be9122a8c4
agent: sanitize ui metrics proxy header values on agent/self endpoint ( #9104 )
2020-11-05 13:25:27 -06:00
621f1db766
Merge pull request #9073 from hashicorp/dnephin/backport-streaming-namespaces
...
streaming: backport namespace changes
2020-11-05 14:19:10 -05:00
cd220e5d6c
Merge pull request #9061 from hashicorp/dnephin/event-fields
...
stream: support filtering by namespace
2020-11-05 14:18:35 -05:00
70fb9d94d2
auto-updated agent/uiserver/bindata_assetfs.go from commit 6ff094976
2020-11-05 19:12:03 +00:00
17d1fa5f42
auto-updated agent/uiserver/bindata_assetfs.go from commit 1ef18c4b6
2020-11-05 16:10:14 +00:00
c2d167d06e
agent: protect the ui metrics proxy endpoint behind ACLs ( #9099 )
...
This ensures the metrics proxy endpoint is ACL protected behind a
wildcard `service:read` and `node:read` set of rules. For Consul
Enterprise these will need to span all namespaces:
```
service_prefix "" { policy = "read" }
node_prefix "" { policy = "read" }
namespace_prefix "" {
service_prefix "" { policy = "read" }
node_prefix "" { policy = "read" }
}
```
This PR contains just the backend changes. The frontend changes to
actually pass the consul token header to the proxy through the JS plugin
will come in another PR.
2020-11-04 12:50:03 -06:00
6645dfcbb1
auto-updated agent/uiserver/bindata_assetfs.go from commit 0f6c0a5c1
2020-11-04 09:37:51 +00:00
ebe0ffce30
auto-updated agent/uiserver/bindata_assetfs.go from commit d5d4155e1
2020-11-03 14:14:58 +00:00
0d8a30d8e3
auto-updated agent/uiserver/bindata_assetfs.go from commit 56c2ff56e
2020-11-02 18:43:31 +00:00
0fa484ae8f
auto-updated agent/uiserver/bindata_assetfs.go from commit bf32a1799
2020-11-02 16:11:45 +00:00
052303f0fa
auto-updated agent/uiserver/bindata_assetfs.go from commit 314eeda95
2020-11-02 14:40:27 +00:00
c8c87ec317
agent: introduce path allow list for requests going through the metrics proxy ( #9059 )
...
Added a new option `ui_config.metrics_proxy.path_allowlist`. This defaults to `["/api/v1/query", "/api/v1/query_range"]` when the metrics provider is set to `prometheus`.
Requests that do not use one of the allow-listed paths (via exact match) get a 403 Forbidden response instead.
2020-10-30 16:49:54 -05:00
8a017c4f43
structs: add a namespace test for CheckServiceNode.CanRead
2020-10-30 15:07:04 -04:00
78260952b0
cache-type: use namespace in tests
...
to verify that the namespace is passed through correctly to the server.
2020-10-30 15:07:04 -04:00
f6b629852f
state: test EventPayloadCheckServiceNode.FilterByKey
...
Also fix a bug in that function when only one of key or namespace were the empty string.
2020-10-30 14:35:57 -04:00
60df44df4f
stream: Add tests for filterByKey with namespace
...
And fix a bug where a request with a Namespace but no Key would not be properly filtered
2020-10-30 14:35:42 -04:00
318dfbe6e4
stream: Move FilterByKey events to a table
...
In preparation for adding new tests.
2020-10-30 14:35:28 -04:00
2d0030da39
state: use enterprise meta for creating events
2020-10-30 14:34:04 -04:00
b57c7afcbb
stream: include the namespace in the snap cache key
...
Otherwise the wrong snapshot could be returned when the same key is used in different namespaces
2020-10-30 14:34:04 -04:00
8da30fcb9a
subscribe: set the request namespace
2020-10-30 14:34:04 -04:00
e69d2c99cf
auto-updated agent/uiserver/bindata_assetfs.go from commit cf2cfbaf2
2020-10-30 15:27:01 +00:00
67a0d0c426
state: ensure we unblock intentions queries upon the upgrade to config entries ( #9062 )
...
1. do a state store query to list intentions as the agent would do over in `agent/proxycfg` backing `agent/xds`
2. upgrade the database and do a fresh `service-intentions` config entry write
3. the blocking query inside of the agent cache in (1) doesn't notice (2)
2020-10-29 15:28:31 -05:00
78014653b3
restore prior signature of test helper so enterprise compiles
2020-10-29 13:52:15 -05:00
e970f9699f
auto-updated agent/uiserver/bindata_assetfs.go from commit 1d6961248
2020-10-29 18:33:41 +00:00
61ce0964a4
stream: remove Event.Key
...
Makes Payload a type with FilterByKey so that Payloads can implement
filtering by key. With this approach we don't need to expose a Namespace
field on Event, and we don't need to invest micro formats or require a
bunch of code to be aware of exactly how the key field is encoded.
