status-im
/
consul
mirror of https://github.com/status-im/consul.git
2
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge pull request #8230 from hashicorp/je.pin-deps 

📌 Hard Pin Website Dependencies
This commit is contained in:
Jeff Escalante 2020-07-15 18:45:19 -04:00 committed by GitHub
parent c591d40be0 338af8ac6b
commit ecc406562a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
41 changed files with 1213 additions and 1406 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
website/components/basic-hero/index.jsx
View File

@ -39,7 +39,11 @@ export default function BasicHero({
</div> </div>
{links[2] && ( {links[2] && (
<div className="third-link"> <div className="third-link">
<a href={links[2].url} rel="noopener" target="_blank"> <a
href={links[2].url}
rel="noopener noreferrer"
target="_blank"
>
<span className="g-type-buttons-and-standalone-links"> <span className="g-type-buttons-and-standalone-links">
{links[2].text} {links[2].text}
</span> </span>

1982
website/package-lock.json generated
View File

File diff suppressed because it is too large Load Diff

88
website/package.json
View File

@ -4,55 +4,51 @@
"version": "0.0.1", "version": "0.0.1",
"author": "HashiCorp", "author": "HashiCorp",
"dependencies": { "dependencies": {
"@hashicorp/nextjs-scripts": "^10.0.2", "@hashicorp/nextjs-scripts": "11.1.0",
"@hashicorp/react-alert": "^2.0.1", "@hashicorp/react-alert": "2.0.1",
"@hashicorp/react-alert-banner": "^3.1.0", "@hashicorp/react-alert-banner": "3.1.0",
"@hashicorp/react-button": "^2.2.0", "@hashicorp/react-button": "2.2.1",
"@hashicorp/react-call-to-action": "^0.2.0", "@hashicorp/react-call-to-action": "0.2.1",
"@hashicorp/react-case-study-slider": "^2.1.0", "@hashicorp/react-case-study-slider": "2.1.1",
"@hashicorp/react-code-block": "^1.2.7", "@hashicorp/react-code-block": "1.2.7",
"@hashicorp/react-content": "3.0.0-0", "@hashicorp/react-content": "4.0.0",
"@hashicorp/react-docs-page": "^3.0.0", "@hashicorp/react-docs-page": "4.0.0",
"@hashicorp/react-docs-sidenav": "^3.2.3", "@hashicorp/react-docs-sidenav": "3.2.5",
"@hashicorp/react-featured-slider": "^1.1.0", "@hashicorp/react-featured-slider": "1.1.1",
"@hashicorp/react-global-styles": "^4.4.0", "@hashicorp/react-global-styles": "4.4.0",
"@hashicorp/react-head": "^1.1.1", "@hashicorp/react-head": "1.1.1",
"@hashicorp/react-image": "^2.0.1", "@hashicorp/react-image": "2.0.1",
"@hashicorp/react-inline-svg": "^1.0.0", "@hashicorp/react-inline-svg": "1.0.0",
"@hashicorp/react-logo-grid": "^2.1.0", "@hashicorp/react-logo-grid": "2.1.1",
"@hashicorp/react-mega-nav": "^4.0.1-2", "@hashicorp/react-mega-nav": "4.0.1-2",
"@hashicorp/react-product-downloader": "^4.0.0", "@hashicorp/react-product-downloader": "4.0.2",
"@hashicorp/react-product-features-list": "^1.0.1", "@hashicorp/react-product-features-list": "1.0.1",
"@hashicorp/react-section-header": "^2.0.0", "@hashicorp/react-section-header": "2.0.0",
"@hashicorp/react-subnav": "^3.2.2", "@hashicorp/react-subnav": "3.2.3",
"@hashicorp/react-text-and-content": "^4.1.0", "@hashicorp/react-text-and-content": "4.1.1",
"@hashicorp/react-text-split": "^0.3.0", "@hashicorp/react-text-split": "0.3.1",
"@hashicorp/react-text-split-with-code": "0.1.0", "@hashicorp/react-text-split-with-code": "0.1.1",
"@hashicorp/react-text-split-with-image": "^1.3.0", "@hashicorp/react-text-split-with-image": "1.3.1",
"@hashicorp/react-text-split-with-logo-grid": "^1.1.0", "@hashicorp/react-text-split-with-logo-grid": "1.1.1",
"@hashicorp/react-use-cases": "^1.0.4", "@hashicorp/react-use-cases": "1.0.4",
"@hashicorp/react-vertical-text-block-list": "^2.0.1", "@hashicorp/react-vertical-text-block-list": "2.0.1",
"algoliasearch": "^4.3.0", "algoliasearch": "4.3.0",
"babel-plugin-import-glob-array": "^0.2.0", "babel-plugin-import-glob-array": "0.2.0",
"dotenv": "^8.2.0", "dotenv": "8.2.0",
"gray-matter": "^4.0.2", "gray-matter": "4.0.2",
"imagemin-mozjpeg": "^9.0.0",
"imagemin-optipng": "^8.0.0",
"imagemin-svgo": "^8.0.0",
"next": "9.4.4", "next": "9.4.4",
"nuka-carousel": "^4.7.0", "nuka-carousel": "4.7.0",
"react": "^16.13.1", "react": "16.13.1",
"react-device-detect": "^1.12.1", "react-device-detect": "1.13.1",
"react-dom": "^16.13.1", "react-dom": "16.13.1",
"remark": "^12.0.0", "remark": "12.0.0",
"unist-util-visit": "^2.0.2" "unist-util-visit": "2.0.2"
}, },
"devDependencies": { "devDependencies": {
"dart-linkcheck": "^2.0.15", "dart-linkcheck": "2.0.15",
"glob": "^7.1.6", "glob": "7.1.6",
"husky": "^4.2.5", "husky": "4.2.5",
"inquirer": "^7.1.0", "prettier": "2.0.5"
"prettier": "^2.0.5"
}, },
"husky": { "husky": {
"hooks": { "hooks": {

12
website/pages/api-docs/catalog.mdx
View File

@ -908,8 +908,8 @@ top level object. The following selectors and filter operations are supported:
This endpoint returns the services associated with an ingress gateway or terminating gateway. This endpoint returns the services associated with an ingress gateway or terminating gateway.
| Method | Path | Produces | | Method | Path | Produces |
| ------ | ------------------------------ | ------------------ | | ------ | ------------------------------------ | ------------------ |
| `GET` | `/catalog/gateway-services/:gateway` | `application/json` | | `GET` | `/catalog/gateway-services/:gateway` | `application/json` |
The table below shows this endpoint's support for The table below shows this endpoint's support for
@ -918,8 +918,8 @@ The table below shows this endpoint's support for
[agent caching](/api/features/caching), and [agent caching](/api/features/caching), and
[required ACLs](/api#authentication). [required ACLs](/api#authentication).
| Blocking Queries | Consistency Modes | Agent Caching | ACL Required | | Blocking Queries | Consistency Modes | Agent Caching | ACL Required |
| ---------------- | ----------------- | ------------- | ------------------------ | | ---------------- | ----------------- | ------------- | -------------- |
| `YES` | `all` | `none` | `service:read` | | `YES` | `all` | `none` | `service:read` |
### Parameters ### Parameters
@ -964,7 +964,7 @@ $ curl \
"SNI": "api.my-domain", "SNI": "api.my-domain",
"CreateIndex": 16, "CreateIndex": 16,
"ModifyIndex": 16 "ModifyIndex": 16
}, },
{ {
"Gateway": { "Gateway": {
"Name": "my-terminating-gateway", "Name": "my-terminating-gateway",
@ -995,7 +995,7 @@ $ curl \
"GatewayKind": "ingress-gateway", "GatewayKind": "ingress-gateway",
"Port": 8888, "Port": 8888,
"Protocol": "http", "Protocol": "http",
"Hosts": ["api.mydomain.com"], "Hosts": ["api.mydomain.com"],
"CreateIndex": 15, "CreateIndex": 15,
"ModifyIndex": 15 "ModifyIndex": 15
}, },

