a failover destination set to one of those targets. 2. For each of these resolvers we will perform a small measurement of comparative healths of the endpoints that come back from the health API for the set of primary target and serial failover targets. We walk the list of targets in order and if any endpoint is healthy we return that target, otherwise we move on to the next target. 3. The CDS and EDS endpoints both perform the measurements in (2) for the affected resolver nodes. 4. For CDS this measurement selects which TLS SNI field to use for the cluster (note the cluster is always going to be named for the primary target) 5. For EDS this measurement selects which set of endpoints will populate the cluster. Priority tiered failover is ignored. One of the big downsides to this approach to failover is that the failover detection and correction is going to be controlled by consul rather than deferring that entirely to the data plane as with the prior version. This also means that we are bound to only failover using official health signals and cannot make use of data plane signals like outlier detection to affect failover. In this specific scenario the lack of data plane signals is ok because the effectiveness is already muted by the fact that the ultimate destination endpoints will have their data plane signals scrambled when they pass through the mesh gateway wrapper anyway so we're not losing much. Another related fix is that we now use the endpoint health from the underlying service, not the health of the gateway (regardless of failover mode).		5 years ago
..
ae	…
cache	Simplified code in various places (#6176 )	5 years ago
cache-types	connect: fix failover through a mesh gateway to a remote datacenter (#6259 )	5 years ago
checks	Merge Consul OSS branch 'master' at commit `ef257b084d`	5 years ago
config	Revert "connect: support AWS PCA as a CA provider" (#6251 )	5 years ago
connect	Revert "connect: support AWS PCA as a CA provider" (#6251 )	5 years ago
consul	connect: fix failover through a mesh gateway to a remote datacenter (#6259 )	5 years ago
debug	…
exec	…
local	Flaky test overhaul (#6100 )	5 years ago
metadata	…
mock	…
pool	tls: auto_encrypt enables automatic RPC cert provisioning for consul clients (#5597 )	5 years ago
proxycfg	connect: fix failover through a mesh gateway to a remote datacenter (#6259 )	5 years ago
proxyprocess	Move internal/ to sdk/ (#5568 )	6 years ago
router	Simplified code in various places (#6176 )	5 years ago
structs	connect: fix failover through a mesh gateway to a remote datacenter (#6259 )	5 years ago
systemd	…
token	…
xds	connect: fix failover through a mesh gateway to a remote datacenter (#6259 )	5 years ago
acl.go	…
acl_endpoint.go	ACL Token ID Initialization (#5307 )	6 years ago
acl_endpoint_legacy.go	…
acl_endpoint_legacy_test.go	…
acl_endpoint_test.go	ACL Token ID Initialization (#5307 )	6 years ago
acl_test.go	tls: auto_encrypt enables automatic RPC cert provisioning for consul clients (#5597 )	5 years ago
agent.go	resolve circleci config conflicts	5 years ago
agent_endpoint.go	resolve circleci config conflicts	5 years ago
agent_endpoint_test.go	resolve circleci config conflicts	5 years ago
agent_test.go	Allow raft TrailingLogs to be configured. (#6186 )	5 years ago
bindata_assetfs.go	update bindata_assetfs.go	5 years ago
blacklist.go	…
blacklist_test.go	…
catalog_endpoint.go	resolve circleci config conflicts	5 years ago
catalog_endpoint_test.go	Add tagged addresses for services (#5965 )	6 years ago
check.go	…
config.go	Make a few config entry endpoints return 404s and allow for snake_case and lowercase key names. (#5748 )	6 years ago
