Commit graph

1491 commits

Author SHA1 Message Date
Aestek 260a9880ae [Security] Add finer control over script checks (#4715)
* Add -enable-local-script-checks options

These options allow for a finer control over when script checks are enabled by
giving the option to only allow them when they are declared from the local
file system.

* Add documentation for the new option

* Nitpick doc wording
2018-10-11 13:22:11 +01:00
Paul Banks e95d78483d
Be more explicit about rolling upgrade process 2018-10-11 11:44:20 +01:00
Paul Banks bf634fafee
Move 1.0.6 upgrade docs that were added in the wrong place 2018-10-11 11:38:55 +01:00
Paul Banks 94332edf2e
[WIP] Initial draft of Sidecar Service and Managed Proxy deprecation docs (#4752)
* Initial draft of Sidecar Service and Managed Proxy deprecation docs

* Service definition deprecation notices and sidecar service

* gRPC and sidecar service config options; Deprecate managed proxy options

* Envoy Docs: Basic envoy command; envoy getting started/intro

* Remove change that snuck in

* Envoy custom config example

* Add agent/service API docs; deprecate proxy config endpoint

* Misc grep cleanup for managed proxies; capitalize Envoy

* Updates to getting started guide

* Add missing link

* Refactor Envoy guide into a separate guide and add bootstrap reference notes.

* Add limitations to Envoy docs; Highlight no fixes for known managed proxy issues on deprecation page; clarify snake cae stuff; Sidecar Service lifecycle
2018-10-11 10:44:42 +01:00
Pierre Souchay 42f250fa53 Added SOA configuration for DNS settings. (#4714)
This will allow to fine TUNE SOA settings sent by Consul in DNS responses,
for instance to be able to control negative ttl.

Will fix: https://github.com/hashicorp/consul/issues/4713

# Example

Override all settings:

* min_ttl: 0 => 60s
* retry: 600 (10m) => 300s (5 minutes),
* expire: 86400 (24h) => 43200 (12h)
* refresh: 3600 (1h) => 1800 (30 minutes)

```
consul agent -dev -hcl 'dns_config={soa={min_ttl=60,retry=300,expire=43200,refresh=1800}}'
```

Result:
```
dig +multiline @localhost -p 8600 service.consul

; <<>> DiG 9.12.1 <<>> +multiline @localhost -p 8600 service.consul
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 36557
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;service.consul.		IN A

;; AUTHORITY SECTION:
consul.			0 IN SOA ns.consul. hostmaster.consul. (
				1537959133 ; serial
				1800       ; refresh (30 minutes)
				300        ; retry (5 minutes)
				43200      ; expire (12 hours)
				60         ; minimum (1 minute)
				)

;; Query time: 4 msec
;; SERVER: 127.0.0.1#8600(127.0.0.1)
;; WHEN: Wed Sep 26 12:52:13 CEST 2018
;; MSG SIZE  rcvd: 93
```
2018-10-10 15:50:56 -04:00
Kyle Havlovitz 0cbd176a48 connect/ca: more OSS split for multi-dc 2018-10-10 12:17:59 -07:00
Kyle Havlovitz 5b98a602af agent: add primary_datacenter and connect replication config options 2018-10-10 12:17:59 -07:00
Kyle Havlovitz 475afd0300 docs: deprecate acl_datacenter and replace it with primary_datacenter 2018-10-10 12:16:47 -07:00
Paul Banks 92fe8c8e89 Add Proxy Upstreams to Service Definition (#4639)
* Refactor Service Definition ProxyDestination.

This includes:
 - Refactoring all internal structs used
 - Updated tests for both deprecated and new input for:
   - Agent Services endpoint response
   - Agent Service endpoint response
   - Agent Register endpoint
     - Unmanaged deprecated field
     - Unmanaged new fields
     - Managed deprecated upstreams
     - Managed new
   - Catalog Register
     - Unmanaged deprecated field
     - Unmanaged new fields
     - Managed deprecated upstreams
     - Managed new
   - Catalog Services endpoint response
   - Catalog Node endpoint response
   - Catalog Service endpoint response
 - Updated API tests for all of the above too (both deprecated and new forms of register)

TODO:
 - config package changes for on-disk service definitions
 - proxy config endpoint
 - built-in proxy support for new fields

* Agent proxy config endpoint updated with upstreams

* Config file changes for upstreams.