40
website/pages/api-docs/config.mdx
View File

@ -39,7 +39,7 @@ The table below shows this endpoint's support for
</p> </p>
| Config Entry Kind | Required ACL | | Config Entry Kind | Required ACL |
| ----------------- | ---------------- | | ------------------- | ---------------- |
| ingress-gateway | `operator:write` | | ingress-gateway | `operator:write` |
| proxy-defaults | `operator:write` | | proxy-defaults | `operator:write` |
| service-defaults | `service:write` | | service-defaults | `service:write` |
@ -104,15 +104,15 @@ The table below shows this endpoint's support for
<sup>1</sup> The ACL required depends on the config entry kind being read: <sup>1</sup> The ACL required depends on the config entry kind being read:
| Config Entry Kind | Required ACL | | Config Entry Kind | Required ACL |
| ----------------- | ---------------- | | ------------------- | -------------- |
| ingress-gateway | `service:read` | | ingress-gateway | `service:read` |
| proxy-defaults | `<none>` | | proxy-defaults | `<none>` |
| service-defaults | `service:read` | | service-defaults | `service:read` |
| service-resolver | `service:read` | | service-resolver | `service:read` |
| service-router | `service:read` | | service-router | `service:read` |
| service-splitter | `service:read` | | service-splitter | `service:read` |
| terminating-gateway | `service:read` | | terminating-gateway | `service:read` |
### Parameters ### Parameters
@ -171,15 +171,15 @@ The table below shows this endpoint's support for
<sup>1</sup> The ACL required depends on the config entry kind being read: <sup>1</sup> The ACL required depends on the config entry kind being read:
| Config Entry Kind | Required ACL | | Config Entry Kind | Required ACL |
| ----------------- | ---------------- | | ------------------- | -------------- |
| ingress-gateway | `service:read` | | ingress-gateway | `service:read` |
| proxy-defaults | `<none>` | | proxy-defaults | `<none>` |
| service-defaults | `service:read` | | service-defaults | `service:read` |
| service-resolver | `service:read` | | service-resolver | `service:read` |
| service-router | `service:read` | | service-router | `service:read` |
| service-splitter | `service:read` | | service-splitter | `service:read` |
| terminating-gateway | `service:read` | | terminating-gateway | `service:read` |
### Parameters ### Parameters
@ -245,7 +245,7 @@ The table below shows this endpoint's support for
<sup>1</sup> The ACL required depends on the config entry kind being deleted: <sup>1</sup> The ACL required depends on the config entry kind being deleted:
| Config Entry Kind | Required ACL | | Config Entry Kind | Required ACL |
| ----------------- | ---------------- | | ------------------- | ---------------- |
| ingress-gateway | `operator:write` | | ingress-gateway | `operator:write` |
| proxy-defaults | `operator:write` | | proxy-defaults | `operator:write` |
| service-defaults | `service:write` | | service-defaults | `service:write` |

4
website/pages/docs/acl/acl-legacy.mdx
View File

@ -199,7 +199,7 @@ as to whether they are set on servers, clients, or both.
| Configuration Option | Servers | Clients | Purpose | | Configuration Option | Servers | Clients | Purpose |
| --------------------------------------------------------------------- | ---------- | ---------- | ----------------------------------------------------------------------------------------- | | --------------------------------------------------------------------- | ---------- | ---------- | ----------------------------------------------------------------------------------------- |
| [`acl_datacenter`](/docs/agent/options#acl_datacenter) | `REQUIRED` | `REQUIRED` | Master control that enables ACLs by defining the authoritative Consul datacenter for ACLs | | [`acl_datacenter`](/docs/agent/options#acl_datacenter) | `REQUIRED` | `REQUIRED` | Master control that enables ACLs by defining the authoritative Consul datacenter for ACLs |
| [`acl_default_policy`](/docs/agent/options#acl_default_policy_legacy) | `OPTIONAL` | `N/A` | Determines allowlist or denylist mode | | [`acl_default_policy`](/docs/agent/options#acl_default_policy_legacy) | `OPTIONAL` | `N/A` | Determines allowlist or denylist mode |
| [`acl_down_policy`](/docs/agent/options#acl_down_policy_legacy) | `OPTIONAL` | `OPTIONAL` | Determines what to do when the ACL datacenter is offline | | [`acl_down_policy`](/docs/agent/options#acl_down_policy_legacy) | `OPTIONAL` | `OPTIONAL` | Determines what to do when the ACL datacenter is offline |
| [`acl_ttl`](/docs/agent/options#acl_ttl_legacy) | `OPTIONAL` | `OPTIONAL` | Determines time-to-live for cached ACLs | | [`acl_ttl`](/docs/agent/options#acl_ttl_legacy) | `OPTIONAL` | `OPTIONAL` | Determines time-to-live for cached ACLs |
@ -277,7 +277,7 @@ datacenter. In this example, we are configuring the following:
2. An ACL master token of "b1gs33cr3t"; see below for an alternative using the [/v1/acl/bootstrap API](/api/acl/acl#bootstrap-acls) 2. An ACL master token of "b1gs33cr3t"; see below for an alternative using the [/v1/acl/bootstrap API](/api/acl/acl#bootstrap-acls)
3. A default policy of "deny" which means we are in allowlist mode 3. A default policy of "deny" which means we are in allowlist mode
4. A down policy of "extend-cache" which means that we will ignore token TTLs 4. A down policy of "extend-cache" which means that we will ignore token TTLs
during an outage during an outage
Here's the corresponding JSON configuration file: Here's the corresponding JSON configuration file:

2
website/pages/docs/acl/acl-system.mdx
View File

@ -279,7 +279,7 @@ as to whether they are set on servers, clients, or both.
| Configuration Option | Servers | Clients | Purpose | | Configuration Option | Servers | Clients | Purpose |
| -------------------------------------------------------------- | ---------- | ---------- | ---------------------------------------------------------------------- | | -------------------------------------------------------------- | ---------- | ---------- | ---------------------------------------------------------------------- |
| [`acl.enabled`](/docs/agent/options#acl_enabled) | `REQUIRED` | `REQUIRED` | Controls whether ACLs are enabled | | [`acl.enabled`](/docs/agent/options#acl_enabled) | `REQUIRED` | `REQUIRED` | Controls whether ACLs are enabled |
| [`acl.default_policy`](/docs/agent/options#acl_default_policy) | `OPTIONAL` | `N/A` | Determines allowlist or denylist mode | | [`acl.default_policy`](/docs/agent/options#acl_default_policy) | `OPTIONAL` | `N/A` | Determines allowlist or denylist mode |
| [`acl.down_policy`](/docs/agent/options#acl_down_policy) | `OPTIONAL` | `OPTIONAL` | Determines what to do when the remote token or policy resolution fails | | [`acl.down_policy`](/docs/agent/options#acl_down_policy) | `OPTIONAL` | `OPTIONAL` | Determines what to do when the remote token or policy resolution fails |
| [`acl.role_ttl`](/docs/agent/options#acl_role_ttl) | `OPTIONAL` | `OPTIONAL` | Determines time-to-live for cached ACL Roles | | [`acl.role_ttl`](/docs/agent/options#acl_role_ttl) | `OPTIONAL` | `OPTIONAL` | Determines time-to-live for cached ACL Roles |
| [`acl.policy_ttl`](/docs/agent/options#acl_policy_ttl) | `OPTIONAL` | `OPTIONAL` | Determines time-to-live for cached ACL Policies | | [`acl.policy_ttl`](/docs/agent/options#acl_policy_ttl) | `OPTIONAL` | `OPTIONAL` | Determines time-to-live for cached ACL Policies |

10
website/pages/docs/acl/auth-methods/index.mdx
View File

@ -35,11 +35,11 @@ service mesh with minimal operator intervention.
## Supported Types ## Supported Types
| Types | Consul Version | | Types | Consul Version |
| ----- | -------------- | | ------------------------------------------------- | --------------------------------- |
| [`kubernetes`](/docs/acl/auth-methods/kubernetes) | 1.5.0+ | | [`kubernetes`](/docs/acl/auth-methods/kubernetes) | 1.5.0+ |
| [`jwt`](/docs/acl/auth-methods/jwt) | 1.8.0+ | | [`jwt`](/docs/acl/auth-methods/jwt) | 1.8.0+ |
| [`oidc`](/docs/acl/auth-methods/oidc) | 1.8.0+ <EnterpriseAlert inline /> | | [`oidc`](/docs/acl/auth-methods/oidc) | 1.8.0+ <EnterpriseAlert inline /> |
## Operator Configuration ## Operator Configuration

