* Net-2712/resource hcl parsing (#18250)
* Initial protohcl implementation
Co-authored-by: Matt Keeler <mkeeler@users.noreply.github.com>
Co-authored-by: Daniel Upton <daniel@floppy.co>
* resourcehcl: implement resource decoding on top of protohcl
Co-authored-by: Daniel Upton <daniel@floppy.co>
* fix: resolve ci failures
* test: add additional unmarshalling tests
* refactor: update function test to clean protohcl package imports
---------
Co-authored-by: Matt Keeler <mkeeler@users.noreply.github.com>
Co-authored-by: Daniel Upton <daniel@floppy.co>
* read endpoint (#18268)
implement http read endpoint to expose resource grpc service read method
* Net-2707/list resource endpoint (#18444)
feat: list resources endpoint
* Fix incorrect yaml in examples (#18463)
* NET-5187: Upgrade test timeout due to log producer errors (#18461)
Stop log producer before restarting container
* [NET-4799] [OSS] xdsv2: listeners L4 support for connect proxies (#18436)
* refactor to avoid future import cycles
* resource: Make resource list tenancy aware (#18475)
* [COMPLIANCE] License update (#18479)
Update BUSL LICENSE to include licensed product and version.
Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com>
* docs: specify manual server metadata intervention (#18477)
* docs: Update OpenShift compatibility (#18478)
Update compatibility.mdx
* resource: Make resource delete tenancy aware (#18476)
resource: Make resource delete tenancy awarae
* Add license-checker action that fails when any backported file contains BUSL header (#18485)
* Add license-checker action that fails when any backported file contains BUSL header
* Quote echoed variable to retain line breaks
* Add ticket to reference for more details
* docs: Update K8s TGW tutorial to reliably obtain role ID (#18474)
The `grep` command used to obtain the ID for the terminating gateway
role is not reliable in all scenarios. For example, if there is a
similarly named role, the command may return the wrong role ID for the
active terminating gateway instance.
This commit updates the command to use jq to obtain the role ID. If
multiple roles are found, jq will raise an error informing the user
that it cannot reliably determine the role ID.
* NET-5371 License checker pt2 (#18491)
* Update grep command to work on ubuntu
* Run license checker when new commits are pushed to PR
* README - Update KV use case to Dynamic App Configuration (#18301)
* Update README.md
* Update kv.mdx
* Add BUSL badge
* README - re-order badges and update hub link (#18498)
Update README.md
* [NET-5163] Support locality testing in consul-container (#18484)
* Support locality testing in consul-container
Support including locality in client sidecar config.
Also align test config structs with Ent to avoid future conflicts.
* Refactor consul-container fortio helpers
Refactor fortio test helpers to separate HTTP retries from waiting on
fortio result changes due to e.g. service startup and failovers.
* NET-4853 - xds v2 - implement base connect proxy functionality for clusters (#18499)
* Fix HCL (#18513)
* Fix HCL
* Update create-sameness-groups.mdx
* NET-4932 - xds v2 - implement base connect proxy functionality for endpoints (#18500)
* NET-4853 - xds v2 - implement base connect proxy functionality for clusters
* NET-4853 - xds v2 - implement base connect proxy functionality for clusters
* NET-4932 - xds v2 - implement base connect proxy functionality for endpoints
* Update endpoints_test.go
* gofmt
* Update naming.go
* Support custom watches on controller (#18439)
* Support custom watches on controller
* refactor mapper methods
* NET-4858 - xds v2 - implement base connect proxy functionality for routes (#18501)
* NET-4853 - xds v2 - implement base connect proxy functionality for clusters
* NET-4853 - xds v2 - implement base connect proxy functionality for clusters
* NET-4932 - xds v2 - implement base connect proxy functionality for endpoints
* Update endpoints_test.go
* gofmt
* NET-4858 - Make connect proxy route tests pass using xds v2
* Update endpoints_test.go
* Update naming.go
* use alsoRunTestForV2
* remove unused makeAddress
* gofmt
* fixing clusters
* bimapper: allow to untrack links and support reference or id (#18451)
* bimapper: fix data race (#18519)
* CI Split integration tests to run nightly and every PR (#18518)
* CI Split integration tests to run nightly and every PR
* Checkout release branch for nightly test
* Fix broken links caught in weekly report (#18522)
* fix broken link caught in weekly report
* Apply suggestions from code review
Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>
---------
Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>
* Create nightly test-integration for consul release branch (#18530)
* Create nightly test-integration for consul release branch
* test
* fix
* docs: Fix spelling errors across various pages on the site (#18533)
This commit fixes numerous spelling errors across the site and also
removes unnecessary whitespace that was present in the edited files.
* Make proto-public license MPL (#18531)
* Make proto-public license MPL
* Add proto-public dir to exclusion list in .copywrite.hcl
* NET-4943 - Implement ProxyTracker (#18535)
* resource: Make resource watchlist tenancy aware (#18539)
* Reduce required type arguments for DecodedResource (#18540)
* OSS -> CE (community edition) changes (#18517)
* CI: fix envoy versions in CI of release branch (#18538)
* CI: fix envoy versions in CI of release branch
* - remove steps sds for 1.15 nightly run
- checkout the release branch
* add default name
* fix
* Update go-tests.yml
* fix checkout code
* add comments and revert schedule
* catalog: add failover mode enum validation (#18545)
* mesh: add validation for the new pbmesh resources (#18410)
Adds validation for HTTPRoute, GRPCRoute, TCPRoute, DestinationPolicy, and ComputedRoutes.
* xds controller: resolve ServiceEndpoints references in ProxyStateTemp… (#18544)
xds controller: resolve ServiceEndpoints references in ProxyStateTemplate
* mesh: adding type aliases for mesh resource usage (#18448)
Introduces some simple type aliases for DecodedResource[*X] wrappers for each type which cut down on the verbosity
* Update trust bundle into proxy-state-template (#18550)
* catalog: validating Protocol and Health enums on Service, Workload, and ServiceEndpoints (#18554)
* chore: fix missing/incorrect license headers (#18555)
* fix for , non presence of consul-version meta (#18464)
* fix for #18406 , non presence of consul-version meta
* removed redundant checks
* updated mock-api to mimic api response for synthetic nodes
* added test to test getDistinctConsulVersions method with synthetic-node case
* updated typo in comments
* added change log
* feat: add experiments flag to testserver sdk (#18541)
* bug: prevent go routine leakage due to existing DeferCheck (#18558)
* bug: prevent go routine leakage due to existing DeferCheck
* add changelog
* NET-5382 & PLAT-1159: Do not trigger workflow if only doc files are in commit history (#18528)
NET-5382: Do not run workflow runs if at least one path matches
* UI: community verbiage (#18560)
* chore: update community verbiage
* chore: add changelog entry
* Fix Windows FIPS Build (#18357)
* Fix Windows FIPS Build
* create new file for windows arm
* removed build tag
* fix buidl tags
* fix multiple go build
* CE port of enterprise extension (#18572)
CE commit
* resource: Make resource listbyowner tenancy aware (#18566)
* NET-5147: Added placeholder structs for JWT functionality (#18575)
* Added placeholder structs for JWT functionality
* Added watches for CE vs ENT
* Add license header
* Undo plumbing work
* Add context arg
* resource: Make resource writestatus tenancy aware (#18577)
* NET-5338 - NET-5338 - Run a v2 mode xds server (#18579)
* NET-5338 - NET-5338 - Run a v2 mode xds server
* fix linting
* CI: send slack notification on failed nightly job (#18578)
* CE commit (#18583)
* Fix broken link on sameness group page (#18511)
fix broken link
* Fix typo in permissive mTLS docs (#18551)
Update onboarding-tproxy-mode.mdx
* Set concurrency for workflows (#18567)
* Set concurrency for workflows
* test: run automated tests against Vault 1.11 - 1.14 (#18590)
Begin to test against Vault 1.14. Drop tests against Vault 1.10.
* Reduce the frequency of metric exports to minutely (#18584)
* NET-4944 - wire up controllers with proxy tracker (#18603)
Co-authored-by: github-team-consul-core <github-team-consul-core@hashicorp.com>
* Watch the ProxyTracker from xDS controller (#18611)
* Distinguish v2 catalog Protocol unset from default (#18612)
Even though we intend to default to TCP when this field is not
explicitly provided, uncluding an `UNSPECIFIED` default enum value allows us
to create inheritance chains, e.g. service to workload.
* Added OpenTelemetry Access Logging Envoy extension (#18336)
* [HCP Telemetry] Move first TelemetryConfig Fetch into the TelemetryConfigProvider (#18318)
* Add Enabler interface to turn sink on/off
* Use h for hcpProviderImpl vars, fix PR feeback and fix errors
* Keep nil check in exporter and fix tests
* Clarify comment and fix function name
* Use disable instead of enable
* Fix errors nit in otlp_transform
* Add test for refreshInterval of updateConfig
* Add disabled field in MetricsConfig struct
* Fix PR feedback: improve comment and remove double colons
* Fix deps test which requires a maybe
* Update hcp-sdk-go to v0.61.0
* use disabled flag in telemetry_config.go
* Handle 4XX errors in telemetry_provider
* Fix deps test
* Check 4XX instead
* Run make go-mod-tidy
* update comments and docs about running envoy integration tests with the ENVOY_VERSION set. (#18614)
update ENVOY_VERSION and documentation of it used in the bats envoy tests.
Co-authored-by: github-team-consul-core <github-team-consul-core@hashicorp.com>
* delete all v2 resources type when deleting a namespace (CE) (#18621)
* add namespace scope to ServiceV1Alpha1Type
* add CE portion of namespace deletion
* resource: Allow nil tenancy (#18618)
* PLAT-1192 - Run CI on smaller instances (#18624)
Use smaller runners
* NET-3181 - Allow log file naming like Nomad (#18617)
* fixes file name for consul
* added log file
* added tests for rename method
* Add the plumbing for APIGW JWT work (#18609)
* Add the plumbing for APIGW JWT work
* Remove unneeded import
* Add deep equal function for HTTPMatch
* Added plumbing for status conditions
* Remove unneeded comment
* Fix comments
* Add calls in xds listener for apigateway to setup listener jwt auth
* docs: admin partition and DNS clarification (#18613)
* fix: make UNSPECIFIED protocol pass validation (#18634)
We explicitly enumerate the allowed protocols in validation, so this
change is necessary to use the new enum value.
Also add tests for enum validators to ensure they stay aligned to
protos unless we explicitly want them to diverge.
* NET 1594 - Snapshot Agent Filename Should Include Consul Version / Datacenter (#18625)
* init
* tests added and few fixes
* revert arg message
* changelog added
* removed var declaration
* fix CI
* fix test
* added node name and status
* updated save.mdx
* added example
* fix tense
* fix description
* Net 3181 consul gh issue 15709 allow log file naming like nomad - fix bug (#18631)
* fixes file name for consul
* added log file
* added tests for rename method
* append instead of trunc
* fix file truncate issue
* added changelog
* fix for build destros ci
* removed changelog
* solaris
* resource: Require scope for resource registration (#18635)
* [NET-4958] Fix issue where envoy endpoints would fail to populate after snapshot restore (#18636)
Fix issue where agentless endpoints would fail to populate after snapshot restore.
Fixes an issue that was introduced in #17775. This issue happens because
a long-lived pointer to the state store is held, which is unsafe to do.
Snapshot restorations will swap out this state store, meaning that the
proxycfg watches would break for agentless.
* Add extra logging for mesh health endpoints. (#18647)
* feat: Change global-read-only policy to non editable (#18602)
* remove stray FIPS file (#18651)
* Add known issue notice for #18636. (#18650)
* fix: remove Intention test with latency to make consul-enterprise rep… (#18654)
fix: remove Intention test with latency to make consul-enterprise repo tests work
* fix: add telemetry bind socket to proxyConfiguration proto (#18652)
* feat: copy edits for built-in policy alert (#18655)
* test: fix snapshot save w/ append test for ENT (#18656)
* Net 2714/xw cli read command (#18462)
enable `consul resource read` command in cli
* change log for audit log (#18668)
* change log for audit log
* fix file name
* breaking change
* Add TCP+TLS Healthchecks (#18381)
* Begin adding TCPUseTLS
* More TCP with TLS plumbing
* Making forward progress
* Keep on adding TCP+TLS support for healthchecks
* Removed too many lines
* Unit tests for TCP+TLS
* Update tlsutil/config.go
Co-authored-by: Samantha <hello@entropy.cat>
* Working on the tcp+tls unit test
* Updated the runtime integration tests
* Progress
* Revert this file back to HEAD
* Remove debugging lines
* Implement TLS enabled TCP socket server and make a successful TCP+TLS healthcheck on it
* Update docs
* Update agent/agent_test.go
Co-authored-by: Samantha <hello@entropy.cat>
* Update website/content/docs/ecs/configuration-reference.mdx
Co-authored-by: Samantha <hello@entropy.cat>
* Update website/content/docs/ecs/configuration-reference.mdx
Co-authored-by: Samantha <hello@entropy.cat>
* Update agent/checks/check.go
Co-authored-by: Samantha <hello@entropy.cat>
* Address comments
* Remove extraneous bracket
* Update agent/agent_test.go
Co-authored-by: Samantha <hello@entropy.cat>
* Update agent/agent_test.go
Co-authored-by: Samantha <hello@entropy.cat>
* Update website/content/docs/ecs/configuration-reference.mdx
Co-authored-by: Samantha <hello@entropy.cat>
* Update the mockTLSServer
* Remove trailing newline
* Address comments
* Fix merge problem
* Add changelog entry
---------
Co-authored-by: Samantha <hello@entropy.cat>
* Fix windows Ent runner (#18683)
* fix windows image for enterprise
* added quotesT
* Removed nodename and status from consul snapshot save -append-filename command and using leader version in version (#18680)
* init
* fix tests
* fix tests lint
* fix api call inside dc
* updated doc
* address comments
* update guide to reflect tenancy and scope (#18687)
* update guide to reflect tenancy and scope
* Apply suggestions from code review
Co-authored-by: Semir Patel <semir.patel@hashicorp.com>
* update ACLHooks signature
* Update docs/resources/guide.md
Co-authored-by: Semir Patel <semir.patel@hashicorp.com>
---------
Co-authored-by: Semir Patel <semir.patel@hashicorp.com>
* Add support for querying tokens by service name. (#18667)
Add support for querying tokens by service name
The consul-k8s endpoints controller has a workflow where it fetches all tokens.
This is not performant for large clusters, where there may be a sizable number
of tokens. This commit attempts to alleviate that problem and introduces a new
way to query by the token's service name.
* restore common-topo peering integration tests, but nightly [NET-5476] (#18673)
* dataplane: Allow getting bootstrap parameters when using V2 APIs (#18504)
This PR enables the GetEnvoyBootstrapParams endpoint to construct envoy bootstrap parameters from v2 catalog and mesh resources.
* Make bootstrap request and response parameters less specific to services so that we can re-use them for workloads or service instances.
* Remove ServiceKind from bootstrap params response. This value was unused previously and is not needed for V2.
* Make access logs generation generic so that we can generate them using v1 or v2 resources.
* switch all client nodes in dc2 to dataplane [NET-4299] (#18608)
* Reformat proxy docs refresh (#18623)
* first commit; reformat PD conf entry
* updated proxies overview page
* added Deploy SM proxy usage and removed reg index
* moved sidecar proxy usage to main proxy folder
* recast sidecar reg page as Deploy sidecar services
* fix typos
* recast SM reg as conf reference- set the sidebar
* add redirects
* fix links
* add PD conf entry usage to appropro pages
* edits to proxy conf ref
* fix links on index page
* example command to write PD conf entry
* updated links to old SM proxy reg page
* updated links to sidecar service reg page
* tryna fix front matter issues
* Apply suggestions from code review
Co-authored-by: Ronald <roncodingenthusiast@users.noreply.github.com>
* added paragraph about SM proxies to overivew
* Apply suggestions from code review
Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>
---------
Co-authored-by: Ronald <roncodingenthusiast@users.noreply.github.com>
Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>
* sidecar-proxy controller: L4 controller with explicit upstreams (NET-3988) (#18352)
* This controller generates and saves ProxyStateTemplate for sidecar proxies.
* It currently supports single-port L4 ports only.
* It keeps a cache of all destinations to make it easier to compute and retrieve destinations.
* It will update the status of the pbmesh.Upstreams resource if anything is invalid.
* This commit also changes service endpoints to include workload identity. This made the implementation a bit easier as we don't need to look up as many workloads and instead rely on endpoints data.
