Commit graph

11026 commits

Author SHA1 Message Date
Hans Hasselberg e00effa325
agent: setup grpc server with auto_encrypt certs and add -https-port (#7086)
* setup grpc server with TLS config used across consul.
* add -https-port flag
2020-01-22 11:32:17 +01:00
Hans Hasselberg f3a01e6a4a
connect: use correct subject key id for leaf certificates. (#7091) 2020-01-22 11:28:28 +01:00
Iryna Shustava 2163f79170
Add docs about rolling out TLS on k8s (#7096)
* Add docs about gradually rolling out TLS on k8s

Co-authored-by: Luke Kysow <1034429+lkysow@users.noreply.github.com>
2020-01-21 19:29:55 -08:00
David Yu 54c46ec678
Small change to wording
Removing automatic connection wording for applications for the time being. From @blake 
> They can automatically establish TLS connections without being aware that TLS is happening. They are aware that they’re routed through the Connect proxy, the app has to configure itself to use the local upstream port.
2020-01-21 16:27:43 -08:00
David Yu 8291cc8133
Small change 2020-01-21 16:22:22 -08:00
David Yu 5c8e7eb7ea
Adding change to mention a few guides
Previously mentioned just one one guide in the header
2020-01-21 15:46:04 -08:00
David Yu 62a84697a1
Adding Service Mesh reference
Adding Service Mesh reference for Consul
2020-01-21 15:07:54 -08:00
David Yu 060a932a1b
Adding links to Kubernetes install
Adding links to Kubernetes deployment guide and minikube install for visibility
2020-01-21 14:55:21 -08:00
R.B. Boyer ce7ab8abc1
make TestCatalogNodes_Blocking less flaky (#7074)
- Explicitly wait to start the test until the initial AE sync of the node.

- Run the blocking query in the main goroutine to cut down on possible
poor goroutine scheduling issues being to blame for delays.

- If the blocking query is woken up with no index change, rerun the
query. This may happen if the CI server is loaded and time dilation is
happening.
2020-01-21 14:58:50 -06:00
R.B. Boyer 791f7baa6b
test: ensure we don't ask vault to sign a leaf that outlives its CA when acting as a secondary (#7100) 2020-01-21 14:55:21 -06:00
R.B. Boyer 6d90d873a4
fix the submodule go.mod and go.sum files (#7098) 2020-01-21 14:49:26 -06:00
R.B. Boyer 988273f2a1
test: run both the TestVaultProvider and TestVaultCAProvider tests in CI (#7097) 2020-01-21 12:01:35 -06:00
John Cowen 1b512badd7
ui: Improve configuration/env/feature flag usage (also add build time year detection) (#7072)
* Add new getEnvironment util/function

* Use new-ish `env` function in all the places

* Clean up ember env file, add year detection from commit date
2020-01-21 17:52:40 +00:00
Hans Hasselberg d52a4e3b82
tests: fix autopilot test (#7092) 2020-01-21 14:09:51 +01:00
Paul Banks 1e88978aae
Fix TestAPI_DiscoveryChain_Get flake (#7082) 2020-01-20 14:56:56 +00:00
John Cowen 9dc83806d8
ui: Keyboard navigation improvements (#7090)
* ui: Improve keyboard access for some custom components

* ui: Add some accessibility related metadata
2020-01-20 14:15:15 +00:00
Aestek 8c799447cf agent: remove service sidecars in Agent.cleanupRegistration (#7022)
Sidecar proxies were left behind when cleaning up after an unsuccessful
registration. There are now also removed when the service is cleanup up.
2020-01-20 14:01:40 +01:00
Hans Hasselberg 43392d5db3
raft: update raft to v1.1.2 (#7079)
* update raft
* use hclogger for raft.
2020-01-20 13:58:02 +01:00
Luke Kysow e2ea3c5965
Merge pull request #6970 from hashicorp/k8s-docs-refactor
Kubernetes docs reorganization
2020-01-18 19:08:26 -06:00
Luke Kysow 520d37fcd5
Reorg kube docs 2020-01-18 19:07:53 -06:00
Hans Hasselberg 315ba7d6ad
connect: check if intermediate cert needs to be renewed. (#6835)
Currently when using the built-in CA provider for Connect, root certificates are valid for 10 years, however secondary DCs get intermediates that are valid for only 1 year. There is no mechanism currently short of rotating the root in the primary that will cause the secondary DCs to renew their intermediates.
This PR adds a check that renews the cert if it is half way through its validity period.

