2015-11-07 00:59:32 +00:00
|
|
|
package structs
|
|
|
|
|
2018-09-06 10:34:28 +00:00
|
|
|
import (
|
|
|
|
"strconv"
|
|
|
|
|
|
|
|
"github.com/hashicorp/consul/agent/cache"
|
|
|
|
"github.com/hashicorp/consul/types"
|
|
|
|
"github.com/mitchellh/hashstructure"
|
|
|
|
)
|
2018-04-10 12:28:27 +00:00
|
|
|
|
2015-11-07 00:59:32 +00:00
|
|
|
// QueryDatacenterOptions sets options about how we fail over if there are no
|
|
|
|
// healthy nodes in the local datacenter.
|
|
|
|
type QueryDatacenterOptions struct {
|
|
|
|
// NearestN is set to the number of remote datacenters to try, based on
|
|
|
|
// network coordinates.
|
|
|
|
NearestN int
|
|
|
|
|
|
|
|
// Datacenters is a fixed list of datacenters to try after NearestN. We
|
|
|
|
// never try a datacenter multiple times, so those are subtracted from
|
|
|
|
// this list before proceeding.
|
|
|
|
Datacenters []string
|
|
|
|
}
|
|
|
|
|
|
|
|
// QueryDNSOptions controls settings when query results are served over DNS.
|
|
|
|
type QueryDNSOptions struct {
|
|
|
|
// TTL is the time to live for the served DNS results.
|
|
|
|
TTL string
|
|
|
|
}
|
|
|
|
|
|
|
|
// ServiceQuery is used to query for a set of healthy nodes offering a specific
|
|
|
|
// service.
|
|
|
|
type ServiceQuery struct {
|
|
|
|
// Service is the service to query.
|
|
|
|
Service string
|
|
|
|
|
|
|
|
// Failover controls what we do if there are no healthy nodes in the
|
|
|
|
// local datacenter.
|
|
|
|
Failover QueryDatacenterOptions
|
|
|
|
|
|
|
|
// If OnlyPassing is true then we will only include nodes with passing
|
|
|
|
// health checks (critical AND warning checks will cause a node to be
|
|
|
|
// discarded)
|
|
|
|
OnlyPassing bool
|
|
|
|
|
2018-04-10 12:28:27 +00:00
|
|
|
// IgnoreCheckIDs is an optional list of health check IDs to ignore when
|
|
|
|
// considering which nodes are healthy. It is useful as an emergency measure
|
|
|
|
// to temporarily override some health check that is producing false negatives
|
|
|
|
// for example.
|
|
|
|
IgnoreCheckIDs []types.CheckID
|
|
|
|
|
2016-06-21 19:39:40 +00:00
|
|
|
// Near allows the query to always prefer the node nearest the given
|
|
|
|
// node. If the node does not exist, results are returned in their
|
2016-07-01 18:50:30 +00:00
|
|
|
// normal randomly-shuffled order. Supplying the magic "_agent" value
|
|
|
|
// is supported to sort near the agent which initiated the request.
|
2016-06-21 19:39:40 +00:00
|
|
|
Near string
|
2016-06-20 21:07:08 +00:00
|
|
|
|
2015-11-07 00:59:32 +00:00
|
|
|
// Tags are a set of required and/or disallowed tags. If a tag is in
|
2015-11-17 16:29:20 +00:00
|
|
|
// this list it must be present. If the tag is preceded with "!" then
|
2015-11-07 00:59:32 +00:00
|
|
|
// it is disallowed.
|
|
|
|
Tags []string
|
2017-01-18 21:23:33 +00:00
|
|
|
|
|
|
|
// NodeMeta is a map of required node metadata fields. If a key/value
|
|
|
|
// pair is in this map it must be present on the node in order for the
|
|
|
|
// service entry to be returned.
|
|
|
|
NodeMeta map[string]string
|
2018-06-05 21:17:19 +00:00
|
|
|
|
Improve Connect with Prepared Queries (#5291)
Given a query like:
```
{
"Name": "tagged-connect-query",
"Service": {
"Service": "foo",
"Tags": ["tag"],
"Connect": true
}
}
```
And a Consul configuration like:
```
{
"services": [
"name": "foo",
"port": 8080,
"connect": { "sidecar_service": {} },
"tags": ["tag"]
]
}
```
If you executed the query it would always turn up with 0 results. This was because the sidecar service was being created without any tags. You could instead make your config look like:
```
{
"services": [
"name": "foo",
"port": 8080,
"connect": { "sidecar_service": {
"tags": ["tag"]
} },
"tags": ["tag"]
]
}
```
However that is a bit redundant for most cases. This PR ensures that the tags and service meta of the parent service get copied to the sidecar service. If there are any tags or service meta set in the sidecar service definition then this copying does not take place. After the changes, the query will now return the expected results.
