luxolus/open-consul
2
0
Fork 0
Code Issues 1 Pull requests Packages Releases Wiki Activity
13222 commits 1 branch 1 tag 358 MiB
Commit graph

3314 commits

Author SHA1 Message Date
R.B. Boyer 7bcbc59dea
command: when generating envoy bootstrap configs use the datacenter returned from the agent services endpoint (#9229) 
Fixes #9215
 2020-11-19 15:27:31 -06:00
Freddy e4e306210a
Require operator:write to get Connect CA config (#9240) 
A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that operators with `operator:read` ACL permissions are able to read the Consul Connect CA configuration when explicitly configured with the `/v1/connect/ca/configuration` endpoint, including the private key. This allows the user to effectively privilege escalate by enabling the ability to mint certificates for any Consul Connect services. This would potentially allow them to masquerade (receive/send traffic) as any service in the mesh.

--

This PR increases the permissions required to read the Connect CA's private key when it was configured via the `/connect/ca/configuration` endpoint. They are now `operator:write`.
 2020-11-19 10:14:48 -07:00
Kit Patella c5af73c4f1
Merge pull request #9091 from scellef/correct-upgrade-guide 
Correcting text on when default was changed in Consul
 2020-11-18 16:54:48 -08:00
Nitya Dhanushkodi 866628b6e8
Add docs for envoyExtraArgs (#9206) 2020-11-18 15:40:39 -08:00
Matt Keeler 4bca029be9
Refactor to call non-voting servers read replicas (#9191) 
Co-authored-by: Kit Patella <kit@jepsen.io>
 2020-11-17 10:53:57 -05:00
Matt Keeler a7d945e7b9
[docs] Change links to the DNS information to the right place (#8675) 
The redirects were working in many situations but some (INTERNALS.md) was not. This just flips everything over to using the real link.
 2020-11-17 10:03:00 -05:00
Luke Kysow 292058c569
Docs for upgrading to CRDs (#9176) 
* Add Upgrading to CRDs docs
 2020-11-13 15:19:21 -08:00
Kent 'picat' Gruber 4ffa3e66d9
Merge pull request #9106 from hashicorp/security-model-docs-revamp 
Revamp Security Model Documentation
 2020-11-13 17:30:24 -05:00
Mike Morris 4902e42ca4 Merge pull request #9155 from hashicorp/release/1.9.0-beta3 
merge: 1.9.0-beta3
 2020-11-13 16:45:50 -05:00
Iryna Shustava 41dddba967
docs: add link to the OpenShift platform guide to k8s docs (#9177) 2020-11-12 15:06:25 -08:00
Kyle Schochenmaier 2504ddc9f1
Docs: for consul-k8s health checks (#8819) 
* docs for consul-k8s health checks

Co-authored-by: Derek Strickland <1111455+DerekStrickland@users.noreply.github.com>
Co-authored-by: Ashwin Venkatesh <ashwin@hashicorp.com>
Co-authored-by: Iryna Shustava <ishustava@users.noreply.github.com>
Co-authored-by: Luke Kysow <1034429+lkysow@users.noreply.github.com>
 2020-11-12 16:55:44 -06:00
Nitya Dhanushkodi 1bd1f44bf2
Update compatibility matrix 
Co-authored-by: Ashwin Venkatesh <ashwin@hashicorp.com>
 2020-11-12 14:43:33 -08:00
R.B. Boyer a5bd1ba323
agent: return the default ACL policy to callers as a header (#9101) 
Header is: X-Consul-Default-ACL-Policy=<allow|deny>

This is of particular utility when fetching matching intentions, as the
fallthrough for a request that doesn't match any intentions is to
enforce using the default acl policy.
 2020-11-12 10:38:32 -06:00
Paul Banks 990134371b
Update ui-visualization.mdx 2020-11-12 15:52:24 +00:00
Matt Keeler 58f98db227
Add a CLI command for retrieving the autopilot configuration. (#9142) 2020-11-11 13:19:02 -05:00
Joel Watson 4b9034b976
Merge pull request #9098 from hashicorp/watsonian/kv-size-breakdown 
Add detailed key size breakdown to snapshot inspect
 2020-11-11 11:34:45 -06:00
Joel Watson 1dd5362620 docs: add warning in 0.9.0 upgrade notes 2020-11-11 09:23:43 -05:00
Joel Watson a88177fbf9 Missed a spot with old params in docs 2020-11-10 11:22:45 -06:00
Joel Watson aa21a32ca5 Rename params to better reflect their purpose 2020-11-10 10:44:09 -06:00
Joel Watson 4298a0f7e1 Make docs for params clearer 2020-11-10 10:35:24 -06:00
Matt Keeler 114521af25
Add some autopilot docs and update the changelog (#9139) 2020-11-09 14:14:19 -05:00
Matt Keeler 755fb72994
Switch to using the external autopilot module 2020-11-09 09:22:11 -05:00
Mike Morris 9ccb340893
chore: upgrade to gopsutil/v3 (#9118) 
* deps: update golang.org/x/sys

