consul

Commit Graph

Author	SHA1	Message	Date
Alvin Huang	c516fabfac	revert commits on master (#6413 )	2019-08-27 17:45:58 -04:00
tradel	9b1ac4e7ef	add subject names to issued certs	2019-08-27 14:15:10 -07:00
R.B. Boyer	561b2fe606	connect: generate the full SNI names for discovery targets in the compiler rather than in the xds package (#6340 )	2019-08-19 13:03:03 -05:00
Todd Radel	2552f4a11a	connect: Support RSA keys in addition to ECDSA (#6055 ) Support RSA keys in addition to ECDSA	2019-07-30 17:47:39 -04:00
R.B. Boyer	f4a3b9d518	fix typos reported by golangci-lint:misspell (#5434 )	2019-03-06 11:13:28 -06:00
R.B. Boyer	c7067645dd	fix a few leap-year related clock math inaccuracies and failing tests	2019-03-01 13:51:49 -06:00
Paul Banks	0638e09b6e	connect: agent leaf cert caching improvements (#5091 ) * Add State storage and LastResult argument into Cache so that cache.Types can safely store additional data that is eventually expired. * New Leaf cache type working and basic tests passing. TODO: more extensive testing for the Root change jitter across blocking requests, test concurrent fetches for different leaves interact nicely with rootsWatcher. * Add multi-client and delayed rotation tests. * Typos and cleanup error handling in roots watch * Add comment about how the FetchResult can be used and change ca leaf state to use a non-pointer state. * Plumb test override of root CA jitter through TestAgent so that tests are deterministic again! * Fix failing config test	2019-01-10 12:46:11 +00:00
Kyle Havlovitz	e8dd89359a	agent: fix formatting	2018-11-07 02:16:03 -08:00
Matt Keeler	677d6dac80	Remove x509 name constraints These were only added as SPIFFE intends to use the in the future but currently does not mandate their usage due to patch support in common TLS implementations and some ambiguity over how to use them with URI SAN certificates. We included them because until now everything seem fine with it, however we've found the latest version of `openssl` (1.1.0h) fails to validate our certificats if its enabled. LibreSSL as installed on OS X by default doesn’t have these issues. For now it's most compatible not to have them and later we can find ways to add constraints with wider compatibility testing.	2018-06-25 12:26:10 -07:00
Kyle Havlovitz	050da22473	connect/ca: undo the interface changes and use sign-self-issued in Vault	2018-06-25 12:25:42 -07:00
Kyle Havlovitz	6a2fc00997	connect/ca: add URI SAN support to the Vault provider	2018-06-25 12:25:41 -07:00
Paul Banks	4aeab3897c	Fixed many tests after rebase. Some still failing and seem unrelated to any connect changes.	2018-06-14 09:42:16 -07:00
Paul Banks	b4803eca59	Generate CSR using real trust-domain	2018-06-14 09:42:16 -07:00
Paul Banks	e0e12e165b	TLS watching integrated into Service with some basic tests. There are also a lot of small bug fixes found when testing lots of things end-to-end for the first time and some cleanup now it's integrated with real CA code.	2018-06-14 09:42:07 -07:00
Paul Banks	90c574ebaa	Wire up agent leaf endpoint to cache framework to support blocking.	2018-06-14 09:42:07 -07:00
Paul Banks	10db79c8ae	Rework connect/proxy and command/connect/proxy. End to end demo working again	2018-06-14 09:41:57 -07:00
Paul Banks	26e65f6bfd	connect.Service based implementation after review feedback.	2018-06-14 09:41:56 -07:00
Mitchell Hashimoto	75bf0e1638	agent/connect: support SpiffeIDSigning	2018-06-14 09:41:53 -07:00
Mitchell Hashimoto	17ca8ad083	agent/connect: rename SpiffeID to CertURI	2018-06-14 09:41:53 -07:00
Mitchell Hashimoto	0cbcb07d61	agent/connect: use proper keyusage fields for CA and leaf	2018-06-14 09:41:53 -07:00
Mitchell Hashimoto	c2588262b7	agent: /v1/connect/ca/leaf/:service_id	2018-06-14 09:41:52 -07:00
Mitchell Hashimoto	891cd22ad9	agent/consul: key the public key of the CSR, verify in test	2018-06-14 09:41:51 -07:00
Mitchell Hashimoto	d768d5e9a7	agent/consul: test for ConnectCA.Sign	2018-06-14 09:41:51 -07:00

23 Commits