Commit graph

10572 commits

Author SHA1 Message Date
Matt Keeler 72a3eec1bf
Update CHANGELOG.md 2019-08-14 10:40:39 -04:00
R.B. Boyer 92bb80bec8 update changelog 2019-08-14 09:12:12 -05:00
R.B. Boyer 22ee60d1ba
agent: blocking central config RPCs iterations should not interfere with each other (#6316) 2019-08-14 09:08:46 -05:00
Matt Keeler b2331a8fc5
Update toolchain to Go 1.12.8 (#6319) 2019-08-14 09:40:57 -04:00
hashicorp-ci 47af2a06ed
Release v1.6.0-rc1 2019-08-13 15:28:07 +00:00
hashicorp-ci 33cab6ae72
update bindata_assetfs.go 2019-08-13 15:28:06 +00:00
Matt Keeler 62ce4b2b1c
Fix changelog format (and alphabatize stuff) 2019-08-13 11:13:55 -04:00
hashicorp-ci 29767157ed Merge Consul OSS branch 'master' at commit 8f7586b339dbb518eff3a2eec27d7b8eae7a3fbb 2019-08-13 02:00:43 +00:00
Mike Morris ecbafc34ac changelog: add snapshot half-close fix 2019-08-12 17:06:34 -04:00
Mike Morris fe1cc73c45 changelog: add managed proxy removal to breaking changes 2019-08-12 17:03:08 -04:00
Sarah Adams c78b552b7f
Update CHANGELOG.md 2019-08-12 13:57:58 -07:00
Matt Keeler 59f2272517
Add missing LicenseReset API function (#6311) 2019-08-12 15:24:02 -04:00
Sarah Adams 2f7a90bc52
add flag to allow /operator/keyring requests to only hit local servers (#6279)
Add parameter local-only to operator keyring list requests to force queries to only hit local servers (no WAN traffic).

HTTP API: GET /operator/keyring?local-only=true
CLI: consul keyring -list --local-only

Sending the local-only flag with any non-GET/list request will result in an error.
2019-08-12 11:11:11 -07:00
Mike Morris e637b48117
snapshot: add TLS support to HalfCloser interface (#6216)
Calls net.TCPConn.CloseWrite or mtls.Conn.CloseWrite, which was added in https://go-review.googlesource.com/c/go/+/31318/
2019-08-12 12:47:02 -04:00
hashicorp-ci eb53f9175c Merge Consul OSS branch 'master' at commit 8241787e922955e973c0e762ad3cb8db1804f6cd 2019-08-11 02:01:18 +00:00
Matt Keeler aa11bc2308
Update CHANGELOG.md 2019-08-10 09:16:55 -04:00
Matt Keeler 0e1b7038cc
Update the v1/agent/service/:service endpoint to output tagged… (#6304) 2019-08-10 09:15:19 -04:00
Jake Lundberg a530fee06e docs: Update consul-helm example to pull latest tag 2019-08-09 16:33:43 -06:00
R.B. Boyer 6f42bd6920 update changelog 2019-08-09 15:07:48 -05:00
R.B. Boyer 3b30dfd3ee
connect: allow mesh gateways to use central config (#6302) 2019-08-09 15:07:01 -05:00
Mike Morris d163740bbf
website: restore accidental JSON deletion [skip ci] (#6303) 2019-08-09 15:32:54 -04:00
Mike Morris 88df658243
connect: remove managed proxies (#6220)
* connect: remove managed proxies implementation and all supporting config options and structs

* connect: remove deprecated ProxyDestination

* command: remove CONNECT_PROXY_TOKEN env var

* agent: remove entire proxyprocess proxy manager

* test: remove all managed proxy tests

* test: remove irrelevant managed proxy note from TestService_ServerTLSConfig

* test: update ContentHash to reflect managed proxy removal

* test: remove deprecated ProxyDestination test

* telemetry: remove managed proxy note

* http: remove /v1/agent/connect/proxy endpoint

* ci: remove deprecated test exclusion

* website: update managed proxies deprecation page to note removal

* website: remove managed proxy configuration API docs

* website: remove managed proxy note from built-in proxy config

* website: add note on removing proxy subdirectory of data_dir
2019-08-09 15:19:30 -04:00
R.B. Boyer a12b51e784 update changelog 2019-08-07 16:42:45 -05:00
R.B. Boyer 6bf4255cdc
command: ensure that the json form of config entries can be submitted with 'consul config write' (#6290)
The json decoder inside of the HCLv1 hcl.Decode function behaves
unexpectedly when decoding generically into a map[string]interface{} as
is done for 'consul config write' pre-submit decoding.