* test: update sidecarproxy/builder golden tests to use determinstic golden data (#18703)
* [APIGW] NET-5017 JWT Cleanup/Status Conditions (#18700)
* Fixes issues in setting status
* Update golden files for changes to xds generation to not use deprecated
methods
* Fixed default for validation of JWT for route
* Added changelog for jwt features (#18709)
* fix: NET-1521 show latest config in /v1/agent/self (#18681)
* fix: NET-1521 show latest config in /v1/agent/self
* Using larger machine for Enterprise (#18713)
using 4x large for ent
* [NET-5325] ACL templated policies support in tokens and roles (#18708)
* [NET-5325] ACL templated policies support in tokens and roles
- Add API support for creating tokens/roles with templated-policies
- Add CLI support for creating tokens/roles with templated-policies
* adding changelog
* Adds PassiveHealthCheck Fields to ServiceDefaults and IngressGateway (#18532)
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
* Instantiate secure resource service client after the grpc server (#18712)
* ENT port: test-integ/peering: peer through mesh gateway [NET-4609] (#18605)
Co-authored-by: Matt Keeler <mjkeeler7@gmail.com>
* [CC-6039] Update builtin policy descriptions (#18705)
* Net-2713/resource apply command (#18610)
* feat: implement apply command
* fix: resolve lint issues
* refactor: use fixed types
* fix: ci lint failures after main rebase
* NET-5530 Support response header modifiers on http-route config entry (#18646)
* Add response header filters to http-route config entry definitions
* Map response header filters from config entry when constructing route destination
* Support response header modifiers at the service level as well
* Update protobuf definitions
* Update existing unit tests
* Add response filters to route consolidation logic
* Make existing unit tests more robust
* Add missing docstring
* Add changelog entry
* Add response filter modifiers to existing integration test
* Add more robust testing for response header modifiers in the discovery chain
* Add more robust testing for request header modifiers in the discovery chain
* Modify test to verify that service filter modifiers take precedence over rule filter modifiers
* fix: emit consul version metric on a regular interval (#18724)
* [NET-5330] Support templated policies in Binding rules (#18719)
* [NET-5330] Support templated policies in Binding rules
* changelog for templated policy support in binding rules
* NET-5530 Generate deep-copy code (#18730)
* Generate deep-copy code
* Undo license header removal
* sidecar-proxy controller: Add support for transparent proxy (NET-5069) (#18458)
This commit adds support for transparent proxy to the sidecar proxy controller. As we do not yet support inferring destinations from intentions, this assumes that all services in the cluster are destinations.
* Prefix sidecar proxy test files with source and destination. (#18620)
* mesh-controller: handle L4 protocols for a proxy without upstreams
* sidecar-controller: Support explicit destinations for L4 protocols and single ports.
* This controller generates and saves ProxyStateTemplate for sidecar proxies.
* It currently supports single-port L4 ports only.
* It keeps a cache of all destinations to make it easier to compute and retrieve destinations.
* It will update the status of the pbmesh.Upstreams resource if anything is invalid.
* endpoints-controller: add workload identity to the service endpoints resource
* small fixes
* review comments
* Address PR comments
* sidecar-proxy controller: Add support for transparent proxy
This currently does not support inferring destinations from intentions.
* PR review comments
* mesh-controller: handle L4 protocols for a proxy without upstreams
* sidecar-controller: Support explicit destinations for L4 protocols and single ports.
* This controller generates and saves ProxyStateTemplate for sidecar proxies.
* It currently supports single-port L4 ports only.
* It keeps a cache of all destinations to make it easier to compute and retrieve destinations.
* It will update the status of the pbmesh.Upstreams resource if anything is invalid.
* endpoints-controller: add workload identity to the service endpoints resource
* small fixes
* review comments
* Make sure endpoint refs route to mesh port instead of an app port
* Address PR comments
* fixing copyright
* tidy imports
* sidecar-proxy controller: Add support for transparent proxy
This currently does not support inferring destinations from intentions.
* tidy imports
* add copyright headers
* Prefix sidecar proxy test files with source and destination.
* Update controller_test.go
---------
Co-authored-by: Iryna Shustava <iryna@hashicorp.com>
Co-authored-by: R.B. Boyer <rb@hashicorp.com>
Co-authored-by: github-team-consul-core <github-team-consul-core@hashicorp.com>
* k8s: Update audit-logging docs to include K8s examples (#18721)
Update audit-logging.mdx
* Fix windows integrations tests machine size (#18736)
fix windows integrations tests machine size
* Increase timeout for integration test windows. (#18737)
increase timeout
* Net-4292/list command (#18649)
* feat: implement list command
* refactor: apply command file parsing
* Added logs for debugging (#18740)
* added logs
* added echo
* removed pull request
* xds: update golden tests to be deterministic (#18707)
* Run copyright after running deep-copy as part of the Makefile/CI (#18741)
* execute copyright headers after performing deep-copy generation.
* fix copyright install
* Apply suggestions from code review
Co-authored-by: Semir Patel <semir.patel@hashicorp.com>
* Apply suggestions from code review
Co-authored-by: Semir Patel <semir.patel@hashicorp.com>
* rename steps to match codegen naming
* remove copywrite install category
---------
Co-authored-by: Semir Patel <semir.patel@hashicorp.com>
* [NET-5333] Add api to read/list and preview templated policies (#18748)
* NET-5132 - Configure multiport routing for connect proxies in TProxy mode (#18606)
* mesh-controller: handle L4 protocols for a proxy without upstreams
* sidecar-controller: Support explicit destinations for L4 protocols and single ports.
* This controller generates and saves ProxyStateTemplate for sidecar proxies.
* It currently supports single-port L4 ports only.
* It keeps a cache of all destinations to make it easier to compute and retrieve destinations.
* It will update the status of the pbmesh.Upstreams resource if anything is invalid.
* endpoints-controller: add workload identity to the service endpoints resource
* small fixes
* review comments
* Address PR comments
* sidecar-proxy controller: Add support for transparent proxy
This currently does not support inferring destinations from intentions.
* PR review comments
* mesh-controller: handle L4 protocols for a proxy without upstreams
* sidecar-controller: Support explicit destinations for L4 protocols and single ports.
* This controller generates and saves ProxyStateTemplate for sidecar proxies.
* It currently supports single-port L4 ports only.
* It keeps a cache of all destinations to make it easier to compute and retrieve destinations.
* It will update the status of the pbmesh.Upstreams resource if anything is invalid.
* endpoints-controller: add workload identity to the service endpoints resource
* small fixes
* review comments
* Make sure endpoint refs route to mesh port instead of an app port
* Address PR comments
* fixing copyright
* tidy imports
* sidecar-proxy controller: Add support for transparent proxy
This currently does not support inferring destinations from intentions.
* tidy imports
* add copyright headers
* Prefix sidecar proxy test files with source and destination.
* Update controller_test.go
* NET-5132 - Configure multiport routing for connect proxies in TProxy mode
* formatting golden files
* reverting golden files and adding changes in manually. build implicit destinations still has some issues.
* fixing files that were incorrectly repeating the outbound listener
* PR comments
* extract AlpnProtocol naming convention to getAlpnProtocolFromPortName(portName)
* removing address level filtering.
* adding license to resources_test.go
---------
Co-authored-by: Iryna Shustava <iryna@hashicorp.com>
Co-authored-by: R.B. Boyer <rb@hashicorp.com>
Co-authored-by: github-team-consul-core <github-team-consul-core@hashicorp.com>
* added time stamps (#18757)
* fix: write endpoint errors out gracefully (#18743)
* [NET-5574] Update Go version to 1.20.8 (#18742)
Update Go version to 1.20.8
This resolves several CVEs (see changelog entry).
* Add Envoy golden test for OTEL access logging extension (#18760)
* mesh: create new routes-controller to reconcile xRoute types into a ComputedRoutes resource (#18460)
This new controller produces an intermediate output (ComputedRoutes) that is meant to summarize all relevant xRoutes and related mesh configuration in an easier-to-use format for downstream use to construct the ProxyStateTemplate.
It also applies status updates to the xRoute resource types to indicate that they are themselves semantically valid inputs.
* xds controller: setup watches for and compute leaf cert references in ProxyStateTemplate, and wire up leaf cert manager dependency (#18756)
* Refactors the leafcert package to not have a dependency on agent/consul and agent/cache to avoid import cycles. This way the xds controller can just import the leafcert package to use the leafcert manager.
The leaf cert logic in the controller:
* Sets up watches for leaf certs that are referenced in the ProxyStateTemplate (which generates the leaf certs too).
* Gets the leaf cert from the leaf cert cache
* Stores the leaf cert in the ProxyState that's pushed to xds
* For the cert watches, this PR also uses a bimapper + a thin wrapper to map leaf cert events to related ProxyStateTemplates
Since bimapper uses a resource.Reference or resource.ID to map between two resource types, I've created an internal type for a leaf certificate to use for the resource.Reference, since it's not a v2 resource.
The wrapper allows mapping events to resources (as opposed to mapping resources to resources)
The controller tests:
Unit: Ensure that we resolve leaf cert references
Lifecycle: Ensure that when the CA is updated, the leaf cert is as well
Also adds a new spiffe id type, and adds workload identity and workload identity URI to leaf certs. This is so certs are generated with the new workload identity based SPIFFE id.
* Pulls out some leaf cert test helpers into a helpers file so it
can be used in the xds controller tests.
* Wires up leaf cert manager dependency
* Support getting token from proxytracker
* Add workload identity spiffe id type to the authorize and sign functions
---------
Co-authored-by: John Murret <john.murret@hashicorp.com>
* Test: NET-5592 - update Nomad integration testing (#18768)
NET-5592 - update Nomad integration testing
* Add workload identity ACL rules (#18769)
* Windows Integration Test Changes (#18758)
* some changes to debug
* revert machines
* increased timeout
* added sleep 10 seconds before test start
* chagne envoy version
* removed sleep
* revert timeout
* replace position
* removed date
* Revert "[NET-5217] [OSS] Derive sidecar proxy locality from parent service (#18437)"
This reverts commit 05604eeec1186a4c8a6156e7519a579171659c1a.
* fix build
* Revert "replace position"
This reverts commit 48e6af46a8daae186c283f30d316b1104906993e.
* Revert "Revert "[NET-5217] [OSS] Derive sidecar proxy locality from parent service (#18437)""
This reverts commit d7c568e2be727b72e6827225782e0e17ac06b74a.
* comment out api gateway http hostnames test
* fix import
* revert integ test run on PR
* Add V2 TCP traffic permissions (#18771)
Add support for TCP traffic permissions
* resource: add helper to normalize inner Reference tenancy during mutate (#18765)
When one resource contains an inner field that is of type *pbresource.Reference we want the
Tenancy to be reasonably defaulted by the following rules:
1. The final values will be limited by the scope of the referenced type.
2. Values will be inferred from the parent's tenancy, and if that is insufficient then using
the default tenancy for the type's scope.
3. Namespace will only be used from a parent if the reference and the parent share a
partition, otherwise the default namespace will be used.
Until we tackle peering, this hard codes an assumption of peer name being local. The
logic for defaulting may need adjustment when that is addressed.
* Disable docs change CI skip detection (#18775)
There's currently a bug that causes CI to be skipped on all non-PR
changes. Until that's fixed and we can be certain the check will fail CI
or default to running tests in the case of errors, disabling this check.
* delete command ready (#18679)
* delete command for resource management
* Vault CA provider clean up previous default issuers (#18773)
* Fix snapshot creation issue. (#18783)
The renaming of files from oss -> ce caused incorrect snapshots
to be created due to ce writes now happening prior to ent writes.
When this happens various entities will attempt to be restored
from the snapshot prior to a partition existing and will cause a
panic to occur.
* catalog: service endpoints inherits protocol from service when workload doesn't have one (#18792)
* add fuzz tests to resourcehcl package and fix some panics (#18798)
* add a simple fuzz test for the resourcehcl package and fix some panics uncovered by the test
* fix default for null values
* Clean up resources in test (#18799)
* Updates gateway-class-config docs to include fields for privileged container port-mapping and Openshift Security Context Constraints
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
* Removes errant word in docs that was breaking the build (#18804)
* Fix flaky test (#18805)
* register traffic permission and workload identity types (#18704)
* add workload identity and traffic permission protos
* register new types
* add generated pb code
* fix exports.go path
* add proto newlines
* fix type name
Co-authored-by: Eric Haberkorn <erichaberkorn@gmail.com>
* address review
* fix protos and add tests
* fix validation constraints
* add tests
---------
Co-authored-by: Eric Haberkorn <erichaberkorn@gmail.com>
* [NET-5329] use acl templated policy under the hood for node/service identities (#18813)
* [NET-5334] Added CLI commands for templated policies (#18816)
* mesh: Wire ComputedRoutes into the ProxyStateTemplate via the sidecar controller (#18752)
Reworks the sidecar controller to accept ComputedRoutes as an input and use it to generate appropriate ProxyStateTemplate resources containing L4/L7 mesh configuration.
* mesh: call the right mapper (#18818)
* fix templated policy cli output (#18821)
* resource: default peername to "local" for now (#18822)
* Wire up traffic permissions (#18812)
Wire up traffic permissions
* added consul and envoy version constraints (#18726)
* added consul and envoy version constraints
* fixed Destination configuraiton and added tproxy requirement
* Apply suggestions from code review
Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>
---------
Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>
* Default to tcp protocol when workload protocol is unspecified (#18824)
* Retry and timeout test acceptance test (#18791)
* retry and timeout test
* add docker mirrior
* checkpoint
* add in error
* add in delay
* up error rate
* fix status code
* Use embedded strings for templated policies (#18829)
* consul operator raft transfer-leader should send the id (#17107)
Fixes#16955
Co-authored-by: Dhia Ayachi <dhia@hashicorp.com>
* Allow empty data writes for resources (#18819)
* allow nil data writes for resources
* update demo to test valid type with no data
* Fix nondeterministic test (#18828)
* mesh: prevent writing a ComputedRoutes with no ported configs (#18833)
* catalog: Default protocol to tcp in catalog.Service if unspecified (#18832)
* Adjust metrics test (#18837)
* Audit log consul 1.17x changes (#18669)
* audit log consul 1.17x changes
* added some details
* verbose
* Fixes for integration tests windows for ENT (#18839)
* fixes for integration tests
* fix runner size for enterprise
* fix spacing
* fix spacing
* removed branch test run
* fix: provide meaningful error messages and add test (#18772)
* fix: provide meaningful error messages and add test
* fix: return error instead of warning when extra args are provided
* add v2 tenancy bridge Flag and v2 Tenancy Bridge initial implementation (#18830)
* add v2 tenancy bridge and a feature flag for v2 tenancy
* move tenancy bridge v2 under resource package
* docs: Fix typo in description for server_addresses (#18838)
Change 'If not port' to 'If no port'.
Resolves#18553
* grafana: display connected consul-dataplanes (#18842)
* Adding Apigee for ext_authz, minor fix in the default ext_authz docs (#18796)
* adding apigee for ext_authz, minor fix
* adding the Apigee docs to nav
* Apply suggestions from code review
Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>
Co-authored-by: Blake Covarrubias <blake.covarrubias@gmail.com>
* addressing feedback
* Apply suggestions from code review
Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>
---------
Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>
Co-authored-by: Blake Covarrubias <blake.covarrubias@gmail.com>
* catalog: normalize/default/validate tenancy components of FailoverPolicy internal References (#18825)
FailoverPolicy resources contain inner Reference fields. We want to ensure
that components of those reference Tenancy fields left unspecified are defaulted
using the tenancy of the enclosing FailoverPolicy resource.
As the underlying helper being used to do the normalization calls the function
modified in #18822, it also means that the PeerName field will be set to "local" for
now automatically to avoid "local" != "" issues downstream.
* Fix gateway services cleanup where proxy deregistration happens after service deregistration (#18831)
* Fix gateway services cleanup where proxy deregistration happens after service deregistration
* Add test
* Add changelog
* Fix comment
* Move ACL templated policies to hcl files (#18853)
* mesh: update xds controller to synthesize empty endpoints when no endpoints ref is found (#18835)
* mesh: normalize/default/validate tenancy components of mesh internal References (#18827)
HTTPRoute, GRPCRoute, TCPRoute, and Upstreams resources contain inner
Reference fields. We want to ensure that components of those reference Tenancy
fields left unspecified are defaulted using the tenancy of the enclosing resource.
As the underlying helper being used to do the normalization calls the function
modified in #18822, it also means that the PeerName field will be set to "local" for
now automatically to avoid "local" != "" issues downstream.
* resource: mutate and validate before acls on write (#18868)
* Remove flaky test assertions (#18870)
* mesh: only build tproxy outbound listener once per destination (#18836)
Previously, when using implicit upstreams, we'd build outbound listener per destination instead of one for all destinations. This will result in port conflicts when trying to send this config to envoy.
This PR also makes sure that leaf and root references are always added (before we would only add it if there are inbound non-mesh ports).
Also, black-hole traffic when there are no inbound ports other than mesh
* NET-4519 Collecting journald logs in "consul debug" bundle (#18797)
* debug since
* fix docs
* chagelog added
* fix go mod
* debug test fix
* fix test
* tabs test fix
* Update .changelog/18797.txt
Co-authored-by: Ganesh S <ganesh.seetharaman@hashicorp.com>
---------
Co-authored-by: Ganesh S <ganesh.seetharaman@hashicorp.com>
* CI: lint test-integ (#18875)
* CI: lint test-integ
* fix lint error
* Honor Default Traffic Permissions in V2 (#18886)
wire up v2 default traffic permissions
* docs: Fix HCL, JSON, and YAML syntax errors (#18879)
This commit fixes syntax errors in HCL, JSON, and YAML example
configurations. In some cases, it replaces the code example with the
proper format for the code block.
Also fixes HCL formatting and misc opportunistic updates to codeblock.
Co-authored-by: Tu Nguyen <im2nguyen@gmail.com>
* Fix code block examples on dns-static-lookups.mdx (#18880)
HCL and JSON configuration examples were being displayed in the same
code block. This commit separates the configurations to properly
display them as independent configuration examples.
* docs: Fix Kubernetes CRD example configs (#18878)
Fixes configuration examples for several Consul Kubernetes CRDs. The
CRDs were missing required fields such as `apiVersion`, `metadata`,
and `spec`.
Co-authored-by: Tu Nguyen <im2nguyen@gmail.com>
* docs: Apigee extension backport (#18847)
* commit
* link text edits
* Add operator audit endpoint changes (#18899)
* docs: Remove YAML service registration examples (#18877)
Remove YAML service registration examples and replace them with JSON.
This is because YAML is not a supported configuration format for the
Consul's agent configuration, nor is it supported by the HTTP API.
This commit replaces the YAML examples with JSON and adds additional
JSON examples where they were missing.