A second change was made to prepared queries in this PR which is to allow filtering on ServiceMeta just like we allow for filtering on NodeMeta.
2019-02-04 14:36:51 +00:00
|
|
|
// ServiceMeta is a map of required service metadata fields. If a key/value
|
|
|
|
// pair is in this map it must be present on the node in order for the
|
|
|
|
// service entry to be returned.
|
|
|
|
ServiceMeta map[string]string
|
|
|
|
|
2018-06-05 21:17:19 +00:00
|
|
|
// Connect if true will filter the prepared query results to only
|
|
|
|
// include Connect-capable services. These include both native services
|
|
|
|
// and proxies for matching services. Note that if a proxy matches,
|
|
|
|
// the constraints in the query above (Near, OnlyPassing, etc.) apply
|
|
|
|
// to the _proxy_ and not the service being proxied. In practice, proxies
|
|
|
|
// should be directly next to their services so this isn't an issue.
|
|
|
|
Connect bool
|
2015-11-07 00:59:32 +00:00
|
|
|
}
|
|
|
|
|
2016-02-26 08:25:44 +00:00
|
|
|
const (
|
|
|
|
// QueryTemplateTypeNamePrefixMatch uses the Name field of the query as
|
|
|
|
// a prefix to select the template.
|
|
|
|
QueryTemplateTypeNamePrefixMatch = "name_prefix_match"
|
|
|
|
)
|
|
|
|
|
|
|
|
// QueryTemplateOptions controls settings if this query is a template.
|
|
|
|
type QueryTemplateOptions struct {
|
|
|
|
// Type, if non-empty, means that this query is a template. This is
|
|
|
|
// set to one of the QueryTemplateType* constants above.
|
|
|
|
Type string
|
|
|
|
|
|
|
|
// Regexp is an optional regular expression to use to parse the full
|
|
|
|
// name, once the prefix match has selected a template. This can be
|
|
|
|
// used to extract parts of the name and choose a service name, set
|
|
|
|
// tags, etc.
|
|
|
|
Regexp string
|
2017-07-27 05:46:43 +00:00
|
|
|
|
|
|
|
// RemoveEmptyTags, if true, removes empty tags from matched tag list
|
|
|
|
RemoveEmptyTags bool
|
2016-02-26 08:25:44 +00:00
|
|
|
}
|
|
|
|
|
2015-11-07 00:59:32 +00:00
|
|
|
// PreparedQuery defines a complete prepared query, and is the structure we
|
|
|
|
// maintain in the state store.
|
|
|
|
type PreparedQuery struct {
|
|
|
|
// ID is this UUID-based ID for the query, always generated by Consul.
|
|
|
|
ID string
|
|
|
|
|
|
|
|
// Name is an optional friendly name for the query supplied by the
|
|
|
|
// user. NOTE - if this feature is used then it will reduce the security
|
|
|
|
// of any read ACL associated with this query/service since this name
|
|
|
|
// can be used to locate nodes with supplying any ACL.
|
|
|
|
Name string
|
|
|
|
|
|
|
|
// Session is an optional session to tie this query's lifetime to. If
|
2015-11-07 06:18:11 +00:00
|
|
|
// this is omitted then the query will not expire.
|
2015-11-07 00:59:32 +00:00
|
|
|
Session string
|
|
|
|
|
|
|
|
// Token is the ACL token used when the query was created, and it is
|
|
|
|
// used when a query is subsequently executed. This token, or a token
|
|
|
|
// with management privileges, must be used to change the query later.
|
|
|
|
Token string
|
|
|
|
|
2016-02-26 08:25:44 +00:00
|
|
|
// Template is used to configure this query as a template, which will
|
|
|
|
// respond to queries based on the Name, and then will be rendered
|
|
|
|
// before it is executed.
|
|
|
|
Template QueryTemplateOptions
|
|
|
|
|
2015-11-07 00:59:32 +00:00
|
|
|
// Service defines a service query (leaving things open for other types
|
|
|
|
// later).
|
|
|
|
Service ServiceQuery
|
|
|
|
|
|
|
|
// DNS has options that control how the results of this query are
|
|
|
|
// served over DNS.
