consul

History

R.B. Boyer e3cd4a8539 connect: use stronger validation that ingress gateways have compatible protocols defined for their upstreams (#8470 ) Fixes #8466 Since Consul 1.8.0 there was a bug in how ingress gateway protocol compatibility was enforced. At the point in time that an ingress-gateway config entry was modified the discovery chain for each upstream was checked to ensure the ingress gateway protocol matched. Unfortunately future modifications of other config entries were not validated against existing ingress-gateway definitions, such as: 1. create tcp ingress-gateway pointing to 'api' (ok) 2. create service-defaults for 'api' setting protocol=http (worked, but not ok) 3. create service-splitter or service-router for 'api' (worked, but caused an agent panic) If you were to do these in a different order, it would fail without a crash: 1. create service-defaults for 'api' setting protocol=http (ok) 2. create service-splitter or service-router for 'api' (ok) 3. create tcp ingress-gateway pointing to 'api' (fail with message about protocol mismatch) This PR introduces the missing validation. The two new behaviors are: 1. create tcp ingress-gateway pointing to 'api' (ok) 2. (NEW) create service-defaults for 'api' setting protocol=http ("ok" for back compat) 3. (NEW) create service-splitter or service-router for 'api' (fail with message about protocol mismatch) In consideration for any existing users that may be inadvertently be falling into item (2) above, that is now officiall a valid configuration to be in. For anyone falling into item (3) above while you cannot use the API to manufacture that scenario anymore, anyone that has old (now bad) data will still be able to have the agent use them just enough to generate a new agent/proxycfg error message rather than a panic. Unfortunately we just don't have enough information to properly fix the config entries.		4 years ago
..
acl.go	ACL Node Identities (#7970 )	5 years ago
acl_cache.go	…
acl_cache_test.go	…
acl_legacy.go	ACL Node Identities (#7970 )	5 years ago
acl_legacy_test.go	Enable gofmt simplify	5 years ago
acl_oss.go	ACL Node Identities (#7970 )	5 years ago
acl_test.go	Enable gofmt simplify	5 years ago
auto_encrypt.go	…
catalog.go	…
check_definition.go	…
check_definition_test.go	Replace goe/verify.Values with testify/require.Equal (#7993 )	5 years ago
check_type.go	…
config_entry.go	Split up unused key validation for oss/ent (#8189 )	4 years ago
config_entry_discoverychain.go	Enable gofmt simplify	5 years ago
config_entry_discoverychain_oss.go	…
config_entry_discoverychain_test.go	Enable gofmt simplify	5 years ago
config_entry_gateways.go	connect: use stronger validation that ingress gateways have compatible protocols defined for their upstreams (#8470 )	4 years ago
config_entry_gateways_test.go	connect: use stronger validation that ingress gateways have compatible protocols defined for their upstreams (#8470 )	4 years ago
config_entry_oss.go	Split up unused key validation for oss/ent (#8189 )	4 years ago
config_entry_oss_test.go	Split up unused key validation for oss/ent (#8189 )	4 years ago
config_entry_test.go	Split up unused key validation for oss/ent (#8189 )	4 years ago
connect.go	…
connect_ca.go	Move generation of the CA Configuration from the agent code into a method on the RuntimeConfig (#8363 )	4 years ago
connect_ca_test.go	…
connect_oss.go	…
connect_proxy_config.go	Add alias struct tags for new decode hook	5 years ago
connect_proxy_config_oss.go	…
connect_proxy_config_test.go	…
discovery_chain.go	…
discovery_chain_oss.go	…
errors.go	DNS: add IsErrQueryNotFound function for easier error evaluation	4 years ago
federation_state.go	…
intention.go	connect: various changes to make namespaces for intentions work more like for other subsystems (#8194 )	4 years ago
intention_oss.go	connect: various changes to make namespaces for intentions work more like for other subsystems (#8194 )	4 years ago
intention_test.go	Enable gofmt simplify	5 years ago
operator.go	…
prepared_query.go	…
prepared_query_test.go	…
protobuf_compat.go	Refactor the agentpb package (#8362 )	4 years ago
sanitize_oss.go	…
service_definition.go	…
service_definition_test.go	Replace goe/verify.Values with testify/require.Equal (#7993 )	5 years ago
snapshot.go	…
structs.go	fsm: Fix snapshot bug with restoring node/service/check indexes	4 years ago
structs_filtering_test.go	Enable gofmt simplify	5 years ago
structs_oss.go	connect: various changes to make namespaces for intentions work more like for other subsystems (#8194 )	4 years ago
structs_test.go	Enable gofmt simplify	5 years ago
testing.go	…
testing_catalog.go	…
testing_connect_proxy_config.go	…
testing_intention.go	…
testing_service_definition.go	…
txn.go	…