* Add upstream opaque config and update all tests to ensure it works everywhere.

* Built in proxy working with new Upstreams config

* Command fixes and deprecations

* Fix key translation, upstream type defaults and a spate of other subtele bugs found with ned to end test scripts...

TODO: tests still failing on one case that needs a fix. I think it's key translation for upstreams nested in Managed proxy struct.

* Fix translated keys in API registration.
≈

* Fixes from docs
 - omit some empty undocumented fields in API
 - Bring back ServiceProxyDestination in Catalog responses to not break backwards compat - this was removed assuming it was only used internally.

* Documentation updates for Upstreams in service definition

* Fixes for tests broken by many refactors.

* Enable travis on f-connect branch in this branch too.

* Add consistent Deprecation comments to ProxyDestination uses

* Update version number on deprecation notices, and correct upstream datacenter field with explanation in docs
2018-10-10 16:55:34 +01:00
Paul Banks 5b0d4db6bc Support Agent Caching for Service Discovery Results (#4541)
* Add cache types for catalog/services and health/services and basic test that caching works

* Support non-blocking cache types with Cache-Control semantics.

* Update API docs to include caching info for every endpoint.

* Comment updates per PR feedback.

* Add note on caching to the 10,000 foot view on the architecture page to make the new data path more clear.

* Document prepared query staleness quirk and force all background requests to AllowStale so we can spread service discovery load across servers.
2018-10-10 16:55:34 +01:00
Mitchell Hashimoto 1e81b23bbb
Merge pull request #4766 from hashicorp/f-connect-inject
website: add docs for the Connect injection
2018-10-10 08:23:56 -07:00
Matt Ho 70cedfd10a website: fix typo in connect example (#4774) 2018-10-10 11:01:57 +02:00
Mitchell Hashimoto 293194e7f2
website: address PR feedback 2018-10-09 09:30:37 -07:00
Hannah Oppenheimer 29170340b3 Clarify enable_tag_override explanation
In designing a potential UI for a configuration of `enable_tag_override`,
I found the documentation confusing and lengthy. Here, I've made an
attempt at re-writing this section to be more concise and clear.

I also made a few small changes to the organization of this file to map
explanations to the order of the properties listing at the top. I find
it easier to scan docs when explanations appear in the same order they
are listed at the top. For explanations that span multiple paragraphs, I
provided a subheading, which also helps in linking from other pages.