8
website/pages/docs/acl/auth-methods/jwt.mdx
View File

@ -14,7 +14,7 @@ description: >-
-> **1.8.0+:** This feature is available in Consul versions 1.8.0 and newer. -> **1.8.0+:** This feature is available in Consul versions 1.8.0 and newer.
The `jwt` auth method can be used to authenticate with Consul by providing a The `jwt` auth method can be used to authenticate with Consul by providing a
[JWT](https://en.wikipedia.org/wiki/JSON_Web_Token) directly. The JWT is [JWT](https://en.wikipedia.org/wiki/JSON_Web_Token) directly. The JWT is
cryptographically verified using locally-provided keys, or, if configured, an cryptographically verified using locally-provided keys, or, if configured, an
OIDC Discovery service can be used to fetch the appropriate keys. OIDC Discovery service can be used to fetch the appropriate keys.
@ -79,15 +79,15 @@ parameters are required to properly configure an auth method of type
claim in a JWT. claim in a JWT.
- `ExpirationLeeway` `(duration: 0s)` - Duration in seconds of leeway when - `ExpirationLeeway` `(duration: 0s)` - Duration in seconds of leeway when
validating expiration of a token to account for clock skew. Defaults to 150 validating expiration of a token to account for clock skew. Defaults to 150
(2.5 minutes) if set to 0 and can be disabled if set to -1. (2.5 minutes) if set to 0 and can be disabled if set to -1.
- `NotBeforeLeeway` `(duration: 0s)` - Duration in seconds of leeway when - `NotBeforeLeeway` `(duration: 0s)` - Duration in seconds of leeway when
validating not before values of a token to account for clock skew. Defaults validating not before values of a token to account for clock skew. Defaults
to 150 (2.5 minutes) if set to 0 and can be disabled if set to -1. to 150 (2.5 minutes) if set to 0 and can be disabled if set to -1.
- `ClockSkewLeeway` `(duration: 0s)` - Duration in seconds of leeway when - `ClockSkewLeeway` `(duration: 0s)` - Duration in seconds of leeway when
validating all claims to account for clock skew. Defaults to 60 (1 minute) validating all claims to account for clock skew. Defaults to 60 (1 minute)
if set to 0 and can be disabled if set to -1. if set to 0 and can be disabled if set to -1.
### Sample Configs ### Sample Configs

53
website/pages/docs/agent/config-entries/ingress-gateway.mdx
View File

@ -11,35 +11,36 @@ description: >-
-> **1.8.0+:** This config entry is available in Consul versions 1.8.0 and newer. -> **1.8.0+:** This config entry is available in Consul versions 1.8.0 and newer.
The `ingress-gateway` config entry kind allows you to configure ingress gateways The `ingress-gateway` config entry kind allows you to configure ingress gateways
with listeners that expose a set of services outside the Consul service mesh. with listeners that expose a set of services outside the Consul service mesh.
See [Ingress Gateway](/docs/connect/ingress-gateway) for more information. See [Ingress Gateway](/docs/connect/ingress-gateway) for more information.
~> [Configuration entries](/docs/agent/config-entries) are global in scope. A configuration entry for a gateway name applies ~> [Configuration entries](/docs/agent/config-entries) are global in scope. A configuration entry for a gateway name applies
across all federated Consul datacenters. If ingress gateways in different Consul datacenters need to route to different across all federated Consul datacenters. If ingress gateways in different Consul datacenters need to route to different
sets of services within their datacenter then the ingress gateways **must** be registered with different names. sets of services within their datacenter then the ingress gateways **must** be registered with different names.
See [Ingress Gateway](/docs/connect/ingress-gateway) for more information. See [Ingress Gateway](/docs/connect/ingress-gateway) for more information.
## Wildcard service specification ## Wildcard service specification
Ingress gateways can optionally target all services within a Consul namespace by Ingress gateways can optionally target all services within a Consul namespace by
specifying a wildcard `*` as the service name. A wildcard specifier allows specifying a wildcard `*` as the service name. A wildcard specifier allows
for a single listener to route traffic to all available services on the for a single listener to route traffic to all available services on the
Consul service mesh, differentiating between the services by their host/authority Consul service mesh, differentiating between the services by their host/authority
header. header.
A wildcard specifier provides the following properties for an ingress A wildcard specifier provides the following properties for an ingress
gateway: gateway:
- All services with the same
[protocol](/docs/agent/config-entries/ingress-gateway#protocol) as the
listener will be routable.
- The ingress gateway will route traffic based on the host/authority header,
expecting a value matching `<service-name>.ingress.*`, or if using namespaces,
`<service-name>.ingress.<namespace>.*`. This matches the [Consul DNS
ingress subdomain](/docs/agent/dns#ingress-service-lookups).
A wildcard specifier cannot be set on a listener of protocol `tcp`. - All services with the same
[protocol](/docs/agent/config-entries/ingress-gateway#protocol) as the
listener will be routable.
- The ingress gateway will route traffic based on the host/authority header,
expecting a value matching `<service-name>.ingress.*`, or if using namespaces,
`<service-name>.ingress.<namespace>.*`. This matches the [Consul DNS
ingress subdomain](/docs/agent/dns#ingress-service-lookups).
A wildcard specifier cannot be set on a listener of protocol `tcp`.
## Sample Config Entries ## Sample Config Entries
@ -325,16 +326,16 @@ Also make two services in the frontend namespace available over a custom port wi
- `Namespace` `(string: "default")` - <EnterpriseAlert inline /> Specifies - `Namespace` `(string: "default")` - <EnterpriseAlert inline /> Specifies
the namespace the config entry will apply to. This must be the namespace the namespace the config entry will apply to. This must be the namespace
the gateway is registered in. If omitted, the namespace will be inherited the gateway is registered in. If omitted, the namespace will be inherited
from [the request](/api/config#ns) or will default to the `default` namespace. from [the request](/api/config#ns) or will default to the `default` namespace.
- `TLS` `(TLSConfig: <optional>)` - TLS configuration for this gateway. - `TLS` `(TLSConfig: <optional>)` - TLS configuration for this gateway.
- `Enabled` `(bool: false)` - Set this configuration to enable TLS for - `Enabled` `(bool: false)` - Set this configuration to enable TLS for
every listener on the gateway. every listener on the gateway.
If TLS is enabled, then each host defined in the `Host` field will be added If TLS is enabled, then each host defined in the `Host` field will be added
as a DNSSAN to the gateway's x509 certificate. as a DNSSAN to the gateway's x509 certificate.
- `Listeners` `(array<IngressListener>: <optional>)` - A list of listeners that - `Listeners` `(array<IngressListener>: <optional>)` - A list of listeners that
the ingress gateway should setup, uniquely identified by their port number. the ingress gateway should setup, uniquely identified by their port number.