* Add otel-access-logging Envoy extension integration test (#18898)
* Add note about service upstream env var dot broken (#18895)
* add note about service upstream env var dot broken
* Apply suggestions from code review
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
---------
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
* xds: Use downstream protocol when connecting to local app (#18573)
Configure Envoy to use the same HTTP protocol version used by the
downstream caller when forwarding requests to a local application that
is configured with the protocol set to either `http2` or `grpc`.
This allows upstream applications that support both HTTP/1.1 and
HTTP/2 on a single port to receive requests using either protocol. This
is beneficial when the application primarily communicates using HTTP/2,
but also needs to support HTTP/1.1, such as to respond to Kubernetes
HTTP readiness/liveness probes.
Co-authored-by: Derek Menteer <derek.menteer@hashicorp.com>
* resource: ensure resource.AuthorizerContext properly strips the local… (#18908)
resource: ensure resource.AuthorizerContext properly strips the local peer name
* docs: Add complete auth method payloads (#18849)
This commit modifies the example payloads for various auth methods to
remove 'other fields' and instead use complete example payloads.
* agent/config: prevent startup if resource-apis experiment and cloud are enabled (#18876)
* v2: various fixes to make K8s tproxy multiport acceptance tests and manual explicit upstreams (single port) tests pass (#18874)
Adding coauthors who mobbed/paired at various points throughout last week.
Co-authored-by: Dan Stough <dan.stough@hashicorp.com>
Co-authored-by: Iryna Shustava <iryna@hashicorp.com>
Co-authored-by: John Murret <john.murret@hashicorp.com>
Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>
Co-authored-by: Ashwin Venkatesh <ashwin@hashicorp.com>
Co-authored-by: Michael Wilkerson <mwilkerson@hashicorp.com>
* Added changelog entries for 1.14.10, 1.15.6, 1.16.2 (#18917)
* [NET-5332] Add nomad server templated policy (#18888)
* [NET-5332] Add nomad server templated policy
* slksfd
* mesh: make FailoverPolicy work in xdsv2 and ProxyStateTemplate (#18900)
Ensure that configuring a FailoverPolicy for a service that is reachable via a xRoute or a direct upstream causes an envoy aggregate cluster to be created for the original cluster name, but with separate clusters for each one of the possible destinations.
* Fix changelog order (#18918)
* Fix changelog order
* fix ordering or entries
* Add namespace proto and registration (#18848)
* add namespace proto and registration
* fix proto generation
* add missing copywrite headers
* fix proto linter errors
* fix exports and Type export
* add mutate hook and more validation
* add more validation rules and tests
* Apply suggestions from code review
Co-authored-by: Semir Patel <semir.patel@hashicorp.com>
* fix owner error and add test
* remove ACL for now
* add tests around space suffix prefix.
* only fait when ns and ap are default, add test for it
---------
Co-authored-by: Semir Patel <semir.patel@hashicorp.com>
* Update base ref property name (#18851)
* Update base ref property name
* Test skip ci (#18924)
test_push_merge
* cleanup test push code
* dns token (#17936)
* dns token
fix whitespace for docs and comments
fix test cases
fix test cases
remove tabs in help text
Add changelog
Peering dns test
Peering dns test
Partial implementation of Peered DNS test
Swap to new topology lib
expose dns port for integration tests on client
remove partial test implementation
remove extra port exposure
remove changelog from the ent pr
Add dns token to set-agent-token switch
Add enterprise golden file
Use builtin/dns template in tests
Update ent dns policy
Update ent dns template test
remove local gen certs
fix templated policy specs
* add changelog
* go mod tidy
* NET-5131 - support multiple ported upstreams tests (#18923)
* add multiple upstream ports to golden file test for destination builder
* NET-5131 - add unit tests for multiple ported upstreams
* fix merge conflicts
* Fix for loop in filter_changed_files_go_test script (#18931)
* iterate through array
* remove comment
* Fix create dns token docs (#18927)
* [NET-5589] Optimize leaf watch diff on xds controller. (#18921)
Optimize leaf watch diff on xds controller.
* NET-4884 - Terminating gateway tests for namespaces & partitions (#18820)
* Add gateway test to CE
* Fix V2 Wildcard RBAC Regular Expressions (#18941)
fix wildcard rbac regular expressions
* skip flaky test (#18949)
* docs: Fix invalid JSON in code examples (#18932)
This commit fixes invalid JSON in various code examples.
* do not trigger integration tests (#18948)
* Dump response body on fail (#18962)
* Add protoc generator to emit resource type variables (#18957)
The annotations include a little more data than is strictly necessary because we will also have a protoc generator for openapi output.
* docs: Change heading to filename in CodeBlockConfig (#18951)
Change various CodeBlockConfig objects to use the `filename` attribute
instead of `heading` when the code block references a named file.
* docs: Replace unicode quotes with ASCII quotes (#18950)
Replaces unicode quotation marks with ASCII quotation marks.
For code examples, this fixes HCL decoding errors that would otherwise
be raised when attempting to read the file.
* net-5689 fix disabling panic threshold logic (#18958)
* tenancy: split up tenancy `types.go` into CE version (#18966)
* [NET-5589] Add jitter to xds v2 leaf cert watches (#18940)
Add jitter to xds v2 leaf cert watches.
* Fix docs for log file name changes (#18913)
* fix docs
* Update website/content/docs/agent/config/cli-flags.mdx
Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>
* Update website/content/docs/agent/config/cli-flags.mdx
Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>
* Update website/content/docs/agent/config/cli-flags.mdx
Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>
---------
Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>
* resource: allow for the ACLs.Read hook to request the entire data payload to perform the authz check (#18925)
The ACLs.Read hook for a resource only allows for the identity of a
resource to be passed in for use in authz consideration. For some
resources we wish to allow for the current stored value to dictate how
to enforce the ACLs (such as reading a list of applicable services from
the payload and allowing service:read on any of them to control reading the enclosing resource).
This change update the interface to usually accept a *pbresource.ID,
but if the hook decides it needs more data it returns a sentinel error
and the resource service knows to defer the authz check until after
fetching the data from storage.
* catalog: add ACL checks for FailoverPolicy resources (#18919)
FailoverPolicy resources are name-aligned with the Service they control.
They also contain a list of possible failover destinations that are References
to other Services.
The ACLs should be:
- list: (default)
- read: service:<resource_name>:read
- write: service:<resource_name>:write + service:<destination_name>:read (for any destination)
* catalog: fix for new method argument (#18978)
* catalog,mesh,auth: Bump versions to v2beta1 (#18930)
* [Docs] Add note to jwt docs to specify the need for ACLs (#18942)
* remove now orphaned generated v1alpha1 pb.go files (#18982)
* peerstream: fix flaky test related to autopilot integration (#18979)
* mesh: add ACL checks for DestinationPolicy resources (#18920)
DestinationPolicy resources are name-aligned with the Service they control.
The ACLs should be:
- list: (default)
- read: service:<resource_name>:read
- write: service:<resource_name>:write
* mesh: add ACL checks for xRoute resources (#18926)
xRoute resources are not name-aligned with the Services they control. They
have a list of "parent ref" services that they alter traffic flow for, and they
contain a list of "backend ref" services that they direct that traffic to.
The ACLs should be:
- list: (default)
- read:
- ALL service:<parent_ref_service>:read
- write:
- ALL service:<parent_ref_service>:write
- ALL service:<backend_ref_service>:read
* Traffic Permissions Validations (#18907)
add TP validations and mutation and add CTP validations
* feat: remove resource api client from api module (#18984)
* feat: remove resource api client from api module
* fix: go mod clean up
* mesh: store bound reference pointers on a ComputedRoutes resource and use during reconcile (#18965)
xRoute resource types contain a slice of parentRefs to services that they
manipulate traffic for. All xRoutes that have a parentRef to given Service
will be merged together to generate a ComputedRoutes resource
name-aligned with that Service.
This means that a write of an xRoute with 2 parent ref pointers will cause
at most 2 reconciles for ComputedRoutes.
If that xRoute's list of parentRefs were ever to be reduced, or otherwise
lose an item, that subsequent map event will only emit events for the current
set of refs. The removed ref will not cause the generated ComputedRoutes
related to that service to be re-reconciled to omit the influence of that xRoute.
To combat this, we will store on the ComputedRoutes resource a
BoundResources []*pbresource.Reference field with references to all
resources that were used to influence the generated output.
When the routes controller reconciles, it will use a bimapper to index this
influence, and the dependency mappers for the xRoutes will look
themselves up in that index to discover additional (former) ComputedRoutes
that need to be notified as well.
* Add CLI support for json (#18991)
* add cli support for json format
* add tests for json parsing
* make owner and id pointers.
* add copyright header
* remove print
---------
Co-authored-by: Poonam Jadhav <poonam.jadhav@hashicorp.com>
* mesh: compute more of the xRoute features into ComputedRoutes (#18980)
Convert more of the xRoutes features that were skipped in an earlier PR into ComputedRoutes and make them work:
- DestinationPolicy defaults
- more timeouts
- load balancer policy
- request/response header mutations
- urlrewrite
- GRPCRoute matches
* catalog,mesh,auth: Move resource types to the proto-public module (#18935)
* mesh: update various protobuf comments for mesh types (#18993)
* docs: add changelog (#18994)
* api: add Token field to ServiceRegisterOpts (#18983)
Ongoing work to support Nomad Workload Identity for authenticating with Consul
will mean that Nomad's service registration sync with Consul will want to use
Consul tokens scoped to individual workloads for registering services and
checks. The `ServiceRegisterOpts` type in the API doesn't have an option to pass
the token in, which prevent us from sharing the same Consul connection for all
workloads. Add a `Token` field to match the behavior of `ServiceDeregisterOpts`.
* api: add `CheckRegisterOpts` method to Agent API (#18943)
Ongoing work to support Nomad Workload Identity for authenticating with Consul
will mean that Nomad's service registration sync with Consul will want to use
Consul tokens scoped to individual workloads for registering services and
checks. The `CheckRegister` method in the API doesn't have an option to pass the
token in, which prevent us from sharing the same Consul connection for all
workloads. Add a `CheckRegisterOpts` to match the behavior of
`ServiceRegisterOpts`.
* grafana: fix a query metrics from ent and add consul version (#18998)
* v2 explicit destination traffic permissions (#18823)
* workload identity boilerplate
* notes from discussion with Iryna
* WIP traffic permissions controller poc
* workload identity, traffic permissions validation, errors, types
* traffic permissions mapper framing, traffic permissions controller updates.
* more roughing out of the controller
* cleanup
* controller and mapper logic
* tests
* refactor mapper logic, add tests
* clean up tenancy and integration test stubs
* consolidate mapping
* cleanup cache leak, revert bimapper changes
* address review comments
* test fix and rebase
* use resource helper
---------
Co-authored-by: John Landa <john.landa@hashicorp.com>
* mesh: rename Upstreams and UpstreamsConfiguration to Destinations* (#18995)
* auth: register auth controllers with the server (#19000)
* acl: default tenancy with the no-auth ACL resolver (#19006)
When using the no-auth acl resolver (the case for most controllers and the get-envoy-boostrap-params endpoint), ResolveTokenAndDefaultMeta
method only returns an acl resolver. However, the resource service relies on the ent meta to be filled in to do the tenancy defaulting and
inheriting it from the token when one is present.
So this change makes sure that the ent meta defaulting always happens in the ACL resolver.
* NET-5657 - consul-containers test for explicit upstreams (#18952)
* Explicit container test
* remove static resources
* fix passing serviceBindPorts
* WIP
* fix explicit upstream test
* use my image in CI until dataplane is fixed.
* gofmt
* fixing reference to v2beta1 in test-containers
* WIP
* remove bad references
* add missing license headers
* allow access internal/resource/resourcetest
* fix check-allowed-imports to append array items
* use preview image for dataplane
* revert some inadverntent comment updates in peering_topology
* add building local consul-dataplane image to compatibility-tests CI
* fix substitution in CI
* change upstreams to destinations based on incoming change
* fixing use of upstreams in resource update
* remove commented out lines and enable envoy concurrency on dataplane.
* changes to addess PR feedback
* small fixes
---------
Co-authored-by: Eric <eric@haberkorn.co>
* Skip the catalog v2 upgrade test (#19005)
We intentionally broke api compatibility here as we are not yet maintaining backwards compat for the v2 apis
* Fix type of datacenter in Service Resolvers Config Entry (#19004)
* docs: Rename Consul OSS to Consul CE (#19009)
Rename references of Consul OSS to Consul Community Edition (CE).
Co-authored-by: Tu Nguyen <im2nguyen@gmail.com>
* Update release notes to indicate folks should upgrade to to 1.16.2 or later (#19002)
* Update v1_16_x.mdx
* Update upgrade-specific.mdx
* Update website/content/docs/upgrading/upgrade-specific.mdx
Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>
* Handle Traffic Permissions With Empty Sources Properly (#19024)
Fix issues with empty sources
* Validate that each permission on traffic permissions resources has at least one source.
* Don't construct RBAC policies when there aren't any principals. This resulted in Envoy rejecting xDS updates with a validation error.
```
error=
| rpc error: code = Internal desc = Error adding/updating listener(s) public_listener: Proto constraint validation failed (RBACValidationError.Rules: embedded message failed validation | caused by RBACValidationError.Policies[consul-intentions-layer4-1]: embedded message failed validation | caused by PolicyValidationError.Principals: value must contain at least 1 item(s)): rules {
```
* Include RequestTimeout in marshal/unmarshal of ServiceResolverConfigEntry
* backport of commit 4ad1a8760d1276ec2f2ce7b9be741badb7abb1f6
* backport of commit 9109bdd79163dbdda4ef1e7dc7e990ba2cab8858
---------
Co-authored-by: Poonam Jadhav <poonam.jadhav@hashicorp.com>
Co-authored-by: Matt Keeler <mkeeler@users.noreply.github.com>
Co-authored-by: Daniel Upton <daniel@floppy.co>
Co-authored-by: wangxinyi7 <121973291+wangxinyi7@users.noreply.github.com>
Co-authored-by: Luke Kysow <1034429+lkysow@users.noreply.github.com>
Co-authored-by: Anita Akaeze <anita.akaeze@hashicorp.com>
Co-authored-by: Nitya Dhanushkodi <nitya@hashicorp.com>
Co-authored-by: Semir Patel <semir.patel@hashicorp.com>
Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com>
Co-authored-by: Dan Bond <danbond@protonmail.com>
Co-authored-by: David Yu <dyu@hashicorp.com>
Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com>
Co-authored-by: Blake Covarrubias <blake@covarrubi.as>
Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>
Co-authored-by: John Murret <john.murret@hashicorp.com>
Co-authored-by: Ashwin Venkatesh <ashwin@hashicorp.com>
Co-authored-by: Iryna Shustava <ishustava@users.noreply.github.com>
Co-authored-by: cskh <hui.kang@hashicorp.com>
Co-authored-by: Tu Nguyen <im2nguyen@users.noreply.github.com>
Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>
Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>
Co-authored-by: Vijay <vijayraghav22@gmail.com>
Co-authored-by: Dan Stough <dan.stough@hashicorp.com>
Co-authored-by: Natalie Smith <nataliemegans@gmail.com>
Co-authored-by: Ashesh Vidyut <134911583+absolutelightning@users.noreply.github.com>
Co-authored-by: Chris S. Kim <ckim@hashicorp.com>
Co-authored-by: John Maguire <john.maguire@hashicorp.com>
Co-authored-by: Curt Bushko <cbushko@gmail.com>
Co-authored-by: Jared Kirschner <85913323+jkirschner-hashicorp@users.noreply.github.com>
Co-authored-by: Joshua Timmons <josh.timmons@hashicorp.com>
Co-authored-by: Hardik Shingala <34568645+hdkshingala@users.noreply.github.com>
Co-authored-by: Ashvitha <ashvitha.sridharan@hashicorp.com>
Co-authored-by: Dhia Ayachi <dhia@hashicorp.com>
Co-authored-by: Derek Menteer <105233703+hashi-derek@users.noreply.github.com>
Co-authored-by: Valeriia Ruban <valeriia.ruban@hashicorp.com>
Co-authored-by: skpratt <sarah.pratt@hashicorp.com>
Co-authored-by: Phil Porada <pgporada@users.noreply.github.com>
Co-authored-by: Samantha <hello@entropy.cat>
Co-authored-by: Nick Irvine <115657443+nfi-hashicorp@users.noreply.github.com>
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
Co-authored-by: Ronald <roncodingenthusiast@users.noreply.github.com>
Co-authored-by: Gerard Nguyen <gerard@hashicorp.com>
Co-authored-by: Melisa Griffin <missylbytes@users.noreply.github.com>
Co-authored-by: Matt Keeler <mjkeeler7@gmail.com>
Co-authored-by: Jeremy Jacobson <jjacobson93@users.noreply.github.com>
Co-authored-by: Iryna Shustava <iryna@hashicorp.com>
Co-authored-by: R.B. Boyer <rb@hashicorp.com>
Co-authored-by: Chris Thain <32781396+cthain@users.noreply.github.com>
Co-authored-by: Sophie Gairo <97480023+sophie-gairo@users.noreply.github.com>
Co-authored-by: Eric Haberkorn <erichaberkorn@gmail.com>
Co-authored-by: sarahalsmiller <100602640+sarahalsmiller@users.noreply.github.com>
Co-authored-by: James Hartig <me@jameshartig.com>
Co-authored-by: Gautam <gautambaghel93@gmail.com>
Co-authored-by: Blake Covarrubias <blake.covarrubias@gmail.com>
Co-authored-by: Andrew Stucki <andrew.stucki@hashicorp.com>
Co-authored-by: Ganesh S <ganesh.seetharaman@hashicorp.com>
Co-authored-by: Tu Nguyen <im2nguyen@gmail.com>
Co-authored-by: Derek Menteer <derek.menteer@hashicorp.com>
Co-authored-by: Nick Ethier <nethier@hashicorp.com>
Co-authored-by: John Landa <jonathanlanda@gmail.com>
Co-authored-by: Tim Gross <tgross@hashicorp.com>
Co-authored-by: John Landa <john.landa@hashicorp.com>
Co-authored-by: Eric <eric@haberkorn.co>
Co-authored-by: Chris Thain <chris.m.thain@gmail.com>
Revert "Backport of NET-5530 Support response header modifiers on http-route config entry into release/1.16.x (#18725)"
This reverts commit b8a0e849832378b63732b40f6ea849b9c6c35803.
