Commit Graph

182 Commits

Author SHA1 Message Date
Hans Hasselberg cf4eb2474a
fix remaining CI failures after Go 1.12.1 Upgrade (#5576) 2019-03-29 16:29:27 +01:00
Jeff Mitchell ae509858ab
Bump vendor to take in new sdk/api versions (#5574) 2019-03-27 09:03:07 -04:00
Jeff Mitchell d3c7d57209
Move internal/ to sdk/ (#5568)
* Move internal/ to sdk/

* Add a readme to the SDK folder
2019-03-27 08:54:56 -04:00
Jeff Mitchell b43800125c
Update vendoring from go mod. (#5566) 2019-03-26 17:50:42 -04:00
Kyle Havlovitz 106fde20b3 Update memberlist for the node renaming change 2019-03-13 15:55:54 -07:00
Pierre Souchay 2ed7fddb06 Revendor memberlist to Fix #3217
Upgrade leads to protocol version (2) is incompatible: [1, 0] (#5313)

This is fixed in https://github.com/hashicorp/memberlist/pull/178, bump
memberlist to fix possible split brain in Consul.
2019-02-05 10:20:14 -05:00
Matt Keeler a2fb5eafdd
Revendor serf to pull in keyring list truncation changes. (#5251) 2019-01-22 16:07:04 -05:00
R.B. Boyer 7f30950060
update github.com/hashicorp/{serf,memberlist,go-sockaddr} (#5189)
This activates large-cluster improvements in the gossip layer from
https://github.com/hashicorp/memberlist/pull/167
2019-01-07 15:00:47 -06:00
Matt Keeler 99e0a124cb
New ACLs (#4791)
This PR is almost a complete rewrite of the ACL system within Consul. It brings the features more in line with other HashiCorp products. Obviously there is quite a bit left to do here but most of it is related docs, testing and finishing the last few commands in the CLI. I will update the PR description and check off the todos as I finish them over the next few days/week.
Description

At a high level this PR is mainly to split ACL tokens from Policies and to split the concepts of Authorization from Identities. A lot of this PR is mostly just to support CRUD operations on ACLTokens and ACLPolicies. These in and of themselves are not particularly interesting. The bigger conceptual changes are in how tokens get resolved, how backwards compatibility is handled and the separation of policy from identity which could lead the way to allowing for alternative identity providers.

On the surface and with a new cluster the ACL system will look very similar to that of Nomads. Both have tokens and policies. Both have local tokens. The ACL management APIs for both are very similar. I even ripped off Nomad's ACL bootstrap resetting procedure. There are a few key differences though.

    Nomad requires token and policy replication where Consul only requires policy replication with token replication being opt-in. In Consul local tokens only work with token replication being enabled though.
    All policies in Nomad are globally applicable. In Consul all policies are stored and replicated globally but can be scoped to a subset of the datacenters. This allows for more granular access management.
    Unlike Nomad, Consul has legacy baggage in the form of the original ACL system. The ramifications of this are:
        A server running the new system must still support other clients using the legacy system.
        A client running the new system must be able to use the legacy RPCs when the servers in its datacenter are running the legacy system.
        The primary ACL DC's servers running in legacy mode needs to be a gate that keeps everything else in the entire multi-DC cluster running in legacy mode.

So not only does this PR implement the new ACL system but has a legacy mode built in for when the cluster isn't ready for new ACLs. Also detecting that new ACLs can be used is automatic and requires no configuration on the part of administrators. This process is detailed more in the "Transitioning from Legacy to New ACL Mode" section below.
2018-10-19 12:04:07 -04:00
Matt Keeler ba4f912b25
Update Raft Vendoring (#4539)
Pulls in a fix for a potential memory leak regarding consistent reads that invoke VerifyLeader.
2018-09-06 15:07:42 -04:00
Mitchell Hashimoto f7a95e1a28
vendor k8s client lib 2018-09-05 14:59:02 -07:00
Mitchell Hashimoto 144b7efa51
Update go-discover vendor 2018-09-05 13:31:10 -07:00
Paul Banks 3adfe86f03 Update Serf and memberlist (#4511)
This includes fixes that improve gossip scalability on very large (> 10k node) clusters.