This results in some subtle (service-router Match and Destinations being
separated) and some not so subtle (service-resolver subsets and failover
panic if multiple subsets are referenced) bugs when subsequently passed
through mapstructure to finish decoding.

Given that HCLv1 is basically frozen and the HCL part of it is fine
instead of trying to figure out what the underlying bug is in the json
decoder for our purposes just sniff the byte slice and selectively use
the stdlib json decoder for JSON and hcl decoder for HCL.
2019-08-07 16:41:33 -05:00
Matt Keeler ef7cbc5850
mesh-gateway ACL tokens should also have node:read on everyth… (#6291) 2019-08-07 13:52:57 -04:00
R.B. Boyer 99f3ba341b update changelog 2019-08-07 11:35:21 -05:00
R.B. Boyer 357ca39868
connect: ensure intention replication continues to work when the replication ACL token changes (#6288) 2019-08-07 11:34:09 -05:00
hashicorp-ci 3ac803da5e Merge Consul OSS branch 'master' at commit d84863799deca45ccf4bec5ab9f645ccae6b3aeb 2019-08-06 02:00:30 +00:00
R.B. Boyer 737ef2ca19 update changelog 2019-08-05 17:16:22 -05:00
R.B. Boyer 48f23a6fb6
api: un-deprecate api.DecodeConfigEntry (#6278)
Add clarifying commentary about when it is not safe to use it. Also add
tests.
2019-08-05 17:15:22 -05:00
Sarah Adams 9ed3e64510
fallback to proxy config global protocol when upstream services' protocol is unset (#6277)
fallback to proxy config global protocol when upstream services' protocol is unset

Fixes #5857
2019-08-05 12:52:35 -07:00
R.B. Boyer c0ef080217
Update CHANGELOG.md 2019-08-05 13:33:07 -05:00
R.B. Boyer 64fc002e03
connect: fix failover through a mesh gateway to a remote datacenter (#6259)
Failover is pushed entirely down to the data plane by creating envoy
clusters and putting each successive destination in a different load
assignment priority band. For example this shows that normally requests
go to 1.2.3.4:8080 but when that fails they go to 6.7.8.9:8080:

- name: foo
  load_assignment:
    cluster_name: foo
    policy:
      overprovisioning_factor: 100000
    endpoints:
    - priority: 0
      lb_endpoints:
      - endpoint:
          address:
            socket_address:
              address: 1.2.3.4
              port_value: 8080
    - priority: 1
      lb_endpoints:
      - endpoint:
          address:
            socket_address:
              address: 6.7.8.9
              port_value: 8080

Mesh gateways route requests based solely on the SNI header tacked onto
the TLS layer. Envoy currently only lets you configure the outbound SNI
header at the cluster layer.

If you try to failover through a mesh gateway you ideally would
configure the SNI value per endpoint, but that's not possible in envoy
today.

This PR introduces a simpler way around the problem for now:

1. We identify any target of failover that will use mesh gateway mode local or
   remote and then further isolate any resolver node in the compiled discovery
   chain that has a failover destination set to one of those targets.

2. For each of these resolvers we will perform a small measurement of
   comparative healths of the endpoints that come back from the health API for the
   set of primary target and serial failover targets. We walk the list of targets
   in order and if any endpoint is healthy we return that target, otherwise we
   move on to the next target.

3. The CDS and EDS endpoints both perform the measurements in (2) for the
   affected resolver nodes.

4. For CDS this measurement selects which TLS SNI field to use for the cluster
   (note the cluster is always going to be named for the primary target)

5. For EDS this measurement selects which set of endpoints will populate the
   cluster. Priority tiered failover is ignored.