2020-10-28 16:48:04 -04:00
8ef4c0fcc5
state: use go-cmp for comparison
...
The output of the previous assertions made it impossible to debug the tests without code changes.
With go-cmp comparing the entire slice we can see the full diffs making it easier to debug failures.
2020-10-28 16:33:00 -04:00
c106d94742
proto: remove Event.Key field
...
The field is never used, and the value is available from the payload.
2020-10-28 16:33:00 -04:00
ab43236f86
proto: remove Event.Namespace field
...
All events are part of a single Topic, so we don't need this field.
2020-10-28 16:33:00 -04:00
44da869ed4
stream: Use a no-op event publisher if streaming is disabled
2020-10-28 13:54:19 -04:00
eea87e1acf
store: use a ReadDB for snapshots
...
to remove the cyclic dependency between the snapshot handlers and the state.Store
2020-10-28 13:07:42 -04:00
cfe0ffde15
Merge pull request #9026 from hashicorp/dnephin/streaming-without-cache-query-param
...
streaming: rename config and remove requirement for cache=1
2020-10-28 12:33:25 -04:00
03d2be03e7
Merge pull request #8618 from hashicorp/dnephin/remove-txn-readtxn
...
state: Use ReadTxn everywhere
2020-10-28 12:32:47 -04:00
ecf0f0b2aa
Merge pull request #9053 from hashicorp/vault-token-lookupself
...
connect: Use the lookup-self endpoint for Vault token
2020-10-27 14:34:03 -07:00
40cb72fe06
agent/grpc: add connection count metrics
...
Gauge metrics are great for understanding the current state, but can somtimes hide problems
if there are many disconnect/reconnects.
This commit adds counter metrics for connections and streams to make it easier to see the
count of newly created connections and streams.
2020-10-27 16:49:49 -04:00
64284ed91a
agent/grpc: rename metrics
...
These new names should make it easier to add counter metics with similar prefixes
2020-10-27 16:49:49 -04:00
72430b9125
Merge pull request #8961 from hashicorp/dnephin/grpc-resolve-node-id
...
agent/grpc: fix some test flakes and handle duplicate server IDs in the pool
2020-10-27 16:47:37 -04:00
a0e017791f
Merge pull request #8998 from hashicorp/dnephin/lib-ttlcache
...
lib/ttlcache: extract a new package from agent/cache
2020-10-27 16:43:10 -04:00
87a43b0ba7
Merge pull request #8987 from hashicorp/dnephin/stream-filter
...
streaming: apply filter to a single item
2020-10-27 16:39:43 -04:00
6e34759442
agent/grpc: Add an integration test for ClientPool with TLS
...
Also deregister the resolver.Builder in tests.
2020-10-27 16:34:18 -04:00
87793cd090
agent/grpc: pass metrics to constructor
...
Instead of referencing a package var. This does not fix the flaky test, but it seems more correct.
2020-10-27 16:34:17 -04:00
70fea7a77e
agent/grpc: fix a flaky test by performing more retries
...
Instead of using retry.Run, which appears to have problems in some cases where it does not
emit an error message, use a for loop.
Increase the number of attempts and remove any sleep, since this operation is not that expensive to do
in a tight loop
2020-10-27 16:34:17 -04:00
9b89fb492d
agent/grpc: remove misleading warnings from test output
...
Handle shutdown properly in tests so that the tests don't warn about using a closed connection.
2020-10-27 16:34:16 -04:00
64105079d9
agent/grpc: fix a flake in TestHandler_EmitsStats
2020-10-27 16:34:16 -04:00
7e338693a8
agent/grpc: use a separate channel for closing the Accept
...
Closing l.conns can lead to a race and a 'panic: send on closed chan' when a
connection is in the middle of being handled when the server is shutting down.
Found using '-race -count=800'
2020-10-27 16:34:15 -04:00
e640d47319
agent/grpc/resolver: namespace the server ID with the DC name
...
So that if two datacenters end up with overlapping serverIDs we don't send requests to the wrong server
2020-10-27 16:34:15 -04:00
1c0608eeeb
connect: Use the lookup-self endpoint for Vault token
2020-10-27 13:03:45 -07:00
e11b76ce80
auto-updated agent/uiserver/bindata_assetfs.go from commit f4208b5fb
2020-10-27 14:56:48 +00:00
e5b54d9be3
auto-updated agent/uiserver/bindata_assetfs.go from commit 30da884d5
2020-10-27 14:31:16 +00:00
707ef19716
auto-updated agent/uiserver/bindata_assetfs.go from commit ed6a2c150
2020-10-27 14:09:17 +00:00
338002054f
auto-updated agent/uiserver/bindata_assetfs.go from commit 827e53694
2020-10-27 13:36:44 +00:00
R.B. Boyer