Finally, I removed a duplicated paragraph from the documentation.
2018-10-09 09:55:44 -05:00
Mitchell Hashimoto 374ab6ff5f
website: note that env vars are set 2018-10-08 09:55:55 -07:00
Mitchell Hashimoto e3786a6d1c
website: address some PR feedback 2018-10-08 08:24:25 -07:00
Mitchell Hashimoto 57834a307f
website: add docs for the Connect injection 2018-10-07 23:47:08 -07:00
Dan Brown a10f1ce2df Fix retry_join config documentation (#4757)
'retry_join': source data must be an array or slice, got string
2018-10-05 14:16:02 -04:00
Matt Keeler 71297a6b9d
Update the snapshot agent documentation(#4758)
Detail the S3 permissions required in addition to a gotcha regarding having part of the key within the S3 bucket name configuration.
2018-10-05 13:55:06 -04:00
Chris Hoffman e7820bc9cb typo: missing space 2018-10-05 11:33:28 -05:00
Freddy 851bf8c2eb Update semaphore guide (#4661)
* Fill in gaps in semaphore guide
* Update to match that values come back b64 encoded
* Add that the value needs to be decoded
* Remove outdated reference to session1
* Fix some typos
* Clarify what is mean by a session having an active key
* Clarify requirements for lock holders in semaphore guide
2018-10-04 12:06:53 -10:00
danielehc 20ae959be8 Update options.html.md (#4753) 2018-10-04 19:28:26 +01:00
Dan Brown 2fac2d1439 Add Deployment Guide and update links (#4487)
* Adds Deployment Guide and update links
* Fixes releases link
* Re-organisation of content
* Cuts down "deployment" doc (which should focus on Reference Architecture) by moving raft and performance tuning to the Server Performance page which already covers some of this.
* Moves backups from "deployment" doc (which should focus on Reference Architecture) to "deployment-guide"
* Cleans up some notes and add single DC diagram
* Removes old link to deployment guide from nav
* Corrects minor styling, formatting, and grammar
2018-10-03 11:37:36 -10:00
Mitchell Hashimoto d80c383198
Merge pull request #4732 from hashicorp/f-service-cli
cli: add `services register` and  `deregister`
2018-10-02 12:45:58 -07:00
Mitchell Hashimoto 0258fc94d5
website: clarify that downward API works in any pod spec 2018-10-01 10:35:09 -07:00
Mitchell Hashimoto 3bbbc3fd66
website: docs for services CLI 2018-10-01 10:27:15 -07:00
Mitchell Hashimoto f1f951d491
website: clarify that the server cluster can run anywhere 2018-09-26 08:41:25 -05:00
Mitchell Hashimoto add6b8e05e
website: clarify coredns requirement 2018-09-25 23:37:21 -05:00
Mitchell Hashimoto a69acc076d
website: address feedback 2018-09-25 21:55:32 -05:00
Mitchell Hashimoto 9ca5ddfe38
website: fix the description of the sync page 2018-09-25 17:56:19 -05:00
Mitchell Hashimoto 697719c4e1
Add new helm fields 2018-09-25 09:20:36 -05:00
Mitchell Hashimoto fb7d1fe348
website: document helm options 2018-09-23 17:29:18 -07:00
Mitchell Hashimoto 2042fbe602
website: document consul-k8s 2018-09-23 17:15:54 -07:00
Mitchell Hashimoto ff1b78b818
website: docs for catalog sync 2018-09-23 17:12:14 -07:00
Alvaro Miranda Aguilera 9ac38c2c7f fix typo on connect/index (#4681)
wtihin -> within
2018-09-17 12:06:47 +01:00
Mitchell Hashimoto b7f7571886
website: correct chart casing 2018-09-13 14:45:40 -07:00
Mitchell Hashimoto 62ceacde67 website: document k8s go-discover (#4666)
This adds documentation for the `k8s` go-discover provider that will be part of 1.2.3.
2018-09-13 10:12:27 -04:00
Mitchell Hashimoto b69342f0c1
Initial Helm Chart/K8S Docs (#4653)
* website: initial Kubernetes section with Helm information

* website: extraConfig for clients

* website: add more helm fields

* website: document extraVolumes

* website: document Consul DNS

* website: fix typos and show example of downward API
2018-09-12 08:44:30 -07:00
Freddy 7a19f2a6da
Update snapshot agent docs to include s3-endpoint (#4652) 2018-09-11 16:32:31 +01:00
Matt Keeler 61a5c965c9
Ensure that errors setting up the DNS servers get propagated back to the shell (#4598)
Fixes: #4578 

Prior to this fix if there was an error binding to ports for the DNS servers the error would be swallowed by the gated log writer and never output. This fix propagates the DNS server errors back to the shell with a multierror.
2018-09-07 10:48:29 -04:00
Pierre Souchay 473e589d86 Implementation of Weights Data structures (#4468)
* Implementation of Weights Data structures

Adding this datastructure will allow us to resolve the
issues #1088 and #4198

This new structure defaults to values:
```
   { Passing: 1, Warning: 0 }
```

Which means, use weight of 0 for a Service in Warning State
while use Weight 1 for a Healthy Service.
Thus it remains compatible with previous Consul versions.

* Implemented weights for DNS SRV Records

* DNS properly support agents with weight support while server does not (backwards compatibility)

* Use Warning value of Weights of 1 by default

When using DNS interface with only_passing = false, all nodes
with non-Critical healthcheck used to have a weight value of 1.
While having weight.Warning = 0 as default value, this is probably
a bad idea as it breaks ascending compatibility.

Thus, we put a default value of 1 to be consistent with existing behaviour.