The Serf changes:
 - take snapshot disk IO out of the critical path for handling messages hashicorp/serf#524
 - make snapshot compaction much less aggressive - the old fixed threshold caused snapshots to be constantly compacted (synchronously with request handling) on clusters larger than about 2000 nodes! hashicorp/serf#525

Memberlist changes:
 - prioritize handling alive messages over suspect/dead to improve stability, and handle queue in LIFO order to avoid acting on info that 's already stale in the queue by the time we handle it. hashicorp/memberlist#159
 - limit the number of concurrent pushPull requests being handled at once to 128. In one test scenario with 10s of thousands of servers we saw channel and lock blocking cause over 3000 pushPulls at once which ballooned the memory of the server because each push pull contained a de-serialised list of all known 10k+ nodes and their tags for a total of about 60 million objects and 7GB of memory stuck. While the rest of the fixes here should prevent the same root cause from blocking in the same way, this prevents any other bug or source of contention from allowing pushPull messages to stack up and eat resources. hashicorp/memberlist#158
2018-08-09 13:16:13 -04:00
Siva Prasad a5ebab63e7 Vendoring update for go-discover. (#4412)
* New Providers added and updated vendoring for go-discover

* Vendor.json formatted using make vendorfmt

* Docs/Agent/auto-join: Added documentation for the new providers introduced in this PR

* Updated the golang.org/x/sys/unix in the vendor directory

* Agent: TestGoDiscoverRegistration updated to reflect the addition of new providers

* Deleted terraform.tfstate from vendor.

* Deleted terraform.tfstate.backup

Deleted terraform state file artifacts from unknown runs.

* Updated x/sys/windows vendor for Windows binary compilation
2018-07-25 16:21:04 -07:00
mkeeler 1da3c42867 Merge remote-tracking branch 'connect/f-connect' 2018-06-25 19:42:51 +00:00
Matt Keeler bc7e9b6fd4 Remove build tags from vendored vault file to allow for this to merge properly into enterprise 2018-06-25 12:26:10 -07:00
Matt Keeler 2f90768662 Vendor the vault api 2018-06-25 12:26:10 -07:00
Leo Zhang b498816e80
Fix invalid vendor.json syntax for go-discover 2018-06-15 02:02:12 -07:00
Matt Keeler 1e485ed727 Update yamux vendoring
Pulls in logging fixes.
2018-06-04 16:02:50 -04:00
Kyle Havlovitz 7cd7f4acd7
vendor: pull in latest version of go-discover 2018-05-10 15:40:16 -07:00
Preetha Appan 98a04a0af9
Update serf to pick up clean leave fix 2018-05-04 15:51:55 -05:00
Preetha Appan 16962cccfa
Update yamux to pick up performance improvements 2018-03-26 08:56:40 -05:00
Preetha 1665908bed
Fix panic in azure go discover provider (#3876) 2018-02-08 16:46:33 -06:00
James Phillips 2e660c7172
Updates hashicorp/go-discover to pull in support for Azure Virtual Machine Scale Sets. 2018-01-19 16:24:08 -08:00
James Phillips 503e01774b
Updates Serf to pickup fix for spammy zero RTT log messages.
Fixes #3789.
2018-01-19 14:47:12 -08:00
James Phillips ffb81aaba5
Updates go-discover to get monkey patch for golang.org/x/net/trace. 2018-01-03 13:22:42 -08:00
James Phillips 63274429ff
Updates hashicorp/go-cleanhttp to pick up new sanitizer. 2017-12-20 13:48:49 -08:00
James Phillips 3ac47e3b1c
Updates Serf to pull in new queue depth controls. 2017-12-06 17:06:08 -08:00
James Phillips 68b698993f
Updated memberlist to fix negative RTT measurements.
Fixes #3704
2017-11-21 01:37:49 -08:00
James Phillips b166ce6969
Updates memberlist to pick up https://github.com/hashicorp/memberlist/pull/69.
Fixes #3671
2017-11-10 09:31:02 -08:00
Frank Schröder bdb8c8f73e vendor: update github.com/hashicorp/go-sockaddr (#3633)
Pull in changes for