* NET-5530 Support response header modifiers on http-route config entry (#18646)
* Add response header filters to http-route config entry definitions
* Map response header filters from config entry when constructing route destination
* Support response header modifiers at the service level as well
* Update protobuf definitions
* Update existing unit tests
* Add response filters to route consolidation logic
* Make existing unit tests more robust
* Add missing docstring
* Add changelog entry
* Add response filter modifiers to existing integration test
* Add more robust testing for response header modifiers in the discovery chain
* Add more robust testing for request header modifiers in the discovery chain
* Modify test to verify that service filter modifiers take precedence over rule filter modifiers
* Generate deep-copy code
---------
Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com>
Add support for querying tokens by service name. (#18667)
Add support for querying tokens by service name
The consul-k8s endpoints controller has a workflow where it fetches all tokens.
This is not performant for large clusters, where there may be a sizable number
of tokens. This commit attempts to alleviate that problem and introduces a new
way to query by the token's service name.
* [OSS] Post Consul 1.16 updates (#17606)
* chore: update dev build to 1.17
* chore(ci): add nightly 1.16 test
Drop the oldest and add the newest running release branch to nightly
builds.
* Add writeAuditRPCEvent to agent_oss (#17607)
* Add writeAuditRPCEvent to agent_oss
* fix the other diffs
* backport change log
* Add Envoy and Consul version constraints to Envoy extensions (#17612)
* [API Gateway] Fix trust domain for external peered services in synthesis code (#17609)
* [API Gateway] Fix trust domain for external peered services in synthesis code
* Add changelog
* backport ent changes to oss (#17614)
* backport ent changes to oss
* Update .changelog/_5669.txt
Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>
---------
Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>
* Update intentions.mdx (#17619)
Make behaviour of L7 intentions clearer
* enterprise changelog update for audit (#17625)
* Update list of Envoy versions (#17546)
* [API Gateway] Fix rate limiting for API gateways (#17631)
* [API Gateway] Fix rate limiting for API gateways
* Add changelog
* Fix failing unit tests
* Fix operator usage tests for api package
* sort some imports that are wonky between oss and ent (#17637)
* PmTLS and tproxy improvements with failover and L7 traffic mgmt for k8s (#17624)
* porting over changes from enterprise repo to oss
* applied feedback on service mesh for k8s overview
* fixed typo
* removed ent-only build script file
* Apply suggestions from code review
Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>
* Apply suggestions from code review
Co-authored-by: David Yu <dyu@hashicorp.com>
Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>
---------
Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>
Co-authored-by: David Yu <dyu@hashicorp.com>
* Delete check-legacy-links-format.yml (#17647)
* docs: Reference doc updates for permissive mTLS settings (#17371)
* Reference doc updates for permissive mTLS settings
* Document config entry filtering
* Fix minor doc errors (double slashes in link url paths)
---------
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
* Add generic experiments configuration and use it to enable catalog v2 resources (#17604)
* Add generic experiments configuration and use it to enable catalog v2 resources
* Run formatting with -s as CI will validate that this has been done
* api-gateway: stop adding all header filters to virtual host when generating xDS (#17644)
* Add header filter to api-gateway xDS golden test
* Stop adding all header filters to virtual host when generating xDS for api-gateway
* Regenerate xDS golden file for api-gateway w/ header filter
* fix: add agent info reporting log (#17654)
* Add new Consul 1.16 docs (#17651)
* Merge pull request #5773 from hashicorp/docs/rate-limiting-from-ip-addresses-1.16
updated docs for rate limiting for IP addresses - 1.16
* Merge pull request #5609 from hashicorp/docs/enterprise-utilization-reporting
Add docs for enterprise utilization reporting
* Merge pull request #5734 from hashicorp/docs/envoy-ext-1.16
Docs/envoy ext 1.16
* Merge pull request #5773 from hashicorp/docs/rate-limiting-from-ip-addresses-1.16
updated docs for rate limiting for IP addresses - 1.16
* Merge pull request #5609 from hashicorp/docs/enterprise-utilization-reporting
Add docs for enterprise utilization reporting
* Merge pull request #5734 from hashicorp/docs/envoy-ext-1.16
Docs/envoy ext 1.16
* fix build errors
---------
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
* Default `ProxyType` for builtin extensions (#17657)
* Post 1.16.0-rc1 updates (#17663)
- Update changelog to include new entries from release
- Update submodule versions to latest published
* Update service-defaults.mdx (#17656)
* docs: Sameness Groups (#17628)
* port from enterprise branch
* Apply suggestions from code review
Co-authored-by: shanafarkas <105076572+shanafarkas@users.noreply.github.com>
* Update website/content/docs/connect/cluster-peering/usage/create-sameness-groups.mdx
* next steps
* Update website/content/docs/connect/cluster-peering/usage/create-sameness-groups.mdx
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
* Update website/content/docs/k8s/connect/cluster-peering/usage/create-sameness-groups.mdx
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
---------
Co-authored-by: shanafarkas <105076572+shanafarkas@users.noreply.github.com>
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
* Remove "BETA" marker from config entries (#17670)
* CAPIgw for K8s installation updates for 1.16 (#17627)
* trimmed CRD step and reqs from installation
* updated tech specs
* Apply suggestions from code review
Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>
Co-authored-by: Jeff Apple <79924108+Jeff-Apple@users.noreply.github.com>
* added upgrade instruction
* removed tcp port req
* described downtime and DT-less upgrades
* applied additional review feedback
---------
Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>
Co-authored-by: Jeff Apple <79924108+Jeff-Apple@users.noreply.github.com>
* additional feedback on API gateway upgrades (#17677)
* additional feedback
* Update website/content/docs/api-gateway/upgrades.mdx
Co-authored-by: Jeff Apple <79924108+Jeff-Apple@users.noreply.github.com>
---------
Co-authored-by: Jeff Apple <79924108+Jeff-Apple@users.noreply.github.com>
* docs: JWT Authorization for intentions (#17643)
* Initial page/nav creation
* configuration entry reference page
* Usage + fixes
* service intentions page
* usage
* description
* config entry updates
* formatting fixes
* Update website/content/docs/connect/config-entries/service-intentions.mdx
Co-authored-by: Paul Glass <pglass@hashicorp.com>
* service intentions review fixes
* Overview page review fixes
* Apply suggestions from code review
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
---------
Co-authored-by: Paul Glass <pglass@hashicorp.com>
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
* docs: minor fixes to JWT auth docs (#17680)
* Fixes
* service intentions fixes
* Fix two WAL metrics in docs/agent/telemetry.mdx (#17593)
* updated failover for k8s w-tproxy page title (#17683)
* Add release notes 1.16 rc (#17665)
* Merge pull request #5773 from hashicorp/docs/rate-limiting-from-ip-addresses-1.16
updated docs for rate limiting for IP addresses - 1.16
* Merge pull request #5609 from hashicorp/docs/enterprise-utilization-reporting
Add docs for enterprise utilization reporting
* Merge pull request #5734 from hashicorp/docs/envoy-ext-1.16
Docs/envoy ext 1.16
* Add release notes for 1.16-rc
* Add consul-e license utlization reporting
* Update with rc absolute links
* Update with rc absolute links
* fix typo
* Apply suggestions from code review
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
* Update to use callout component
* address typo
* docs: FIPS 140-2 Compliance (#17668)
* Page + nav + formatting
* link fix
* Update website/content/docs/enterprise/fips.mdx
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
* Update website/content/docs/enterprise/fips.mdx
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
* Update website/content/docs/enterprise/fips.mdx
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
* Update website/content/docs/enterprise/fips.mdx
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
* Update website/content/docs/enterprise/fips.mdx
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
* Update website/content/docs/enterprise/fips.mdx
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
* Update website/content/docs/enterprise/fips.mdx
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
* Update website/content/docs/enterprise/fips.mdx
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
* Update website/content/docs/enterprise/fips.mdx
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
* Update website/content/docs/enterprise/fips.mdx
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
* link fix
* Apply suggestions from code review
Co-authored-by: Jeff Apple <79924108+Jeff-Apple@users.noreply.github.com>
* Update website/content/docs/enterprise/fips.mdx
---------
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
Co-authored-by: Jeff Apple <79924108+Jeff-Apple@users.noreply.github.com>
* fix apigw install values file
* fix typos in release notes
---------
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>
Co-authored-by: Jeff Apple <79924108+Jeff-Apple@users.noreply.github.com>
* fix release notes links (#17687)
* adding redirects for tproxy and envoy extensions (#17688)
* adding redirects
* Apply suggestions from code review
* Fix FIPS copy (#17691)
* fix release notes links
* fix typos on fips docs
* [NET-4107][Supportability] Log Level set to TRACE and duration set to 5m for consul-debug (#17596)
* changed duration to 5 mins and log level to trace
* documentation update
* change log
* ENT merge of ext-authz extension updates (#17684)
* docs: Update default values for Envoy extension proxy types (#17676)
* fix: stop peering delete routine on leader loss (#17483)
* Refactor disco chain prioritize by locality structs (#17696)
This includes prioritize by localities on disco chain targets rather than
resolvers, allowing different targets within the same partition to have
different policies.
* agent: remove agent cache dependency from service mesh leaf certificate management (#17075)
* agent: remove agent cache dependency from service mesh leaf certificate management
This extracts the leaf cert management from within the agent cache.
This code was produced by the following process:
1. All tests in agent/cache, agent/cache-types, agent/auto-config,
agent/consul/servercert were run at each stage.
- The tests in agent matching .*Leaf were run at each stage.
- The tests in agent/leafcert were run at each stage after they
existed.
2. The former leaf cert Fetch implementation was extracted into a new
package behind a "fake RPC" endpoint to make it look almost like all
other cache type internals.
3. The old cache type was shimmed to use the fake RPC endpoint and
generally cleaned up.
4. I selectively duplicated all of Get/Notify/NotifyCallback/Prepopulate
from the agent/cache.Cache implementation over into the new package.
This was renamed as leafcert.Manager.
- Code that was irrelevant to the leaf cert type was deleted
(inlining blocking=true, refresh=false)
5. Everything that used the leaf cert cache type (including proxycfg
stuff) was shifted to use the leafcert.Manager instead.
6. agent/cache-types tests were moved and gently replumbed to execute
as-is against a leafcert.Manager.
7. Inspired by some of the locking changes from derek's branch I split
the fat lock into N+1 locks.
8. The waiter chan struct{} was eventually replaced with a
singleflight.Group around cache updates, which was likely the biggest
net structural change.
9. The awkward two layers or logic produced as a byproduct of marrying
the agent cache management code with the leaf cert type code was
slowly coalesced and flattened to remove confusion.
10. The .*Leaf tests from the agent package were copied and made to work
directly against a leafcert.Manager to increase direct coverage.
I have done a best effort attempt to port the previous leaf-cert cache
type's tests over in spirit, as well as to take the e2e-ish tests in the
agent package with Leaf in the test name and copy those into the
agent/leafcert package to get more direct coverage, rather than coverage
tangled up in the agent logic.
There is no net-new test coverage, just coverage that was pushed around
from elsewhere.
* [core]: Pin github action workflows (#17695)
* docs: missing changelog for _5517 (#17706)
* add enterprise notes for IP-based rate limits (#17711)
* add enterprise notes for IP-based rate limits
* Apply suggestions from code review
Co-authored-by: Tu Nguyen <im2nguyen@users.noreply.github.com>
Co-authored-by: David Yu <dyu@hashicorp.com>
* added bolded 'Enterprise' in list items.
---------
Co-authored-by: Tu Nguyen <im2nguyen@users.noreply.github.com>
Co-authored-by: David Yu <dyu@hashicorp.com>
* Update compatibility.mdx (#17713)
* Remove extraneous version info for Config entries (#17716)
* Update terminating-gateway.mdx
* Update exported-services.mdx
* Update mesh.mdx
* fix: typo in link to section (#17527)
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
* Bump Alpine to 3.18 (#17719)
* Update Dockerfile
* Create 17719.txt
* NET-1825: New ACL token creation docs (#16465)
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
Co-authored-by: Jared Kirschner <85913323+jkirschner-hashicorp@users.noreply.github.com>
* [NET-3865] [Supportability] Additional Information in the output of 'consul operator raft list-peers' (#17582)
* init
* fix tests
* added -detailed in docs
* added change log
* fix doc
* checking for entry in map
* fix tests
* removed detailed flag
* removed detailed flag
* revert unwanted changes
* removed unwanted changes
* updated change log
* pr review comment changes
* pr comment changes single API instead of two
* fix change log
* fix tests
* fix tests
* fix test operator raft endpoint test
* Update .changelog/17582.txt
Co-authored-by: Semir Patel <semir.patel@hashicorp.com>
* nits
* updated docs
---------
Co-authored-by: Semir Patel <semir.patel@hashicorp.com>
* OSS merge: Update error handling login when applying extensions (#17740)
* Bump atlassian/gajira-transition from 3.0.0 to 3.0.1 (#17741)
Bumps [atlassian/gajira-transition](https://github.com/atlassian/gajira-transition) from 3.0.0 to 3.0.1.
- [Release notes](https://github.com/atlassian/gajira-transition/releases)
- [Commits](4749176faf...38fc9cd61b)
---
updated-dependencies:
- dependency-name: atlassian/gajira-transition
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Add truncation to body (#17723)
* docs: Failover overview minor fix (#17743)
* Incorrect symbol
* Clarification
* slight edit for clarity
* docs - update Envoy and Dataplane compat matrix (#17752)
* Update envoy.mdx
added more detail around default versus other compatible versions
* validate localities on agent configs and registration endpoints (#17712)
* Updated docs added explanation. (#17751)
* init
* fix tests
* added -detailed in docs
* added change log
* fix doc
* checking for entry in map
* fix tests
* removed detailed flag
* removed detailed flag
* revert unwanted changes
* removed unwanted changes
* updated change log
* pr review comment changes
* pr comment changes single API instead of two
* fix change log
* fix tests
* fix tests
* fix test operator raft endpoint test
* Update .changelog/17582.txt
Co-authored-by: Semir Patel <semir.patel@hashicorp.com>
* nits
* updated docs
* explanation added
---------
Co-authored-by: Semir Patel <semir.patel@hashicorp.com>
* Update index.mdx (#17749)
* added redirects and updated links (#17764)
* Add transparent proxy enhancements changelog (#17757)
* docs - remove use of consul leave during upgrade instructions (#17758)
* Fix issue with streaming service health watches. (#17775)
Fix issue with streaming service health watches.
This commit fixes an issue where the health streams were unaware of service
export changes. Whenever an exported-services config entry is modified, it is
effectively an ACL change.
The bug would be triggered by the following situation:
- no services are exported
- an upstream watch to service X is spawned
- the streaming backend filters out data for service X (due to lack of exports)
- service X is finally exported
In the situation above, the streaming backend does not trigger a refresh of its
data. This means that any events that were supposed to have been received prior
to the export are NOT backfilled, and the watches never see service X spawning.
We currently have decided to not trigger a stream refresh in this situation due
to the potential for a thundering herd effect (touching exports would cause a
re-fetch of all watches for that partition, potentially). Therefore, a local
blocking-query approach was added by this commit for agentless.
It's also worth noting that the streaming subscription is currently bypassed
most of the time with agentful, because proxycfg has a `req.Source.Node != ""`
which prevents the `streamingEnabled` check from passing. This means that while
agents should technically have this same issue, they don't experience it with
mesh health watches.
Note that this is a temporary fix that solves the issue for proxycfg, but not
service-discovery use cases.
* Property Override validation improvements (#17759)
* Reject inbound Prop Override patch with Services
Services filtering is only supported for outbound TrafficDirection patches.
* Improve Prop Override unexpected type validation
- Guard against additional invalid parent and target types
- Add specific error handling for Any fields (unsupported)
* Fixes (#17765)
* Update license get explanation (#17782)
This PR is to clarify what happens if the license get command is run on a follower if the leader hasn't been updated with a newer license.
* Add Patch index to Prop Override validation errors (#17777)
When a patch is found invalid, include its index for easier debugging
when multiple patches are provided.
* Stop referenced jwt providers from being deleted (#17755)
* Stop referenced jwt providers from being deleted
* Implement a Catalog Controllers Lifecycle Integration Test (#17435)
* Implement a Catalog Controllers Lifecycle Integration Test
* Prevent triggering the race detector.
This allows defining some variables for protobuf constants and using those in comparisons. Without that, something internal in the fmt package ended up looking at the protobuf message size cache and triggering the race detector.
* HCP Add node id/name to config (#17750)
* Catalog V2 Container Based Integration Test (#17674)
* Implement the Catalog V2 controller integration container tests
This now allows the container tests to import things from the root module. However for now we want to be very restrictive about which packages we allow importing.
* Add an upgrade test for the new catalog
Currently this should be dormant and not executed. However its put in place to detect breaking changes in the future and show an example of how to do an upgrade test with integration tests structured like catalog v2.
* Make testutil.Retry capable of performing cleanup operations
These cleanup operations are executed after each retry attempt.
