consul

Consul is a distributed, highly available, and data center aware solution to connect and configure applications across dynamic, distributed infrastructure.

consul api-gateway kubernetes ecs service-discovery service-mesh vault

Tree: 8878f0ea21

History

Mike Morris 1b1a97e8f9 ingress: allow setting TLS min version and cipher suites in ingress gateway config entries (#11576 ) * xds: refactor ingress listener SDS configuration * xds: update resolveListenerSDS call args in listeners_test * ingress: add TLS min, max and cipher suites to GatewayTLSConfig * xds: implement envoyTLSVersions and envoyTLSCipherSuites * xds: merge TLS config * xds: configure TLS parameters with ingress TLS context from leaf * xds: nil check in resolveListenerTLSConfig validation * xds: nil check in makeTLSParameters* functions * changelog: add entry for TLS params on ingress config entries * xds: remove indirection for TLS params in TLSConfig structs * xds: return tlsContext, nil instead of ambiguous err Co-authored-by: Chris S. Kim <ckim@hashicorp.com> * xds: switch zero checks to types.TLSVersionUnspecified * ingress: add validation for ingress config entry TLS params * ingress: validate listener TLS config * xds: add basic ingress with TLS params tests * xds: add ingress listeners mixed TLS min version defaults precedence test * xds: add more explicit tests for ingress listeners inheriting gateway defaults * xds: add test for single TLS listener on gateway without TLS defaults * xds: regen golden files for TLSVersionInvalid zero value, add TLSVersionAuto listener test * types/tls: change TLSVersion to string * types/tls: update TLSCipherSuite to string type * types/tls: implement validation functions for TLSVersion and TLSCipherSuites, make some maps private * api: add TLS params to GatewayTLSConfig, add tests * api: add TLSMinVersion to ingress gateway config entry test JSON * xds: switch to Envoy TLS cipher suite encoding from types package * xds: fixup validation for TLSv1_3 min version with cipher suites * add some kitchen sink tests and add a missing struct tag * xds: check if mergedCfg.TLSVersion is in TLSVersionsWithConfigurableCipherSuites * xds: update connectTLSEnabled comment * xds: remove unsued resolveGatewayServiceTLSConfig function * xds: add makeCommonTLSContextFromLeafWithoutParams * types/tls: add LessThan comparator function for concrete values * types/tls: change tlsVersions validation map from string to TLSVersion keys * types/tls: remove unused envoyTLSCipherSuites * types/tls: enable chacha20 cipher suites for Consul agent * types/tls: remove insecure cipher suites from allowed config TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 and TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 are both explicitly listed as insecure and disabled in the Go source. Refs https://cs.opensource.google/go/go/+/refs/tags/go1.17.3:src/crypto/tls/cipher_suites.go;l=329-330 * types/tls: add ValidateConsulAgentCipherSuites function, make direct lookup map private * types/tls: return all unmatched cipher suites in validation errors * xds: check that Envoy API value matching TLS version is found when building TlsParameters * types/tls: check that value is found in map before appending to slice in MarshalEnvoyTLSCipherSuiteStrings * types/tls: cast to string rather than fmt.Printf in TLSCihperSuite.String() * xds: add TLSVersionUnspecified to list of configurable cipher suites * structs: update note about config entry warning * xds: remove TLS min version cipher suite unconfigurable test placeholder * types/tls: update tests to remove assumption about private map values Co-authored-by: R.B. Boyer <rb@hashicorp.com>		3 years ago
..
acl	cli: Show node identities in acl token list output (#11926 )	3 years ago
agent	agent: refactor the agent delegate interface to be partition friendly (#11429 )	3 years ago
catalog	re-run gofmt on 1.17 (#11579 )	3 years ago
cli	…
config	ingress: allow setting TLS min version and cipher suites in ingress gateway config entries (#11576 )	3 years ago
connect	Update golden files	3 years ago
debug	debug: use human readable dates for filenames	3 years ago
event	…
exec	…
flags	add partition flag to catalog commands (#10949 )	3 years ago
forceleave	agent: add variation of force-leave that exclusively works on the WAN (#11722 )	3 years ago
helpers	…
info	…
intention	Support partitions in connect expose cmd	3 years ago
join	partitions: various refactors to support partitioning the serf LAN pool (#11568 )	3 years ago
keygen	…
keyring	partitions: various refactors to support partitioning the serf LAN pool (#11568 )	3 years ago
kv	KV refactoring, part 2 (#11512 )	3 years ago
leave	…
lock	re-run gofmt on 1.17 (#11579 )	3 years ago
login	Remove references to "master" ACL tokens in tests (#11751 )	3 years ago
logout	Remove references to "master" ACL tokens in tests (#11751 )	3 years ago
maint	…
members	partitions: various refactors to support partitioning the serf LAN pool (#11568 )	3 years ago
monitor	…
operator	…
reload	…
rtt	agent: ensure that most agent behavior correctly respects partition configuration (#10880 )	3 years ago
services	Fixup to support unix domain socket via command line (#10758 )	3 years ago
snapshot	cli: use file mode 0600 when saving a snapshot	3 years ago
tls	Merge pull request #11884 from assareh/patch-1	3 years ago
validate	…
version	…
watch	…
commands_oss.go	debug: restore cancel on SigInt	3 years ago
registry.go	debug: restore cancel on SigInt	3 years ago