 * hashicorp/go-sockaddr#12
 * hashicorp/go-sockaddr#13
 * hashicorp/go-sockaddr#14
 * hashicorp/go-sockaddr#16
2017-10-31 17:05:57 -07:00
Frank Schröder 56561523cf vendor: update go-discover (#3634)
* vendor: update go-discover

Pull in providers:

 * Aliyun (Alibaba Cloud)
 * Digital Ocean
 * OpenStack (os)
 * Scaleway

* doc: use ... instead of xxx

* doc: strip trailing whitespace

* doc: add docs for aliyun, digitalocean, os and scaleway

* agent: fix test
2017-10-31 17:03:54 -05:00
Preetha Appan ad8b9171d6 Update serf library to pick up coordinate persistence fix 2017-10-21 21:19:43 -05:00
Preetha Appan d206639f83 REbase master serf 2017-10-20 10:33:59 -05:00
Preetha Appan 09c51e3119 Vendor update serf to pick up fix for out of range ping periods in coordinate subsystem 2017-10-20 10:14:15 -05:00
Matt McQuillan 63bd7cb687 Updating go-checkpoint lib to have a fixed timeout (#3564)
* Updating go-checkpoint lib to have a fixed timeout

* formatting vendor/vendor.json file per project spec
2017-10-17 17:01:23 -07:00
Preetha Appan 10b7ab252f Update go-retryablehttp 2017-10-06 13:42:11 -05:00
Frank Schroeder 3d4fa7f65d Update github.com/hashicorp/go-discover to pull in new config parser
This patch updates the go-discover library to use the new config parser
which uses a different encoding scheme for the go-discover config DSL.
Values are no longer URL encoded but taken literally unless they contain
spaces, backslashes or double quotes. To support keys or values with
these special characters the string needs to be double quoted and usual
escaping rules apply.

Fixes #3417
2017-10-04 19:12:28 +02:00
Preetha Appan ae08f17c11 Updates vendor directory for raft to record raft v1.0.0. No functional changes 2017-10-03 17:19:10 -05:00
Frank Schroeder 4a98b26537
Revert monkey patch since it is not clear whether this is an issue at all. 2017-09-26 13:42:32 +02:00
Frank Schroeder 1530f12f56
serf: monkey patch https://github.com/hashicorp/serf/pull/486 2017-09-26 13:40:26 +02:00
Frank Schroeder 3396f11cfd
Replace monkey patch with code from https://github.com/hashicorp/hcl/pull/213 2017-09-26 12:42:03 +02:00
Frank Schröder 69a088ca85 New config parser, HCL support, multiple bind addrs (#3480)
* new config parser for agent

This patch implements a new config parser for the consul agent which
makes the following changes to the previous implementation:

 * add HCL support
 * all configuration fragments in tests and for default config are
   expressed as HCL fragments
 * HCL fragments can be provided on the command line so that they
   can eventually replace the command line flags.
 * HCL/JSON fragments are parsed into a temporary Config structure
   which can be merged using reflection (all values are pointers).
   The existing merge logic of overwrite for values and append
   for slices has been preserved.
 * A single builder process generates a typed runtime configuration
   for the agent.

The new implementation is more strict and fails in the builder process
if no valid runtime configuration can be generated. Therefore,
additional validations in other parts of the code should be removed.

The builder also pre-computes all required network addresses so that no
address/port magic should be required where the configuration is used
and should therefore be removed.

* Upgrade github.com/hashicorp/hcl to support int64

* improve error messages

* fix directory permission test

* Fix rtt test

* Fix ForceLeave test

* Skip performance test for now until we know what to do

* Update github.com/hashicorp/memberlist to update log prefix

* Make memberlist use the default logger

* improve config error handling

* do not fail on non-existing data-dir

* experiment with non-uniform timeouts to get a handle on stalled leader elections

* Run tests for packages separately to eliminate the spurious port conflicts

* refactor private address detection and unify approach for ipv4 and ipv6.

