Update generate token endpoint (rpc, http, and api module)
If ServerExternalAddresses are set, it will override any addresses gotten from the "consul" service, and be used in the token instead, and dialed by the dialer. This allows for setting up a load balancer for example, in front of the consul servers.
* Only show instances- and tags-tab peered services
* Adapt show-with-slashes test to peering changes
Tests always have the peering feature turned on and the default service
we load from the mock-api will be peered. This is why the topology
view of the service.show page will not be accessible in the updated
test it will show the instances instead. This change does not change
what the test is actually testing so just putting changing to the now
different url is fine.
This is the OSS portion of enterprise PR 2352.
It adds a server-local implementation of the proxycfg.PeeredUpstreams interface
based on a blocking query against the server's state store.
It also fixes an omission in the Virtual IP freeing logic where we were never
updating the max index (and therefore blocking queries against
VirtualIPsForAllImportedServices would not return on service deletion).
* don't show partition / peer at the same time in bucket-list
* use bucket-list in intentions table
* add bucket-list tests
* Simplify bucket list - match old behavior
Refactor the bucket-list component to be easier to grok and match
how the old template based approach worked. I.e. do not surface
partition or namespace when it matches the passed nspace or partition
property.
* Update docs for bucket-list
* fix linting
Peered upstreams has a separate loop in xds from discovery chain upstreams. This PR adds similar but slightly modified code to add filters for peered upstream listeners, clusters, and endpoints in the case of transparent proxy.
I had protoc-gen-go installed through `google.golang.org/protobuf` instead of
`github.com/golang/protobuf` and `make proto` was failing silently.
This change will ensure you get an error:
```
protoc-gen-go is already installed by module "google.golang.org/protobuf" but
should be installed by module "github.com/golang/protobuf".
Delete it and re-run to re-install.
```
The client is set to send keepalive pings every 30s. The server
keepalive enforcement must be set to a number less than that,
otherwise it will disconnect clients for sending pings too often.
MinTime governs the minimum amount of time between pings.
* ui: Add a modal.opened property for inspecting whether the modal is open
* merge isOpen setting into the exiting event handler
* Revert to multiple listeners, plus comment to explain
* Wrap close in an afterRender
* Only display dc dropdown when more than one dc is available
* Add wan federation message to dc dropdown
* Add test for conditionally displaying dc dropdown
* Move single datacenter indicator into datacenter selector
* Add `DATACENTERS` seperator dc dropdown
* "fix" unnecessary margin-top in dc dropdown
This mimics xDS's discovery protocol where you must request a resource
explicitly for the exporting side to send those events to you.
As part of this I aligned the overall ResourceURL with the TypeURL that
gets embedded into the encoded protobuf Any construct. The
CheckServiceNodes is now wrapped in a better named "ExportedService"
struct now.
* peerstream: dialer should reconnect when stream closes
If the stream is closed unexpectedly (i.e. when we haven't received
a terminated message), the dialer should attempt to re-establish the
stream.
Previously, the `HandleStream` would return `nil` when the stream
was closed. The caller then assumed the stream was terminated on purpose
and so didn't reconnect when instead it was stopped unexpectedly and
the dialer should have attempted to reconnect.
Ensure that the peer stream replication rpc can successfully be used with TLS activated.
Also:
- If key material is configured for the gRPC port but HTTPS is not
enabled now TLS will still be activated for the gRPC port.
- peerstream replication stream opened by the establishing-side will now
ignore grpc.WithBlock so that TLS errors will bubble up instead of
being awkwardly delayed or suppressed
* Made changes based on Adams suggestions
* updating list layout in systems integration guide. updating wan federation docs.
* fixing env vars on systems integration page
* fixing h3 to h2 on enterprise license page
* Changed `The following steps will be performed` to `Complete the following steps`
* Replaced `These steps will be repeated for each datacenter` with `Repeat the following steps for each datacenter in the cluster`
* Emphasizing that kv2 secrets only need to be stored once.
* Move the sentence indicating where the vault path maps to the helm chart out of the -> Note callout
* remaining suggestions
* Removing store the secret in Vault from server-tls page
* Making the Bootstrapping the Server PKI Engine sections the same on server-tls and webhook-cert pages
* Apply suggestions from code review
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
* Updating VAULT_ADDR on systems-integration to get it out of the shell.
* Updating intro paragraph of Overview on systems-integration.mdx to what Adamsuggested.
* Putting the GKE, AKS, AKS info into tabs on the systems integration page.
* Apply suggestions from code review
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
A Node ID is not a required field with Consul’s data model. Therefore we cannot reliably expect all uses to have it. However the node name is required and must be unique so its equally as good of a key for the internal healthSnapshot node tracking.
Nitya Dhanushkodi