Previously, when launching a sidecar proxy with one of the following commands:
- consul connect envoy -sidecar-for=...
- consul connect proxy -sidecar-for=...
... the -sidecar-for argument could only contain lowercase letters, even if
the service was registered with some uppercase letters.
Now, the -sidecar-for argument is treated as case-insensitive.
* ui: Make peered intentions read-only
* Replace "" to undefined for SourcePeer so its the same as PeerName
* Fixup copypasta
* Ensure tests run with no peers
* add ember-cli-deprecation-workflow
* Add deprecation workflow configuration
This will silence all deprecations by default reducing noise in the test
output significantly.
We can tackle deprecations now one by one but won't have to deal with
very verbose console logs anymore.
Now that peered upstreams can generate envoy resources (#13758), we need a way to disambiguate local from peered resources in our metrics. The key difference is that datacenter and partition will be replaced with peer, since in the context of peered resources partition is ambiguous (could refer to the partition in a remote cluster or one that exists locally). The partition and datacenter of the proxy will always be that of the source service.
Regexes were updated to make emitting datacenter and partition labels mutually exclusive with peer labels.
Listener filter names were updated to better match the existing regex.
Cluster names assigned to peered upstreams were updated to be synthesized from local peer name (it previously used the externally provided primary SNI, which contained the peer name from the other side of the peering). Integration tests were updated to assert for the new peer labels.
This commit adds a new ACL rule named "peering" to authorize
actions taken against peering-related endpoints.
The "peering" rule has several key properties:
- It is scoped to a partition, and MUST be defined in the default
namespace.
- Its access level must be "read', "write", or "deny".
- Granting an access level will apply to all peerings. This ACL rule
cannot be used to selective grant access to some peerings but not
others.
- If the peering rule is not specified, we fall back to the "operator"
rule and then the default ACL rule.
This is the OSS portion of enterprise PR 2377.
Adds a server-local implementation of the proxycfg.ExportedPeeredServices
interface that sources data from a blocking query against the server's
state store.
Update generate token endpoint (rpc, http, and api module)
If ServerExternalAddresses are set, it will override any addresses gotten from the "consul" service, and be used in the token instead, and dialed by the dialer. This allows for setting up a load balancer for example, in front of the consul servers.
Jared Kirschner
Iryna Shustava
cskh
John Cowen
Michael Klein
alex
trujillo-adam
Nitya Dhanushkodi
Jared Kirschner
Luke Kysow
trujillo-adam
Kyle Havlovitz
David Yu
Chris S. Kim
DanStough
Freddy
Matt Keeler
freddygv
NicoletaPopoviciu
A.J. Sanon
Daniel Upton
Eric Haberkorn