Commit Graph

123 Commits

Author SHA1 Message Date
Mitchell Hashimoto 67d8cae7d0 website: update security model 2018-06-25 12:24:18 -07:00
Jim Kalafut 15274b7e36
Fix broken link to SWIM paper 2018-01-21 17:41:58 -08:00
Chad Whitacre 53d1102191 Fix some small doc errors 2018-01-04 16:44:07 -05:00
James Phillips d0b4b18e11
Update coordinates.html.md 2017-10-31 21:23:51 -07:00
James Phillips 31676bba76
Adds a note about not replicating data to FAQ and federation-related spots. 2017-08-04 16:14:39 -07:00
James Phillips 3388daf479 Adds links to Lifeguard info. 2017-07-06 12:19:39 -07:00
Preetha Appan 42d3a3f3db Redo bug fix for stale reads on server startup, leveraging RPCHOldtimeout instead of maxQueryTime, plus tests 2017-06-15 22:41:30 -05:00
Frank Schroeder 2391e8e98a
website: rename *.markdown to *.md 2017-05-17 20:25:45 +02:00
Frank Schroeder 927335c045
Fix imports on website 2017-05-05 17:07:02 +02:00
James Phillips 72b9ae96f5
Fixes deep link on ACL bounce page. 2017-04-06 07:55:23 -07:00
James Phillips 217d304619
Does a complete rework of the ACL guide. 2017-04-05 10:36:19 -07:00
James Phillips 686ddd8c83
Deprecates the ACLs internals doc in favor of a guide. 2017-04-04 18:56:42 -07:00
Seth Vargo b3cd9acdae
Link to new api 2017-04-04 12:52:00 -04:00
Seth Vargo b0bb01d5da
Update API docs 2017-04-04 12:33:35 -04:00
James Phillips 4259ecd8bc
Disables agent-level enforcement on Consul agents unless acl_datacenter is set. 2017-03-29 12:24:42 -07:00
James Phillips 16a9f6d671
Modifies server reconcile path to not use the server's token for internal operations. 2017-03-23 13:34:30 -07:00
needkane 9258df0f5b occasionally->occasionally 2017-01-13 15:34:44 +08:00
James Phillips 8a64bb6445 Adds session policy example to ACL internals doc. 2016-12-14 21:31:59 -08:00
James Phillips 90cd498ea6
Adds some basic documentation about the new ACL changes. 2016-12-14 20:32:44 -08:00
James Phillips 7c0f6bd742 Clarifies ACL replication token. 2016-12-05 18:43:05 -08:00
James Turnbull 25566a292b Removed two space after period exceptions 2016-11-25 13:25:09 -05:00
James Turnbull dd4918fd16 Documentation pass
I was reviewing some docs and found a few issues.

1. Fixed some spelling mistakes.
2. Re-formatted some paragraphs.
3. Changed some potentially loaded language.
4. Fixed some grammar issues.
5. Tried to consistently use syntax-highlighting.
6. Fixed post-period spacing.
7. Fixed some formatting issues and inconsistency.
8. All "notes" are either proper notes or re-written.
2016-11-25 12:02:32 -05:00
Kyle Havlovitz 86ae45c78b Add keyring api website doc sections 2016-11-22 20:10:43 -05:00
Michel Lebeau 4ea1f2e613 Fix typo
The double "to" was distracting
2016-10-11 15:51:49 +01:00
James Phillips 27061563ea Tweaks wording in lifeguard section. 2016-09-14 10:17:23 -07:00
James Phillips b7cf261f38
Adds a section about lifeguard. 2016-09-14 10:09:23 -07:00
James Phillips c063a1a8d0
Updates documentation with details on the Consul operator actions. 2016-08-30 13:15:37 -07:00
kyhavlov 5bd32c0316 Fix links for ACL replication status 2016-08-17 12:41:04 -04:00
James Phillips 31ad878324 Merge pull request #2246 from atomicpirate/patch-1
Minor fix: "lookup up" -> "looking up"
2016-08-12 16:45:41 -07:00
James Phillips 3585b5a4cb Merge pull request #2237 from hashicorp/f-acl-replication
Adds ACL replication.
2016-08-09 11:42:16 -07:00
Seth Vargo dee626c6f2
Update links to serf 2016-08-08 12:44:27 -04:00
atomicpirate d1493cd9ca Minor fix: "lookup up" -> "looking up" 2016-08-05 10:18:13 -04:00
James Phillips 5577b8ef66
Updates documentation for ACL replication. 2016-08-05 00:23:28 -07:00
Seth Vargo 1b2586abd4
Update arch diagram 2016-08-02 13:13:43 +05:30
James Phillips 2dc98dee32 Adds a note about prepared queries to the coordinates internals guide. 2016-06-28 23:02:00 -07:00
Sean Chittenden b20f86b4c7
Speling police 2016-05-15 09:13:52 -07:00
James Phillips 0ed56d6606 Adds a note about template query ACLs. 2016-03-17 08:21:58 -07:00
James Phillips ae7b45a6df Merge pull request #1820 from hashicorp/f-port-docs
Adds a reference to the network ports from the security guide.
2016-03-09 21:22:41 -08:00
James Phillips b2992a5e83 Adds a reference to the network ports from the security page. 2016-03-09 21:21:49 -08:00
James Phillips 72f7c08a0a Cleans up the documents. 2016-02-24 18:05:58 -08:00
James Phillips 2f7eac8b86 Renames "prepared_query" ACL policy to "query". 2016-02-24 17:02:06 -08:00
James Phillips a8ac27fa49 Refactors docs into a more complete state for prepared query ACLs. 2016-02-23 22:27:44 -08:00
James Phillips 633c231d67 Creates new "prepared-query" ACL type and new token capture behavior.
Prior to this change, prepared queries had the following behavior for
ACLs, which will need to change to support templates:

1. A management token, or a token with read access to the service being
   queried needed to be provided in order to create a prepared query.

2. The token used to create the prepared query was stored with the query
   in the state store and used to execute the query.

3. A management token, or the token used to create the query needed to be
   supplied to perform and CRUD operations on an existing prepared query.

This was pretty subtle and complicated behavior, and won't work for
templates since the service name is computed at execution time. To solve
this, we introduce a new "prepared-query" ACL type, where the prefix
applies to the query name for static prepared query types and to the
prefix for template prepared query types.

With this change, the new behavior is:

1. A management token, or a token with "prepared-query" write access to
   the query name or (soon) the given template prefix is required to do
   any CRUD operations on a prepared query, or to list prepared queries
   (the list is filtered by this ACL).

2. You will no longer need a management token to list prepared queries,
   but you will only be able to see prepared queries that you have access
   to (you get an empty list instead of permission denied).

3. When listing or getting a query, because it was easy to capture
   management tokens given the past behavior, this will always blank out
   the "Token" field (replacing the contents as <hidden>) for all tokens
   unless a management token is supplied. Going forward, we should
   discourage people from binding tokens for execution unless strictly
   necessary.

4. No token will be captured by default when a prepared query is created.
   If the user wishes to supply an execution token then can pass it in via
   the "Token" field in the prepared query definition. Otherwise, this
   field will default to empty.

5. At execution time, we will use the captured token if it exists with the
   prepared query definition, otherwise we will use the token that's passed
   in with the request, just like we do for other RPCs (or you can use the
   agent's configured token for DNS).

6. Prepared queries with no name (accessible only by ID) will not require
   ACLs to create or modify (execution time will depend on the service ACL
   configuration). Our argument here is that these are designed to be
   ephemeral and the IDs are as good as an ACL. Management tokens will be
   able to list all of these.

These changes enable templates, but also enable delegation of authority to
manage the prepared query namespace.
2016-02-23 17:12:43 -08:00
csawyerYumaed 793195b7d8 Update documentation - add Network Ports.
Update security.html.markdown add section on Network Port usage.
TODO: add Atlas port usage.
2016-02-23 11:27:15 -08:00
Seth Vargo dc9131a732 Use HTTPS + www. where appropriate 2016-01-13 17:44:01 -05:00
James Phillips 9e29bb4238 Adds and updates docs for prepared queries. 2015-11-15 17:06:00 -08:00
James Phillips 1a3c523816 Adds a note about the new acquire behavior into the sessions internals guide. 2015-11-14 10:28:14 -08:00
James Phillips c2fab40aee Fixes a typo. 2015-10-30 23:50:11 -07:00
James Phillips b3b1c6940b Updates docs for network coordinates. 2015-10-23 15:23:01 -07:00
James Phillips b25797a808 Merge pull request #1187 from sfncook/enable_tag_drift_03
Enable tag drift 03
2015-09-11 15:35:32 -07:00