Fixes #2825

* do not allow unix sockets for DNS

* improve bind and advertise addr error handling

* go through builder using test coverage

* minimal update to the docs

* more coverage tests fixed

* more tests

* fix makefile

* cleanup

* fix port conflicts with external port server 'porter'

* stop test server on error

* do not run api test that change global ENV concurrently with the other tests

* Run remaining api tests concurrently

* no need for retry with the port number service

* monkey patch race condition in go-sockaddr until we understand why that fails

* monkey patch hcl decoder race condidtion until we understand why that fails

* monkey patch spurious errors in strings.EqualFold from here

* add test for hcl decoder race condition. Run with go test -parallel 128

* Increase timeout again

* cleanup

* don't log port allocations by default

* use base command arg parsing to format help output properly

* handle -dc deprecation case in Build

* switch autopilot.max_trailing_logs to int

* remove duplicate test case

* remove unused methods

* remove comments about flag/config value inconsistencies

* switch got and want around since the error message was misleading.

* Removes a stray debug log.

* Removes a stray newline in imports.

* Fixes TestACL_Version8.

* Runs go fmt.

* Adds a default case for unknown address types.

* Reoders and reformats some imports.

* Adds some comments and fixes typos.

* Reorders imports.

* add unix socket support for dns later

* drop all deprecated flags and arguments

* fix wrong field name

* remove stray node-id file

* drop unnecessary patch section in test

* drop duplicate test

* add test for LeaveOnTerm and SkipLeaveOnInt in client mode

* drop "bla" and add clarifying comment for the test

* split up tests to support enterprise/non-enterprise tests

* drop raft multiplier and derive values during build phase

* sanitize runtime config reflectively and add test

* detect invalid config fields

* fix tests with invalid config fields

* use different values for wan sanitiziation test

* drop recursor in favor of recursors

* allow dns_config.udp_answer_limit to be zero

* make sure tests run on machines with multiple ips

* Fix failing tests in a few more places by providing a bind address in the test

* Gets rid of skipped TestAgent_CheckPerformanceSettings and adds case for builder.

* Add porter to server_test.go to make tests there less flaky

* go fmt
2017-09-25 11:40:42 -07:00
Frank Schroeder 85f0f71eb1
Add support to discover public v4 and v6 addresses on AWS (#3471)
Update github.com/hashicorp/go-discover/provider/aws to support the
'addr_type' option which allows detection of private_v4, public_v4 and
public_v6 addresses.

Fixes #3471
2017-09-25 03:16:27 +02:00
Preetha Appan aadaae1d2d Updating vendor directory for raft address provider interface changes 2017-08-30 09:57:48 -05:00
Preetha Appan 2514523920 Update raft library for windows snapshot fsync fixes. This fixes #3409 2017-08-24 16:44:05 -05:00
Frank Schroeder 509e667f94 vendor: upgrade github.com/hashicorp/go-discover
Pull in improved debug logging for AWS
2017-08-23 21:23:34 +02:00
Preetha Appan 040f8ae775 Update serf to pick up fixes for fsyncing snapshots and panic when coordinates are disabled 2017-08-17 16:35:06 -05:00
Preetha Appan 40d6e1fbc7 Update memberlist for a deadlock fix 2017-08-15 18:07:28 -05:00
James Phillips 7fd45a6b67
Propagates a better error message from memberlist.
Fixes #3312.
2017-08-07 16:35:57 -07:00
Preetha Appan 5d15481d8a Pick up raft library change that fsyncs snapshot files correctly 2017-08-04 10:36:41 -05:00
Frank Schroeder 5f6b74d4ee
vendor: update hashicorp/go-discover to pull in hashicorp/go-discover#7 2017-08-03 21:00:37 +02:00
Frank Schroeder 5ddcdd41c2 vendor: add go-discover 2017-08-01 11:41:43 +02:00
Preetha Appan 7f47cc15c0 Govendor update go-memdb and go-immutable-radix to pick up changes for DeletePrefix 2017-07-25 17:28:43 -05:00
James Phillips c82d84a1dd Updates memberlist to pick up Lifeguard research findings. (#3287)
See https://www.hashicorp.com/blog/making-gossip-more-robust-with-lifeguard/.
2017-07-17 12:54:17 -07:00
Preetha Appan 891558cd09 Update raft library to pick up cleanup of temporary snapshot files 2017-07-11 08:22:57 -05:00
Frank Schroeder 4843839cf5 Pull in vendor updates 2017-07-07 09:22:34 +02:00
James Phillips f7df065c39 memberlist: Monkey patch memberlist to fix port 0 behavior.
https://github.com/hashicorp/memberlist/pull/128
2017-07-07 09:22:34 +02:00
Frank Schroeder 4322b7217c serf: monkey patch data race in github.com/hashicorp/serf
https://github.com/hashicorp/serf/pull/476