|
|
|
|
DNS QueryDNSOptions
|
|
|
|
|
|
|
|
RaftIndex
|
|
|
|
}
|
|
|
|
|
2016-02-24 09:26:16 +00:00
|
|
|
// GetACLPrefix returns the prefix to look up the prepared_query ACL policy for
|
2016-02-25 00:26:43 +00:00
|
|
|
// this query, and whether the prefix applies to this query. You always need to
|
|
|
|
// check the ok value before using the prefix.
|
|
|
|
func (pq *PreparedQuery) GetACLPrefix() (string, bool) {
|
2016-03-03 07:59:35 +00:00
|
|
|
if pq.Name != "" || pq.Template.Type != "" {
|
2016-02-25 00:26:43 +00:00
|
|
|
return pq.Name, true
|
2016-02-24 09:26:16 +00:00
|
|
|
}
|
|
|
|
|
2016-02-25 00:26:43 +00:00
|
|
|
return "", false
|
Creates new "prepared-query" ACL type and new token capture behavior.
Prior to this change, prepared queries had the following behavior for
ACLs, which will need to change to support templates:
1. A management token, or a token with read access to the service being
queried needed to be provided in order to create a prepared query.
2. The token used to create the prepared query was stored with the query
in the state store and used to execute the query.
3. A management token, or the token used to create the query needed to be
supplied to perform and CRUD operations on an existing prepared query.
This was pretty subtle and complicated behavior, and won't work for
templates since the service name is computed at execution time. To solve
this, we introduce a new "prepared-query" ACL type, where the prefix
applies to the query name for static prepared query types and to the
prefix for template prepared query types.
With this change, the new behavior is:
1. A management token, or a token with "prepared-query" write access to
the query name or (soon) the given template prefix is required to do
any CRUD operations on a prepared query, or to list prepared queries
(the list is filtered by this ACL).
2. You will no longer need a management token to list prepared queries,
but you will only be able to see prepared queries that you have access
to (you get an empty list instead of permission denied).
3. When listing or getting a query, because it was easy to capture
management tokens given the past behavior, this will always blank out
the "Token" field (replacing the contents as <hidden>) for all tokens
unless a management token is supplied. Going forward, we should
discourage people from binding tokens for execution unless strictly
necessary.
4. No token will be captured by default when a prepared query is created.
If the user wishes to supply an execution token then can pass it in via
the "Token" field in the prepared query definition. Otherwise, this
field will default to empty.
5. At execution time, we will use the captured token if it exists with the
prepared query definition, otherwise we will use the token that's passed
in with the request, just like we do for other RPCs (or you can use the
agent's configured token for DNS).
6. Prepared queries with no name (accessible only by ID) will not require
ACLs to create or modify (execution time will depend on the service ACL
configuration). Our argument here is that these are designed to be
ephemeral and the IDs are as good as an ACL. Management tokens will be
able to list all of these.
These changes enable templates, but also enable delegation of authority to
manage the prepared query namespace.
2016-02-23 08:12:58 +00:00
|
|
|
}
|
|
|
|
|
2015-11-07 00:59:32 +00:00
|
|
|
type PreparedQueries []*PreparedQuery
|
|
|
|
|
2015-11-10 07:03:20 +00:00
|
|
|
type IndexedPreparedQueries struct {
|
|
|
|
Queries PreparedQueries
|
|
|
|
QueryMeta
|
|
|
|
}
|
|
|
|
|
2015-11-10 04:37:41 +00:00
|
|
|
type PreparedQueryOp string
|
2015-11-07 00:59:32 +00:00
|
|
|
|
|
|
|
const (
|
2015-11-10 04:37:41 +00:00
|
|
|
PreparedQueryCreate PreparedQueryOp = "create"
|
2015-11-17 17:27:10 +00:00
|
|
|
PreparedQueryUpdate PreparedQueryOp = "update"
|
|
|
|
PreparedQueryDelete PreparedQueryOp = "delete"
|
2015-11-07 00:59:32 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
// QueryRequest is used to create or change prepared queries.
|
2015-11-10 04:37:41 +00:00
|
|
|
type PreparedQueryRequest struct {
|
2015-11-12 01:27:51 +00:00
|
|
|
// Datacenter is the target this request is intended for.
|
2015-11-07 00:59:32 +00:00
|
|
|
Datacenter string
|
2015-11-12 01:27:51 +00:00
|
|
|
|
|
|
|
// Op is the operation to apply.
|
|
|
|
Op PreparedQueryOp
|
|
|
|
|
|
|
|
// Query is the query itself.
|
|
|
|
Query *PreparedQuery
|
|
|
|
|
|
|
|
// WriteRequest holds the ACL token to go along with this request.
|
2015-11-07 00:59:32 +00:00
|
|
|
WriteRequest
|
|
|
|
}
|
|
|
|
|
|
|
|
// RequestDatacenter returns the datacenter for a given request.
