Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

agent: prevent very old servers re-joining a cluster with stale data #17171

Merged
merged 24 commits into from
May 15, 2023
Merged

agent: prevent very old servers re-joining a cluster with stale data #17171

merged 24 commits into from
May 15, 2023

Conversation

loshz
Copy link
Contributor

@loshz loshz commented Apr 27, 2023 •
edited
Loading

Description

This PR introduces the concept of Server Metadata, which is server specific information written to a file stored in the configured data directory. During this initial phase, we only store the last seen timestamp in Unix format:

consul/agent/consul/server_metadata.go

Lines 17 to 19 in 5103a1a

type ServerMetadata struct {
LastSeenUnix int64 `json:"last_seen_unix"`
}

2 new agent methods for attempting to prevent old servers from rejoining an existing cluster.

  • persistServerMetadata(): Periodically write a server's metadata to a file in the configured data directory every hour.
  • checkServerLastSeen(): Attempt to read a server's last seen file and check the Unix timestamp against a configurable max age. If the last seen file does not exist, we treat this as an initial startup and return no error.

Example

We attempt to start a previously running server with the following last seen timestamp 1672531200 (2023-Jan-01 00:00:00).

Setting the new config to server_rejoin_age_max = "3d" will prevent this server from starting and require an operator to manually remove this file from the data directory if they need to force the server to rejoin.

Testing & Reproduction steps

  • Added unit tests for new Server Metatdata helper funcs.
  • Added unit tests for agent Server Metatdata implementation.

Links

PR Checklist

  • Write validation function for new config field.
  • updated test coverage
  • external facing docs updated
  • appropriate backport labels added
  • not a security concern

@loshz loshz added the backport/1.15 This release series is no longer active on CE. Use backport/ent/1.15. label Apr 27, 2023
@github-actions github-actions bot added the theme/config Relating to Consul Agent configuration, including reloading label Apr 27, 2023
loshz added 3 commits April 27, 2023 11:23
@loshz
use correct config
38cb8ca 
Signed-off-by: Dan Bond <[email protected]>
@loshz
add comments
15e1e38 
Signed-off-by: Dan Bond <[email protected]>
@loshz
use default age in test golden data
9baff64 
Signed-off-by: Dan Bond <[email protected]>
@loshz loshz changed the title agent: configure server lastseen timestamp agent: prevent very old servers re-joining a cluster with stale data Apr 27, 2023
@loshz
add changelog
f672df4 
Signed-off-by: Dan Bond <[email protected]>
banks
banks reviewed Apr 28, 2023
View reviewed changes
Copy link
Member

@banks banks left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Amazing stuff Dan!

I was originally thinking it might be cleanest to wrap this file handling stuff in a sub-package in the agent package. Then I saw how many actual lines of code it was and was less sure.

But I think I'd still lean towards that because:

  • agent.go is way to big and has all sorts of different logic in. We've been trying to remove stuff from here for years allbeit very slowly.
  • although it's trivial, the logic around reading and writing files, possibly handling misformated (e.g. because of corruption or crash) files etc. would all be so much easier to test in a small package in a unit test vs against a whole agent.

Youd still need the same call points in agent.go so it's only like 20 lines of code to extract but I think it would be a little cleaner that way and a bit easier to test more.

I could also imagine a future where we end up expanding this a bit - e.g. also adding a second timestamp for "last connected to a leader" which might help if servers are up but partitioned for a long time before being decomissioned. I don't think we should do that yet, but it would be much nicer to add stuff like that to a small independent package than agent.go if we do it.

.changelog/17171.txt Outdated Show resolved Hide resolved
agent/agent.go Outdated Show resolved Hide resolved
agent/agent.go Outdated Show resolved Hide resolved
agent/agent.go Outdated

if err := os.WriteFile(file, []byte(now), 0600); err != nil {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

While it wouldn't be the end of the world if we fail to read this on a crash, do you think it's worth attempting to write it more robustly? (e.g. write to a temp file and rename)

agent/agent.go Outdated Show resolved Hide resolved
agent/config/runtime.go Show resolved Hide resolved
loshz added 2 commits May 11, 2023 12:21
@loshz
add comments
0102b59 
Signed-off-by: Dan Bond <[email protected]>
@loshz
update comments
ce52131 
Signed-off-by: Dan Bond <[email protected]>
boxofrad
boxofrad approved these changes May 11, 2023
View reviewed changes
Copy link
Contributor

@boxofrad boxofrad left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks great, nice job! 👏🏻

Don't forget to update the docs. We probably want to call out that you can't set server_rejoin_age_max to anything less than an hour because of the frequency we write the file out to disk.

agent/agent.go Outdated Show resolved Hide resolved
boxofrad
boxofrad reviewed May 11, 2023
View reviewed changes
agent/config/builder.go Outdated Show resolved Hide resolved
jmurret
jmurret reviewed May 11, 2023
View reviewed changes
Copy link
Member

@jmurret jmurret left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice work. I just had a question on whether persistServerMetadata() could silently fail many times and then checkServerLastSeen() would silently continue because it thought it has an assumption about it just booting up.

agent/agent.go Outdated Show resolved Hide resolved
agent/agent.go Outdated Show resolved Hide resolved
agent/agent.go Outdated
// Read server metadata file.
md, err := consul.ReadServerMetadata(filename)
if err != nil {
// Return early if it doesn't as this indicates the server is starting for the first time.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it possible that persistServerMetadata() never wrote the file because it encountered errors writing the file? do we need some kind of check between first startup time and now in this so we figure out "it must have had an opportunity to write a file"? Or possibly an inmemory counter of how many times persistServerMetadata() has run so we should expect a file?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Answered here. But I will update the code comments to explicitly call this out.