One of the big downsides to this approach to failover is that the failover
detection and correction is going to be controlled by consul rather than
deferring that entirely to the data plane as with the prior version. This also
means that we are bound to only failover using official health signals and
cannot make use of data plane signals like outlier detection to affect
failover.

In this specific scenario the lack of data plane signals is ok because the
effectiveness is already muted by the fact that the ultimate destination
endpoints will have their data plane signals scrambled when they pass through
the mesh gateway wrapper anyway so we're not losing much.

Another related fix is that we now use the endpoint health from the
underlying service, not the health of the gateway (regardless of
failover mode).
2019-08-05 13:30:35 -05:00
Alvin Huang 4f6523b2d7
Merge pull request #6274 from hashicorp/merge-master-de01a1e
Merge master at de01a1e279230624fcc2d7e692b7e773d570204b
2019-08-02 19:13:54 -04:00
Alvin Huang a9dc90b001 fix grpc-addr-config hosts template 2019-08-02 19:00:39 -04:00
Alvin Huang ae898a4a33 Merge remote-tracking branch 'origin/master' into release/1-6 2019-08-02 18:09:32 -04:00
R.B. Boyer eaeb9998f2 update changelog 2019-08-02 15:36:13 -05:00
R.B. Boyer 0165e93517
connect: expose an API endpoint to compile the discovery chain (#6248)
In addition to exposing compilation over the API cleaned up the structures that would be exchanged to be cleaner and easier to support and understand.

Also removed ability to configure the envoy OverprovisioningFactor.
2019-08-02 15:34:54 -05:00
Matt Keeler 510b1271bc
Update CHANGELOG.md 2019-08-02 16:23:00 -04:00
Matt Keeler 72b8149333
Add license management functions to API client (#6268)
* Add license management functions to API client

* Get rid of jsonapi struct tags
2019-08-02 16:20:38 -04:00
Alvin Huang f834854f8a
add generic master merge into release/* branches (#6249) 2019-08-02 16:11:41 -04:00
Todd Radel 295abd82c3
connect: generate intermediate at same time as root (#6272)
Generate intermediate at same time as root
Co-Authored-By: Freddy <freddygv@users.noreply.github.com>
2019-08-02 15:36:03 -04:00
Alvin Huang f5471c7f8d
Add arm builds (#6263)
* try arm builds

* Update .circleci/config.yml

Co-Authored-By: Matt Keeler <mkeeler@users.noreply.github.com>

* Update .circleci/config.yml

Co-Authored-By: Matt Keeler <mkeeler@users.noreply.github.com>

* Update .circleci/config.yml

Co-Authored-By: Matt Keeler <mkeeler@users.noreply.github.com>
2019-08-02 15:15:59 -04:00
R.B. Boyer 871ebb9dc2 update changelog 2019-08-02 09:19:37 -05:00
R.B. Boyer 4e2fb5730c
connect: detect and prevent circular discovery chain references (#6246) 2019-08-02 09:18:45 -05:00
John Cowen d3930d55aa
ui: Adds readonly meta data to the serviceInstance and node detail pages (#6196) 2019-08-02 13:53:52 +02:00
R.B. Boyer 3177392194 update changelog 2019-08-01 23:07:54 -05:00
R.B. Boyer 6c9edb17c2
server: if inserting bootstrap config entries fails don't silence the errors (#6256) 2019-08-01 23:07:11 -05:00
R.B. Boyer 95d08b8ea8 update changelog 2019-08-01 22:45:01 -05:00
R.B. Boyer 782c647bf4
connect: simplify the compiled discovery chain data structures (#6242)
This should make them better for sending over RPC or the API.

Instead of a chain implemented explicitly like a linked list (nodes
holding pointers to other nodes) instead switch to a flat map of named
nodes with nodes linking other other nodes by name. The shipped
structure is just a map and a string to indicate which key to start
from.

Other changes:

* inline the compiler option InferDefaults as true

* introduce compiled target config to avoid needing to send back
  additional maps of Resolvers; future target-specific compiled state
  can go here

* move compiled MeshGateway out of the Resolver and into the
  TargetConfig where it makes more sense.
2019-08-01 22:44:05 -05:00