github
/
consul
mirror of https://github.com/hashicorp/consul
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
consul/agent
History
Nitya Dhanushkodi 78b170ad50
xds controller: setup watches for and compute leaf cert references in ProxyStateTemplate, and wire up leaf cert manager dependency (#18756) 
* Refactors the leafcert package to not have a dependency on agent/consul and agent/cache to avoid import cycles. This way the xds controller can just import the leafcert package to use the leafcert manager.

The leaf cert logic in the controller:
* Sets up watches for leaf certs that are referenced in the ProxyStateTemplate (which generates the leaf certs too).
* Gets the leaf cert from the leaf cert cache
* Stores the leaf cert in the ProxyState that's pushed to xds
* For the cert watches, this PR also uses a bimapper + a thin wrapper to map leaf cert events to related ProxyStateTemplates

Since bimapper uses a resource.Reference or resource.ID to map between two resource types, I've created an internal type for a leaf certificate to use for the resource.Reference, since it's not a v2 resource.
The wrapper allows mapping events to resources (as opposed to mapping resources to resources)

The controller tests:
Unit: Ensure that we resolve leaf cert references
Lifecycle: Ensure that when the CA is updated, the leaf cert is as well

Also adds a new spiffe id type, and adds workload identity and workload identity URI to leaf certs. This is so certs are generated with the new workload identity based SPIFFE id.

* Pulls out some leaf cert test helpers into a helpers file so it
can be used in the xds controller tests.
* Wires up leaf cert manager dependency
* Support getting token from proxytracker
* Add workload identity spiffe id type to the authorize and sign functions



