mirror of
https://github.com/status-im/consul.git
synced 2025-01-09 21:35:52 +00:00
78b170ad50
* Refactors the leafcert package to not have a dependency on agent/consul and agent/cache to avoid import cycles. This way the xds controller can just import the leafcert package to use the leafcert manager. The leaf cert logic in the controller: * Sets up watches for leaf certs that are referenced in the ProxyStateTemplate (which generates the leaf certs too). * Gets the leaf cert from the leaf cert cache * Stores the leaf cert in the ProxyState that's pushed to xds * For the cert watches, this PR also uses a bimapper + a thin wrapper to map leaf cert events to related ProxyStateTemplates Since bimapper uses a resource.Reference or resource.ID to map between two resource types, I've created an internal type for a leaf certificate to use for the resource.Reference, since it's not a v2 resource. The wrapper allows mapping events to resources (as opposed to mapping resources to resources) The controller tests: Unit: Ensure that we resolve leaf cert references Lifecycle: Ensure that when the CA is updated, the leaf cert is as well Also adds a new spiffe id type, and adds workload identity and workload identity URI to leaf certs. This is so certs are generated with the new workload identity based SPIFFE id. * Pulls out some leaf cert test helpers into a helpers file so it can be used in the xds controller tests. * Wires up leaf cert manager dependency * Support getting token from proxytracker * Add workload identity spiffe id type to the authorize and sign functions --------- Co-authored-by: John Murret <john.murret@hashicorp.com>
63 lines
2.6 KiB
Go
63 lines
2.6 KiB
Go
// Copyright (c) HashiCorp, Inc.
|
|
// SPDX-License-Identifier: BUSL-1.1
|
|
|
|
package structs
|
|
|
|
import (
|
|
"errors"
|
|
"strings"
|
|
)
|
|
|
|
const (
|
|
errNoLeader = "No cluster leader"
|
|
errNoDCPath = "No path to datacenter"
|
|
errDCNotAvailable = "Remote DC has no server currently reachable"
|
|
errNoServers = "No known Consul servers"
|
|
errNotReadyForConsistentReads = "Not ready to serve consistent reads"
|
|
errSegmentsNotSupported = "Network segments are not supported in this version of Consul"
|
|
errRPCRateExceeded = "RPC rate limit exceeded"
|
|
errServiceNotFound = "Service not found: "
|
|
errQueryNotFound = "Query not found"
|
|
errLeaderNotTracked = "Raft leader not found in server lookup mapping"
|
|
errConnectNotEnabled = "Connect must be enabled in order to use this endpoint"
|
|
errRateLimited = "Rate limit reached, try again later" // Note: we depend on this error message in the gRPC ConnectCA.Sign endpoint (see: isRateLimitError).
|
|
errNotPrimaryDatacenter = "not the primary datacenter"
|
|
errStateReadOnly = "CA Provider State is read-only"
|
|
)
|
|
|
|
var (
|
|
ErrNoLeader = errors.New(errNoLeader)
|
|
ErrNoDCPath = errors.New(errNoDCPath)
|
|
ErrNoServers = errors.New(errNoServers)
|
|
ErrNotReadyForConsistentReads = errors.New(errNotReadyForConsistentReads)
|
|
ErrSegmentsNotSupported = errors.New(errSegmentsNotSupported)
|
|
ErrRPCRateExceeded = errors.New(errRPCRateExceeded)
|
|
ErrDCNotAvailable = errors.New(errDCNotAvailable)
|
|
ErrQueryNotFound = errors.New(errQueryNotFound)
|
|
ErrLeaderNotTracked = errors.New(errLeaderNotTracked)
|
|
ErrConnectNotEnabled = errors.New(errConnectNotEnabled)
|
|
ErrRateLimited = errors.New(errRateLimited) // Note: we depend on this error message in the gRPC ConnectCA.Sign endpoint (see: isRateLimitError).
|
|
ErrNotPrimaryDatacenter = errors.New(errNotPrimaryDatacenter)
|
|
ErrStateReadOnly = errors.New(errStateReadOnly)
|
|
)
|
|
|
|
func IsErrNoDCPath(err error) bool {
|
|
return err != nil && strings.Contains(err.Error(), errNoDCPath)
|
|
}
|
|
|
|
func IsErrQueryNotFound(err error) bool {
|
|
return err != nil && strings.Contains(err.Error(), errQueryNotFound)
|
|
}
|
|
|
|
func IsErrNoLeader(err error) bool {
|
|
return err != nil && strings.Contains(err.Error(), errNoLeader)
|
|
}
|
|
|
|
func IsErrRPCRateExceeded(err error) bool {
|
|
return err != nil && strings.Contains(err.Error(), errRPCRateExceeded)
|
|
}
|
|
|
|
func IsErrServiceNotFound(err error) bool {
|
|
return err != nil && strings.Contains(err.Error(), errServiceNotFound)
|
|
}
|