|
2015-11-10 04:37:41 +00:00
|
|
|
func (q *PreparedQueryRequest) RequestDatacenter() string {
|
2015-11-07 00:59:32 +00:00
|
|
|
return q.Datacenter
|
|
|
|
}
|
|
|
|
|
2015-11-10 07:03:20 +00:00
|
|
|
// PreparedQuerySpecificRequest is used to get information about a prepared
|
|
|
|
// query.
|
|
|
|
type PreparedQuerySpecificRequest struct {
|
|
|
|
// Datacenter is the target this request is intended for.
|
|
|
|
Datacenter string
|
|
|
|
|
2015-11-11 20:20:40 +00:00
|
|
|
// QueryID is the ID of a query.
|
|
|
|
QueryID string
|
2015-11-10 07:03:20 +00:00
|
|
|
|
|
|
|
// QueryOptions (unfortunately named here) controls the consistency
|
|
|
|
// settings for the query lookup itself, as well as the service lookups.
|
|
|
|
QueryOptions
|
|
|
|
}
|
|
|
|
|
|
|
|
// RequestDatacenter returns the datacenter for a given request.
|
|
|
|
func (q *PreparedQuerySpecificRequest) RequestDatacenter() string {
|
|
|
|
return q.Datacenter
|
|
|
|
}
|
|
|
|
|
2015-11-10 04:37:41 +00:00
|
|
|
// PreparedQueryExecuteRequest is used to execute a prepared query.
|
|
|
|
type PreparedQueryExecuteRequest struct {
|
2015-11-10 04:59:16 +00:00
|
|
|
// Datacenter is the target this request is intended for.
|
|
|
|
Datacenter string
|
|
|
|
|
|
|
|
// QueryIDOrName is the ID of a query _or_ the name of one, either can
|
|
|
|
// be provided.
|
2015-11-07 00:59:32 +00:00
|
|
|
QueryIDOrName string
|
2015-11-10 04:59:16 +00:00
|
|
|
|
|
|
|
// Limit will trim the resulting list down to the given limit.
|
|
|
|
Limit int
|
|
|
|
|
2018-06-05 21:42:01 +00:00
|
|
|
// Connect will force results to be Connect-enabled nodes for the
|
|
|
|
// matching services. This is equivalent in semantics exactly to
|
|
|
|
// setting "Connect" in the query template itself, but allows callers
|
|
|
|
// to use any prepared query in a Connect setting.
|
|
|
|
Connect bool
|
|
|
|
|
2015-11-10 04:59:16 +00:00
|
|
|
// Source is used to sort the results relative to a given node using
|
|
|
|
// network coordinates.
|
|
|
|
Source QuerySource
|
|
|
|
|
2016-06-30 23:51:18 +00:00
|
|
|
// Agent is used to carry around a reference to the agent which initiated
|
|
|
|
// the execute request. Used to distance-sort relative to the local node.
|
|
|
|
Agent QuerySource
|
|
|
|
|
2015-11-10 04:59:16 +00:00
|
|
|
// QueryOptions (unfortunately named here) controls the consistency
|
|
|
|
// settings for the query lookup itself, as well as the service lookups.
|
2015-11-07 00:59:32 +00:00
|
|
|
QueryOptions
|
|
|
|
}
|
|
|
|
|
|
|
|
// RequestDatacenter returns the datacenter for a given request.
|
2015-11-10 04:37:41 +00:00
|
|
|
func (q *PreparedQueryExecuteRequest) RequestDatacenter() string {
|
2015-11-07 00:59:32 +00:00
|
|
|
return q.Datacenter
|
|
|
|
}
|
|
|
|
|
2018-09-06 10:34:28 +00:00
|
|
|
// CacheInfo implements cache.Request allowing requests to be cached on agent.
|
|
|
|
func (q *PreparedQueryExecuteRequest) CacheInfo() cache.RequestInfo {
|
|
|
|
info := cache.RequestInfo{
|
|
|
|
Token: q.Token,
|
|
|
|
Datacenter: q.Datacenter,
|
|
|
|
MinIndex: q.MinQueryIndex,
|
|
|
|
Timeout: q.MaxQueryTime,
|
|
|
|
MaxAge: q.MaxAge,
|
|
|
|
MustRevalidate: q.MustRevalidate,
|
|
|
|
}
|
|
|
|
|
|
|
|
// To calculate the cache key we hash over all the fields that affect the
|
|
|
|
// output other than Datacenter and Token which are dealt with in the cache
|
|
|
|
// framework already. Note the order here is important for the outcome - if we
|
|
|
|
// ever care about cache-invalidation on updates e.g. because we persist
|
|
|
|
// cached results, we need to be careful we maintain the same order of fields
|
|
|
|
// here. We could alternatively use `hash:set` struct tag on an anonymous
|
|
|
|
// struct to make it more robust if it becomes significant.