* Added documentation for new weight field in service description

* Better documentation about weights as suggested by @banks

* Return weight = 1 for unknown Check states as suggested by @banks

* Fixed typo (of -> or) in error message as requested by @mkeeler

* Fixed unstable unit test TestRetryJoin

* Fixed unstable tests

* Fixed wrong Fatalf format in `testrpc/wait.go`

* Added notes regarding DNS SRV lookup limitations regarding number of instances

* Documentation fixes and clarification regarding SRV records with weights as requested by @banks

* Rephrase docs
2018-09-07 15:30:47 +01:00
Geoffrey Grosenbach 36fa155675
Adds XL machine spec and notes on large deployments (#4622)
* Adds XL machine spec and notes on large deployments
* Clarifies machine sizes
* Fixes internal links within the document
* Moves datacenter size guidelines to "Single Datacenter" section
2018-08-31 10:41:48 -05:00
Siva Prasad 59dea9a31f
Adds a new command line flag -log-file for file based logging. (#4581)
* Added log-file flag to capture Consul logs in a user specified file

* Refactored code.

* Refactored code. Added flags to rotate logs based on bytes and duration

* Added the flags for log file and log rotation on the webpage

* Fixed TestSantize from failing due to the addition of 3 flags

* Introduced changes : mutex, data-dir log writes, rotation logic

* Added test for logfile and updated the default log destination for docs

* Log name now uses UnixNano

* TestLogFile is now uses t.Parallel()

* Removed unnecessary int64Val function

* Updated docs to reflect default log name for log-file

* No longer writes to data-dir and adds .log if the filename has no extension
2018-08-29 16:56:58 -04:00
Freddy 31c5e19e2f
Correct rpc telemetry docs (#4602) 2018-08-28 16:38:22 -04:00
Jack Pearkes a1bd33da11
website: use 127.0.0.1 instead of consul.rocks (#4523)
By default, the Consul agent listens on the local interface
at port 8500 for API requests. This change makes the API examples
using `curl` copy-pasteable for this default configuration.
2018-08-28 09:07:15 -07:00
Rémi Jouannet 3d5d7ba6df
Update monitoring-telegraf.html.md 2018-08-24 16:48:02 +02:00
jjshanks 12342e0d0e Update intentions documentation to clarify ACL behavior (#4546)
* Update intentions documentation to clarify ACL behavior

* Incorprate @banks suggestions into docs

* Fix my own typos!
2018-08-20 20:03:53 +01:00
Miroslav Bagljas 8f7e87439a Fixes #4483: Add support for Authorization: Bearer token Header (#4502)
Added Authorization Bearer token support as per RFC6750

* appended Authorization header token parsing after X-Consul-Token
* added test cases
* updated website documentation to mention Authorization header

* improve tests, improve Bearer parsing
2018-08-17 16:18:42 -04:00
sandstrom 0e987522d9 Clarify port usage for agents (#4510) 2018-08-14 16:10:01 -07:00
Paul Banks 352057b956
Update intentions.html.md 2018-08-14 15:09:45 +01:00
Geoffrey Grosenbach d3573d7c27
Consul Production Deployment Guide
Renames guide to "Production Deployment"
Adds link in sidebar menu.
Implements edits suggested by Consul engineering team.
2018-08-10 11:51:05 -07:00
Geoffrey Grosenbach c2c6765fc0 Remove all mention of Atlas, even in deprecated changelogs 2018-08-03 10:51:18 -07:00
Jack Pearkes 5c993a3f5f
Clarification for serf_wan documentation (#4459)
* updates docs for agent options

trying to add a little more clarity to suggestion that folks should use
port 8302 for both LAN and WAN comms

* website: clarify language for serf wan port behavior
2018-08-02 10:25:25 -07:00
Jeff Escalante 2dea506400 a couple more corrections 2018-07-27 19:39:44 -04:00
Jeff Escalante 60e1450606 fix a couple html errors (#4456) 2018-07-26 16:30:24 -07:00
Christie Koehler fb4a902ca3 docs: Update links to ttl health check endpoints. (#4208)
* docs: Update links to ttl health check endpoints.

