43f13d5a0b
Add cross-signing mechanism to root rotation
2018-06-14 09:42:00 -07:00
bbfcb278e1
Add the root rotation mechanism to the CA config endpoint
2018-06-14 09:41:59 -07:00
a585a0ba10
Have the built in CA store its state in raft
2018-06-14 09:41:59 -07:00
80eddb0bfb
Fix the testing endpoint's root set op
2018-06-14 09:41:59 -07:00
9fefac745e
Update the CA config endpoint to enable GETs
2018-06-14 09:41:59 -07:00
fc9ef9741b
Hook the CA RPC endpoint into the provider interface
2018-06-14 09:41:59 -07:00
a40db26ffe
Add CA bootstrapping on establishing leadership
2018-06-14 09:41:59 -07:00
e26819ed9c
Add the bootstrap config for the CA
2018-06-14 09:41:59 -07:00
4d0713d5bb
Add the CA provider interface and built-in provider
2018-06-14 09:41:58 -07:00
ebdda17a30
Add CA config set to fsm operations
2018-06-14 09:41:58 -07:00
f7ff16669f
Add the Connect CA config to the state store
2018-06-14 09:41:58 -07:00
a90f69faa4
Adds `api` client code and tests for new Proxy Config endpoint, registering with proxy and seeing proxy config in /agent/services list.
2018-06-14 09:41:58 -07:00
d8ac823ab1
Make test output more useful now we uses testify with multi-line error messages
2018-06-14 09:41:58 -07:00
9d11cd9bf4
Fix various test failures and vet warnings.
...
Intention de-duplication in previously merged PR actualy failed some tests that were not caught be me or CI. I ran the test files for state changes but they happened not to trigger this case so I made sure they did first and then fixed. That fixed some upstream intention endpoint tests that I'd not run as part of testing the previous fix.
2018-06-14 09:41:58 -07:00
8a4410b549
Refactor localBlockingQuery to use memdb.WatchSet. Much simpler and correct as a bonus!
2018-06-14 09:41:58 -07:00
aed5e5b03e
Super ugly hack to get TeamCity build to work for this PR without adding a vendor that is being added elsewhere and will conflict...
2018-06-14 09:41:58 -07:00
cbd8606651
Add X-Consul-ContentHash header; implement removing all proxies; add load/unload test.
2018-06-14 09:41:57 -07:00
44afb5c699
Agent Connect Proxy config endpoint with hash-based blocking
2018-06-14 09:41:57 -07:00
c2266b134a
HTTP agent registration allows proxy to be defined.
2018-06-14 09:41:57 -07:00
78e48fd547
Added connect proxy config and local agent state setup on boot.
2018-06-14 09:41:57 -07:00
280382c25f
Add tests all the way up through the endpoints to ensure duplicate src/destination is supported and so ultimately deny/allow nesting works.
...
Also adds a sanity check test for `api.Agent().ConnectAuthorize()` and a fix for a trivial bug in it.
2018-06-14 09:41:57 -07:00
adc5589329
Allow duplicate source or destination, but enforce uniqueness across all four.
2018-06-14 09:41:57 -07:00
51b1bc028d
Rework connect/proxy and command/connect/proxy. End to end demo working again
2018-06-14 09:41:57 -07:00
67669abf82
Remove old connect client and proxy implementation
2018-06-14 09:41:56 -07:00
2d6a2ce1e3
connect.Service based implementation after review feedback.
2018-06-14 09:41:56 -07:00
800deb693c
Original proxy and connect.Client implementation. Working end to end.
2018-06-14 09:41:56 -07:00
62b746c380
agent: rename authorize param ClientID to ClientCertURI
2018-06-14 09:41:56 -07:00
26f254fac0
api: rename Authorize field to ClientCertURI
2018-06-14 09:41:56 -07:00
9de861d722
api: fix up some comments and rename IssuedCert to LeafCert
2018-06-14 09:41:56 -07:00
c0894f0f50
api: IntentionMatch
2018-06-14 09:41:56 -07:00
9c33068394
api: starting intention endpoints, reorganize files slightly
2018-06-14 09:41:55 -07:00
b5b301aa2a
api: endpoints for working with CA roots, agent authorize, etc.
2018-06-14 09:41:55 -07:00
94e7a0a3c1
agent: add TODO for verification
2018-06-14 09:41:55 -07:00
f983978fb8
acl: IntentionDefault => IntentionDefaultAllow
2018-06-14 09:41:55 -07:00
b3584b6355
agent: ACL checks for authorize, default behavior
2018-06-14 09:41:55 -07:00
3e0e0a94a7
agent/structs: String format for Intention, used for logging
2018-06-14 09:41:55 -07:00
3f80808379
agent: bolster commenting for clearer understandability
2018-06-14 09:41:55 -07:00
c6269cda37
agent: default deny on connect authorize endpoint
2018-06-14 09:41:54 -07:00
5364a8cd90
agent: /v1/agent/connect/authorize is functional, with tests
2018-06-14 09:41:54 -07:00
7af99667b6
agent/connect: Authorize for CertURI
2018-06-14 09:41:54 -07:00
68fa4a83b1
agent: get rid of method checks since they're done in the http layer
2018-06-14 09:41:54 -07:00
3efe3f8aff
require -> assert until rebase
2018-06-14 09:41:54 -07:00
894ee3c5b0
Add Connect agent, catalog and health endpoints to api Client
2018-06-14 09:41:54 -07:00
1985655dff
agent/consul/state: ensure exactly one active CA exists when setting
2018-06-14 09:41:54 -07:00
9d93c52098
agent/connect: support any values in the URL
2018-06-14 09:41:54 -07:00
8934f00d03
agent/connect: support SpiffeIDSigning
2018-06-14 09:41:53 -07:00
da1bc48372
agent/connect: rename SpiffeID to CertURI
2018-06-14 09:41:53 -07:00
b0315811b9
agent/connect: use proper keyusage fields for CA and leaf
2018-06-14 09:41:53 -07:00
434d8750ae
agent/connect: address PR feedback for the CA.go file
2018-06-14 09:41:53 -07:00
e0562f1c21
agent: implement an always-200 authorize endpoint
2018-06-14 09:41:53 -07:00
Kyle Havlovitz