9 Commits

Author	SHA1	Message	Date
freddygv	f209408918	Update spiffe ID patterns used for RBAC	2021-09-14 11:00:03 -06:00
freddygv	0e30151eaa	Expand testing of simplifyNotSourceSlice for partitions	2021-09-14 10:55:15 -06:00
freddygv	a65da57a3d	Expand testing of removeSameSourceIntentions for partitions	2021-09-14 10:55:09 -06:00
freddygv	e9d78a20c7	Account for partition when matching src intentions	2021-09-14 10:55:02 -06:00
R.B. Boyer	e018d8a10b	xds: ensure single L7 deny intention with default deny policy does not result in allow action (CVE-2021-36213) (#10619)	2021-07-15 10:09:00 -05:00
R.B. Boyer	503041f216	xds: default to speaking xDS v3, but allow for v2 to be spoken upon request (#9658) ... - Also add support for envoy 1.17.0	2021-02-26 16:23:15 -06:00
R.B. Boyer	cdc5e99184	xds: remove deprecated usages of xDS (#9602) ... Note that this does NOT upgrade to xDS v3. That will come in a future PR. Additionally: - Ignored staticcheck warnings about how github.com/golang/protobuf is deprecated. - Shuffled some agent/xds imports in advance of a later xDS v3 upgrade. - Remove support for envoy 1.13.x but don't add in 1.17.x yet. We have to wait until the xDS v3 support is added in a follow-up PR. Fixes #8425	2021-02-22 15:00:15 -06:00
R.B. Boyer	35c4efd220	connect: support defining intentions using layer 7 criteria (#8839) ... Extend Consul’s intentions model to allow for request-based access control enforcement for HTTP-like protocols in addition to the existing connection-based enforcement for unspecified protocols (e.g. tcp).	2020-10-06 17:09:13 -05:00
R.B. Boyer	f2b8bf109c	xds: use envoy's rbac filter to handle intentions entirely within envoy (#8569)	2020-08-27 12:20:58 -05:00