* Move TestContext to taking an interface instead of a concrete testing.T
This allows this to be used on a retry.R or generally anything that meets the interface.
* Move to using TestContext instead of background contexts
Also this forces all test methods to implement the Cleanup method now instead of that being an optional interface.
Co-authored-by: Daniel Upton <daniel@floppy.co>
* Fix Docs for Trails Leader By (#17763)
* init
* fix tests
* added -detailed in docs
* added change log
* fix doc
* checking for entry in map
* fix tests
* removed detailed flag
* removed detailed flag
* revert unwanted changes
* removed unwanted changes
* updated change log
* pr review comment changes
* pr comment changes single API instead of two
* fix change log
* fix tests
* fix tests
* fix test operator raft endpoint test
* Update .changelog/17582.txt
Co-authored-by: Semir Patel <semir.patel@hashicorp.com>
* nits
* updated docs
* explanation added
* fix doc
* fix docs
---------
Co-authored-by: Semir Patel <semir.patel@hashicorp.com>
* Improve Prop Override docs examples (#17799)
- Provide more realistics examples for setting properties not already
supported natively by Consul
- Remove superfluous commas from HCL, correct target service name, and
fix service defaults vs. proxy defaults in examples
- Align existing integration test to updated docs
* Test permissive mTLS filter chain not configured with tproxy disabled (#17747)
* Add documentation for remote debugging of integration tests. (#17800)
* Add documentation for remote debugging of integration tests.
* add link from main docs page.
* changes related to PR feedback
* Clarify limitations of Prop Override extension (#17801)
Explicitly document the limitations of the extension, particularly what
kind of fields it is capable of modifying.
* Fix formatting for webhook-certs Consul tutorial (#17810)
* Fix formatting for webhook-certs Consul tutorial
* Make a small grammar change to also pick up whitespace changes necessary for formatting
---------
Co-authored-by: David Yu <dyu@hashicorp.com>
* Add jwt-authn metrics to jwt-provider docs (#17816)
* [NET-3095] add jwt-authn metrics docs
* Change URLs for redirects from RC to default latest (#17822)
* Set GOPRIVATE for all hashicorp repos in CI (#17817)
Consistently set GOPRIVATE to include all hashicorp repos, s.t. private
modules are successfully pulled in enterprise CI.
* Make locality aware routing xDS changes (#17826)
* Fixup consul-container/test/debugging.md (#17815)
Add missing `-t` flag and fix minor typo.
* fixes#17732 - AccessorID in request body should be optional when updating ACL token (#17739)
* AccessorID in request body should be optional when updating ACL token
* add a test case
* fix test case
* add changelog entry for PR #17739
* CA provider doc updates and Vault provider minor update (#17831)
Update CA provider docs
Clarify that providers can differ between
primary and secondary datacenters
Provide a comparison chart for consul vs
vault CA providers
Loosen Vault CA provider validation for RootPKIPath
Update Vault CA provider documentation
* ext-authz Envoy extension: support `localhost` as a valid target URI. (#17821)
* CI Updates (#17834)
* Ensure that git access to private repos uses the ELEVATED_GITHUB_TOKEN
* Bump the runner size for the protobuf generation check
This has failed previously when the runner process that communicates with GitHub gets starved causing the job to fail.
* counter part of ent pr (#17618)
* watch: support -filter for consul watch: checks, services, nodes, service (#17780)
* watch: support -filter for watch checks
* Add filter for watch nodes, services, and service
- unit test added
- Add changelog
- update doc
* Trigger OSS => ENT merge for all release branches (#17853)
Previously, this only triggered for release/*.*.x branches; however, our release process involves cutting a release/1.16.0 branch, for example, at time of code freeze these days. Any PRs to that branch after code freeze today do not make their way to consul-enterprise. This will make behavior for a .0 branch consistent with current behavior for a .x branch.
* Update service-mesh.mdx (#17845)
Deleted two commas which looks quite like some leftovers.
* Add docs for sameness groups with resolvers. (#17851)
* docs: add note about path prefix matching behavior for HTTPRoute config (#17860)
* Add note about path prefix matching behavior for HTTPRoute config
* Update website/content/docs/connect/gateways/api-gateway/configuration/http-route.mdx
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
---------
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
* docs: update upgrade to consul-dataplane docs on k8s (#17852)
* resource: add `AuthorizerContext` helper method (#17393)
* resource: enforce consistent naming of resource types (#17611)
For consistency, resource type names must follow these rules:
- `Group` must be snake case, and in most cases a single word.
- `GroupVersion` must be lowercase, start with a "v" and end with a number.
- `Kind` must be pascal case.
These were chosen because they map to our protobuf type naming
conventions.
* tooling: generate protoset file (#17364)
Extends the `proto` make target to generate a protoset file for use with
grpcurl etc.
* Fix a bug that wrongly trims domains when there is an overlap with DC name (#17160)
* Fix a bug that wrongly trims domains when there is an overlap with DC name
Before this change, when DC name and domain/alt-domain overlap, the domain name incorrectly trimmed from the query.
Example:
Given: datacenter = dc-test, alt-domain = test.consul.
Querying for "test-node.node.dc-test.consul" will faile, because the
code was trimming "test.consul" instead of just ".consul"
This change, fixes the issue by adding dot (.) before trimming
* trimDomain: ensure domain trimmed without modyfing original domains
* update changelog
---------
Co-authored-by: Dhia Ayachi <dhia@hashicorp.com>
* deps: aws-sdk-go v1.44.289 (#17876)
Signed-off-by: Dan Bond <danbond@protonmail.com>
* api-gateway: add operation cannot be fulfilled error to common errors (#17874)
* add error message
* Update website/content/docs/api-gateway/usage/errors.mdx
Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com>
* fix formating issues
---------
Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com>
* api-gateway: add step to upgrade instructions for creating intentions (#17875)
* Changelog - add 1.13.9, 1.14.8, and 1.15.4 (#17889)
* docs: update config enable_debug (#17866)
* update doc for config enable_debug
* Update website/content/docs/agent/config/config-files.mdx
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
---------
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
* Update wording on WAN fed and intermediate_pki_path (#17850)
* Allow service identity tokens the ability to read jwt-providers (#17893)
* Allow service identity tokens the ability to read jwt-providers
* more tests
* service_prefix tests
* Update docs (#17476)
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
* Add emit_tags_as_labels to envoy bootstrap config when using Consul Telemetry Collector (#17888)
* Fix command from kg to kubectl get (#17903)
* Create and update release notes for 1.16 and 1.2 (#17895)
* update release notes for 1.16 and 1.2
* update latest consul core release
* Propose new changes to APIgw upgrade instructions (#17693)
* Propose new changes to APIgw upgrade instructions
* fix build error
* update callouts to render correctly
* Add hideClipboard to log messages
* Added clarification around consul k8s and crds
* Add workflow to verify linux release packages (#17904)
* adding docker files to verify linux packages.
* add verifr-release-linux.yml
* updating name
* pass inputs directly into jobs
* add other linux package platforms
* remove on push
* fix TARGETARCH on debian and ubuntu so it can check arm64 and amd64
* fixing amazon to use the continue line
* add ubuntu i386
* fix comment lines
* working
* remove commented out workflow jobs
* Apply suggestions from code review
Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com>
* update fedora and ubuntu to use latest tag
---------
Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com>
* Reference hashicorp/consul instead of consul for Docker image (#17914)
* Reference hashicorp/consul instead of consul for Docker image
* Update Make targets that pull consul directly
* Update Consul K8s Upgrade Doc Updates (#17921)
Updating upgrade procedures to encompass expected errors during upgrade process from v1.13.x to v1.14.x.
* Update sameness-group.mdx (#17915)
* Update create-sameness-groups.mdx (#17927)
* deps: coredns v1.10.1 (#17912)
* Ensure RSA keys are at least 2048 bits in length (#17911)
* Ensure RSA keys are at least 2048 bits in length
* Add changelog
* update key length check for FIPS compliance
* Fix no new variables error and failing to return when error exists from
validating
* clean up code for better readability
* actually return value
* tlsutil: Fix check TLS configuration (#17481)
* tlsutil: Fix check TLS configuration
* Rewording docs.
* Update website/content/docs/services/configuration/checks-configuration-reference.mdx
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
* Fix typos and add changelog entry.
---------
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
* docs: Deprecations for connect-native SDK and specific connect native APIs (#17937)
* Update v1_16_x.mdx
* Update connect native golang page
---------
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
* Revert "Add workflow to verify linux release packages (#17904)" (#17942)
This reverts commit 3368f14fab500ebe9f6aeab5631dd1d5f5a453e5.
* Fixes Secondary ConnectCA update (#17846)
This fixes a bug that was identified which resulted in subsequent
ConnectCA configuration update not to persist in the cluster.
* fixing typo in link to jwt-validations-with-intentions doc (#17955)
* Fix streaming backend link (#17958)
* Fix streaming backend link
* Update health.mdx
* Dynamically create jwks clusters for jwt-providers (#17944)
* website: remove deprecated agent rpc docs (#17962)
* Fix missing BalanceOutboundConnections in v2 catalog. (#17964)
* feature - [NET - 4005] - [Supportability] Reloadable Configuration - enable_debug (#17565)
* # This is a combination of 9 commits.
# This is the 1st commit message:
init without tests
# This is the commit message #2:
change log
# This is the commit message #3:
fix tests
# This is the commit message #4:
fix tests
# This is the commit message #5:
added tests
# This is the commit message #6:
change log breaking change
# This is the commit message #7:
removed breaking change
# This is the commit message #8:
fix test
# This is the commit message #9:
keeping the test behaviour same
* # This is a combination of 12 commits.
# This is the 1st commit message:
init without tests
# This is the commit message #2:
change log
# This is the commit message #3:
fix tests
# This is the commit message #4:
fix tests
# This is the commit message #5:
added tests
# This is the commit message #6:
change log breaking change
# This is the commit message #7:
removed breaking change
# This is the commit message #8:
fix test
# This is the commit message #9:
keeping the test behaviour same
# This is the commit message #10:
made enable debug atomic bool
# This is the commit message #11:
fix lint
# This is the commit message #12:
fix test true enable debug
* parent 10f500e895d92cc3691ade7b74a33db755d22039
author absolutelightning <ashesh.vidyut@hashicorp.com> 1687352587 +0530
committer absolutelightning <ashesh.vidyut@hashicorp.com> 1687352592 +0530
init without tests
change log
fix tests
fix tests
added tests
change log breaking change
removed breaking change
fix test
keeping the test behaviour same
made enable debug atomic bool
fix lint
fix test true enable debug
using enable debug in agent as atomic bool
test fixes
fix tests
fix tests
added update on correct locaiton
fix tests
fix reloadable config enable debug
fix tests
fix init and acl 403
* revert commit
* Fix formatting codeblocks on APIgw docs (#17970)
* fix formatting codeblocks
* remove unnecessary indents
* Remove POC code (#17974)
* update doc (#17910)
* update doc
* update link
* Remove duplicate and unused newDecodeConfigEntry func (#17979)
* docs: samenessGroup YAML examples (#17984)
* configuration entry syntax
* Example config
* Add changelog entry for 1.16.0 (#17987)
* Fix typo (#17198)
servcies => services
* Expose JWKS cluster config through JWTProviderConfigEntry (#17978)
* Expose JWKS cluster config through JWTProviderConfigEntry
* fix typos, rename trustedCa to trustedCA
* Integration test for ext-authz Envoy extension (#17980)
* Fix incorrect protocol for transparent proxy upstreams. (#17894)
This PR fixes a bug that was introduced in:
https://github.com/hashicorp/consul/pull/16021
A user setting a protocol in proxy-defaults would cause tproxy implicit
upstreams to not honor the upstream service's protocol set in its
`ServiceDefaults.Protocol` field, and would instead always use the
proxy-defaults value.
Due to the fact that upstreams configured with "tcp" can successfully contact
upstream "http" services, this issue was not recognized until recently (a
proxy-defaults with "tcp" and a listening service with "http" would make
successful requests, but not the opposite).
As a temporary work-around, users experiencing this issue can explicitly set
the protocol on the `ServiceDefaults.UpstreamConfig.Overrides`, which should
take precedence.
The fix in this PR removes the proxy-defaults protocol from the wildcard
upstream that tproxy uses to configure implicit upstreams. When the protocol
was included, it would always overwrite the value during discovery chain
compilation, which was not correct. The discovery chain compiler also consumes
proxy defaults to determine the protocol, so simply excluding it from the
wildcard upstream config map resolves the issue.
* feat: include nodes count in operator usage endpoint and cli command (#17939)
* feat: update operator usage api endpoint to include nodes count
* feat: update operator usange cli command to includes nodes count
* [OSS] Improve Gateway Test Coverage of Catalog Health (#18011)
* fix(cli): remove failing check from 'connect envoy' registration for api gateway
* test(integration): add tests to check catalog statsus of gateways on startup
* remove extra sleep comment
* Update test/integration/consul-container/libs/assert/service.go
* changelog
* Fixes Traffic rate limitting docs (#17997)
* Fix removed service-to-service peering links (#17221)
* docs: fix removed service-to-service peering links
* docs: extend peering-via-mesh-gateways intro (thanks @trujillo-adam)
---------
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
* docs: Sameness "beta" warning (#18017)
* Warning updates
* .x
* updated typo in tab heading (#18022)
* updated typo in tab heading
* updated tab group typo, too
* Document that DNS lookups can target cluster peers (#17990)
Static DNS lookups, in addition to explicitly targeting a datacenter,
can target a cluster peer. This was added in 95dc0c7b301b70a6b955a8b7c9737c9b86f03df6 but didn't make the documentation.
The driving function for the change is `parseLocality` here: 0b1299c28d/agent/dns_oss.go (L25)
The biggest change in this is to adjust the standard lookup syntax to tie
`.<datacenter>` to `.dc` as required-together, and to append in the similar `.<cluster-peer>.peer` optional argument, both to A record and SRV record lookups.
Co-authored-by: David Yu <dyu@hashicorp.com>
* Add first integration test for jwt auth with intention (#18005)
* fix stand-in text for name field (#18030)
* removed sameness conf entry from failover nav (#18033)
* docs - add service sync annotations and k8s service weight annotation (#18032)
* Docs for https://github.com/hashicorp/consul-k8s/pull/2293
* remove versions for enterprise features since they are old
---------
Co-authored-by: Tu Nguyen <im2nguyen@users.noreply.github.com>
* docs - add jobs use case for service mesh k8s (#18037)
* docs - add jobs use case for service mesh k8s
* add code blocks
* address feedback (#18045)
* Add verify server hostname to tls default (#17155)
* [OSS] Fix initial_fetch_timeout to wait for all xDS resources (#18024)
* fix(connect): set initial_fetch_time to wait indefinitely
* changelog
* PR feedback 1
* ui: fix typos for peer service imports (#17999)
* test: fix FIPS inline cert test message (#18076)
* Fix a couple typos in Agent Telemetry Metrics docs (#18080)
* Fix metrics docs
* Add changelog
Signed-off-by: josh <josh.timmons@hashicorp.com>
---------
Signed-off-by: josh <josh.timmons@hashicorp.com>
* docs updates - cluster peering and virtual services (#18069)
* Update route-to-virtual-services.mdx
* Update establish-peering.mdx
* Update service-mesh-compare.mdx (#17279)
grammar change
* Update helm docs on main (#18085)
* ci: use gotestsum v1.10.1 [NET-4042] (#18088)
* Docs: Update proxy lifecycle annotations and consul-dataplane flags (#18075)
* Update proxy lifecycle annotations and consul-dataplane flags
* Pass configured role name to Vault for AWS auth in Connect CA (#17885)
* Docs for dataplane upgrade on k8s (#18051)
* Docs for dataplane upgrade on k8s
---------
Co-authored-by: David Yu <dyu@hashicorp.com>
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
* docs - update upgrade index page to not recommend consul leave. (#18100)
* Displays Consul version of each nodes in UI nodes section (#17754)
* update UINodes and UINodeInfo response with consul-version info added as NodeMeta, fetched from serf members
* update test cases TestUINodes, TestUINodeInfo
* added nil check for map
* add consul-version in local agent node metadata
* get consul version from serf member and add this as node meta in catalog register request
* updated ui mock response to include consul versions as node meta
* updated ui trans and added version as query param to node list route
* updates in ui templates to display consul version with filter and sorts
* updates in ui - model class, serializers,comparators,predicates for consul version feature
* added change log for Consul Version Feature
* updated to get version from consul service, if for some reason not available from serf
* updated changelog text
* updated dependent testcases
* multiselection version filter
* Update agent/consul/state/catalog.go
comments updated
Co-authored-by: Jared Kirschner <85913323+jkirschner-hashicorp@users.noreply.github.com>
---------
Co-authored-by: Jared Kirschner <85913323+jkirschner-hashicorp@users.noreply.github.com>
* api gw 1.16 updates (#18081)
* api gw 1.16 updates
* Apply suggestions from code review
Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>
* update CodeBlockConfig filename
* Apply suggestions from code review
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>
* remove non-standard intentions page
* Update website/content/docs/api-gateway/configuration/index.mdx
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
---------
Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
* [NET-4103] ci: build s390x (#18067)
* ci: build s390x
* ci: test s390x
* ci: dev build s390x
* no GOOS
* ent only
* build: publish s390x
* fix syntax error
* fix syntax error again
* fix syntax error again x2
* test branch
* Move s390x conditionals to step level
* remove test branch
---------
Co-authored-by: emilymianeil <eneil@hashicorp.com>
* :ermahgerd "Sevice Mesh" -> "Service Mesh" (#18116)
Just a typo in the docs.
