status-im/consul
2
0
Fork 0
mirror of https://github.com/status-im/consul.git synced 2025-01-11 06:16:08 +00:00
Code Issues Projects Releases Wiki Activity
17,660 Commits 445 Branches 179 Tags 489 MiB
Commit Graph

11 Commits

Author SHA1 Message Date
Chris S. Kim
fb5eb20563
Pass trust domain to RBAC to validate and fix use of wrong peer trust bundles (#13508) 2022-06-20 22:47:14 -04:00
Chris S. Kim
a02e9abcc1
Update RBAC to handle imported services (#13404) 
When converting from Consul intentions to xds RBAC rules, services imported from other peers must encode additional data like partition (from the remote cluster) and trust domain.

This PR updates the PeeringTrustBundle to hold the sending side's local partition as ExportedPartition. It also updates RBAC code to encode SpiffeIDs of imported services with the ExportedPartition and TrustDomain.
 2022-06-10 17:15:22 -04:00
freddygv
d90e30f009 Update spiffe ID patterns used for RBAC 2021-09-14 11:00:03 -06:00
freddygv
5e54f253d7 Expand testing of simplifyNotSourceSlice for partitions 2021-09-14 10:55:15 -06:00
freddygv
19da23be28 Expand testing of removeSameSourceIntentions for partitions 2021-09-14 10:55:09 -06:00
freddygv
beab0cd962 Account for partition when matching src intentions 2021-09-14 10:55:02 -06:00
R.B. Boyer
20feb42d3a
xds: ensure single L7 deny intention with default deny policy does not result in allow action (CVE-2021-36213) (#10619) 2021-07-15 10:09:00 -05:00
R.B. Boyer
398b766532
xds: default to speaking xDS v3, but allow for v2 to be spoken upon request (#9658) 
- Also add support for envoy 1.17.0
 2021-02-26 16:23:15 -06:00
R.B. Boyer
3b6ffc447b
xds: remove deprecated usages of xDS (#9602) 
Note that this does NOT upgrade to xDS v3. That will come in a future PR.

Additionally:

- Ignored staticcheck warnings about how github.com/golang/protobuf is deprecated.
- Shuffled some agent/xds imports in advance of a later xDS v3 upgrade.
- Remove support for envoy 1.13.x but don't add in 1.17.x yet. We have to wait until the xDS v3 support is added in a follow-up PR.

Fixes #8425
 2021-02-22 15:00:15 -06:00
R.B. Boyer
1b413b0444
connect: support defining intentions using layer 7 criteria (#8839) 
Extend Consul’s intentions model to allow for request-based access control enforcement for HTTP-like protocols in addition to the existing connection-based enforcement for unspecified protocols (e.g. tcp).
 2020-10-06 17:09:13 -05:00
R.B. Boyer
74d5df7c7a
xds: use envoy's rbac filter to handle intentions entirely within envoy (#8569) 2020-08-27 12:20:58 -05:00