Paul Banks
|
78e48fd547
|
Added connect proxy config and local agent state setup on boot.
|
2018-06-14 09:41:57 -07:00 |
|
Paul Banks
|
280382c25f
|
Add tests all the way up through the endpoints to ensure duplicate src/destination is supported and so ultimately deny/allow nesting works.
Also adds a sanity check test for `api.Agent().ConnectAuthorize()` and a fix for a trivial bug in it.
|
2018-06-14 09:41:57 -07:00 |
|
Paul Banks
|
adc5589329
|
Allow duplicate source or destination, but enforce uniqueness across all four.
|
2018-06-14 09:41:57 -07:00 |
|
Paul Banks
|
51b1bc028d
|
Rework connect/proxy and command/connect/proxy. End to end demo working again
|
2018-06-14 09:41:57 -07:00 |
|
Paul Banks
|
2d6a2ce1e3
|
connect.Service based implementation after review feedback.
|
2018-06-14 09:41:56 -07:00 |
|
Mitchell Hashimoto
|
62b746c380
|
agent: rename authorize param ClientID to ClientCertURI
|
2018-06-14 09:41:56 -07:00 |
|
Mitchell Hashimoto
|
94e7a0a3c1
|
agent: add TODO for verification
|
2018-06-14 09:41:55 -07:00 |
|
Mitchell Hashimoto
|
f983978fb8
|
acl: IntentionDefault => IntentionDefaultAllow
|
2018-06-14 09:41:55 -07:00 |
|
Mitchell Hashimoto
|
b3584b6355
|
agent: ACL checks for authorize, default behavior
|
2018-06-14 09:41:55 -07:00 |
|
Mitchell Hashimoto
|
3e0e0a94a7
|
agent/structs: String format for Intention, used for logging
|
2018-06-14 09:41:55 -07:00 |
|
Mitchell Hashimoto
|
3f80808379
|
agent: bolster commenting for clearer understandability
|
2018-06-14 09:41:55 -07:00 |
|
Mitchell Hashimoto
|
c6269cda37
|
agent: default deny on connect authorize endpoint
|
2018-06-14 09:41:54 -07:00 |
|
Mitchell Hashimoto
|
5364a8cd90
|
agent: /v1/agent/connect/authorize is functional, with tests
|
2018-06-14 09:41:54 -07:00 |
|
Mitchell Hashimoto
|
7af99667b6
|
agent/connect: Authorize for CertURI
|
2018-06-14 09:41:54 -07:00 |
|
Mitchell Hashimoto
|
68fa4a83b1
|
agent: get rid of method checks since they're done in the http layer
|
2018-06-14 09:41:54 -07:00 |
|
Paul Banks
|
894ee3c5b0
|
Add Connect agent, catalog and health endpoints to api Client
|
2018-06-14 09:41:54 -07:00 |
|
Mitchell Hashimoto
|
1985655dff
|
agent/consul/state: ensure exactly one active CA exists when setting
|
2018-06-14 09:41:54 -07:00 |
|
Mitchell Hashimoto
|
9d93c52098
|
agent/connect: support any values in the URL
|
2018-06-14 09:41:54 -07:00 |
|
Mitchell Hashimoto
|
8934f00d03
|
agent/connect: support SpiffeIDSigning
|
2018-06-14 09:41:53 -07:00 |
|
Mitchell Hashimoto
|
da1bc48372
|
agent/connect: rename SpiffeID to CertURI
|
2018-06-14 09:41:53 -07:00 |
|
Mitchell Hashimoto
|
b0315811b9
|
agent/connect: use proper keyusage fields for CA and leaf
|
2018-06-14 09:41:53 -07:00 |
|
Mitchell Hashimoto
|
434d8750ae
|
agent/connect: address PR feedback for the CA.go file
|
2018-06-14 09:41:53 -07:00 |
|
Mitchell Hashimoto
|
e0562f1c21
|
agent: implement an always-200 authorize endpoint
|
2018-06-14 09:41:53 -07:00 |
|
Mitchell Hashimoto
|
2026cf3753
|
agent/consul: encode issued cert serial number as hex encoded