75
website/pages/docs/agent/config-entries/terminating-gateway.mdx
View File

@ -11,35 +11,36 @@ description: >-
-> **1.8.0+:** This config entry is available in Consul versions 1.8.0 and newer. -> **1.8.0+:** This config entry is available in Consul versions 1.8.0 and newer.
The `terminating-gateway` config entry kind you to configure terminating gateways The `terminating-gateway` config entry kind you to configure terminating gateways
to proxy traffic from services in the Consul service mesh to services registered with Consul that do not have a to proxy traffic from services in the Consul service mesh to services registered with Consul that do not have a
[Connect service sidecar proxy](/docs/connect/proxies). The configuration is associated with the name of a gateway service [Connect service sidecar proxy](/docs/connect/proxies). The configuration is associated with the name of a gateway service
and will apply to all instances of the gateway with that name. and will apply to all instances of the gateway with that name.
~> [Configuration entries](/docs/agent/config-entries) are global in scope. A configuration entry for a gateway name applies ~> [Configuration entries](/docs/agent/config-entries) are global in scope. A configuration entry for a gateway name applies
across all federated Consul datacenters. If terminating gateways in different Consul datacenters need to route to different across all federated Consul datacenters. If terminating gateways in different Consul datacenters need to route to different
sets of services within their datacenter then the terminating gateways **must** be registered with different names. sets of services within their datacenter then the terminating gateways **must** be registered with different names.
See [Terminating Gateway](/docs/connect/terminating-gateway) for more information. See [Terminating Gateway](/docs/connect/terminating-gateway) for more information.
## TLS Origination ## TLS Origination
By specifying a path to a [CA file](/docs/agent/config-entries/terminating-gateway#cafile) connections
from the terminating gateway will be encrypted using one-way TLS authentication. If a path to a
[client certificate](/docs/agent/config-entries/terminating-gateway#certfile)
and [private key](/docs/agent/config-entries/terminating-gateway#keyfile) are also specified connections
from the terminating gateway will be encrypted using mutual TLS authentication.
If none of these are provided, Consul will **only** encrypt connections to the gateway and not By specifying a path to a [CA file](/docs/agent/config-entries/terminating-gateway#cafile) connections
from the gateway to the destination service. from the terminating gateway will be encrypted using one-way TLS authentication. If a path to a
[client certificate](/docs/agent/config-entries/terminating-gateway#certfile)
and [private key](/docs/agent/config-entries/terminating-gateway#keyfile) are also specified connections
from the terminating gateway will be encrypted using mutual TLS authentication.
If none of these are provided, Consul will **only** encrypt connections to the gateway and not
from the gateway to the destination service.
## Wildcard service specification ## Wildcard service specification
Terminating gateways can optionally target all services within a Consul namespace by specifying a wildcard "*" Terminating gateways can optionally target all services within a Consul namespace by specifying a wildcard "\*"
as the service name. Configuration options set on the wildcard act as defaults that can be overridden as the service name. Configuration options set on the wildcard act as defaults that can be overridden
by options set on a specific service name. by options set on a specific service name.
Note that if the wildcard specifier is used, and some services in that namespace have a Connect sidecar proxy, Note that if the wildcard specifier is used, and some services in that namespace have a Connect sidecar proxy,
traffic from the mesh to those services will be evenly load-balanced between the gateway and their sidecars. traffic from the mesh to those services will be evenly load-balanced between the gateway and their sidecars.
## Sample Config Entries ## Sample Config Entries
@ -351,12 +352,12 @@ Also override the SNI and CA file used for connections to the billing service:
"CAFile": "/etc/billing-ca/ca-chain.cert.pem", "CAFile": "/etc/billing-ca/ca-chain.cert.pem",
"KeyFile": "/etc/certs/gateway.key.pem", "KeyFile": "/etc/certs/gateway.key.pem",
"CertFile": "/etc/certs/gateway.cert.pem", "CertFile": "/etc/certs/gateway.cert.pem",
"SNI": "billing.service.com" "SNI": "billing.service.com"
}, },
{ {
"Name": "billing", "Name": "billing",
"CAFile": "/etc/billing-ca/ca-chain.cert.pem", "CAFile": "/etc/billing-ca/ca-chain.cert.pem",
"SNI": "billing.service.com" "SNI": "billing.service.com"
} }
] ]
} }
@ -380,13 +381,13 @@ and configure default certificates for mutual TLS. Also override the SNI and CA
"CAFile": "/etc/billing-ca/ca-chain.cert.pem", "CAFile": "/etc/billing-ca/ca-chain.cert.pem",
"KeyFile": "/etc/certs/gateway.key.pem", "KeyFile": "/etc/certs/gateway.key.pem",
"CertFile": "/etc/certs/gateway.cert.pem", "CertFile": "/etc/certs/gateway.cert.pem",
"SNI": "billing.service.com" "SNI": "billing.service.com"
}, },
{ {
"Namespace": "finance", "Namespace": "finance",
"Name": "billing", "Name": "billing",
"CAFile": "/etc/billing-ca/ca-chain.cert.pem", "CAFile": "/etc/billing-ca/ca-chain.cert.pem",
"SNI": "billing.service.com" "SNI": "billing.service.com"
} }
] ]
} }
@ -402,37 +403,37 @@ and configure default certificates for mutual TLS. Also override the SNI and CA
- `Name` `(string: <required>)` - Set to the name of the gateway being configured. - `Name` `(string: <required>)` - Set to the name of the gateway being configured.
- `Namespace` `(string: "default")` - <EnterpriseAlert inline /> Specifies the namespace - `Namespace` `(string: "default")` - <EnterpriseAlert inline /> Specifies the namespace
the config entry will apply to. This must be the namespace the gateway is registered in. the config entry will apply to. This must be the namespace the gateway is registered in.
If omitted, the namespace will be inherited from [the request](/api/config#ns) If omitted, the namespace will be inherited from [the request](/api/config#ns)
or will default to the `default` namespace. or will default to the `default` namespace.
- `Services` `(array<LinkedService>: <optional>)` - A list of services to link - `Services` `(array<LinkedService>: <optional>)` - A list of services to link
with the gateway. The gateway will proxy traffic to these services. These linked services with the gateway. The gateway will proxy traffic to these services. These linked services
must be registered with Consul for the gateway to discover their addresses. They must also must be registered with Consul for the gateway to discover their addresses. They must also
be registered in the same Consul datacenter as the terminating gateway. be registered in the same Consul datacenter as the terminating gateway.
- `Name` `(string: "")` - The name of the service to link with the gateway. - `Name` `(string: "")` - The name of the service to link with the gateway.
If the wildcard specifier, `*`, is provided, then ALL services within the namespace If the wildcard specifier, `*`, is provided, then ALL services within the namespace
will be linked with the gateway. will be linked with the gateway.
- `Namespace` `(string: "")` - <EnterpriseAlert inline /> The namespace of the service. - `Namespace` `(string: "")` - <EnterpriseAlert inline /> The namespace of the service.
If omitted, the namespace will be inherited from the config entry. If omitted, the namespace will be inherited from the config entry.
- `CAFile` `(string: "")` - A file path to a PEM-encoded certificate authority. - `CAFile` `(string: "")` - A file path to a PEM-encoded certificate authority.
The file must be present on the proxy's filesystem. The file must be present on the proxy's filesystem.
The certificate authority is used to verify the authenticity of the service linked with the gateway. The certificate authority is used to verify the authenticity of the service linked with the gateway.
It can be provided along with a CertFile and KeyFile for mutual TLS authentication, or on its own It can be provided along with a CertFile and KeyFile for mutual TLS authentication, or on its own
for one-way TLS authentication. If none is provided the gateway **will not** encrypt the traffic to the destination. for one-way TLS authentication. If none is provided the gateway **will not** encrypt the traffic to the destination.
- `CertFile` `(string: "")` - A file path to a PEM-encoded certificate. - `CertFile` `(string: "")` - A file path to a PEM-encoded certificate.
The file must be present on the proxy's filesystem. The file must be present on the proxy's filesystem.
The certificate is provided servers to verify the gateway's authenticity. It must be provided if a KeyFile was specified. The certificate is provided servers to verify the gateway's authenticity. It must be provided if a KeyFile was specified.
- `KeyFile` `(string: "")` - A file path to a PEM-encoded private key. - `KeyFile` `(string: "")` - A file path to a PEM-encoded private key.
The file must be present on the proxy's filesystem. The file must be present on the proxy's filesystem.
The key is used with the certificate to verify the gateway's authenticity. It must be provided along if a CertFile was specified. The key is used with the certificate to verify the gateway's authenticity. It must be provided along if a CertFile was specified.
- `SNI` `(string: "")` - An optional hostname or domain name to specify during the TLS handshake. - `SNI` `(string: "")` - An optional hostname or domain name to specify during the TLS handshake.
## ACLs ## ACLs

4
website/pages/docs/agent/index.mdx
View File

@ -62,14 +62,14 @@ There are several important messages that
[`-node`](/docs/agent/options#_node) flag. [`-node`](/docs/agent/options#_node) flag.
- **Datacenter**: This is the datacenter in which the agent is configured to - **Datacenter**: This is the datacenter in which the agent is configured to
run. run.
Consul has first-class support for multiple datacenters; however, to work Consul has first-class support for multiple datacenters; however, to work
efficiently, each node must be configured to report its datacenter. The efficiently, each node must be configured to report its datacenter. The
[`-datacenter`](/docs/agent/options#_datacenter) flag can be used to set the [`-datacenter`](/docs/agent/options#_datacenter) flag can be used to set the
datacenter. For single-DC configurations, the agent will default to "dc1". datacenter. For single-DC configurations, the agent will default to "dc1".
- **Server**: This indicates whether the agent is running in server or client - **Server**: This indicates whether the agent is running in server or client
mode. mode.
Server nodes have the extra burden of participating in the consensus quorum, Server nodes have the extra burden of participating in the consensus quorum,
storing cluster state, and handling queries. Additionally, a server may be storing cluster state, and handling queries. Additionally, a server may be
in ["bootstrap"](/docs/agent/options#_bootstrap_expect) mode. Multiple servers in ["bootstrap"](/docs/agent/options#_bootstrap_expect) mode. Multiple servers