---------

Co-authored-by: John Murret <john.murret@hashicorp.com>
 		2023-09-12 12:56:43 -07:00
..
ae [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
auto-config OSS -> CE (community edition) changes (#18517) 2023-08-22 09:46:03 -05:00
blockingquery [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
cache xds controller: setup watches for and compute leaf cert references in ProxyStateTemplate, and wire up leaf cert manager dependency (#18756) 2023-09-12 12:56:43 -07:00
cache-types xds controller: setup watches for and compute leaf cert references in ProxyStateTemplate, and wire up leaf cert manager dependency (#18756) 2023-09-12 12:56:43 -07:00
cacheshim xds controller: setup watches for and compute leaf cert references in ProxyStateTemplate, and wire up leaf cert manager dependency (#18756) 2023-09-12 12:56:43 -07:00
checks Add TCP+TLS Healthchecks (#18381) 2023-09-05 13:34:44 -07:00
config Run copyright after running deep-copy as part of the Makefile/CI (#18741) 2023-09-11 13:50:52 -04:00
configentry CE commit (#18583) 2023-08-25 12:47:20 -04:00
connect xds controller: setup watches for and compute leaf cert references in ProxyStateTemplate, and wire up leaf cert manager dependency (#18756) 2023-09-12 12:56:43 -07:00
consul xds controller: setup watches for and compute leaf cert references in ProxyStateTemplate, and wire up leaf cert manager dependency (#18756) 2023-09-12 12:56:43 -07:00
debug [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
dns [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
envoyextensions Add Envoy golden test for OTEL access logging extension (#18760) 2023-09-12 09:58:53 -07:00
exec [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
grpc-external dataplane: Allow getting bootstrap parameters when using V2 APIs (#18504) 2023-09-06 16:46:25 -06:00
grpc-internal [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
grpc-middleware [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
hcp [HCP Telemetry] Move first TelemetryConfig Fetch into the TelemetryConfigProvider (#18318) 2023-08-30 13:25:26 -04:00
leafcert xds controller: setup watches for and compute leaf cert references in ProxyStateTemplate, and wire up leaf cert manager dependency (#18756) 2023-09-12 12:56:43 -07:00
local bug: prevent go routine leakage due to existing DeferCheck (#18558) 2023-08-23 10:33:07 -04:00
log-drop [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
metadata [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
metrics [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
mock [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
pool [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
proxycfg Run copyright after running deep-copy as part of the Makefile/CI (#18741) 2023-09-11 13:50:52 -04:00
proxycfg-glue Add extra logging for mesh health endpoints. (#18647) 2023-09-01 12:29:09 -05:00
proxycfg-sources Run copyright after running deep-copy as part of the Makefile/CI (#18741) 2023-09-11 13:50:52 -04:00
router [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
routine-leak-checker [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
rpc NET-4944 - wire up controllers with proxy tracker (#18603) 2023-08-29 09:15:34 -06:00
rpcclient OSS -> CE (community edition) changes (#18517) 2023-08-22 09:46:03 -05:00
structs xds controller: setup watches for and compute leaf cert references in ProxyStateTemplate, and wire up leaf cert manager dependency (#18756) 2023-09-12 12:56:43 -07:00
submatview [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
systemd [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
token OSS -> CE (community edition) changes (#18517) 2023-08-22 09:46:03 -05:00
uiserver [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
xds Add Envoy golden test for OTEL access logging extension (#18760) 2023-09-12 09:58:53 -07:00
xdsv2 NET-5132 - Configure multiport routing for connect proxies in TProxy mode (#18606) 2023-09-12 01:17:56 +00:00
acl.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
acl_ce.go OSS -> CE (community edition) changes (#18517) 2023-08-22 09:46:03 -05:00
acl_endpoint.go [NET-5333] Add api to read/list and preview templated policies (#18748) 2023-09-11 18:11:37 +00:00
acl_endpoint_test.go [NET-5333] Add api to read/list and preview templated policies (#18748) 2023-09-11 18:11:37 +00:00
acl_test.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
agent.go xds controller: setup watches for and compute leaf cert references in ProxyStateTemplate, and wire up leaf cert manager dependency (#18756) 2023-09-12 12:56:43 -07:00
agent_ce.go OSS -> CE (community edition) changes (#18517) 2023-08-22 09:46:03 -05:00
agent_ce_test.go OSS -> CE (community edition) changes (#18517) 2023-08-22 09:46:03 -05:00
agent_endpoint.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
agent_endpoint_ce.go OSS -> CE (community edition) changes (#18517) 2023-08-22 09:46:03 -05:00
agent_endpoint_ce_test.go OSS -> CE (community edition) changes (#18517) 2023-08-22 09:46:03 -05:00
agent_endpoint_test.go fix: NET-1521 show latest config in /v1/agent/self (#18681) 2023-09-08 09:47:31 +10:00
agent_test.go Add TCP+TLS Healthchecks (#18381) 2023-09-05 13:34:44 -07:00
apiserver.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
apiserver_test.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
catalog_endpoint.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
catalog_endpoint_ce.go OSS -> CE (community edition) changes (#18517) 2023-08-22 09:46:03 -05:00
catalog_endpoint_test.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
check.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
config_endpoint.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
config_endpoint_test.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
connect_auth.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
connect_ca_endpoint.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
connect_ca_endpoint_test.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
coordinate_endpoint.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
coordinate_endpoint_test.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
delegate_mock_test.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
denylist.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
denylist_test.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
discovery_chain_endpoint.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
discovery_chain_endpoint_test.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
dns.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
dns_ce.go OSS -> CE (community edition) changes (#18517) 2023-08-22 09:46:03 -05:00
dns_ce_test.go OSS -> CE (community edition) changes (#18517) 2023-08-22 09:46:03 -05:00
dns_test.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
enterprise_delegate_ce.go OSS -> CE (community edition) changes (#18517) 2023-08-22 09:46:03 -05:00
event_endpoint.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
event_endpoint_test.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
federation_state_endpoint.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
health_endpoint.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
health_endpoint_test.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
http.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
http_ce.go OSS -> CE (community edition) changes (#18517) 2023-08-22 09:46:03 -05:00
http_ce_test.go OSS -> CE (community edition) changes (#18517) 2023-08-22 09:46:03 -05:00
http_decode_test.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
http_register.go [NET-5333] Add api to read/list and preview templated policies (#18748) 2023-09-11 18:11:37 +00:00
http_test.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
intentions_endpoint.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
intentions_endpoint_ce_test.go OSS -> CE (community edition) changes (#18517) 2023-08-22 09:46:03 -05:00
intentions_endpoint_test.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
keyring.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
keyring_test.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
kvs_endpoint.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
kvs_endpoint_test.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
metrics.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
metrics_test.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
nodeid.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
nodeid_test.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
notify.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
notify_test.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
operator_endpoint.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
operator_endpoint_ce.go OSS -> CE (community edition) changes (#18517) 2023-08-22 09:46:03 -05:00
operator_endpoint_ce_test.go OSS -> CE (community edition) changes (#18517) 2023-08-22 09:46:03 -05:00
operator_endpoint_test.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
peering_endpoint.go OSS -> CE (community edition) changes (#18517) 2023-08-22 09:46:03 -05:00
peering_endpoint_ce_test.go OSS -> CE (community edition) changes (#18517) 2023-08-22 09:46:03 -05:00
peering_endpoint_test.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
prepared_query_endpoint.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
prepared_query_endpoint_test.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
proxycfg_test.go Watch the ProxyTracker from xDS controller (#18611) 2023-08-29 14:39:29 -07:00
reload.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
remote_exec.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
remote_exec_test.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
retry_join.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
retry_join_test.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
service_checks_test.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
service_manager.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
service_manager_test.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
session_endpoint.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
session_endpoint_test.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
setup.go xds controller: setup watches for and compute leaf cert references in ProxyStateTemplate, and wire up leaf cert manager dependency (#18756) 2023-09-12 12:56:43 -07:00
setup_ce.go OSS -> CE (community edition) changes (#18517) 2023-08-22 09:46:03 -05:00
sidecar_service.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
sidecar_service_test.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
signal_unix.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
signal_windows.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
snapshot_endpoint.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
snapshot_endpoint_test.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
status_endpoint.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
status_endpoint_test.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
streaming_test.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
testagent.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
testagent_test.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
translate_addr.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
txn_endpoint.go Add TCP+TLS Healthchecks (#18381) 2023-09-05 13:34:44 -07:00
txn_endpoint_test.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
ui_endpoint.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
ui_endpoint_ce_test.go OSS -> CE (community edition) changes (#18517) 2023-08-22 09:46:03 -05:00
ui_endpoint_test.go OSS -> CE (community edition) changes (#18517) 2023-08-22 09:46:03 -05:00
user_event.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
user_event_test.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
util.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
util_test.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
watch_handler.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00
watch_handler_test.go [COMPLIANCE] License changes (#18443) 2023-08-11 09:12:13 -04:00