* Split pbmesh.UpstreamsConfiguration as a resource out of pbmesh.Upstreams (#17991)
Configuration that previously was inlined into the Upstreams resource
applies to both explicit and implicit upstreams and so it makes sense to
split it out into its own resource.
It also has other minor changes:
- Renames `proxy.proto` proxy_configuration.proto`
- Changes the type of `Upstream.destination_ref` from `pbresource.ID` to
`pbresource.Reference`
- Adds comments to fields that didn't have them
* [NET-4895] ci - api tests and consul container tests error because of dependency bugs with go 1.20.6. Pin go to 1.20.5. (#18124)
### Description
The following jobs started failing when go 1.20.6 was released:
- `go-test-api-1-19`
- `go-test-api-1-20`
- `compatibility-integration-tests`
- `upgrade-integration-tests`
`compatibility-integration-tests` and `compatibility-integration-tests`
to this testcontainers issue:
https://github.com/testcontainers/testcontainers-go/issues/1359. This
issue calls for testcontainers to release a new version when one of
their dependencies is fixed. When that is done, we will unpin the go
versions in `compatibility-integration-tests` and
`compatibility-integration-tests`.
### Testing & Reproduction steps
See these jobs broken in CI and then see them work with this PR.
---------
Co-authored-by: Chris Thain <32781396+cthain@users.noreply.github.com>
* Add ingress gateway deprecation notices to docs (#18102)
### Description
This adds notices, that ingress gateway is deprecated, to several places
in the product docs where ingress gateway is the topic.
### Testing & Reproduction steps
Tested with a local copy of the website.
### Links
Deprecation of ingress gateway was announced in the Release Notes for
Consul 1.16 and Consul-K8s 1.2. See:
[https://developer.hashicorp.com/consul/docs/release-notes/consul/v1_16_x#what-s-deprecated](https://developer.hashicorp.com/consul/docs/release-notes/consul/v1_16_x#what-s-deprecated
)
[https://developer.hashicorp.com/consul/docs/release-notes/consul-k8s/v1_2_x#what-s-deprecated](https://developer.hashicorp.com/consul/docs/release-notes/consul-k8s/v1_2_x#what-s-deprecated)
### PR Checklist
* [N/A] updated test coverage
* [X] external facing docs updated
* [X] appropriate backport labels added
* [X] not a security concern
---------
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
* Add docs for jwt cluster configuration (#18004)
### Description
<!-- Please describe why you're making this change, in plain English.
-->
- Add jwt-provider docs for jwks cluster configuration. The
configuration was added here:
https://github.com/hashicorp/consul/pull/17978
* Docs: fix unmatched bracket for health checks page (#18134)
* NET-4657/add resource service client (#18053)
### Description
<!-- Please describe why you're making this change, in plain English.
-->
Dan had already started on this
[task](https://github.com/hashicorp/consul/pull/17849) which is needed
to start building the HTTP APIs. This just needed some cleanup to get it
ready for review.
Overview:
- Rename `internalResourceServiceClient` to
`insecureResourceServiceClient` for name consistency
- Configure a `secureResourceServiceClient` with auth enabled
### PR Checklist
* [ ] ~updated test coverage~
* [ ] ~external facing docs updated~
* [x] appropriate backport labels added
* [ ] ~not a security concern~
* Fix bug with Vault CA provider (#18112)
Updating RootPKIPath but not IntermediatePKIPath would not update
leaf signing certs with the new root. Unsure if this happens in practice
but manual testing showed it is a bug that would break mesh and agent
connections once the old root is pruned.
* [NET-4897] net/http host header is now verified and request.host that contains socked now error (#18129)
### Description
This is related to https://github.com/hashicorp/consul/pull/18124 where
we pinned the go versions in CI to 1.20.5 and 1.19.10.
go 1.20.6 and 1.19.11 now validate request host headers for validity,
including the hostname cannot be prefixed with slashes.
For local communications (npipe://, unix://), the hostname is not used,
but we need valid and meaningful hostname. Prior versions go Go would
clean the host header, and strip slashes in the process, but go1.20.6
and go1.19.11 no longer do, and reject the host header. Around the
community we are seeing that others are intercepting the req.host and if
it starts with a slash or ends with .sock, they changing the host to
localhost or another dummy value.
[client: define a "dummy" hostname to use for local connections by
thaJeztah · Pull Request #45942 ·
moby/moby](https://github.com/moby/moby/pull/45942)
### Testing & Reproduction steps
Check CI tests.
### Links
* [ ] updated test coverage
* [ ] external facing docs updated
* [ ] appropriate backport labels added
* [ ] not a security concern
* add a conditional around setting LANFilter.AllSegments to make sure it is valid (#18139)
### Description
This is to correct a code problem because this assumes all segments, but
when you get to Enterprise, you can be in partition that is not the
default partition, in which case specifying all segments does not
validate and fails. This is to correct the setting of this filter with
`AllSegments` to `true` to only occur when in the the `default`
partition.
### Testing & Reproduction steps
<!--
* In the case of bugs, describe how to replicate
* If any manual tests were done, document the steps and the conditions
to replicate
* Call out any important/ relevant unit tests, e2e tests or integration
tests you have added or are adding
-->
### Links
<!--
Include any links here that might be helpful for people reviewing your
PR (Tickets, GH issues, API docs, external benchmarks, tools docs, etc).
If there are none, feel free to delete this section.
Please be mindful not to leak any customer or confidential information.
HashiCorp employees may want to use our internal URL shortener to
obfuscate links.
-->
### PR Checklist
* [ ] updated test coverage
* [ ] external facing docs updated
* [ ] appropriate backport labels added
* [ ] not a security concern
* chore: bump upgrade integrations tests to 1.15, 116 [NET-4743] (#18130)
* re org resource type registry (#18133)
* fix: update delegateMock used in ENT (#18149)
### Description
<!-- Please describe why you're making this change, in plain English.
-->
The mock is used in `http_ent_test` file which caused lint failures. For
OSS->ENT parity adding the same change here.
### Links
<!--
Include any links here that might be helpful for people reviewing your
PR (Tickets, GH issues, API docs, external benchmarks, tools docs, etc).
If there are none, feel free to delete this section.
Please be mindful not to leak any customer or confidential information.
HashiCorp employees may want to use our internal URL shortener to
obfuscate links.
-->
Identified in OSS->ENT [merge
PR](https://github.com/hashicorp/consul-enterprise/pull/6328)
### PR Checklist
* [ ] ~updated test coverage~
* [ ] ~external facing docs updated~
* [x] appropriate backport labels added
* [ ] ~not a security concern~
* Use JWT-auth filter in metadata mode & Delegate validation to RBAC filter (#18062)
### Description
<!-- Please describe why you're making this change, in plain English.
-->
- Currently the jwt-auth filter doesn't take into account the service
identity when validating jwt-auth, it only takes into account the path
and jwt provider during validation. This causes issues when multiple
source intentions restrict access to an endpoint with different JWT
providers.
- To fix these issues, rather than use the JWT auth filter for
validation, we use it in metadata mode and allow it to forward the
successful validated JWT token payload to the RBAC filter which will
make the decisions.
This PR ensures requests with and without JWT tokens successfully go
through the jwt-authn filter. The filter however only forwards the data
for successful/valid tokens. On the RBAC filter level, we check the
payload for claims and token issuer + existing rbac rules.
### Testing & Reproduction steps
<!--
* In the case of bugs, describe how to replicate
* If any manual tests were done, document the steps and the conditions
to replicate
* Call out any important/ relevant unit tests, e2e tests or integration
tests you have added or are adding
-->
- This test covers a multi level jwt requirements (requirements at top
level and permissions level). It also assumes you have envoy running,
you have a redis and a sidecar proxy service registered, and have a way
to generate jwks with jwt. I mostly use:
https://www.scottbrady91.com/tools/jwt for this.
- first write your proxy defaults
```
Kind = "proxy-defaults"
name = "global"
config {
protocol = "http"
}
```
- Create two providers
```
Kind = "jwt-provider"
Name = "auth0"
Issuer = "https://ronald.local"
JSONWebKeySet = {
Local = {
JWKS = "eyJrZXlzIjog....."
}
}
```
```
Kind = "jwt-provider"
Name = "okta"
Issuer = "https://ronald.local"
JSONWebKeySet = {
Local = {
JWKS = "eyJrZXlzIjogW3...."
}
}
```
- add a service intention
```
Kind = "service-intentions"
Name = "redis"
JWT = {
Providers = [
{
Name = "okta"
},
]
}
Sources = [
{
Name = "*"
Permissions = [{
Action = "allow"
HTTP = {
PathPrefix = "/workspace"
}
JWT = {
Providers = [
{
Name = "okta"
VerifyClaims = [
{
Path = ["aud"]
Value = "my_client_app"
},
{
Path = ["sub"]
Value = "5be86359073c434bad2da3932222dabe"
}
]
},
]
}
},
{
Action = "allow"
HTTP = {
PathPrefix = "/"
}
JWT = {
Providers = [
{
Name = "auth0"
},
]
}
}]
}
]
```
- generate 3 jwt tokens: 1 from auth0 jwks, 1 from okta jwks with
different claims than `/workspace` expects and 1 with correct claims
- connect to your envoy (change service and address as needed) to view
logs and potential errors. You can add: `-- --log-level debug` to see
what data is being forwarded
```
consul connect envoy -sidecar-for redis1 -grpc-addr 127.0.0.1:8502
```
- Make the following requests:
```
curl -s -H "Authorization: Bearer $Auth0_TOKEN" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v
RBAC filter denied
curl -s -H "Authorization: Bearer $Okta_TOKEN_with_wrong_claims" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v
RBAC filter denied
curl -s -H "Authorization: Bearer $Okta_TOKEN_with_correct_claims" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v
Successful request
```
### TODO
* [x] Update test coverage
* [ ] update integration tests (follow-up PR)
* [x] appropriate backport labels added
* Support Consul Connect Envoy Command on Windows (#17694)
### Description
Add support for consul connect envoy command on windows. This PR fixes
the comments of PR - https://github.com/hashicorp/consul/pull/15114
### Testing
* Built consul.exe from this branch on windows and hosted here - [AWS
S3](https://asheshvidyut-bucket.s3.ap-southeast-2.amazonaws.com/consul.zip)
* Updated the
[tutorial](https://developer.hashicorp.com/consul/tutorials/developer-mesh/consul-windows-workloads)
and changed the `consul_url.default` value to [AWS
S3](https://asheshvidyut-bucket.s3.ap-southeast-2.amazonaws.com/consul.zip)
* Followed the steps in the tutorial and verified that everything is
working as described.
### PR Checklist
* [x] updated test coverage
* [ ] external facing docs updated
* [x] appropriate backport labels added
* [x] not a security concern
---------
Co-authored-by: Franco Bruno Lavayen <cocolavayen@gmail.com>
Co-authored-by: Jose Ignacio Lorenzo <74208929+joselo85@users.noreply.github.com>
Co-authored-by: Jose Ignacio Lorenzo <joseignaciolorenzo85@gmail.com>
Co-authored-by: Dhia Ayachi <dhia@hashicorp.com>
* Change docs to say 168h instead of 7d for server_rejoin_age_max (#18154)
### Description
Addresses
https://github.com/hashicorp/consul/pull/17171#issuecomment-1636930705
* [OSS] test: improve xDS listener code coverage (#18138)
test: improve xDS listener code coverage
* Re-order expected/actual for assertContainerState in consul container tests (#18157)
Re-order expected/actual, consul container tests
* group and document make file (#17943)
* group and document make file
* Add `testing/deployer` (neé `consul-topology`) [NET-4610] (#17823)
Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>
Co-authored-by: R.B. Boyer <rb@hashicorp.com>
Co-authored-by: Freddy <freddygv@users.noreply.github.com>
* [NET-4792] Add integrations tests for jwt-auth (#18169)
* Add FIPS reference to consul enterprise docs (#18028)
* Add FIPS reference to consul enterprise docs
* Update website/content/docs/enterprise/index.mdx
Co-authored-by: David Yu <dyu@hashicorp.com>
* remove support for ecs client (fips)
---------
Co-authored-by: David Yu <dyu@hashicorp.com>
* add peering_commontopo tests [NET-3700] (#17951)
Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>
Co-authored-by: R.B. Boyer <rb@hashicorp.com>
Co-authored-by: Freddy <freddygv@users.noreply.github.com>
Co-authored-by: NiniOak <anita.akaeze@hashicorp.com>
* docs - remove Sentinel from enterprise features list (#18176)
* Update index.mdx
* Update kv.mdx
* Update docs-nav-data.json
* delete sentinel.mdx
* Update redirects.js
---------
Co-authored-by: Tu Nguyen <im2nguyen@users.noreply.github.com>
* [NET-4865] Bump golang.org/x/net to 0.12.0 (#18186)
Bump golang.org/x/net to 0.12.0
While not necessary to directly address CVE-2023-29406 (which should be
handled by using a patched version of Go when building), an
accompanying change to HTTP/2 error handling does impact agent code.
See https://go-review.googlesource.com/c/net/+/506995 for the HTTP/2
change.
Bump this dependency across our submodules as well for the sake of
potential indirect consumers of `x/net/http`.
* Call resource mutate hook before validate hook (NET-4907) (#18178)
* [NET-4865] security: Update Go version to 1.20.6 (#18190)
Update Go version to 1.20.6
This resolves [CVE-2023-29406]
(https://nvd.nist.gov/vuln/detail/CVE-2023-29406) for uses of the
`net/http` standard library.
Note that until the follow-up to #18124 is done, the version of Go used
in those impacted tests will need to remain on 1.20.5.
* Improve XDS test coverage: JWT auth edition (#18183)
* Improve XDS test coverage: JWT auth edition
more tests
* test: xds coverage for jwt listeners
---------
Co-authored-by: DanStough <dan.stough@hashicorp.com>
* update readme.md (#18191)
u[date readme.md
* Update submodules to latest following 1.16.0 (#18197)
Align all our internal use of submodules on the latest versions.
* SEC-090: Automated trusted workflow pinning (2023-07-18) (#18174)
Result of tsccr-helper -log-level=info -pin-all-workflows .
Co-authored-by: hashicorp-tsccr[bot] <hashicorp-tsccr[bot]@users.noreply.github.com>
* Fix Backport Assistant PR commenting (#18200)
* Fix Backport Assistant failure PR commenting
For general comments on a PR, it looks like you have to use the `/issue`
endpoint rather than `/pulls`, which requires commit/other
review-specific target details.
This matches the endpoint used in `backport-reminder.yml`.
* Remove Backport Reminder workflow
This is noisy (even when adding multiple labels, individual comments per
label are generated), and likely no longer needed: we haven't had this
work in a long time due to an expired GH token, and we now have better
automation for backport PR assignment.
* resource: Pass resource to Write ACL hook instead of just resource Id [NET-4908] (#18192)
* Explicitly enable WebSocket upgrades (#18150)
This PR explicitly enables WebSocket upgrades in Envoy's UpgradeConfig for all
proxy types. (API Gateway, Ingress, and Sidecar.)
