This commit makes two changes to the validation.
Previously we would call this validation in GenerateRoot, which happens
both on initialization (when a follower becomes leader), and when a
configuration is updated. We only want to do this validation during
config update so the logic was moved to the UpdateConfiguration
function.
Previously we would compare the config values against the actual cert.
This caused problems when the cert was created manually in Vault (not
created by Consul). Now we compare the new config against the previous
config. Using a already created CA cert should never error now.
Adding the key bit and types to the config should only error when
the previous values were not the defaults.
We need a way to load certain CSS based on the environment you are viewing, i.e. we have debug CSS that we use for our Eng Documentation and various other DX utilities that shouldn't be compiled into our production or test builds.
Previously we would compile two entirely different CSS files (app and debug) and the load one or the other depending on which environment you were in.
This approach just empties out the debug.css file in certain environments (prod/test) which means we can just import that file from app. When in staging/development this imports the contents of debug.css (quite a bit of CSS) whereas when building for production/test this debug.css is emptied out during the build process.
There is a slight little hack in order to have this work, we import _debug.scss which imports the debug.scss file. I couldn't for the life of me figure out how to have broccoli empty out a file during the build process, so instead we essentially copy over debug.scss during dev and create an empty file during prod to _debug.scss.
When using make build to build an artifact for production CSS remains at ~58kb (during dev its a lot bigger than this)
Remove incorrect sidecar port range on docs for built-in proxy.
Updates the bind_port/port fields on the built-in proxy and sidecar
service registration pages to link to the `sidecar_min_port` and
`sidecar_max_port` configuration options for the defined port range.
Fixes#12253
This test found a bug in the secondary. We were appending the root cert
to the PEM, but that cert was already appended. This was failing
validation in Vault here:
https://github.com/hashicorp/vault/blob/sdk/v0.3.0/sdk/helper/certutil/types.go#L329
Previously this worked because self signed certs have the same
SubjectKeyID and AuthorityKeyID. So having the same self-signed cert
repeated doesn't fail that check.
However with an intermediate that is not self-signed, those values are
different, and so we fail the check. A test I added in a previous commit
should show that this continues to work with self-signed root certs as
well.
This is safer than embedding two interface because there are a number of
places where we check the concrete type. If we check the concrete type
on the top-level interface it will fail. So instead expose the
ACLIdentity from a method.
Fixes several issues with the pre/postremove scripts for both rpm and
deb packages. Specifically:
For postremove:
- the postremove script now functions correctly (i.e. restarts consul
after a package upgrade) on rpm-based systems (where $1 is numeric
rather than `purge` or `upgrade`)
- `systemctl daemon-reload` is called on package removal (rather than
only on upgrade)
- calls `systemctl try-restart` instead of `systemctl restart`, which
will only (re)start consul if it was already running when the upgrade
happened.
For preremove:
- if the package is being completely uninstalled (rather than upgraded),
stop consul before removing the package
Some practitioners look to the makefile directly rather than to the consul
website for information on how to compile from source. Link to the website
instructions directly from the makefile so the practitioner can accomplish
their task successfully without a careful read of the makefile.
This change allows us to remove one of the last remaining duplicate
resolve token methods (Server.ResolveToken).
With this change we are down to only 2, where the second one also
handles setting the default EnterpriseMeta from the token.
Daniel Nephin