* remove absolute URLs
2018-07-26 16:14:44 -07:00
Matt Keeler 5c7c58ed26
Gossip tuneables (#4444)
Expose a few gossip tuneables for both lan and wan interfaces

gossip_nodes
gossip_interval
probe_timeout
probe_interval
retransmit_mult
suspicion_mult
2018-07-26 11:39:49 -04:00
Paul Banks c4be0d2a4f
Document managed proxy logs (#4447)
* Document proxy logs

* Add extra note about terminating proxies
2018-07-26 13:56:28 +01:00
Paul Banks 25628f0e69
Add config option to disable HTTP printable char path check (#4442) 2018-07-26 13:53:39 +01:00
Kyle Havlovitz ecc02c6aee
Merge pull request #4400 from hashicorp/leaf-cert-ttl
Add configurable leaf cert TTL to Connect CA
2018-07-25 17:53:25 -07:00
Siva Prasad a5ebab63e7 Vendoring update for go-discover. (#4412)
* New Providers added and updated vendoring for go-discover

* Vendor.json formatted using make vendorfmt

* Docs/Agent/auto-join: Added documentation for the new providers introduced in this PR

* Updated the golang.org/x/sys/unix in the vendor directory

* Agent: TestGoDiscoverRegistration updated to reflect the addition of new providers

* Deleted terraform.tfstate from vendor.

* Deleted terraform.tfstate.backup

Deleted terraform state file artifacts from unknown runs.

* Updated x/sys/windows vendor for Windows binary compilation
2018-07-25 16:21:04 -07:00
Pierre Souchay 7bf22a5091 Added explainations on how having a working configuration for Prometheus (#4397)
* Added explainations on how having a working configuration for Prometheus

Since Prometheus escapes by default query parameters, this paragraph explains
how having `format=prometheus` to be taken into account by prometheus.

* Rephrase Prometheus notes in documentation as requested by @pearkes
2018-07-25 16:17:38 -07:00
Sergey Shepelev e6dea80797 website: typo in node meta additional section (#4429) 2018-07-25 13:32:36 -07:00
Paul Banks 17de36c36e
Allow config-file based Service Definitions for unmanaged proxies and Connect-natice apps. (#4443) 2018-07-25 19:55:41 +01:00
Paul Banks feeea60dea
Ooops that was meant to be to a branch no master... EMORECOFFEE
Revert "Add config option to disable HTTP printable char path check"

This reverts commit eebe45a47b4df5c0271b17f0fd1bd85db8bdefca.
2018-07-25 15:54:11 +01:00
Paul Banks d6c16dd0ad
Add config option to disable HTTP printable char path check 2018-07-25 15:52:37 +01:00
Paul Banks 186987874c
Merge pull request #4353 from azam/add-serf-lan-wan-port-args
Make RPC, Serf LAN, Serf WAN port configurable from CLI
2018-07-24 12:33:10 +01:00
Peter Souter 056db5d697 Adds Monitoring with Telegraf guide (#4227)
* Installing Telegraf
* Configuring Telegraf 
* Configuring Consul to send metrics to Telegraf
* Important metrics and aggregates
2018-07-23 16:46:43 -07:00
Kyle Havlovitz a125735d76
connect/ca: check LeafCertTTL when rotating expired roots 2018-07-20 16:04:04 -07:00
Mitchell Hashimoto 5c42dacef4
Merge pull request #4320 from hashicorp/f-alias-check
Add "Alias" Check Type
2018-07-20 13:01:33 -05:00
azam 5290d69cb3 Make Serf LAN & WAN port configurable from CLI
Make RPC port accessible to CLI