76
website/pages/docs/agent/options.mdx
View File

@ -825,51 +825,51 @@ Valid time units are 'ns', 'us' (or 'µs'), 'ms', 's', 'm', 'h'."
- `serf_wan_allowed_cidrs` ((#serf_wan_allowed_cidrs)) Equivalent to the [`-serf-wan-allowed-cidrs` command-line flag](#_serf_wan_allowed_cidrs). - `serf_wan_allowed_cidrs` ((#serf_wan_allowed_cidrs)) Equivalent to the [`-serf-wan-allowed-cidrs` command-line flag](#_serf_wan_allowed_cidrs).
- `audit` <EnterpriseAlert inline /> - Added in Consul 1.8, the audit object allow users to enable auditing - `audit` <EnterpriseAlert inline /> - Added in Consul 1.8, the audit object allow users to enable auditing
and configure a sink and filters for their audit logs. and configure a sink and filters for their audit logs.
```hcl ```hcl
audit { audit {
enabled = true enabled = true
sink "My sink" { sink "My sink" {
type = "file" type = "file"
format = "json" format = "json"
path = "data/audit/audit.json" path = "data/audit/audit.json"
delivery_guarantee = "best-effort" delivery_guarantee = "best-effort"
rotate_duration = "24h" rotate_duration = "24h"
rotate_max_files = 15 rotate_max_files = 15
rotate_bytes = 25165824 rotate_bytes = 25165824
} }
} }
``` ```
The following sub-keys are available: The following sub-keys are available:
- `enabled` - Controls whether Consul logs out each time a user - `enabled` - Controls whether Consul logs out each time a user
performs an operation. ACLs must be enabled to use this feature. Defaults to `false`. performs an operation. ACLs must be enabled to use this feature. Defaults to `false`.
- `sink` - This object provides configuration for the destination to which - `sink` - This object provides configuration for the destination to which
Consul will log auditing events. Sink is an object containing keys to sink objects, where the key is the name of the sink. Consul will log auditing events. Sink is an object containing keys to sink objects, where the key is the name of the sink.
- `type` - Type specifies what kind of sink this is. - `type` - Type specifies what kind of sink this is.
The following keys are valid: The following keys are valid:
- `file` - Currently only file sinks are available, they take the following keys. - `file` - Currently only file sinks are available, they take the following keys.
- `format` - Format specifies what format the events will - `format` - Format specifies what format the events will
be emitted with. be emitted with.
The following keys are valid: The following keys are valid:
- `json` - Currently only json events are offered. - `json` - Currently only json events are offered.
- `path` - The directory and filename to write audit events to. - `path` - The directory and filename to write audit events to.
- `delivery_guarantee` - Specifies - `delivery_guarantee` - Specifies
the rules governing how audit events are written. the rules governing how audit events are written.
The following keys are valid: The following keys are valid:
- `best-effort` - Consul only supports `best-effort` event delivery. - `best-effort` - Consul only supports `best-effort` event delivery.
- `rotate_duration` - Specifies the - `rotate_duration` - Specifies the
interval by which the system rotates to a new log file. At least one of `rotate_duration` or `rotate_bytes` interval by which the system rotates to a new log file. At least one of `rotate_duration` or `rotate_bytes`
must be configured to enable audit logging. must be configured to enable audit logging.
- `rotate_max_files` - Defines the - `rotate_max_files` - Defines the
limit that Consul should follow before it deletes old log files. limit that Consul should follow before it deletes old log files.
- `rotate_bytes` - Specifies how large an - `rotate_bytes` - Specifies how large an
individual log file can grow before Consul rotates to a new file. At least one of `rotate_bytes` or individual log file can grow before Consul rotates to a new file. At least one of `rotate_bytes` or
`rotate_duration` must be configured to enable audit logging. `rotate_duration` must be configured to enable audit logging.
- `autopilot` Added in Consul 0.8, this object allows a - `autopilot` Added in Consul 0.8, this object allows a
number of sub-keys to be set which can configure operator-friendly settings for number of sub-keys to be set which can configure operator-friendly settings for

16
website/pages/docs/agent/telemetry.mdx
View File

@ -147,9 +147,9 @@ This is a full list of metrics emitted by Consul.
| `consul.client.api.catalog_register.` | This increments whenever a Consul agent receives a catalog register request. | requests | counter | | `consul.client.api.catalog_register.` | This increments whenever a Consul agent receives a catalog register request. | requests | counter |
| `consul.client.api.success.catalog_register.` | This increments whenever a Consul agent successfully responds to a catalog register request. | requests | counter | | `consul.client.api.success.catalog_register.` | This increments whenever a Consul agent successfully responds to a catalog register request. | requests | counter |
| `consul.client.rpc.error.catalog_register.` | This increments whenever a Consul agent receives an RPC error for a catalog register request. | errors | counter | | `consul.client.rpc.error.catalog_register.` | This increments whenever a Consul agent receives an RPC error for a catalog register request. | errors | counter |
| `consul.client.api.catalog_deregister.` | This increments whenever a Consul agent receives a catalog deregister request. | requests | counter | | `consul.client.api.catalog_deregister.` | This increments whenever a Consul agent receives a catalog deregister request. | requests | counter |
| `consul.client.api.success.catalog_deregister.` | This increments whenever a Consul agent successfully responds to a catalog deregister request. | requests | counter | | `consul.client.api.success.catalog_deregister.` | This increments whenever a Consul agent successfully responds to a catalog deregister request. | requests | counter |
| `consul.client.rpc.error.catalog_deregister.` | This increments whenever a Consul agent receives an RPC error for a catalog deregister request. | errors | counter | | `consul.client.rpc.error.catalog_deregister.` | This increments whenever a Consul agent receives an RPC error for a catalog deregister request. | errors | counter |
| `consul.client.api.catalog_datacenters.` | This increments whenever a Consul agent receives a request to list datacenters in the catalog. | requests | counter | | `consul.client.api.catalog_datacenters.` | This increments whenever a Consul agent receives a request to list datacenters in the catalog. | requests | counter |
| `consul.client.api.success.catalog_datacenters.` | This increments whenever a Consul agent successfully responds to a request to list datacenters. | requests | counter | | `consul.client.api.success.catalog_datacenters.` | This increments whenever a Consul agent successfully responds to a request to list datacenters. | requests | counter |
| `consul.client.rpc.error.catalog_datacenters.` | This increments whenever a Consul agent receives an RPC error for a request to list datacenters. | errors | counter | | `consul.client.rpc.error.catalog_datacenters.` | This increments whenever a Consul agent receives an RPC error for a request to list datacenters. | errors | counter |
@ -163,11 +163,11 @@ This is a full list of metrics emitted by Consul.
| `consul.client.api.success.catalog_service_nodes.` | This increments whenever a Consul agent successfully responds to a request to list nodes offering a service. | requests | counter | | `consul.client.api.success.catalog_service_nodes.` | This increments whenever a Consul agent successfully responds to a request to list nodes offering a service. | requests | counter |
| `consul.client.rpc.error.catalog_service_nodes.` | This increments whenever a Consul agent receives an RPC error for a request to list nodes offering a service. | errors | counter | | `consul.client.rpc.error.catalog_service_nodes.` | This increments whenever a Consul agent receives an RPC error for a request to list nodes offering a service. | errors | counter |
| `consul.client.api.catalog_node_services.` | This increments whenever a Consul agent receives a request to list services registered in a node. | requests | counter | | `consul.client.api.catalog_node_services.` | This increments whenever a Consul agent receives a request to list services registered in a node. | requests | counter |
| `consul.client.api.success.catalog_node_services.` | This increments whenever a Consul agent successfully responds to a request to list services in a node. | requests | counter | | `consul.client.api.success.catalog_node_services.` | This increments whenever a Consul agent successfully responds to a request to list services in a node. | requests | counter |
| `consul.client.rpc.error.catalog_node_services.` | This increments whenever a Consul agent receives an RPC error for a request to list services in a node. | errors | counter | | `consul.client.rpc.error.catalog_node_services.` | This increments whenever a Consul agent receives an RPC error for a request to list services in a node. | errors | counter |
| `consul.client.api.catalog_gateway_services.` | This increments whenever a Consul agent receives a request to list services associated with a gateway. | requests | counter | | `consul.client.api.catalog_gateway_services.` | This increments whenever a Consul agent receives a request to list services associated with a gateway. | requests | counter |
| `consul.client.api.success.catalog_gateway_services.` | This increments whenever a Consul agent successfully responds to a request to list services associated with a gateway. | requests | counter | | `consul.client.api.success.catalog_gateway_services.` | This increments whenever a Consul agent successfully responds to a request to list services associated with a gateway. | requests | counter |
| `consul.client.rpc.error.catalog_gateway_services.` | This increments whenever a Consul agent receives an RPC error for a request to list services associated with a gateway. | errors | counter | | `consul.client.rpc.error.catalog_gateway_services.` | This increments whenever a Consul agent receives an RPC error for a request to list services associated with a gateway. | errors | counter |
| `consul.runtime.num_goroutines` | This tracks the number of running goroutines and is a general load pressure indicator. This may burst from time to time but should return to a steady state value. | number of goroutines | gauge | | `consul.runtime.num_goroutines` | This tracks the number of running goroutines and is a general load pressure indicator. This may burst from time to time but should return to a steady state value. | number of goroutines | gauge |
| `consul.runtime.alloc_bytes` | This measures the number of bytes allocated by the Consul process. This may burst from time to time but should return to a steady state value. | bytes | gauge | | `consul.runtime.alloc_bytes` | This measures the number of bytes allocated by the Consul process. This may burst from time to time but should return to a steady state value. | bytes | gauge |
| `consul.runtime.heap_objects` | This measures the number of objects allocated on the heap and is a general memory pressure indicator. This may burst from time to time but should return to a steady state value. | number of objects | gauge | | `consul.runtime.heap_objects` | This measures the number of objects allocated on the heap and is a general memory pressure indicator. This may burst from time to time but should return to a steady state value. | number of objects | gauge |

