* Fixes#5606: Tokens converted from legacy ACLs get their Hash computed
This allows new style token replication to work for legacy tokens as well when they change.
* tests: fix timestamp comparison
Co-authored-by: Matt Keeler <mjkeeler7@gmail.com>
Previously, we did not require the 'service-name.*' host header value
when on a single http service was exposed. However, this allows a user
to get into a situation where, if they add another service to the
listener, suddenly the previous service's traffic might not be routed
correctly. Thus, we always require the Host header, even if there is
only 1 service.
Also, we add the make the default domain matching more restrictive by
matching "service-name.ingress.*" by default. This lines up better with
the namespace case and more accurately matches the Consul DNS value we
expect people to use in this case.
This allows the operator to disable agent caching for the http endpoint.
It is on by default for backwards compatibility and if disabled will
ignore the url parameter `cached`.
In current implementation of Consul, check alias cannot determine
if a service exists or not. Because a service without any check
is semantically considered as passing, so when no healthchecks
are found for an agent, the check was considered as passing.
But this make little sense as the current implementation does not
make any difference between:
* a non-existing service (passing)
* a service without any check (passing as well)
In order to make it work, we have to ensure that when a check did
not find any healthcheck, the service does indeed exists. If it
does not, lets consider the check as failing.
The DNS resolution will be handled by Envoy and defaults to LOGICAL_DNS. This discovery type can be overridden on a per-gateway basis with the envoy_dns_discovery_type Gateway Option.
If a service contains an instance with a hostname as an address we set the Envoy cluster to use DNS as the discovery type rather than EDS. Since both mesh gateways and terminating gateways route to clusters using SNI, whenever there is a mix of hostnames and IP addresses associated with a service we use the hostname + CDS rather than the IPs + EDS.
Note that we detect hostnames by attempting to parse the service instance's address as an IP. If it is not a valid IP we assume it is a hostname.
We occasionally see the lint job fail due to this timeout. Likely when the node running lint is under heavy load, because normally it runs much faster.
This commit increases the timeout substantially to work around that problem.
* ui: Add ability to sort service based on health
* ui: Move custom sorting to sort/comparator Service/Helper (like search)
This moves custom sorting to use the same pattern as custom searching.
* Remove old Controller based comparator
* Remove gateway endpoint adapter, model, and serializer and tests
* Update service tests to handle gateway-services-nodes
* Upgrade consul-api-double to 2.15.2
* Add a fairly temporary shouldReconcile method
Co-authored-by: John Cowen <jcowen@hashicorp.com>
1. Removes all icons not supported by the backend
2. Adds other icons supported by the backend
3. If there is no icon available don't add CSS positioning for one
* ui: CSS and component changes to the <EmptyState /> component
* ui: Reset the auth-form component back to its initial state
Moving forwards we are going to have the auth-form on the page all the
time, even when logged in (for relogging in purposes). This means the
auth-form will not always be removed from the DOM when you log in.
This sets the form back to its idle state before calling onsubmit
* ui: Make a public api for modal-dialog with a single close method
* ui : Move cache reset somewhere that makes more sense, + single refresh
1. Centralize cache resetting elsewhere, for now the store makes most
sense, although I would prefer the Repository class, so using the store
is temporary
2. We only need to refresh on login once, unless we have a differing
nspace
* ui: Ensure visibilitychange events are cleaned up
* ui: Only cache DataSource data if we have any, + only clear the cache
* ui: Add the modal login dialog to both unauth and auth views
This means we can 'relogin' when already logged in
* ui: Add new empty states
* ui: CSS Tweaks
* Remove marketing grays
It seems that blink/webkit browsers at least will leak memory when using
input[type=password] inputs. This only affects us during testing as we
'refresh' the ember app ~1000 times without actually refreshing
the browser. This means references to these HTML input elements mount
up now that every single page/test has an input[password] on it.
Following this change our memory usage during testing seems to have
reduced by as much as 75%.
During normal usage the single password element is only added to the
page once per login/logout.
* ui: Move individual component types into a single %composite-list plus
1. Removes all out separate CSS components (that match HTML components)
to favour not having those separate for the moemnt at least
2. Reuses <ConsulServiceList /> component for Terminating Gateways >
Linked Services
* ui: Tweak breadcrumb spacing for '/' separator
* Fix up the tests i.e. services per tab so we can call them all services
The ACL.GetPolicy RPC endpoint was supposed to return the “parent” policy and not always the default policy. In the case of legacy management tokens the parent policy was supposed to be “manage”. The result of us not sending this properly was that operations that required specifically a management token such as saving a snapshot would not work in secondary DCs until they were upgraded.
The previous change, which moved test running to Go, appears to have
broken log capturing. I am not entirely sure why, but the run_tests
function seems to exit on the first error.
This change moves test teardown and log capturing out of run_test, and
has the go test runner call them when necessary.
* testing: replace most goe/verify.Values with require.Equal
One difference between these two comparisons is that go/verify considers
nil slices/maps to be equal to empty slices/maps, where as testify/require
does not, and does not appear to provide any way to enable that behaviour.
Because of this difference some expected values were changed from empty
slices to nil slices, and some calls to verify.Values were left.
* Remove github.com/pascaldekloe/goe/verify
Reduce the number of assertion packages we use from 2 to 1
Hans Hasselberg
Chris Piraino
Blake Covarrubias
Krastin
Jeff Escalante
Peter M
R.B. Boyer
John Cowen
Alexander Mykolaichuk
John Cowen
Pierre Souchay
Freddy
Kevin Pruett
Jono Sosulska
Daniel Nephin
Kevin Pruett
Kenia
Matt Keeler
Daniel Nephin