Add tests and documentation for server-port, serf-lan-port, serf-wan-port CLI arguments
2018-07-21 02:17:21 +09:00
Paul Banks a3d1d4af2e
Merge pull request #4352 from hashicorp/doc-dev-flag-generates-certs
Note that `-dev` generates certs for Connect.
2018-07-17 11:36:02 +01:00
Geoffrey Grosenbach 934d4e4477 Clarify Connect-related implications for -dev flag 2018-07-16 14:53:46 -07:00
Kyle Havlovitz ce29660245
website: update docs for leaf cert TTL option 2018-07-16 13:33:42 -07:00
Paul Banks bb39b86907
Merge pull request #4392 from hashicorp/connect-sdk-http
Implement missing HTTP host to ConsulResolver func for Connect SDK.
2018-07-16 13:54:53 +01:00
Paul Banks 79df65204d
Typos 2018-07-13 23:09:34 +01:00
Paul Banks 5511f17719
Add notes about hostname gotchas to Connect HTTPClient docs 2018-07-13 23:08:26 +01:00
MagnumOpus21 52d00a276d Docs: Removed text about proxies on Windows not starting up. 2018-07-13 14:47:42 -07:00
Paul Banks e40e131dd7
Merge pull request #4263 from hashicorp/kv-get-docs
Update kv docs detail for accuracy
2018-07-13 18:29:34 +01:00
Mitchell Hashimoto 3ff378ec60
website: fix some website typos 2018-07-12 21:18:00 -07:00
Mitchell Hashimoto 77e30d4fa5
website: document alias check 2018-07-12 21:14:36 -07:00
Paul Banks 399444e2d3
Grammar 2018-07-12 14:36:52 +01:00
Paul Banks 8b54b87599
Update proxy config docs and add test for ipv6 2018-07-12 13:07:48 +01:00
Matt Keeler 22c5951ec4
Merge pull request #4303 from pierresouchay/non_blocking_acl
Only send one single ACL cache refresh across network when TTL is over
2018-07-10 08:57:33 -04:00
Paul Banks dae66b1afc
Merge pull request #4038 from pierresouchay/ACL_additional_info
Track calls blocked by ACLs using metrics
2018-07-09 20:21:21 +01:00
Paul Banks 488c147ade
Merge pull request #4351 from hashicorp/doc-config-dir-reads-hcl-files
Notes that both "hcl" and "json" files are loaded from the config-dir.
2018-07-09 14:43:55 +01:00
Paul Banks aa1c0e04f8
Fix formatting issue in config docs.
The floating paragraph seems to need additional indentation to work correctly on the markdown parser middle man uses - GitHub got it right before in the preview but the website broke dumping the new config option inline.
2018-07-09 14:39:20 +01:00
Pierre Souchay 74d3e64cd5 Added new ACL blocked Metrics to telemetry.html 2018-07-09 11:36:33 +02:00
Geoffrey Grosenbach 361db8ebcf Note that -dev generates certs for Connect.
Previous version of the documentation didn't mention this, which can
lead to confusion when experimenting with Connect. Many other features
of Consul work fine without `-dev` mode, but Connect needs certs in
order to proxy, which must be done with this flag or by generating certs
directly and passing them to Consul in configs.
2018-07-06 12:26:15 -07:00
Geoffrey Grosenbach cc24a65d45 Notes that both "hcl" and "json" files are loaded from the config-dir.
The previous version only mentioned "json" but the behavior was to read
"hcl" files as well.
2018-07-06 12:22:18 -07:00
Siva Prasad f17cd346aa
Merge pull request #4335 from MagnumOpus21/Telemetry
Website/Docs/Telemetry : Adds more telemetry metrics for memberlist and raft.
2018-07-05 11:11:57 -04:00
M S Vishwanath Bhat 91a2d769ea Trivial spell correction in connect configuration doc
Signed-off-by: M S Vishwanath Bhat <msvbhat@gmail.com>
2018-07-04 17:07:24 +02:00
Siva Prasad 911f2a51f0
Website/Docs/Telemetry : Errata 2018-07-03 18:18:57 -04:00
Siva 1c2e0cc2ef Website/Docs/Telemetry: Added more raft and memberlist items. 2018-07-03 17:37:29 -04:00
Siva 9e0914e904 Website/Telemetry: Errata for snapshot.compact and reworded memberlist.health.score 2018-07-03 10:59:31 -04:00
Siva ed853b1d1f Merge branch 'master' of github.com:hashicorp/consul into Telemetry 2018-07-03 10:48:31 -04:00
Siva 5d65cb8f2a Website: Added more telemetry details for raft and memberlist. 2018-07-03 10:27:01 -04:00
Paul Banks a85659778f
Remove the TODO latency measurement. 2018-07-03 14:54:44 +01:00
Siva 8cbfb0e5ed Website: Added more telemetry metrics 2018-07-03 08:00:39 -04:00
Siva Prasad 984e22d73a
Merge pull request #4244 from MagnumOpus21/WinService
Added a new package service_os that can make Consul run as a service on Windows.
2018-07-02 12:01:22 -04:00