2
website/pages/docs/commands/index.mdx
View File

@ -249,7 +249,7 @@ scheme should be used, or `CONSUL_HTTP_SSL` set.
**Enterprise only** **Enterprise only**
If you're using Consul Enterprise namespaces you can set this for the CLI to If you're using Consul Enterprise namespaces you can set this for the CLI to
explicitly use a single namespace. This is common across all Hashicorp explicitly use a single namespace. This is common across all Hashicorp
products that support Enterprise namespaces. products that support Enterprise namespaces.
``` ```

14
website/pages/docs/commands/intention/index.mdx
View File

@ -70,10 +70,10 @@ $ consul intention match db
Intention commands commonly take positional arguments referred to as `SRC` and Intention commands commonly take positional arguments referred to as `SRC` and
`DST` in the command documentation. These can take several forms: `DST` in the command documentation. These can take several forms:
| Format | Meaning | | Format | Meaning |
| ----------------------- | -----------------------------------------------------------------------| | ----------------------- | -------------------------------------------------------------------- |
| `<service>` | the named service in the current namespace | | `<service>` | the named service in the current namespace |
| `*` | any service in the current namespace | | `*` | any service in the current namespace |
| `<namespace>/<service>` | <EnterpriseAlert inline /> the named service in a specific namespace | | `<namespace>/<service>` | <EnterpriseAlert inline /> the named service in a specific namespace |
| `<namespace>/*` | <EnterpriseAlert inline /> any service in the specified namespace | | `<namespace>/*` | <EnterpriseAlert inline /> any service in the specified namespace |
| `*/*` | <EnterpriseAlert inline /> any service in any namespace | | `*/*` | <EnterpriseAlert inline /> any service in any namespace |

6
website/pages/docs/connect/ingress-gateway.mdx
View File

@ -10,7 +10,7 @@ description: >-
# Ingress Gateways # Ingress Gateways
-> **1.8.0+:** This feature is available in Consul versions 1.8.0 and newer. -> **1.8.0+:** This feature is available in Consul versions 1.8.0 and newer.
Ingress gateways enable ingress traffic from services outside the Consul Ingress gateways enable ingress traffic from services outside the Consul
service mesh to services inside the Consul service mesh. An ingress gateway is service mesh to services inside the Consul service mesh. An ingress gateway is
@ -68,5 +68,5 @@ If the Consul client agent on the gateway's node is not configured to use the de
must also provide `agent:read` for its node's name in order to discover the agent's gRPC port. gRPC is used to expose Envoy's xDS API to Envoy proxies. must also provide `agent:read` for its node's name in order to discover the agent's gRPC port. gRPC is used to expose Envoy's xDS API to Envoy proxies.
~> [Configuration entries](/docs/agent/config-entries) are global in scope. A configuration entry for a gateway name applies ~> [Configuration entries](/docs/agent/config-entries) are global in scope. A configuration entry for a gateway name applies
across all federated Consul datacenters. If ingress gateways in different Consul datacenters need to route to different across all federated Consul datacenters. If ingress gateways in different Consul datacenters need to route to different
sets of services within their datacenter then the ingress gateways **must** be registered with different names. sets of services within their datacenter then the ingress gateways **must** be registered with different names.

2
website/pages/docs/connect/proxies/built-in.mdx
View File

@ -68,7 +68,7 @@ All fields are optional with a sane default.
or `[::]` in which case this defaults to `127.0.0.1` and assumes the agent can or `[::]` in which case this defaults to `127.0.0.1` and assumes the agent can
dial the proxy over loopback. For more complex configurations where agent and proxy dial the proxy over loopback. For more complex configurations where agent and proxy
communicate over a bridge for example, this configuration can be used to specify communicate over a bridge for example, this configuration can be used to specify
a different *address* (but not port) for the agent to use for health checks if a different _address_ (but not port) for the agent to use for health checks if
it can't talk to the proxy over localhost or it's publicly advertised port. The it can't talk to the proxy over localhost or it's publicly advertised port. The
check always uses the same port that the proxy is bound to. check always uses the same port that the proxy is bound to.

1
website/pages/docs/connect/proxies/envoy.mdx
View File

@ -287,7 +287,6 @@ definition](/docs/connect/registration/service-registration) or
- `max_failures` - The number of consecutive failures which cause a host to be - `max_failures` - The number of consecutive failures which cause a host to be
removed from the load balancer. removed from the load balancer.
### Gateway Options ### Gateway Options
These fields may also be overridden explicitly in the [proxy service These fields may also be overridden explicitly in the [proxy service

19
website/pages/docs/connect/wan-federation-via-mesh-gateways.mdx
View File

@ -8,7 +8,7 @@ description: |-
# WAN Federation via Mesh Gateways # WAN Federation via Mesh Gateways
-> **1.8.0+:** This feature is available in Consul versions 1.8.0 and higher -> **1.8.0+:** This feature is available in Consul versions 1.8.0 and higher
~> This topic requires familiarity with [mesh gateways](/docs/connect/mesh-gateway). ~> This topic requires familiarity with [mesh gateways](/docs/connect/mesh-gateway).
@ -28,11 +28,11 @@ the WAN.
Sometimes this prerequisite is difficult or undesirable to meet: Sometimes this prerequisite is difficult or undesirable to meet:
* **Difficult:** The datacenters may exist in multiple Kubernetes clusters that - **Difficult:** The datacenters may exist in multiple Kubernetes clusters that
unfortunately have overlapping pod IP subnets, or may exist in different unfortunately have overlapping pod IP subnets, or may exist in different
cloud provider VPCs that have overlapping subnets. cloud provider VPCs that have overlapping subnets.
* **Undesirable:** Network security teams may not approve of granting so many - **Undesirable:** Network security teams may not approve of granting so many
firewall rules. When using platform autoscaling, keeping rules up to date becomes untenable. firewall rules. When using platform autoscaling, keeping rules up to date becomes untenable.
Operators looking to simplify their WAN deployment and minimize the exposed Operators looking to simplify their WAN deployment and minimize the exposed
@ -44,17 +44,16 @@ gateways](/docs/connect/mesh-gateways.html) to do so.
There are two main kinds of communication that occur over the WAN link spanning There are two main kinds of communication that occur over the WAN link spanning
the gulf between disparate Consul datacenters: the gulf between disparate Consul datacenters:
* **WAN gossip:** We leverage the serf and memberlist libraries to gossip - **WAN gossip:** We leverage the serf and memberlist libraries to gossip
around failure detector knowledge about Consul servers in each datacenter. around failure detector knowledge about Consul servers in each datacenter.
By default this operates point to point between servers over `8302/udp` with By default this operates point to point between servers over `8302/udp` with
a fallback to `8302/tcp` (which logs a warning indicating the network is a fallback to `8302/tcp` (which logs a warning indicating the network is
misconfigured). misconfigured).
* **Cross-datacenter RPCs:** Consul servers expose a special multiplexed port - **Cross-datacenter RPCs:** Consul servers expose a special multiplexed port
over `8300/tcp`. Several distinct kinds of messages can be received on this over `8300/tcp`. Several distinct kinds of messages can be received on this
port, such as RPC requests forwarded from servers in other datacenters. port, such as RPC requests forwarded from servers in other datacenters.
In this network topology individual Consul client agents on a LAN in one In this network topology individual Consul client agents on a LAN in one
datacenter never need to directly dial servers in other datacenters. This datacenter never need to directly dial servers in other datacenters. This
means you could introduce a set of firewall rules prohibiting `10.0.0.0/24` means you could introduce a set of firewall rules prohibiting `10.0.0.0/24`
@ -80,8 +79,7 @@ these SAN fields:
server.<this_datacenter>.<domain> (normal) server.<this_datacenter>.<domain> (normal)
<node_name>.server.<this_datacenter>.<domain> (needed for wan federation) <node_name>.server.<this_datacenter>.<domain> (needed for wan federation)
This can be achieved using any number of tools, including `consul tls cert This can be achieved using any number of tools, including `consul tls cert create` with the `-node` flag.
create` with the `-node` flag.
### Mesh Gateways ### Mesh Gateways
@ -157,7 +155,6 @@ follow this general procedure:
resolve ACL tokens from the secondary, at which time it should be possible resolve ACL tokens from the secondary, at which time it should be possible
to launch the mesh gateways in the secondary datacenter. to launch the mesh gateways in the secondary datacenter.
### Existing secondary ### Existing secondary
1. Upgrade to the desired version of the consul binary for all servers, 1. Upgrade to the desired version of the consul binary for all servers,
@ -175,9 +172,9 @@ follow this general procedure:
From any two datacenters joined together double check the following give you an From any two datacenters joined together double check the following give you an
expected result: expected result:
* Check that `consul members -wan` lists all servers in all datacenters with - Check that `consul members -wan` lists all servers in all datacenters with
their _local_ ip addresses and are listed as `alive`. their _local_ ip addresses and are listed as `alive`.
* Ensure any API request that activates datacenter request forwarding. such as - Ensure any API request that activates datacenter request forwarding. such as
[`/v1/catalog/services?dc=<OTHER_DATACENTER_NAME>`](/api/catalog.html#dc-1) [`/v1/catalog/services?dc=<OTHER_DATACENTER_NAME>`](/api/catalog.html#dc-1)
succeeds. succeeds.

3
website/pages/docs/enterprise/backups.mdx
View File

@ -11,7 +11,8 @@ description: >-
# Automated Backups # Automated Backups
<EnterpriseAlert> <EnterpriseAlert>
This feature is available in all versions of <a href="https://www.hashicorp.com/products/consul/">Consul Enterprise</a>. This feature is available in all versions of{' '}
<a href="https://www.hashicorp.com/products/consul/">Consul Enterprise</a>.
</EnterpriseAlert> </EnterpriseAlert>
Consul Enterprise enables you to run Consul Enterprise enables you to run

4
website/pages/docs/enterprise/federation.mdx
View File

@ -11,7 +11,9 @@ description: >-
# Consul Enterprise Advanced Federation # Consul Enterprise Advanced Federation
<EnterpriseAlert> <EnterpriseAlert>
This feature requires <a href="https://www.hashicorp.com/products/consul/">Consul Enterprise</a> with the Global Visibility, Routing, and Scale module. This feature requires{' '}
<a href="https://www.hashicorp.com/products/consul/">Consul Enterprise</a>{' '}
with the Global Visibility, Routing, and Scale module.
</EnterpriseAlert> </EnterpriseAlert>
Consul's core federation capability uses the same gossip mechanism that is used Consul's core federation capability uses the same gossip mechanism that is used

4
website/pages/docs/enterprise/namespaces.mdx
View File

@ -8,7 +8,9 @@ description: Consul Enterprise enables data isolation with Namespaces.
# Consul Enterprise Namespaces # Consul Enterprise Namespaces
<EnterpriseAlert> <EnterpriseAlert>
This feature requires <a href="https://www.hashicorp.com/products/consul/">Consul Enterprise</a> with the Governance and Policy module. This feature requires{' '}
<a href="https://www.hashicorp.com/products/consul/">Consul Enterprise</a>{' '}
with the Governance and Policy module.
</EnterpriseAlert> </EnterpriseAlert>
With Consul Enterprise v1.7.0, data for different users or teams With Consul Enterprise v1.7.0, data for different users or teams

4
website/pages/docs/enterprise/network-segments.mdx
View File

@ -10,7 +10,9 @@ description: |-
# Network Segments # Network Segments
<EnterpriseAlert> <EnterpriseAlert>
This feature requires <a href="https://www.hashicorp.com/products/consul/">Consul Enterprise</a> with the Global Visibility, Routing, and Scale module. This feature requires{' '}
<a href="https://www.hashicorp.com/products/consul/">Consul Enterprise</a>{' '}
with the Global Visibility, Routing, and Scale module.
</EnterpriseAlert> </EnterpriseAlert>
Consul Network Segments enables operators to create separate LAN gossip segments Consul Network Segments enables operators to create separate LAN gossip segments

4
website/pages/docs/enterprise/read-scale.mdx
View File

@ -12,7 +12,9 @@ description: >-
# Enhanced Read Scalability with Non-Voting Servers # Enhanced Read Scalability with Non-Voting Servers
<EnterpriseAlert> <EnterpriseAlert>
This feature requires <a href="https://www.hashicorp.com/products/consul/">Consul Enterprise</a> with the Global Visibility, Routing, and Scale module. This feature requires{' '}
<a href="https://www.hashicorp.com/products/consul/">Consul Enterprise</a>{' '}
with the Global Visibility, Routing, and Scale module.
</EnterpriseAlert> </EnterpriseAlert>
Consul Enterprise provides the ability to scale clustered Consul servers Consul Enterprise provides the ability to scale clustered Consul servers

4
website/pages/docs/enterprise/redundancy.mdx
View File

@ -10,7 +10,9 @@ description: >-
# Redundancy Zones # Redundancy Zones
<EnterpriseAlert> <EnterpriseAlert>
This feature requires <a href="https://www.hashicorp.com/products/consul/">Consul Enterprise</a> with the Global Visibility, Routing, and Scale module. This feature requires{' '}
<a href="https://www.hashicorp.com/products/consul/">Consul Enterprise</a>{' '}
with the Global Visibility, Routing, and Scale module.
</EnterpriseAlert> </EnterpriseAlert>
Consul Enterprise redundancy zones provide Consul Enterprise redundancy zones provide

4
website/pages/docs/enterprise/sentinel.mdx
View File

@ -11,7 +11,9 @@ description: >-
# Sentinel in Consul # Sentinel in Consul
<EnterpriseAlert> <EnterpriseAlert>
This feature requires <a href="https://www.hashicorp.com/products/consul/">Consul Enterprise</a> with the Governance and Policy module. This feature requires{' '}
<a href="https://www.hashicorp.com/products/consul/">Consul Enterprise</a>{' '}
with the Governance and Policy module.
</EnterpriseAlert> </EnterpriseAlert>
Sentinel policies extend the ACL system in Consul beyond static "read", "write", Sentinel policies extend the ACL system in Consul beyond static "read", "write",

3
website/pages/docs/enterprise/upgrades.mdx
View File

@ -11,7 +11,8 @@ description: >-
# Automated Upgrades # Automated Upgrades
<EnterpriseAlert> <EnterpriseAlert>
This feature is available in all versions of <a href="https://www.hashicorp.com/products/consul/">Consul Enterprise</a>. This feature is available in all versions of{' '}
<a href="https://www.hashicorp.com/products/consul/">Consul Enterprise</a>.
</EnterpriseAlert> </EnterpriseAlert>
Consul Enterprise enables the capability of automatically upgrading a cluster of Consul servers to a new Consul Enterprise enables the capability of automatically upgrading a cluster of Consul servers to a new

2
website/pages/docs/guides/acl-legacy.mdx
View File

@ -187,7 +187,7 @@ as to whether they are set on servers, clients, or both.
| Configuration Option | Servers | Clients | Purpose | | Configuration Option | Servers | Clients | Purpose |
| --------------------------------------------------------------------- | ---------- | ---------- | ----------------------------------------------------------------------------------------- | | --------------------------------------------------------------------- | ---------- | ---------- | ----------------------------------------------------------------------------------------- |
| [`primary_datacenter`](/docs/agent/options#primary_datacenter) | `REQUIRED` | `REQUIRED` | Master control that enables ACLs by defining the authoritative Consul datacenter for ACLs | | [`primary_datacenter`](/docs/agent/options#primary_datacenter) | `REQUIRED` | `REQUIRED` | Master control that enables ACLs by defining the authoritative Consul datacenter for ACLs |
| [`acl_default_policy`](/docs/agent/options#acl_default_policy_legacy) | `OPTIONAL` | `N/A` | Determines allowlist or denylist mode | | [`acl_default_policy`](/docs/agent/options#acl_default_policy_legacy) | `OPTIONAL` | `N/A` | Determines allowlist or denylist mode |
| [`acl_down_policy`](/docs/agent/options#acl_down_policy_legacy) | `OPTIONAL` | `OPTIONAL` | Determines what to do when the ACL datacenter is offline | | [`acl_down_policy`](/docs/agent/options#acl_down_policy_legacy) | `OPTIONAL` | `OPTIONAL` | Determines what to do when the ACL datacenter is offline |
| [`acl_ttl`](/docs/agent/options#acl_ttl_legacy) | `OPTIONAL` | `OPTIONAL` | Determines time-to-live for cached ACLs | | [`acl_ttl`](/docs/agent/options#acl_ttl_legacy) | `OPTIONAL` | `OPTIONAL` | Determines time-to-live for cached ACLs |

5
website/pages/docs/internals/coordinates.mdx
View File

@ -2,10 +2,7 @@
layout: docs layout: docs
page_title: Network Coordinates page_title: Network Coordinates
sidebar_title: Network Coordinates sidebar_title: Network Coordinates
description: '' description: A Decentralized Network Coordinate System, with several improvements based on several follow-on papers.
Serf uses a network tomography system to compute network coordinates for nodes in the cluster. These coordinates are useful for easily calculating the estimated network round trip time between any two nodes in the cluster. This page documents the details of this system. The core of the network tomography system us based on Vivaldi: >-
A Decentralized Network Coordinate System, with several improvements based on
several follow-on papers.