* deps: update imports to gopsutil/v3

* chore: make update-vendor
 2020-11-06 20:48:38 -05:00
Mike Morris 4ac5e4638c
website: update callout to 1.9.0-beta2 (#9131) 2020-11-06 20:39:25 -05:00
Kent 'picat' Gruber aa46893717 Adjust the ACLs requirement section wording and add link to ACL docs 
It's better to avoid the ambiguous Vault statement that was not clarified and drop the loaded "roles" term in favor of "capabilities" since the ACL system is described as capability-based in previous ACL documentation.
 2020-11-06 16:25:21 -05:00
Paul Banks 1757ed6326
UI Metrics documentation (#9048) 
* UI Metrics documentation

* Update website/pages/docs/connect/observability/ui-visualization.mdx

* Fix some review comments

* Fix review comments

* Apply suggestions from code review

Co-authored-by: R.B. Boyer <rb@hashicorp.com>

Co-authored-by: R.B. Boyer <rb@hashicorp.com>
 2020-11-06 20:32:28 +00:00
Kent 'picat' Gruber 7d692f0b13 Use the EnterpriseAlert inline widget 2020-11-06 10:47:22 -05:00
Kent 'picat' Gruber 9e1054097b Add mention of auto_encrypt to mTLS requirements 2020-11-06 10:15:26 -05:00
Kent 'picat' Gruber c3aa90fe27 Fix sublist format for client agent threats 2020-11-05 16:41:15 -05:00
Kent 'picat' Gruber e0735f6fe0 Add link to the keygen command 2020-11-05 16:34:32 -05:00
Kent 'picat' Gruber 0fa4a13233 Use short link to keyring command 2020-11-05 16:33:04 -05:00
Kent 'picat' Gruber 8e1b9cb177 Add link to default_policy with code format to ACLs requirement section 2020-11-05 16:30:00 -05:00
Kent 'picat' Gruber 845cd6d1da Cleanup verify_server_hostname mTLS requirement 2020-11-05 16:27:23 -05:00
Kent 'picat' Gruber 99906ad09d Add extra clarification around verify_incoming_https for localhost 
In many cases access to localhost is restricted to trusted/privellged actors only
 2020-11-05 16:20:41 -05:00
Kent 'picat' Gruber f2c124702c Fix inline links + format in mTLS requirements section 2020-11-05 16:09:07 -05:00
Kent 'picat' Gruber e39c20c715 Capitalize enterprise and add link to enerprise docs 2020-11-05 16:03:14 -05:00
Kent 'picat' Gruber 6688fc7e5c Soften language by replacing utilize with use 2020-11-05 15:59:53 -05:00
Kim Ngo 43f3a42a11
Fix NIA doc links (#9110) 
fix config link and anchor
 2020-11-05 13:35:57 -06:00
Jimmy Merritello eda072a280
Bump HSM version (#9102) 2020-11-05 11:48:12 -06:00
Joel Watson 4ae01f349a Update docs with new flags 2020-11-05 10:31:36 -06:00
Kent 'picat' Gruber 2c62e82143 Actually fix spelling of recommendations 
I obviously have no idea how to spell this word
 2020-11-05 11:13:14 -05:00
Kent 'picat' Gruber ef4c2f40d7 Fix spelling of recomendations 
Thank you @rboyer!
 2020-11-04 17:44:51 -05:00
Kent 'picat' Gruber 9f802dffc2 Revamp security model documentation 2020-11-04 17:05:44 -05:00
Sean Ellefson 7180f9e114 Correcting text on when default was changed in Consul 2020-11-02 15:10:34 -08:00
Alvin Huang d6652b0bc9
use hashicorp docker mirror to prevent rate limit (#9070) 2020-10-30 17:59:13 -04:00
s-christoff ee3eb03f50
cli: Add JSON and Pretty Print formatting for consul snapshot inspect (#9006) 2020-10-29 11:31:14 -05:00
Kim Ngo 1b0efbfd27
docs: Add links in CTS docs for the community to get involved (#9060) 2020-10-29 10:07:20 -05:00
Daniel Nephin cfe0ffde15
Merge pull request #9026 from hashicorp/dnephin/streaming-without-cache-query-param 
streaming: rename config and remove requirement for cache=1
 2020-10-28 12:33:25 -04:00
Daniel Nephin aaca3610ff docs: Add the new metrics to telemetry.mdx 2020-10-27 16:49:50 -04:00
Kevin Pruett 7589b0f265
Merge pull request #9021 from hashicorp/pruett.alertbanner-exp 
Expose `expirationDate` prop in <AlertBanner/>
 2020-10-26 16:08:23 -04:00