|
|
|
|
v, err := hashstructure.Hash([]interface{}{
|
|
|
|
q.QueryIDOrName,
|
|
|
|
q.Limit,
|
|
|
|
q.Connect,
|
|
|
|
}, nil)
|
|
|
|
if err == nil {
|
|
|
|
// If there is an error, we don't set the key. A blank key forces
|
|
|
|
// no cache for this request so the request is forwarded directly
|
|
|
|
// to the server.
|
|
|
|
info.Key = strconv.FormatUint(v, 10)
|
|
|
|
}
|
|
|
|
|
|
|
|
return info
|
|
|
|
}
|
|
|
|
|
2015-11-10 04:37:41 +00:00
|
|
|
// PreparedQueryExecuteRemoteRequest is used when running a local query in a
|
2015-11-10 04:59:16 +00:00
|
|
|
// remote datacenter.
|
2015-11-10 04:37:41 +00:00
|
|
|
type PreparedQueryExecuteRemoteRequest struct {
|
2015-11-10 04:59:16 +00:00
|
|
|
// Datacenter is the target this request is intended for.
|
2015-11-07 00:59:32 +00:00
|
|
|
Datacenter string
|
2015-11-10 04:59:16 +00:00
|
|
|
|
|
|
|
// Query is a copy of the query to execute. We have to ship the entire
|
|
|
|
// query over since it won't be present in the remote state store.
|
|
|
|
Query PreparedQuery
|
|
|
|
|
|
|
|
// Limit will trim the resulting list down to the given limit.
|
|
|
|
Limit int
|
|
|
|
|
2018-06-05 21:42:01 +00:00
|
|
|
// Connect is the same as ExecuteRequest.
|
|
|
|
Connect bool
|
|
|
|
|
2015-11-10 04:59:16 +00:00
|
|
|
// QueryOptions (unfortunately named here) controls the consistency
|
|
|
|
// settings for the the service lookups.
|
2015-11-07 00:59:32 +00:00
|
|
|
QueryOptions
|
|
|
|
}
|
|
|
|
|
|
|
|
// RequestDatacenter returns the datacenter for a given request.
|
2015-11-10 04:37:41 +00:00
|
|
|
func (q *PreparedQueryExecuteRemoteRequest) RequestDatacenter() string {
|
2015-11-07 00:59:32 +00:00
|
|
|
return q.Datacenter
|
|
|
|
}
|
|
|
|
|
2015-11-10 04:37:41 +00:00
|
|
|
// PreparedQueryExecuteResponse has the results of executing a query.
|
|
|
|
type PreparedQueryExecuteResponse struct {
|
2015-11-13 18:38:44 +00:00
|
|
|
// Service is the service that was queried.
|
|
|
|
Service string
|
|
|
|
|
2015-11-11 01:42:41 +00:00
|
|
|
// Nodes has the nodes that were output by the query.
|
2015-11-07 00:59:32 +00:00
|
|
|
Nodes CheckServiceNodes
|
2015-11-11 01:42:41 +00:00
|
|
|
|
|
|
|
// DNS has the options for serving these results over DNS.
|
|
|
|
DNS QueryDNSOptions
|
|
|
|
|
|
|
|
// Datacenter is the datacenter that these results came from.
|
|
|
|
Datacenter string
|
|
|
|
|
|
|
|
// Failovers is a count of how many times we had to query a remote
|
|
|
|
// datacenter.
|
|
|
|
Failovers int
|
2015-11-12 06:34:46 +00:00
|
|
|
|
|
|
|
// QueryMeta has freshness information about the query.
|
|
|
|
QueryMeta
|
2015-11-07 00:59:32 +00:00
|
|
|
}
|
2016-03-03 09:04:12 +00:00
|
|
|
|
2016-03-04 01:30:36 +00:00
|
|
|
// PreparedQueryExplainResponse has the results when explaining a query/
|
|
|
|
type PreparedQueryExplainResponse struct {
|
2016-03-03 09:04:12 +00:00
|
|
|
// Query has the fully-rendered query.
|
|
|
|
Query PreparedQuery
|
|
|
|
|
|
|
|
// QueryMeta has freshness information about the query.
|
|
|
|
QueryMeta
|
|
|
|
}
|