--- ---
# Network Coordinates # Network Coordinates

46
website/pages/docs/k8s/helm.mdx
View File

@ -789,36 +789,36 @@ and consider if they're appropriate for your deployment.
- `wanAddress` ((#v-meshgateway-wanaddress)) - What gets registered as WAN (wide area network) address for the gateway. - `wanAddress` ((#v-meshgateway-wanaddress)) - What gets registered as WAN (wide area network) address for the gateway.
- `source` ((#v-meshgateway-wanaddress-source)) (`string: "Service"`) - source configures where to retrieve the WAN address (and possibly port) - `source` ((#v-meshgateway-wanaddress-source)) (`string: "Service"`) - source configures where to retrieve the WAN address (and possibly port)
for the mesh gateway from. for the mesh gateway from.
Can be set to either: `Service`, `NodeIP`, `NodeName` or `Static`. See the behavior of each below: Can be set to either: `Service`, `NodeIP`, `NodeName` or `Static`. See the behavior of each below:
* `Service` - Determine the address based on the service type. - `Service` - Determine the address based on the service type.
If `service.type=LoadBalancer` use the external IP or hostname of If `service.type=LoadBalancer` use the external IP or hostname of
the service. Use the port set by `service.port`. the service. Use the port set by `service.port`.
If `service.type=NodePort` use the Node IP. The port will be set to If `service.type=NodePort` use the Node IP. The port will be set to
`service.nodePort` so `service.nodePort` cannot be null. `service.nodePort` so `service.nodePort` cannot be null.
If `service.type=ClusterIP` use the ClusterIP. The port will be set to If `service.type=ClusterIP` use the ClusterIP. The port will be set to
`service.port`. `service.port`.
`service.type=ExternalName` is not supported. `service.type=ExternalName` is not supported.
* `NodeIP` - The node IP as provided by the Kubernetes downward API. - `NodeIP` - The node IP as provided by the Kubernetes downward API.
* `NodeName` - The name of the node as provided by the Kubernetes downward - `NodeName` - The name of the node as provided by the Kubernetes downward
API. This is useful if the node names are DNS entries that API. This is useful if the node names are DNS entries that
are routable from other datacenters. are routable from other datacenters.
* `Static` - Use the address hardcoded in `meshGateway.wanAddress.static`. - `Static` - Use the address hardcoded in `meshGateway.wanAddress.static`.
- `port` ((#v-meshgateway-wanaddress-port)) (`integer: 443`) - Port that gets registered for WAN traffic. - `port` ((#v-meshgateway-wanaddress-port)) (`integer: 443`) - Port that gets registered for WAN traffic.
If source is set to "Service" then this setting will have no effect. If source is set to "Service" then this setting will have no effect.
See the documentation for `source` as to which port will be used in that See the documentation for `source` as to which port will be used in that
case. case.
- `static` ((#v-meshgateway-wanaddress-static)) (`string: ""`) - If source is set to "Static" then this value will be used as the WAN - `static` ((#v-meshgateway-wanaddress-static)) (`string: ""`) - If source is set to "Static" then this value will be used as the WAN
address of the mesh gateways. This is useful if you've configured a address of the mesh gateways. This is useful if you've configured a
DNS entry to point to your mesh gateways. DNS entry to point to your mesh gateways.
@ -851,8 +851,8 @@ and consider if they're appropriate for your deployment.
- `dnsPolicy` ((#v-meshgateway-dnspolicy)) (`string: null`) - `dnsPolicy` to use. - `dnsPolicy` ((#v-meshgateway-dnspolicy)) (`string: null`) - `dnsPolicy` to use.
- `consulServiceName` ((#v-meshgateway-consulservicename)) (`string: "mesh-gateway"`) - Consul service name for the mesh gateways. - `consulServiceName` ((#v-meshgateway-consulservicename)) (`string: "mesh-gateway"`) - Consul service name for the mesh gateways.
Cannot be set to anything other than `"mesh-gateway"` if `global.acls.manageSystemACLs` is true since the ACL token Cannot be set to anything other than `"mesh-gateway"` if `global.acls.manageSystemACLs` is true since the ACL token
generated is only for the name "mesh-gateway". generated is only for the name "mesh-gateway".
- `containerPort` ((#v-meshgateway-containerPort)) (`integer: 8443`) - Port that the gateway will run on inside the container. - `containerPort` ((#v-meshgateway-containerPort)) (`integer: 8443`) - Port that the gateway will run on inside the container.
@ -920,8 +920,8 @@ and consider if they're appropriate for your deployment.
"annotation-key": "annotation-value" "annotation-key": "annotation-value"
``` ```
- `consulNamespace` ((#v-ingressgateways-defaults-consulnamespace)) (`string: "default"`) <EnterpriseAlert inline /> - Defines the Consul namespace to register the gateway into. Requires `global.enableConsulNamespaces` to be true and - `consulNamespace` ((#v-ingressgateways-defaults-consulnamespace)) (`string: "default"`) <EnterpriseAlert inline /> - Defines the Consul namespace to register the gateway into. Requires `global.enableConsulNamespaces` to be true and
Consul Enterprise v1.7+ with a valid Consul Enterprise license. Note: The Consul namespace MUST exist before the gateway is deployed. Consul Enterprise v1.7+ with a valid Consul Enterprise license. Note: The Consul namespace MUST exist before the gateway is deployed.
- `gateways` ((#v-ingressgateways-gateways)) - Gateways is a list of gateway objects. The only required field for each is `name`, though they can also contain any of the fields in `ingressGateways.defaults`. Values defined here override the defaults except in the case of annotations where both will be applied. - `gateways` ((#v-ingressgateways-gateways)) - Gateways is a list of gateway objects. The only required field for each is `name`, though they can also contain any of the fields in `ingressGateways.defaults`. Values defined here override the defaults except in the case of annotations where both will be applied.
@ -941,9 +941,9 @@ and consider if they're appropriate for your deployment.
extraVolumes: extraVolumes:
- type: 'secret' - type: 'secret'
name: 'my-secret' name: 'my-secret'
items: # optional items array items: # optional items array
- key: key - key: key
path: path # secret will now mount to /consul/userconfig/my-secret/path path: path # secret will now mount to /consul/userconfig/my-secret/path
``` ```
- `resources` ((#v-terminatinggateways-defaults-resources)) (`string`) - Resources for gateway pods. See values file for default. - `resources` ((#v-terminatinggateways-defaults-resources)) (`string`) - Resources for gateway pods. See values file for default.
@ -963,7 +963,7 @@ and consider if they're appropriate for your deployment.
"annotation-key": "annotation-value" "annotation-key": "annotation-value"
``` ```
- `consulNamespace` ((#v-terminatinggateways-defaults-consulnamespace)) (`string: "default"`) <EnterpriseAlert inline /> - Defines the Consul namespace to register the gateway into. Requires `global.enableConsulNamespaces` to be true and Consul Enterprise v1.7+ with a valid Consul Enterprise license. Note: The Consul namespace MUST exist before the gateway is deployed. - `consulNamespace` ((#v-terminatinggateways-defaults-consulnamespace)) (`string: "default"`) <EnterpriseAlert inline /> - Defines the Consul namespace to register the gateway into. Requires `global.enableConsulNamespaces` to be true and Consul Enterprise v1.7+ with a valid Consul Enterprise license. Note: The Consul namespace MUST exist before the gateway is deployed.
- `gateways` ((#v-terminatinggateways-gateways)) - Gateways is a list of gateway objects. The only required field for each is `name`, though they can also contain any of the fields in `terminatingGateways.defaults`. Values defined here override the defaults except in the case of annotations where both will be applied. - `gateways` ((#v-terminatinggateways-gateways)) - Gateways is a list of gateway objects. The only required field for each is `name`, though they can also contain any of the fields in `terminatingGateways.defaults`. Values defined here override the defaults except in the case of annotations where both will be applied.

6
website/pages/home/index.jsx
View File

@ -195,16 +195,14 @@ export default function HomePage() {
title: 'Getting Started', title: 'Getting Started',
category: 'Step-by-Step Guides', category: 'Step-by-Step Guides',
time: '48 mins', time: '48 mins',
link: link: 'https://learn.hashicorp.com/consul/getting-started/install',
'https://learn.hashicorp.com/consul/getting-started/install',
image: require('./img/learn/getting-started.svg?url'), image: require('./img/learn/getting-started.svg?url'),
}, },
{ {
title: 'Run Consul on Kubernetes', title: 'Run Consul on Kubernetes',
category: 'Step-by-Step Guides', category: 'Step-by-Step Guides',
time: '142 mins', time: '142 mins',
link: link: 'https://learn.hashicorp.com/consul/kubernetes/minikube',
'https://learn.hashicorp.com/consul/kubernetes/minikube',
image: require('./img/learn/kubernetes.svg?url'), image: require('./img/learn/kubernetes.svg?url'),
}, },
]} ]}