Fixes#8283
* docs: fix the description of client rpc (#18206)
* NET-4804: Add dashboard for monitoring consul-k8s (#18208)
* [OSS] Improve xDS Code Coverage - Clusters (#18165)
test: improve xDS cluster code coverage
* NET-4222 take config file consul container (#18218)
Net 4222 take config file consul container
* Envoy Integration Test Windows (#18007)
* [CONSUL-395] Update check_hostport and Usage (#40)
* [CONSUL-397] Copy envoy binary from Image (#41)
* [CONSUL-382] Support openssl in unique test dockerfile (#43)
* [CONSUL-405] Add bats to single container (#44)
* [CONSUL-414] Run Prometheus Test Cases and Validate Changes (#46)
* [CONSUL-410] Run Jaeger in Single container (#45)
* [CONSUL-412] Run test-sds-server in single container (#48)
* [CONSUL-408] Clean containers (#47)
* [CONSUL-384] Rebase and sync fork (#50)
* [CONSUL-415] Create Scenarios Troubleshooting Docs (#49)
* [CONSUL-417] Update Docs Single Container (#51)
* [CONSUL-428] Add Socat to single container (#54)
* [CONSUL-424] Replace pkill in kill_envoy function (#52)
* [CONSUL-434] Modify Docker run functions in Helper script (#53)
* [CONSUL-435] Replace docker run in set_ttl_check_state & wait_for_agent_service_register functions (#55)
* [CONSUL-438] Add netcat (nc) in the Single container Dockerfile (#56)
* [CONSUL-429] Replace Docker run with Docker exec (#57)
* [CONSUL-436] Curl timeout and run tests (#58)
* [CONSUL-443] Create dogstatsd Function (#59)
* [CONSUL-431] Update Docs Netcat (#60)
* [CONSUL-439] Parse nc Command in function (#61)
* [CONSUL-463] Review curl Exec and get_ca_root Func (#63)
* [CONSUL-453] Docker hostname in Helper functions (#64)
* [CONSUL-461] Test wipe volumes without extra cont (#66)
* [CONSUL-454] Check ports in the Server and Agent containers (#65)
* [CONSUL-441] Update windows dockerfile with version (#62)
* [CONSUL-466] Review case-grpc Failing Test (#67)
* [CONSUL-494] Review case-cfg-resolver-svc-failover (#68)
* [CONSUL-496] Replace docker_wget & docker_curl (#69)
* [CONSUL-499] Cleanup Scripts - Remove nanoserver (#70)
* [CONSUL-500] Update Troubleshooting Docs (#72)
* [CONSUL-502] Pull & Tag Envoy Windows Image (#73)
* [CONSUL-504] Replace docker run in docker_consul (#76)
* [CONSUL-505] Change admin_bind
* [CONSUL-399] Update envoy to 1.23.1 (#78)
* [CONSUL-510] Support case-wanfed-gw on Windows (#79)
* [CONSUL-506] Update troubleshooting Documentation (#80)
* [CONSUL-512] Review debug_dump_volumes Function (#81)
* [CONSUL-514] Add zipkin to Docker Image (#82)
* [CONSUL-515] Update Documentation (#83)
* [CONSUL-529] Support case-consul-exec (#86)
* [CONSUL-530] Update Documentation (#87)
* [CONSUL-530] Update default consul version 1.13.3
* [CONSUL-539] Cleanup (#91)
* [CONSUL-546] Scripts Clean-up (#92)
* [CONSUL-491] Support admin_access_log_path value for Windows (#71)
* [CONSUL-519] Implement mkfifo Alternative (#84)
* [CONSUL-542] Create OS Specific Files for Envoy Package (#88)
* [CONSUL-543] Create exec_supported.go (#89)
* [CONSUL-544] Test and Build Changes (#90)
* Implement os.DevNull
* using mmap instead of disk files
* fix import in exec-unix
* fix nmap open too many arguemtn
* go fmt on file
* changelog file
* fix go mod
* Update .changelog/17694.txt
Co-authored-by: Dhia Ayachi <dhia@hashicorp.com>
* different mmap library
* fix bootstrap json
* some fixes
* chocolatey version fix and image fix
* using different library
* fix Map funciton call
* fix mmap call
* fix tcp dump
* fix tcp dump
* windows tcp dump
* Fix docker run
* fix tests
* fix go mod
* fix version 16.0
* fix version
* fix version dev
* sleep to debug
* fix sleep
* fix permission issue
* fix permission issue
* fix permission issue
* fix command
* fix command
* fix funciton
* fix assert config entry status command not found
* fix command not found assert_cert_has_cn
* fix command not found assert_upstream_missing
* fix command not found assert_upstream_missing_once
* fix command not found get_upstream_endpoint
* fix command not found get_envoy_public_listener_once
* fix command not found
* fix test cases
* windows integration test workflow github
* made code similar to unix using npipe
* fix go.mod
* fix dialing of npipe
* dont wait
* check size of written json
* fix undefined n
* running
* fix dep
* fix syntax error
* fix workflow file
* windows runner
* fix runner
* fix from json
* fix runs on
* merge connect envoy
* fix cin path
* build
* fix file name
* fix file name
* fix dev build
* remove unwanted code
* fix upload
* fix bin name
* fix path
* checkout current branch
* fix path
* fix tests
* fix shell bash for windows sh files
* fix permission of run-test.sh
* removed docker dev
* added shell bash for tests
* fix tag
* fix win=true
* fix cd
* added dev
* fix variable undefined
* removed failing tests
* fix tcp dump image
* fix curl
* fix curl
* tcp dump path
* fix tcpdump path
* fix curl
* fix curl install
* stop removing intermediate containers
* fix tcpdump docker image
* revert -rm
* --rm=false
* makeing docker image before
* fix tcpdump
* removed case consul exec
* removed terminating gateway simple
* comment case wasm
* removed data dog
* comment out upload coverage
* uncomment case-consul-exec
* comment case consul exec
* if always
* logs
* using consul 1.17.0
* fix quotes
* revert quotes
* redirect to dev null
* Revert version
* revert consul connect
* fix version
* removed envoy connect
* not using function
* change log
* docker logs
* fix logs
* restructure bad authz
* rmeoved dev null
* output
* fix file descriptor
* fix cacert
* fix cacert
* fix ca cert
* cacert does not work in windows curl
* fix func
* removed docker logs
* added sleep
* fix tls
* commented case-consul-exec
* removed echo
* retry docker consul
* fix upload bin
* uncomment consul exec
* copying consul.exe to docker image
* copy fix
* fix paths
* fix path
* github workspace path
* latest version
* Revert "latest version"
This reverts commit 5a7d7b82d9e7553bcb01b02557ec8969f9deba1d.
* commented consul exec
* added ssl revoke best effort
* revert best effort
* removed unused files
* rename var name and change dir
* windows runner
* permission
* needs setup fix
* swtich to github runner
* fix file path
* fix path
* fix path
* fix path
* fix path
* fix path
* fix build paths
* fix tag
* nightly runs
* added matrix in github workflow, renamed files
* fix job
* fix matrix
* removed brackes
* from json
* without using job matrix
* fix quotes
* revert job matrix
* fix workflow
* fix comment
* added comment
* nightly runs
* removed datadog ci as it is already measured in linux one
* running test
* Revert "running test"
This reverts commit 7013d15a23732179d18ec5d17336e16b26fab5d4.
* pr comment fixes
* running test now
* running subset of test
* running subset of test
* job matrix
* shell bash
* removed bash shell
* linux machine for job matrix
* fix output
* added cat to debug
* using ubuntu latest
* fix job matrix
* fix win true
* fix go test
* revert job matrix
---------
Co-authored-by: Jose Ignacio Lorenzo <74208929+joselo85@users.noreply.github.com>
Co-authored-by: Franco Bruno Lavayen <cocolavayen@gmail.com>
Co-authored-by: Ivan K Berlot <ivanberlot@gmail.com>
Co-authored-by: Ezequiel Fernández Ponce <20102608+ezfepo@users.noreply.github.com>
Co-authored-by: joselo85 <joseignaciolorenzo85@gmail.com>
Co-authored-by: Ezequiel Fernández Ponce <ezequiel.fernandez@southworks.com>
Co-authored-by: Dhia Ayachi <dhia@hashicorp.com>
* fix typos and update ecs compat table (#18215)
* fix typos and update ecs compat table
* real info for the ecs compat matrix table
* Update website/content/docs/ecs/compatibility.mdx
Co-authored-by: Chris Thain <32781396+cthain@users.noreply.github.com>
---------
Co-authored-by: Chris Thain <32781396+cthain@users.noreply.github.com>
* [OSS] proxystate: add proxystate protos (#18216)
* proxystate: add proxystate protos to pbmesh and resolve imports and conflicts between message names
* ci: don't verify s390x (#18224)
* [CC-5718] Remove HCP token requirement during bootstrap (#18140)
* [CC-5718] Remove HCP token requirement during bootstrap
* Re-add error for loading HCP management token
* Remove old comment
* Add changelog entry
* Remove extra validation line
* Apply suggestions from code review
Co-authored-by: lornasong <lornasong@users.noreply.github.com>
---------
Co-authored-by: lornasong <lornasong@users.noreply.github.com>
* [NET-4122] Doc guidance for federation with externalServers (#18207)
Doc guidance for federation with externalServers
Add guidance for proper configuration when joining to a secondary
cluster using WAN fed with external servers also enabled.
Also clarify federation requirements and fix formatting for an
unrelated value.
Update both the Helm chart reference (synced from `consul-k8s`, see
hashicorp/consul-k8s#2583) and the docs on using `externalServers`.
* [OSS] Improve xDS Code Coverage - Endpoints and Misc (#18222)
test: improve xDS endpoints code coverage
* Clarify license reporting timing and GDPR compliance (#18237)
Add Alicia's edits to clarify log timing and other details
* Fix Github Workflow File (#18241)
* [CONSUL-382] Support openssl in unique test dockerfile (#43)
* [CONSUL-405] Add bats to single container (#44)
* [CONSUL-414] Run Prometheus Test Cases and Validate Changes (#46)
* [CONSUL-410] Run Jaeger in Single container (#45)
* [CONSUL-412] Run test-sds-server in single container (#48)
* [CONSUL-408] Clean containers (#47)
* [CONSUL-384] Rebase and sync fork (#50)
* [CONSUL-415] Create Scenarios Troubleshooting Docs (#49)
* [CONSUL-417] Update Docs Single Container (#51)
* [CONSUL-428] Add Socat to single container (#54)
* [CONSUL-424] Replace pkill in kill_envoy function (#52)
* [CONSUL-434] Modify Docker run functions in Helper script (#53)
* [CONSUL-435] Replace docker run in set_ttl_check_state & wait_for_agent_service_register functions (#55)
* [CONSUL-438] Add netcat (nc) in the Single container Dockerfile (#56)
* [CONSUL-429] Replace Docker run with Docker exec (#57)
* [CONSUL-436] Curl timeout and run tests (#58)
* [CONSUL-443] Create dogstatsd Function (#59)
* [CONSUL-431] Update Docs Netcat (#60)
* [CONSUL-439] Parse nc Command in function (#61)
* [CONSUL-463] Review curl Exec and get_ca_root Func (#63)
* [CONSUL-453] Docker hostname in Helper functions (#64)
* [CONSUL-461] Test wipe volumes without extra cont (#66)
* [CONSUL-454] Check ports in the Server and Agent containers (#65)
* [CONSUL-441] Update windows dockerfile with version (#62)
* [CONSUL-466] Review case-grpc Failing Test (#67)
* [CONSUL-494] Review case-cfg-resolver-svc-failover (#68)
* [CONSUL-496] Replace docker_wget & docker_curl (#69)
* [CONSUL-499] Cleanup Scripts - Remove nanoserver (#70)
* [CONSUL-500] Update Troubleshooting Docs (#72)
* [CONSUL-502] Pull & Tag Envoy Windows Image (#73)
* [CONSUL-504] Replace docker run in docker_consul (#76)
* [CONSUL-505] Change admin_bind
* [CONSUL-399] Update envoy to 1.23.1 (#78)
* [CONSUL-510] Support case-wanfed-gw on Windows (#79)
* [CONSUL-506] Update troubleshooting Documentation (#80)
* [CONSUL-512] Review debug_dump_volumes Function (#81)
* [CONSUL-514] Add zipkin to Docker Image (#82)
* [CONSUL-515] Update Documentation (#83)
* [CONSUL-529] Support case-consul-exec (#86)
* [CONSUL-530] Update Documentation (#87)
* [CONSUL-530] Update default consul version 1.13.3
* [CONSUL-539] Cleanup (#91)
* [CONSUL-546] Scripts Clean-up (#92)
* [CONSUL-491] Support admin_access_log_path value for Windows (#71)
* [CONSUL-519] Implement mkfifo Alternative (#84)
* [CONSUL-542] Create OS Specific Files for Envoy Package (#88)
* [CONSUL-543] Create exec_supported.go (#89)
* [CONSUL-544] Test and Build Changes (#90)
* Implement os.DevNull
* using mmap instead of disk files
* fix import in exec-unix
* fix nmap open too many arguemtn
* go fmt on file
* changelog file
* fix go mod
* Update .changelog/17694.txt
Co-authored-by: Dhia Ayachi <dhia@hashicorp.com>
* different mmap library
* fix bootstrap json
* some fixes
* chocolatey version fix and image fix
* using different library
* fix Map funciton call
* fix mmap call
* fix tcp dump
* fix tcp dump
* windows tcp dump
* Fix docker run
* fix tests
* fix go mod
* fix version 16.0
* fix version
* fix version dev
* sleep to debug
* fix sleep
* fix permission issue
* fix permission issue
* fix permission issue
* fix command
* fix command
* fix funciton
* fix assert config entry status command not found
* fix command not found assert_cert_has_cn
* fix command not found assert_upstream_missing
* fix command not found assert_upstream_missing_once
* fix command not found get_upstream_endpoint
* fix command not found get_envoy_public_listener_once
* fix command not found
* fix test cases
* windows integration test workflow github
* made code similar to unix using npipe
* fix go.mod
* fix dialing of npipe
* dont wait
* check size of written json
* fix undefined n
* running
* fix dep
* fix syntax error
* fix workflow file
* windows runner
* fix runner
* fix from json
* fix runs on
* merge connect envoy
* fix cin path
* build
* fix file name
* fix file name
* fix dev build
* remove unwanted code
* fix upload
* fix bin name
* fix path
* checkout current branch
* fix path
* fix tests
* fix shell bash for windows sh files
* fix permission of run-test.sh
* removed docker dev
* added shell bash for tests
* fix tag
* fix win=true
* fix cd
* added dev
* fix variable undefined
* removed failing tests
* fix tcp dump image
* fix curl
* fix curl
* tcp dump path
* fix tcpdump path
* fix curl
* fix curl install
* stop removing intermediate containers
* fix tcpdump docker image
* revert -rm
* --rm=false
* makeing docker image before
* fix tcpdump
* removed case consul exec
* removed terminating gateway simple
* comment case wasm
* removed data dog
* comment out upload coverage
* uncomment case-consul-exec
* comment case consul exec
* if always
* logs
* using consul 1.17.0
* fix quotes
* revert quotes
* redirect to dev null
* Revert version
* revert consul connect
* fix version
* removed envoy connect
* not using function
* change log
* docker logs
* fix logs
* restructure bad authz
* rmeoved dev null
* output
* fix file descriptor
* fix cacert
* fix cacert
* fix ca cert
* cacert does not work in windows curl
* fix func
* removed docker logs
* added sleep
* fix tls
* commented case-consul-exec
* removed echo
* retry docker consul
* fix upload bin
* uncomment consul exec
* copying consul.exe to docker image
* copy fix
* fix paths
* fix path
* github workspace path
* latest version
* Revert "latest version"
This reverts commit 5a7d7b82d9e7553bcb01b02557ec8969f9deba1d.
* commented consul exec
* added ssl revoke best effort
* revert best effort
* removed unused files
* rename var name and change dir
* windows runner
* permission
* needs setup fix
* swtich to github runner
* fix file path
* fix path
* fix path
* fix path
* fix path
* fix path
* fix build paths
* fix tag
* nightly runs
* added matrix in github workflow, renamed files
* fix job
* fix matrix
* removed brackes
* from json
* without using job matrix
* fix quotes
* revert job matrix
* fix workflow
* fix comment
* added comment
* nightly runs
* removed datadog ci as it is already measured in linux one
* running test
* Revert "running test"
This reverts commit 7013d15a23732179d18ec5d17336e16b26fab5d4.
* pr comment fixes
* running test now
* running subset of test
* running subset of test
* job matrix
* shell bash
* removed bash shell
* linux machine for job matrix
* fix output
* added cat to debug
* using ubuntu latest
* fix job matrix
* fix win true
* fix go test
* revert job matrix
* Fix tests
---------
Co-authored-by: Ivan K Berlot <ivanberlot@gmail.com>
Co-authored-by: Jose Ignacio Lorenzo <74208929+joselo85@users.noreply.github.com>
Co-authored-by: Franco Bruno Lavayen <cocolavayen@gmail.com>
Co-authored-by: Ezequiel Fernández Ponce <20102608+ezfepo@users.noreply.github.com>
Co-authored-by: joselo85 <joseignaciolorenzo85@gmail.com>
Co-authored-by: Ezequiel Fernández Ponce <ezequiel.fernandez@southworks.com>
Co-authored-by: Dhia Ayachi <dhia@hashicorp.com>
* NET-4996 - filter go-tests and test-integration workflows from running on docs only and ui only changes (#18236)
* Align build arch matrix with enterprise (#18235)
Ensure that OSS remains in sync w/ Enterprise by aligning the format of
arch matrix args for various build jobs.
* Revert "NET-4996 - filter go-tests and test-integration workflows from running on docs only and ui only changes" (#18248)
Revert "NET-4996 - filter go-tests and test-integration workflows from running on docs only and ui only changes (#18236)"
This reverts commit a11dba710e6ce6f172c0fa6c9b61567cc1efffc8.
* resource: Add scope to resource type registration [NET-4976] (#18214)
Enables querying a resource type's registration to determine if a resource is cluster, partition, or partition and namespace scoped.
* Fix some inconsistencies in jwt docs (#18234)
* NET-1825: More new ACL token creation docs (#18063)
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
* [CC-5719] Add support for builtin global-read-only policy
* Add changelog
* Add read-only to docs
* Fix some minor issues.
* Change from ReplaceAll to Sprintf
* Change IsValidPolicy name to return an error instead of bool
* Fix PolicyList test
* Fix other tests
* Apply suggestions from code review
Co-authored-by: Paul Glass <pglass@hashicorp.com>
* Fix state store test for policy list.