This should be replaced when the patch is merged upstream
and the library is upgraded.
2017-07-07 09:22:34 +02:00
Preetha Appan bb0e0bdff9 Update serf to pull in disk space failure recovery changes 2017-07-06 08:58:42 -05:00
James Phillips 4d0aa9b82a Bumps Raft library. (#3201)
This picks up the fix for https://github.com/hashicorp/raft/issues/212,
which can cause out-of-date followers to get stuck in a loop trying to
sync because they don't discard old snapshot data.

There's some incidental reordering of the vendor.json since the last
update to that file was merged by hand.
2017-06-27 18:41:00 -07:00
James Phillips 59621dbccc Revert "discover: move instance discover code into separate package (#3144)" (#3180)
This reverts commit 26bfb2d00a30bf30ebdd85ba2e1e19f37355853f.
2017-06-23 01:38:55 -07:00
Kyle Havlovitz e875cc30fa vendor: update github.com/hashicorp/memberlist (#3176) 2017-06-22 14:44:46 -07:00
Frank Schroeder 43c42b12ae
vendor: update github.com/hashicorp/go-discover 2017-06-22 12:46:23 +02:00
Frank Schröder 4bdff5fff4 discover: move instance discover code into separate package (#3144)
This patch moves the code that discovers instances from metadata
information to github.com/hashicorp/go-discover with
sub-packages for each provider.
2017-06-21 10:40:38 +02:00
Kyle Havlovitz 5e45aec642 Add an option to disable keyring file (#3145)
Also disables keyring file in dev mode.
2017-06-15 15:24:04 -07:00
Kyle Havlovitz e196576c07 Add settings for upshifting to encrypted gossip (#3079) 2017-05-30 08:51:37 -07:00
James Phillips 3cce06fd38
Pulls in Serf logger fix. 2017-05-25 22:02:09 -07:00
James Phillips 0a8a78833e
Updates Serf to pick up small fixes and coordinate NaN/Inf defenses. 2017-05-25 16:16:37 -07:00
Sean Chittenden 6037c3c016
Update hashicorp/go-sockaddr to the latest version.
* Adds plural IP helpers (e.g. `GetPrivateIPs`, `GetPublicIPs`)
  hashicorp/go-sockaddr#11
* Adds subnet math hashicorp/go-sockaddr#8
* Fixes helper functions for dual-homed hosts hashicorp/go-sockaddr#10)
2017-05-23 16:47:17 -07:00
Frank Schroeder 39aeb5e520 vendor: remove github.com/hashicorp/scada-client 2017-05-22 11:07:46 +02:00
Frank Schroeder e13f3446ac agent: drop atlas/scada code 2017-05-10 23:06:36 +02:00
James Phillips e17e514249
Updates vendored Raft library.
This pulls in https://github.com/hashicorp/raft/pull/207 to get
support for the new-style peers.json recovery file.
2017-05-04 13:27:33 -07:00
Kyle Havlovitz 8119cea849
Vendor the go-rootcerts lib for the client tls options 2017-04-14 13:46:19 -07:00
Kyle Havlovitz 37ea20cb44
Add advanced autopilot features 2017-03-22 15:25:16 -07:00
James Phillips 21e2307248
Updates memberlist to get NACK penalty improvements. 2017-03-17 15:28:12 -07:00
James Phillips 8b39dc9dd5
Updates memberlist to get new transport interface. 2017-03-16 16:57:28 -07:00
Kyle Havlovitz 9c7bba7903
Tweak last_contact health logic for leader 2017-03-15 19:57:54 -07:00
James Phillips d9f4d4949b
Updates hashicorp/go-immutable-radix to pick up leaf panic fixes.
This fixes #2724 by properly tracking leaf updates during very large
delete transactions.
2017-02-13 16:47:49 -08:00
Jeff Mitchell 726590367f Update unix dial functions to use DialContext with new go-cleanhttp 2017-02-10 21:11:21 -05:00
James Phillips a5028e833e Revert "Updates go-cleanhttp to get better tuning for newer Go versions." 2017-02-10 17:12:56 -08:00
James Phillips 5221c4086c
Updates go-cleanhttp to get better tuning for newer Go versions. 2017-02-10 16:39:19 -08:00
James Phillips 8bcf1a74a9
Updates memberlist and Serf (and adds new dependencies).
This gets a number of improvements:

* Fixed a missing case where gossip would stop flowing to dead nodes for a short while.
* Uses the go-sockaddr library to look for private IP addresses, which prefers non-loopback
  private addresses over loopback ones when trying to automatically determine the advertise address.
* Properly seeds Go's random number generator using the seed library.
* Serf snapshots no longer have the executable bit set on thie file.
2017-02-08 13:56:07 -08:00
James Phillips 2df8b492c4
Updates Serf library to get relay fixes.
https://github.com/hashicorp/serf/pull/447
2017-02-06 08:57:36 -08:00
Kyle Havlovitz 21ce56e6f3
Update serf deps 2017-02-01 20:57:37 -05:00
James Phillips b4272f31ad
Updates go-immutable-radix and go-memdb to get fine-grained watches. 2017-01-25 09:58:22 -08:00
Sean Chittenden c82cc25b09
Update `hashicorp/go-sockaddr` to account for `tun(4)` interfaces. 2017-01-17 12:37:56 -08:00
Kyle Havlovitz 12da452136
vendor: Update go-memdb dependency 2017-01-09 11:23:09 -08:00
Kyle Havlovitz d5a675e02d
Update memberlist vendor deps 2016-12-13 18:53:40 -05:00
Kyle Havlovitz 3a771c8994
Update memberlist vendor deps 2016-12-05 17:27:52 -05:00
Sean Chittenden cf02ce2033
Small vendor update for go-sockaddr: now able to filter by CIDR. 2016-12-03 01:21:34 +11:00
Sean Chittenden 73d8efa908
Update Windows support. 2016-12-02 18:05:18 +11:00
Sean Chittenden 98afed5da3
Fix compilation on Windows. 2016-12-02 17:04:28 +11:00
Sean Chittenden 4104e9e53a
Import github.com/hashicorp/go-sockaddr 2016-12-02 15:14:44 +11:00
James Phillips bd5adea5ba Merge pull request #2555 from hashicorp/pr-2497-slackpad
Updates Circonus library and adds support for custom display name and tags.
2016-11-30 21:42:01 -08:00
James Phillips b2b883239f
Cleans up go-msgpack vendoring. 2016-11-14 17:37:05 -08:00
Kyle Havlovitz 55bae4a4c1 Update raft deps to fix snapshot races in -dev mode (#2498) 2016-11-09 17:10:03 -08:00
James Phillips 60d0c66be0
Revert "Updates Circonus metrics library and adds support for display name and tags."
This reverts commit bd490ec937a5859ba43b07d9103b3cb8f037e9e5 from #2491.
2016-11-09 16:21:02 -08:00
matt maier c7f98fe988 Updates Circonus metrics library and adds support for display name and tags.
* Update circonus-gometrics

`vendor circonus-labs/circonus-gometrics`
`vendor circonus-labs/circonus-gometrics/api`
`vendor circonus-labs/circonus-gometrics/checkmgr`
`vendor circonus-labs/circonusllhist`
`vendor hashicorp/go-retryablehttp`

* Update Circonus integration expose Check Display Name and Check Tags configuration options.

* Adds version info to docs for new Circonus options.
2016-11-09 13:26:43 -08:00
matt maier febd734bd1 Update circonus-gometrics
`vendor circonus-labs/circonus-gometrics`
`vendor circonus-labs/circonus-gometrics/api`
`vendor circonus-labs/circonus-gometrics/checkmgr`
`vendor circonus-labs/circonusllhist`
`vendor hashicorp/go-retryablehttp`
2016-11-09 15:30:07 -05:00