In order to be able to test these changes, a new configuration option was added: IntermediateCertTTL which is set extremely low in the tests.
2020-01-17 23:27:13 +01:00
Hans Hasselberg b6c83e06d5
auto_encrypt: set dns and ip san for k8s and provide configuration (#6944)
* Add CreateCSRWithSAN
* Use CreateCSRWithSAN in auto_encrypt and cache
* Copy DNSNames and IPAddresses to cert
* Verify auto_encrypt.sign returns cert with SAN
* provide configuration options for auto_encrypt dnssan and ipsan
* rename CreateCSRWithSAN to CreateCSR
2020-01-17 23:25:26 +01:00
Kit Patella 3de3259833
.gitignore: cut IDE-specific entries, cleanup (#7083)
* .gitignore: add vscode and MacOS-specific files. add a little org

* .gitignore: remove IDE-specific ignores, add docs
2020-01-17 11:06:33 -08:00
Matt Keeler ff31b9c248
Update CHANGELOG.md 2020-01-17 09:55:59 -05:00
Aestek 9329cbac0a Add support for dual stack IPv4/IPv6 network (#6640)
* Use consts for well known tagged adress keys

* Add ipv4 and ipv6 tagged addresses for node lan and wan

* Add ipv4 and ipv6 tagged addresses for service lan and wan

* Use IPv4 and IPv6 address in DNS
2020-01-17 09:54:17 -05:00
Aestek c35af89dfd agent: do not deregister service checks twice (#6168)
Deregistering a service from the catalog automatically deregisters its
checks, however the agent still performs a deregister call for each
service checks even after the service has been deregistered.
With ACLs enabled this results in logs like:
"message:consul: "Catalog.Deregister" RPC failed to server
server_ip:8300: rpc error making call: rpc error making call: Unknown
check 'check_id'"
This change removes associated checks from the agent state when
deregistering a service, which results in less calls to the servers and
supresses the error logs.
2020-01-17 14:26:53 +01:00
Matej Urbas d877e091d6 agent: configurable MaxQueryTime and DefaultQueryTime. (#3777) 2020-01-17 14:20:57 +01:00
neillyt 5f5085aa75 Fix Namespace Typo (#7030) 2020-01-16 20:34:04 -07:00
John Cowen 35c4fd03ab
ui: Discovery Chain Improvements (#7036)
* Reorganize resolvers so its clearer what's happening

* Use entire route definition for id

* Clean up a tiny bit more, use guid for ids instead of JSON

* ui: Externalize disco-chain utils and add initial unit testing

* Add some click outside-ness for de-highlighting things
2020-01-16 16:31:09 +00:00
John Cowen efdae83a87
ui: Use structure-icons as much as possible (#6851)
* ui: Delete a bunch of CSS that we recently moved elsewhere

* ui: Add some masking placeholders

* Switch out hashicorp logo for one from structure-icons

* Change copy-button to use new copy-action icon

* Change secret-button to use new visibility-hide/show icons

* New folder icon for KVs

* Cleanup some of the icons we no longer use

* Switch from %with-exit to standard-like %with-exit-icon

* Move all chevrons to use structure-icons properly

* Use star-fill as much as possible

* Remove the remaining icons from icons/index plus the file itself
2020-01-16 09:10:32 +00:00
Matt Keeler a1655062da
Update CHANGELOG.md 2020-01-15 11:58:19 -05:00
John Cowen 248ee65f72
docs: Add note about using valid DNS labels for service names (#7035)
Add note about using valid DNS labels for service names
2020-01-15 15:36:17 +00:00
John Cowen 6bf6002ab0
ui: Move slots to use attributes over positional params (#7032)
* Change all instances of yield/block-slots to use attributes over positional arguments

* Remove the ability to use yield/block-slots with positional params
2020-01-15 09:15:54 +00:00
Kit Patella 79fef74772
Small improvements to Connect docs (#6910)
* docs/connect add link to intentions and minor phrasing change

* docs/connect pluralize 'applications'

* Update website/source/docs/connect/connect-internals.html.md

Co-Authored-By: Paul Banks <banks@banksco.de>
2020-01-14 14:59:27 -08:00
Freddy de49668707
Update CHANGELOG.md 2020-01-14 15:44:03 -07:00
Freddy f3ba6a9166
Update force-leave ACL requirement to operator:write (#7033) 2020-01-14 15:40:34 -07:00
Matt Keeler c8294b8595
AuthMethod updates to support alternate namespace logins (#7029) 2020-01-14 10:09:29 -05:00
Paul Banks cc8f580ddd
Add contributing dir with Config file checklist (#7017)
* Add contributing dir with Config file checklist and modify contribution guides