* Fix naming issues
* Update acl/validation.go
Co-authored-by: Chris Thain <32781396+cthain@users.noreply.github.com>
* backport of commit d63fa5481dc02c6faae7cc2647b4073b3286af1d
* backport of commit 3d099a6ed8ed10b6dc464c466cb1668914db8f08
---------
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Dan Bond <danbond@protonmail.com>
Signed-off-by: josh <josh.timmons@hashicorp.com>
Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>
Co-authored-by: Ronald <roncodingenthusiast@users.noreply.github.com>
Co-authored-by: Eric Haberkorn <erichaberkorn@gmail.com>
Co-authored-by: Andrew Stucki <andrew.stucki@hashicorp.com>
Co-authored-by: Luke Kysow <1034429+lkysow@users.noreply.github.com>
Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>
Co-authored-by: David Yu <dyu@hashicorp.com>
Co-authored-by: Bryce Kalow <bkalow@hashicorp.com>
Co-authored-by: Paul Glass <pglass@hashicorp.com>
Co-authored-by: Matt Keeler <mkeeler@users.noreply.github.com>
Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com>
Co-authored-by: Poonam Jadhav <poonam.jadhav@hashicorp.com>
Co-authored-by: Tu Nguyen <im2nguyen@users.noreply.github.com>
Co-authored-by: Chris Thain <32781396+cthain@users.noreply.github.com>
Co-authored-by: Hariram Sankaran <56744845+ramramhariram@users.noreply.github.com>
Co-authored-by: shanafarkas <105076572+shanafarkas@users.noreply.github.com>
Co-authored-by: Thomas Eckert <teckert@hashicorp.com>
Co-authored-by: Jeff Apple <79924108+Jeff-Apple@users.noreply.github.com>
Co-authored-by: Joshua Timmons <josh.timmons@hashicorp.com>
Co-authored-by: Ashesh Vidyut <134911583+absolutelightning@users.noreply.github.com>
Co-authored-by: Dan Stough <dan.stough@hashicorp.com>
Co-authored-by: Curt Bushko <cbushko@gmail.com>
Co-authored-by: Tobias Birkefeld <t@craxs.de>
Co-authored-by: Jared Kirschner <85913323+jkirschner-hashicorp@users.noreply.github.com>
Co-authored-by: Semir Patel <semir.patel@hashicorp.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: chappie <6537530+chapmanc@users.noreply.github.com>
Co-authored-by: Derek Menteer <105233703+hashi-derek@users.noreply.github.com>
Co-authored-by: John Murret <john.murret@hashicorp.com>
Co-authored-by: Mark Campbell-Vincent <mnmvincent@gmail.com>
Co-authored-by: Daniel Upton <daniel@floppy.co>
Co-authored-by: Steven Zamborsky <97125550+stevenzamborsky@users.noreply.github.com>
Co-authored-by: George Bolo <george.bolo@gmail.com>
Co-authored-by: Chris S. Kim <ckim@hashicorp.com>
Co-authored-by: wangxinyi7 <121973291+wangxinyi7@users.noreply.github.com>
Co-authored-by: cskh <hui.kang@hashicorp.com>
Co-authored-by: V. K <cn007b@gmail.com>
Co-authored-by: Iryna Shustava <ishustava@users.noreply.github.com>
Co-authored-by: Alex Simenduev <shamil.si@gmail.com>
Co-authored-by: Dhia Ayachi <dhia@hashicorp.com>
Co-authored-by: Dan Bond <danbond@protonmail.com>
Co-authored-by: sarahalsmiller <100602640+sarahalsmiller@users.noreply.github.com>
Co-authored-by: Gerard Nguyen <gerard@hashicorp.com>
Co-authored-by: mr-miles <miles.waller@gmail.com>
Co-authored-by: natemollica-dev <57850649+natemollica-nm@users.noreply.github.com>
Co-authored-by: John Maguire <john.maguire@hashicorp.com>
Co-authored-by: Samantha <hello@entropy.cat>
Co-authored-by: Ranjandas <thejranjan@gmail.com>
Co-authored-by: Evan Phoenix <evan@phx.io>
Co-authored-by: Michael Hofer <karras@users.noreply.github.com>
Co-authored-by: J.C. Jones <james.jc.jones@gmail.com>
Co-authored-by: Fulvio <fulviodenza823@gmail.com>
Co-authored-by: Krastin Krastev <krastin@hashicorp.com>
Co-authored-by: david3a <49253132+david3a@users.noreply.github.com>
Co-authored-by: Nick Irvine <115657443+nfi-hashicorp@users.noreply.github.com>
Co-authored-by: Tom Davies <tom@t-davies.com>
Co-authored-by: Vijay <vijayraghav22@gmail.com>
Co-authored-by: Eddie Rowe <74205376+eddie-rowe@users.noreply.github.com>
Co-authored-by: emilymianeil <eneil@hashicorp.com>
Co-authored-by: nv-hashi <80716011+nv-hashi@users.noreply.github.com>
Co-authored-by: Franco Bruno Lavayen <cocolavayen@gmail.com>
Co-authored-by: Jose Ignacio Lorenzo <74208929+joselo85@users.noreply.github.com>
Co-authored-by: Jose Ignacio Lorenzo <joseignaciolorenzo85@gmail.com>
Co-authored-by: R.B. Boyer <rb@hashicorp.com>
Co-authored-by: Freddy <freddygv@users.noreply.github.com>
Co-authored-by: NiniOak <anita.akaeze@hashicorp.com>
Co-authored-by: hashicorp-tsccr[bot] <129506189+hashicorp-tsccr[bot]@users.noreply.github.com>
Co-authored-by: hashicorp-tsccr[bot] <hashicorp-tsccr[bot]@users.noreply.github.com>
Co-authored-by: Blake Covarrubias <blake@covarrubi.as>
Co-authored-by: Ivan K Berlot <ivanberlot@gmail.com>
Co-authored-by: Ezequiel Fernández Ponce <20102608+ezfepo@users.noreply.github.com>
Co-authored-by: Ezequiel Fernández Ponce <ezequiel.fernandez@southworks.com>
Co-authored-by: Nitya Dhanushkodi <nitya@hashicorp.com>
Co-authored-by: Jeremy Jacobson <jjacobson93@users.noreply.github.com>
Co-authored-by: lornasong <lornasong@users.noreply.github.com>
Co-authored-by: Judith Malnick <judith@hashicorp.com>
Co-authored-by: Jeremy Jacobson <jeremy.jacobson@hashicorp.com>
Update submodules to latest following 1.16.0
Align all our internal use of submodules on the latest versions.
Manual backport of 235d9c5ca5bccdad2e853f0ac052e25efdef1ca5.
Bump golang.org/x/net to 0.12.0
While not necessary to directly address CVE-2023-29406 (which should be
handled by using a patched version of Go when building), an
accompanying change to HTTP/2 error handling does impact agent code.
See https://go-review.googlesource.com/c/net/+/506995 for the HTTP/2
change.
Bump this dependency across our submodules as well for the sake of
potential indirect consumers of `x/net/http`.
Manual backport of 84cbf09185ebfc59f9fcf486d1c4983ef129bf95.
add `omitempty` to api prepared query targets
Manual backport of c2bbe67714ee7c603447e18c25ad391b8de6226e.
Co-authored-by: Nick Irvine <115657443+nfi-hashicorp@users.noreply.github.com>
* no-op commit due to failed cherry-picking
* [NET-4897] net/http host header is now verified and request.host that contains socked now error (#18129)
### Description
This is related to https://github.com/hashicorp/consul/pull/18124 where
we pinned the go versions in CI to 1.20.5 and 1.19.10.
go 1.20.6 and 1.19.11 now validate request host headers for validity,
including the hostname cannot be prefixed with slashes.
For local communications (npipe://, unix://), the hostname is not used,
but we need valid and meaningful hostname. Prior versions go Go would
clean the host header, and strip slashes in the process, but go1.20.6
and go1.19.11 no longer do, and reject the host header. Around the
community we are seeing that others are intercepting the req.host and if
it starts with a slash or ends with .sock, they changing the host to
localhost or another dummy value.
[client: define a "dummy" hostname to use for local connections by
thaJeztah · Pull Request #45942 ·
moby/moby](https://github.com/moby/moby/pull/45942)
### Testing & Reproduction steps
Check CI tests.
### Links
* [ ] updated test coverage
* [ ] external facing docs updated
* [ ] appropriate backport labels added
* [ ] not a security concern
---------
Co-authored-by: temp <temp@hashicorp.com>
Co-authored-by: John Murret <john.murret@hashicorp.com>
## Backport
This PR is auto-generated from #17754 to be assessed for backporting due
to the inclusion of the label backport/1.16.
🚨
>**Warning** automatic cherry-pick of commits failed. If the first
commit failed,
you will see a blank no-op commit below. If at least one commit
succeeded, you
will see the cherry-picked commits up to, _not including_, the commit
where
the merge conflict occurred.
The person who merged in the original PR is:
@WenInCode
This person should manually cherry-pick the original PR into a new
backport PR,
and close this one when the manual backport PR is merged in.
> merge conflict error: unable to process merge commit:
"1c757b8a2c1160ad53421b7b8bd7f74b205c4b89", automatic backport requires
rebase workflow
The below text is copied from the body of the original PR.
---
fixes#17097 Consul version of each nodes in UI nodes section
@jkirschner-hashicorp @huikang @team @Maintainers
Updated consul version in the request to register consul.
Added this as Node MetaData.
Fetching this new metadata in UI
<img width="1512" alt="Screenshot 2023-06-15 at 4 21 33 PM"
src="https://github.com/hashicorp/consul/assets/3139634/94f7cf6b-701f-4230-b9f7-d8c4342d0737">
Also made this backward compatible and tested.
Backward compatible in this context means - If consul binary with above
PR changes is deployed to one of node, and if UI is run from this node,
then the version of not only current (upgraded) node is displayed in UI
, but also of older nodes given that they are consul servers only.
For older (non-server or client) nodes the version is not added in
NodeMeta Data and hence the version will not be displayed for them.
If a old node is consul server, the version will be displayed. As the
endpoint - "v1/internal/ui/nodes?dc=dc1" was already returning version
in service meta. This is made use of in current UI changes.
<img width="1480" alt="Screenshot 2023-06-16 at 6 58 32 PM"
src="https://github.com/hashicorp/consul/assets/3139634/257942f4-fbed-437d-a492-37849d2bec4c">
---
<details>
<summary> Overview of commits </summary>
- 931fdfc7ecdc26bb7cc20b698c5e14c1b65fcc6e -
b3e2ec1ccaca3832a088ffcac54257fa6653c6c1 -
8d0e9a54907039c09330c6cd7b9e761566af6856 -
04e5d88cca37821f6667be381c16aaa5958b5c92 -
28286a2e98f8cd66ef8593c2e2893b4db6080417 -
43e50ad38207952a9c4d04d45d08b6b8f71b31fe -
0cf1b7077cdf255596254d9dc1624a269c42b94d -
27f34ce1c2973591f75b1e38a81ccbe7cee6cee3 -
2ac76d62b8cbae76b1a903021aebb9b865e29d6e -
3d618df9ef1d10dd5056c8b1ed865839c553a0e0 -
1c757b8a2c1160ad53421b7b8bd7f74b205c4b89 -
23ce82b4cee8f74dd634dbe145313e9a56c0077d -
4dc1c9b4c5aafdb8883ef977dfa9b39da138b6cb -
85a12a92528bfa267a039a9bb258170be914abf7 -
25d30a3fa980d130a30d445d26d47ef2356cb553 -
7f1d6192dce3352e92307175848b89f91e728c24 -
5174cbff84b0795d4cb36eb8980d0d5336091ac9
</details>
---------
Co-authored-by: Vijay Srinivas <vijayraghav22@gmail.com>
Co-authored-by: John Murret <john.murret@hashicorp.com>
Co-authored-by: Jared Kirschner <85913323+jkirschner-hashicorp@users.noreply.github.com>
* backport of commit fb2f3b61004d9ef2296b51306ddbf5b6d72679ed
* backport of commit 178abb8495ba4bb35c29a835965e3f244a385865
* backport of commit 77b399877413c6e65669659deb8962c2cc5b52f6
* backport of commit a245b326ac030f7ef3292e7bbdb58e0b2850a12f
---------
Co-authored-by: Andrew Stucki <andrew.stucki@hashicorp.com>
* backport of commit dc9c08d3b8cc1eda95a05a8b041ab2a3a5248dd0
* backport of commit 1271705a5cce5fe5e9487fed2ac965ab7aac3d59
---------
Co-authored-by: Ronald Ekambi <ronekambi@gmail.com>
Co-authored-by: Ronald <roncodingenthusiast@users.noreply.github.com>
TLDR with many modules the versions included in each diverged quite a bit. Attempting to use Go Workspaces produces a bunch of errors.
This commit:
1. Fixes envoy-library-references.sh to work again
2. Ensures we are pulling in go-control-plane@v0.11.0 everywhere (previously it was at that version in some modules and others were much older)
3. Remove one usage of golang/protobuf that caused us to have a direct dependency on it.
4. Remove deprecated usage of the Endpoint field in the grpc resolver.Target struct. The current version of grpc (v1.55.0) has removed that field and recommended replacement with URL.Opaque and calls to the Endpoint() func when needing to consume the previous field.
4. `go work init <all the paths to go.mod files>` && `go work sync`. This syncrhonized versions of dependencies from the main workspace/root module to all submodules
5. Updated .gitignore to ignore the go.work and go.work.sum files. This seems to be standard practice at the moment.
6. Update doc comments in protoc-gen-consul-rate-limit to be go fmt compatible
7. Upgraded makefile infra to perform linting, testing and go mod tidy on all modules in a flexible manner.
8. Updated linter rules to prevent usage of golang/protobuf
9. Updated a leader peering test to account for an extra colon in a grpc error message.
This commit only contains the OSS PR (datacenter query param support).
A separate enterprise PR adds support for ap and namespace query params.
Resources in Consul can exists within scopes such as datacenters, cluster
peers, admin partitions, and namespaces. You can refer to those resources from
interfaces such as the CLI, HTTP API, DNS, and configuration files.
Some scope levels have consistent naming: cluster peers are always referred to
as "peer".
Other scope levels use a short-hand in DNS lookups...
- "ns" for namespace
- "ap" for admin partition
- "dc" for datacenter
...But use long-hand in CLI commands:
- "namespace" for namespace
- "partition" for admin partition
- and "datacenter"
However, HTTP API query parameters do not follow a consistent pattern,
supporting short-hand for some scopes but long-hand for others:
- "ns" for namespace
- "partition" for admin partition
- and "dc" for datacenter.
This inconsistency is confusing, especially for users who have been exposed to
providing scope names through another interface such as CLI or DNS queries.
This commit improves UX by consistently supporting both short-hand and
long-hand forms of the namespace, partition, and datacenter scopes in HTTP API
query parameters.
`property-override` is an extension that allows for arbitrarily
patching Envoy resources based on resource matching filters. Patch
operations resemble a subset of the JSON Patch spec with minor
differences to facilitate patching pre-defined (protobuf) schemas.
See Envoy Extension product documentation for more details.
Co-authored-by: Eric Haberkorn <eric.haberkorn@hashicorp.com>
Co-authored-by: Kyle Havlovitz <kyle@hashicorp.com>
To avoid unintended tampering with remote downstreams via service
config, refactor BasicEnvoyExtender and RuntimeConfig to disallow
typical Envoy extensions from being applied to non-local proxies.
Continue to allow this behavior for AWS Lambda and the read-only
Validate builtin extensions.
Addresses CVE-2023-2816.
* Move status condition for invalid certifcate to reference the listener
that is using the certificate
* Fix where we set the condition status for listeners and certificate
refs, added tests
* Add changelog
* Add MaxEjectionPercent to config entry
* Add BaseEjectionTime to config entry
* Add MaxEjectionPercent and BaseEjectionTime to protobufs
* Add MaxEjectionPercent and BaseEjectionTime to api
* Fix integration test breakage
* Verify MaxEjectionPercent and BaseEjectionTime in integration test upstream confings
* Website docs for MaxEjectionPercent and BaseEjection time
* Add `make docs` to browse docs at http://localhost:3000
* Changelog entry
* so that is the difference between consul-docker and dev-docker
* blah
* update proto funcs
* update proto
---------
Co-authored-by: Maliz <maliheh.monshizadeh@hashicorp.com>
* normalize status conditions for gateways and routes
* Added tests for checking condition status and panic conditions for
validating combinations, added dummy code for fsm store
* get rid of unneeded gateway condition generator struct
* Remove unused file
* run go mod tidy
* Update tests, add conflicted gateway status
* put back removed status for test
* Fix linting violation, remove custom conflicted status
* Update fsm commands oss
* Fix incorrect combination of type/condition/status
* cleaning up from PR review
* Change "invalidCertificate" to be of accepted status
* Move status condition enums into api package
* Update gateways controller and generated code
* Update conditions in fsm oss tests
* run go mod tidy on consul-container module to fix linting
* Fix type for gateway endpoint test
* go mod tidy from changes to api
* go mod tidy on troubleshoot
* Fix route conflicted reason
* fix route conflict reason rename
* Fix text for gateway conflicted status
* Add valid certificate ref condition setting
* Revert change to resolved refs to be handled in future PR
* added method for converting SamenessGroupConfigEntry
- added new method `ToQueryFailoverTargets` for converting a SamenessGroupConfigEntry's members to a list of QueryFailoverTargets
- renamed `ToFailoverTargets` ToServiceResolverFailoverTargets to distinguish it from `ToQueryFailoverTargets`
* Added SamenessGroup to PreparedQuery
- exposed Service.Partition to API when defining a prepared query
- added a method for determining if a QueryFailoverOptions is empty
- This will be useful for validation
- added unit tests
* added method for retrieving a SamenessGroup to state store
* added logic for using PQ with SamenessGroup
- added branching path for SamenessGroup handling in execute. It will be handled separate from the normal PQ case
- added a new interface so that the `GetSamenessGroupFailoverTargets` can be properly tested
- separated the execute logic into a `targetSelector` function so that it can be used for both failover and sameness group PQs
- split OSS only methods into new PQ OSS files
- added validation that `samenessGroup` is an enterprise only feature
* added documentation for PQ SamenessGroup
Before this change, we were not fetching service resolvers (and therefore
service defaults) configuration entries for services on members of sameness
groups.
This implements permissive mTLS , which allows toggling services into "permissive" mTLS mode.
Permissive mTLS mode allows incoming "non Consul-mTLS" traffic to be forward unmodified to the application.
* Update service-defaults and proxy-defaults config entries with a MutualTLSMode field
* Update the mesh config entry with an AllowEnablingPermissiveMutualTLS field and implement the necessary validation. AllowEnablingPermissiveMutualTLS must be true to allow changing to MutualTLSMode=permissive, but this does not require that all proxy-defaults and service-defaults are currently in strict mode.
* Update xDS listener config to add a "permissive filter chain" when MutualTLSMode=permissive for a particular service. The permissive filter chain matches incoming traffic by the destination port. If the destination port matches the service port from the catalog, then no mTLS is required and the traffic sent is forwarded unmodified to the application.
This commit adds the PrioritizeByLocality field to both proxy-config
and service-resolver config entries for locality-aware routing. The
field is currently intended for enterprise only, and will be used to
enable prioritization of service-mesh connections to services based
on geographical region / zone.
hc-github-team-consul-core