config_endpoint.go	Centralized Config CLI (#5731 )	6 years ago
config_endpoint_test.go	handle structs.ConfigEntry decoding similarly to api.ConfigEntry decoding (#6106 )	5 years ago
connect_auth.go	…
connect_ca_endpoint.go	…
connect_ca_endpoint_test.go	connect: Support RSA keys in addition to ECDSA (#6055 )	5 years ago
coordinate_endpoint.go	…
coordinate_endpoint_test.go	Update retries that weren't using retry.R (#6146 )	5 years ago
discovery_chain_endpoint.go	connect: expose an API endpoint to compile the discovery chain (#6248 )	5 years ago
discovery_chain_endpoint_test.go	connect: fix failover through a mesh gateway to a remote datacenter (#6259 )	5 years ago
dns.go	Merge Consul OSS branch 'master' at commit `e91f73f592`	5 years ago
dns_test.go	Merge Consul OSS branch 'master' at commit `e91f73f592`	5 years ago
enterprise_delegate_oss.go	Update to use a consulent build tag instead of just ent (#5759 )	6 years ago
event_endpoint.go	…
event_endpoint_test.go	Move internal/ to sdk/ (#5568 )	6 years ago
health_endpoint.go	Filter non-passing nodes without modifying cache	6 years ago
health_endpoint_test.go	Merge branch 'master' into release/1-6	5 years ago
http.go	Simplified code in various places (#6176 )	5 years ago
http_oss.go	connect: expose an API endpoint to compile the discovery chain (#6248 )	5 years ago
http_oss_test.go	…
http_test.go	Move internal/ to sdk/ (#5568 )	6 years ago
intentions_endpoint.go	Implement Mesh Gateways	5 years ago
intentions_endpoint_test.go	…
keyring.go	…
keyring_test.go	Move internal/ to sdk/ (#5568 )	6 years ago
kvs_endpoint.go	Chunking support (#6172 )	5 years ago
kvs_endpoint_test.go	…
notify.go	…
notify_test.go	…
operator_endpoint.go	…
operator_endpoint_test.go	Merge pull request #5376 from hashicorp/fix-tests	6 years ago
prepared_query_endpoint.go	…
prepared_query_endpoint_test.go	Add tagged addresses for services (#5965 )	6 years ago
remote_exec.go	…
remote_exec_test.go	Update retries that weren't using retry.R (#6146 )	5 years ago
retry_join.go	tls: auto_encrypt enables automatic RPC cert provisioning for consul clients (#5597 )	5 years ago
retry_join_test.go	tls: auto_encrypt enables automatic RPC cert provisioning for consul clients (#5597 )	5 years ago
service_manager.go	Implement Mesh Gateways	5 years ago
service_manager_test.go	Add integration test for central config; fix central config WIP (#5752 )	6 years ago
session_endpoint.go	…
session_endpoint_test.go	tests: actually have TestSessionTTLRenew sleep during execution (#5669 )	6 years ago
sidecar_service.go	Ensure Consul is IPv6 compliant (#5468 )	6 years ago
sidecar_service_test.go	…
signal_unix.go	…
signal_windows.go	…
snapshot_endpoint.go	…
snapshot_endpoint_test.go	…
status_endpoint.go	Allow forwarding of some status RPCs (#6198 )	5 years ago
status_endpoint_test.go	Fix flaky tests (#6229 )	5 years ago
testagent.go	tls: auto_encrypt enables automatic RPC cert provisioning for consul clients (#5597 )	5 years ago
testagent_test.go	…
translate_addr.go	Add tagged addresses for services (#5965 )	6 years ago
txn_endpoint.go	Chunking support (#6172 )	5 years ago
txn_endpoint_test.go	Chunking support (#6172 )	5 years ago
ui_endpoint.go	Implement Kind based ServiceDump and caching of the ServiceDump RPC	5 years ago
ui_endpoint_test.go	Simplified code in various places (#6176 )	5 years ago
user_event.go	…
user_event_test.go	Move internal/ to sdk/ (#5568 )	6 years ago
util.go	…
util_test.go	Move internal/ to sdk/ (#5568 )	6 years ago
watch_handler.go	Move the watch package into the api module (#5664 )	6 years ago
watch_handler_test.go	Move the watch package into the api module (#5664 )	6 years ago