There will only be a small set of consul build versions that a single consul
server will witness. Inside of metadata.IsConsulServer we use a very
expensive function in the hashicorp/go-version library to parse these into
read-only *version.Version structs all over Consul.
Memoize these in a package cache map. Likely the thing will only have like
2 keys in it ever over the life of the process.
* NET-11798: Set APIGateway TLSConfig if unset or empty
* add changelog
* update golden file tests
* add missing golden files
* Update .changelog/21984.txt
Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com>
* remove use of reflect library and check if object is empty instead
---------
Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com>
The consul-k8s endpoints controller issues catalog register and manual virtual ip
updates without first checking to see if the updates would be effectively not
changing anything. This is supposed to be reasonable because the state store
functions do the check for a no-op update and should discard repeat updates so
that downstream blocking queries watching one of the resources don't fire
pointlessly (and CPU wastefully).
While this is true for the check/service/node catalog updates, it is not true for
the "manual virtual ip" updates triggered by the PUT /v1/internal/service-virtual-ip.
Forcing the connect injector pod to recycle while watching some lightly
modified FSM code can show that a lot of updates are of the update list of ips
from [A] to [A]. Immediately following this stray update you can see a lot of
activity in proxycfg and xds packages waking up due to blocking queries
triggered by this.
This PR skips updates that change nothing both:
- at the RPC layer before passing it to raft (ideally)
- if the write does make it through raft and get applied to the FSM (failsafe)
* NET-11737 - sec vulnerability - remediate ability to use bexpr to filter results without ACL read on endpoint
* add changelog
* update test descriptions to make more sense
* upgrade hcl package and account for possiblity of duplicates existing already in the cache
* upgrade to new tag
* add defensive line to prevent potential forever loop
* o mod tidy and changelog
* Update acl/policy.go
* fix raft reversion
* go mod tidy
* fix test
* remove duplicate key in test
* remove duplicates from test cases
* clean up
* go mod tidy
* go mod tidy
* pull in new hcl tag
Also prevent de-registered retired v2 types from being restored from a
snapshot, such as these hcp resources. Without doing this, anyone with
any of these types in their state store will retain them forever with no
avenue to remove them.
* Added the docs for all the grafana dashboards.
Author: Yasmin Lorin Kaygalak <ykaygala@villanova.edu>
Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>
Co-authored-by: Blake Covarrubias <blake@covarrubi.as>
mesh: add options for HTTP incoming request normalization
Expose global mesh configuration to enforce inbound HTTP request
normalization on mesh traffic via Envoy xDS config.
mesh: enable inbound URL path normalization by default
mesh: add support for L7 header match contains and ignore_case
Enable partial string and case-insensitive matching in L7 intentions
header match rules.
ui: support L7 header match contains and ignore_case
Co-authored-by: Phil Renaud <phil@riotindustries.com>
test: add request normalization integration bats tests
Add both "positive" and "negative" test suites, showing normalization in
action as well as expected results when it is not enabled, for the same
set of test cases.
Also add some alternative service container test helpers for verifying
raw HTTP request paths, which is difficult to do with Fortio.
docs: update security and reference docs for L7 intentions bypass prevention
- Update security docs with best practices for service intentions
configuration
- Update configuration entry references for mesh and intentions to
reflect new values and add guidance on usage
* explicitly add content-type anywhere possible and add middleware to set and warn
* added tests, fixed typo
* clean up unused constants
* changelog
* fix call order in middleware
* remove v2 tenancy, catalog, and mesh
- Inline the v2tenancy experiment to false
- Inline the resource-apis experiment to false
- Inline the hcp-v2-resource-apis experiment to false
- Remove ACL policy templates and rule language changes related to
workload identities (a v2-only concept) (e.g. identity and
identity_prefix)
- Update the gRPC endpoint used by consul-dataplane to no longer respond
specially for v2
- Remove stray v2 references scattered throughout the DNS v1.5 newer
implementation.
* changelog
* go mod tidy on consul containers
* lint fixes from ENT
---------
Co-authored-by: John Murret <john.murret@hashicorp.com>
* upgrade d3 packages to update color dependency
* yarn package bump
* deps moved into devdeps
---------
Co-authored-by: Phil Renaud <phil@riotindustries.com>
* [NET-10290] Update ENVOY_VERSIONS
* Add changelog entry
* Link to CVE for more info in changelog entry
Co-authored-by: Deniz Onur Duzgun <59659739+dduzgun-security@users.noreply.github.com>
---------
Co-authored-by: Deniz Onur Duzgun <59659739+dduzgun-security@users.noreply.github.com>
* Namespaced and file-specified deps
* Pinning to a specific version of tailwind and setting config for js packages to come from npmjs
* Pin glob instead of reverting tailwind or any other (grand)parent dependency
* ember-cli-build fixed path resolution for now-namespaced submodules
* Dropping the namespace prefix and relying on relative pathing
* bump go version
* changelog
* Update .changelog/21507.txt
* Update go.mod
Co-authored-by: Deniz Onur Duzgun <59659739+dduzgun-security@users.noreply.github.com>
* go mod tidy
---------
Co-authored-by: Deniz Onur Duzgun <59659739+dduzgun-security@users.noreply.github.com>