* Apply suggestions from code review

Co-Authored-By: Chris Piraino <cpiraino@hashicorp.com>

Co-authored-by: Chris Piraino <piraino.chris@gmail.com>
2020-01-14 12:24:03 +00:00
Matt Keeler baa89c7c65
Intentions ACL enforcement updates (#7028)
* Renamed structs.IntentionWildcard to structs.WildcardSpecifier

* Refactor ACL Config

Get rid of remnants of enterprise only renaming.

Add a WildcardName field for specifying what string should be used to indicate a wildcard.

* Add wildcard support in the ACL package

For read operations they can call anyAllowed to determine if any read access to the given resource would be granted.

For write operations they can call allAllowed to ensure that write access is granted to everything.

* Make v1/agent/connect/authorize namespace aware

* Update intention ACL enforcement

This also changes how intention:read is granted. Before the Intention.List RPC would allow viewing an intention if the token had intention:read on the destination. However Intention.Match allowed viewing if access was allowed for either the source or dest side. Now Intention.List and Intention.Get fall in line with Intention.Matches previous behavior.

Due to this being done a few different places ACL enforcement for a singular intention is now done with the CanRead and CanWrite methods on the intention itself.

* Refactor Intention.Apply to make things easier to follow.
2020-01-13 15:51:40 -05:00
Pierre Souchay 61fc4f8253 rpc: log method when a server/server RPC call fails (#4548)
Sometimes, we have lots of errors in cross calls between DCs (several hundreds / sec)
Enrich the log in order to help diagnose the root cause of issue.
2020-01-13 19:55:29 +01:00
Matt Keeler 0b4bd016a9
Move where the service-resolver watch is done so that it happen… (#7025)
Before we were issuing 1 watch for every service in the services listing which would have caused the agent to process many more identical events simultaneously.
2020-01-10 10:30:13 -05:00
Hans Hasselberg 0e2605335f
connect: use inline_string instead for envoy ca(#7024) 2020-01-10 15:57:54 +01:00
R.B. Boyer 20f51f9181 connect: derive connect certificate serial numbers from a memdb index instead of the provider table max index (#7011) 2020-01-09 16:32:19 +01:00
R.B. Boyer 446f0533cd connect: ensure that updates to the secondary root CA configuration use the correct signing key ID values for comparison (#7012)
Fixes #6886
2020-01-09 16:28:16 +01:00
danielehc 71eca6330c
added disclaimer about network segments due to Serf limitations (#7004)
* added disclaimer about network segments due to Serf limitations

using work made at https://github.com/hashicorp/consul/pull/6558 by @thepomeranian

* Lowercasing functionality name

* Update website/source/docs/enterprise/network-segments/index.html.md

Co-Authored-By: kaitlincarter-hc <43049322+kaitlincarter-hc@users.noreply.github.com>

Co-authored-by: kaitlincarter-hc <43049322+kaitlincarter-hc@users.noreply.github.com>
2020-01-09 10:41:31 +01:00
danielehc aca0720a0e
Update docs to point to new learn guide (#7003)
* Changed the link to point to new guide
* Removed querystring from link
2020-01-09 10:26:47 +01:00
DevOps Rob 7a4b055f50 Azure MSI for cloud auto-join (#7000)
* Azure MSI documentation

Adding in note about support for Azure MSI authentication method for Cloud auto-join

* fixing text formatting

fixing text formatting

* missing word

missing word - variable

* Update website/source/docs/agent/cloud-auto-join.html.md

Language change to be specific about where the security risk mitigation is concerned

Co-Authored-By: Jack Pearkes <jackpearkes@gmail.com>

Co-authored-by: Jack Pearkes <jackpearkes@gmail.com>
2020-01-08 20:43:45 -05:00
kaitlincarter-hc dcd8153244
updating the ent docs to mention GCP (#7001) 2020-01-07 13:19:34 -08:00
tehmoon 7fead04f2e docs: Fix extraVolumes mount paths in helm.html.md (#7008) 2020-01-07 12:13:09 -08:00
Rémi Lapeyre 6b4050fdbf docs: fix typo in ACL legacy documentation (#7006) 2020-01-07 14:33:56 +01:00