|
2018-06-14 09:41:53 -07:00 |
|
Mitchell Hashimoto
|
deb55c436d
|
agent/structs: hide some fields from JSON
|
2018-06-14 09:41:52 -07:00 |
|
Mitchell Hashimoto
|
746f80639a
|
agent: /v1/connect/ca/configuration PUT for setting configuration
|
2018-06-14 09:41:52 -07:00 |
|
Mitchell Hashimoto
|
2dfca5dbc2
|
agent/consul/fsm,state: snapshot/restore for CA roots
|
2018-06-14 09:41:52 -07:00 |
|
Mitchell Hashimoto
|
17d6b437d2
|
agent/consul/fsm,state: tests for CA root related changes
|
2018-06-14 09:41:52 -07:00 |
|
Mitchell Hashimoto
|
a8510f8224
|
agent/consul: set more fields on the issued cert
|
2018-06-14 09:41:52 -07:00 |
|
Mitchell Hashimoto
|
58b6f476e8
|
agent: /v1/connect/ca/leaf/:service_id
|
2018-06-14 09:41:52 -07:00 |
|
Mitchell Hashimoto
|
748a0bb824
|
agent: CA root HTTP endpoints
|
2018-06-14 09:41:51 -07:00 |
|
Mitchell Hashimoto
|
80a058a573
|
agent/consul: CAS operations for setting the CA root
|
2018-06-14 09:41:51 -07:00 |
|
Mitchell Hashimoto
|
712888258b
|
agent/consul: tests for CA endpoints
|
2018-06-14 09:41:51 -07:00 |
|
Mitchell Hashimoto
|
1928c07d0c
|
agent/consul: key the public key of the CSR, verify in test
|
2018-06-14 09:41:51 -07:00 |
|
Mitchell Hashimoto
|
9a8653f45e
|
agent/consul: test for ConnectCA.Sign
|
2018-06-14 09:41:51 -07:00 |
|
Mitchell Hashimoto
|
a360c5cca4
|
agent/consul: basic sign endpoint not tested yet
|
2018-06-14 09:41:51 -07:00 |
|
Mitchell Hashimoto
|
6550ff9492
|
agent/connect: package for agent-related Connect, parse SPIFFE IDs
|
2018-06-14 09:41:50 -07:00 |
|
Mitchell Hashimoto
|
f433f61fdf
|
agent/structs: json omit QueryMeta
|
2018-06-14 09:41:50 -07:00 |
|
Mitchell Hashimoto
|
9ad2a12441
|
agent: /v1/connect/ca/roots
|
2018-06-14 09:41:50 -07:00 |
|
Mitchell Hashimoto
|
24830f4cfa
|
agent/consul: RPC endpoints to list roots
|
2018-06-14 09:41:50 -07:00 |
|
Mitchell Hashimoto
|
cfb62677c0
|
agent/consul/state: CARoot structs and initial state store
|
2018-06-14 09:41:49 -07:00 |
|
Mitchell Hashimoto
|
7e8d606717
|
agent: address PR feedback
|
2018-06-14 09:41:49 -07:00 |
|
Mitchell Hashimoto
|
767d2eaef6
|
agent: commenting some tests
|
2018-06-14 09:41:49 -07:00 |
|
Mitchell Hashimoto
|
f9a55aa7e0
|
agent: clarified a number of comments per PR feedback
|
2018-06-14 09:41:49 -07:00 |
|
Mitchell Hashimoto
|
62cbb892e3
|
agent/consul: Health.ServiceNodes ACL check for Connect
|
2018-06-14 09:41:49 -07:00 |
|
Mitchell Hashimoto
|
641c982480
|
agent/consul: Catalog endpoint ACL requirements for Connect proxies
|
2018-06-14 09:41:49 -07:00 |
|
Mitchell Hashimoto
|
4cc4de1ff6
|
agent: remove ConnectProxyServiceName
|
2018-06-14 09:41:49 -07:00 |
|
Mitchell Hashimoto
|
566c98b2fc
|
agent/consul: require name for proxies
|
2018-06-14 09:41:48 -07:00 |
|
Mitchell Hashimoto
|
4207bb42c0
|
agent: validate service entry on register
|
2018-06-14 09:41:48 -07:00 |
|
Mitchell Hashimoto
|
b5fd3017bb
|
agent/structs: tests for PartialClone and IsSame for proxy fields
|
2018-06-14 09:41:48 -07:00 |