@loshz
Copy link
Contributor Author

loshz commented May 12, 2023

Nice work. I just had a question on whether persistServerMetadata() could silently fail many times and then checkServerLastSeen() would silently continue because it thought it has an assumption about it just booting up.

checkServerLastSeen() will always occur first and only once on startup. So even if persistServerMetadata() fails multiple times during a previously running server, we wouldn't have a reliable way of telling and therefore shouldn't block a proceeding server startup attempt.

@loshz loshz marked this pull request as ready for review May 12, 2023 09:51
jmurret
jmurret reviewed May 13, 2023
View reviewed changes
agent/agent.go Outdated Show resolved Hide resolved
jmurret
jmurret approved these changes May 13, 2023
View reviewed changes
Copy link
Member

@jmurret jmurret left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks great. Nice work. Just left a note about one hanging TODO but approved. 🎉

@loshz
Copy link
Contributor Author

loshz commented May 15, 2023 •
edited
Loading

I did some manual testing via Docker compose and everything seems to be working as expected:

Default server_rejoin_age_max with a last_seen_unix of 2 weeks:

==> Starting Consul agent...
...
2023-05-15T09:41:14.616Z [ERROR] agent: startup error: error="refusing to rejoin cluster because server has been offline for more than the configured server_rejoin_age_max (168h0m0s) - consider wiping your data dir"
2023-05-15T09:41:24.616Z [ERROR] agent: startup error: error="refusing to rejoin cluster because server has been offline for more than the configured server_rejoin_age_max (168h0m0s) - consider wiping your data dir"
2023-05-15T09:41:34.616Z [ERROR] agent: startup error: error="refusing to rejoin cluster because server has been offline for more than the configured server_rejoin_age_max (168h0m0s) - consider wiping your data dir"
2023-05-15T09:41:44.617Z [ERROR] agent: startup error: error="refusing to rejoin cluster because server has been offline for more than the configured server_rejoin_age_max (168h0m0s) - consider wiping your data dir"
2023-05-15T09:41:54.617Z [ERROR] agent: startup error: error="refusing to rejoin cluster because server has been offline for more than the configured server_rejoin_age_max (168h0m0s) - consider wiping your data dir"
2023-05-15T09:42:04.618Z [ERROR] agent: startup error: error="refusing to rejoin cluster because server has been offline for more than the configured server_rejoin_age_max (168h0m0s) - consider wiping your data dir"
2023-05-15T09:42:14.620Z [ERROR] agent: Error starting agent: error="refusing to rejoin cluster because server has been offline for more than the configured server_rejoin_age_max (168h0m0s) - consider wiping your data dir"
2023-05-15T09:42:14.620Z [INFO]  agent: Exit code: code=1
exited with code 1

Default server_rejoin_age_max with a last_seen_unix of 1 hour:

==> Starting Consul agent...
...
2023-05-15T10:40:15.679Z [INFO]  agent: Consul agent running!

server_rejoin_age_max set to 10 hours with a last_seen_unix of 2 weeks:

==> Starting Consul agent...
...
2023-05-15T10:44:55.587Z [ERROR] agent: startup error: error="refusing to rejoin cluster because server has been offline for more than the configured server_rejoin_age_max (10h0m0s) - consider wiping your data dir"
2023-05-15T10:45:05.587Z [ERROR] agent: startup error: error="refusing to rejoin cluster because server has been offline for more than the configured server_rejoin_age_max (10h0m0s) - consider wiping your data dir"
2023-05-15T10:45:15.588Z [ERROR] agent: startup error: error="refusing to rejoin cluster because server has been offline for more than the configured server_rejoin_age_max (10h0m0s) - consider wiping your data dir"
2023-05-15T10:45:25.589Z [ERROR] agent: startup error: error="refusing to rejoin cluster because server has been offline for more than the configured server_rejoin_age_max (10h0m0s) - consider wiping your data dir"
2023-05-15T10:45:35.590Z [ERROR] agent: startup error: error="refusing to rejoin cluster because server has been offline for more than the configured server_rejoin_age_max (10h0m0s) - consider wiping your data dir"
2023-05-15T10:45:45.591Z [ERROR] agent: startup error: error="refusing to rejoin cluster because server has been offline for more than the configured server_rejoin_age_max (10h0m0s) - consider wiping your data dir"
2023-05-15T10:45:55.592Z [ERROR] agent: Error starting agent: error="refusing to rejoin cluster because server has been offline for more than the configured server_rejoin_age_max (10h0m0s) - consider wiping your data dir"
2023-05-15T10:45:55.592Z [INFO]  agent: Exit code: code=1
exited with code 1

server_rejoin_age_max set to 10 hours with a last_seen_unix of 1 hour:

==> Starting Consul agent...
...
2023-05-15T10:42:05.568Z [INFO]  agent: Consul agent running!

server_rejoin_age_max set to 1 hour:

==> 1 error occurred:
 	* server_rejoin_age_max: duration '1h' cannot be less than: 6h0m0s


exited with code 1

@loshz loshz merged commit 95f462d into main May 15, 2023
@loshz loshz deleted the loshz/NET-3772 branch May 15, 2023 11:05
@hc-github-team-consul-core hc-github-team-consul-core mentioned this pull request May 15, 2023
Closed
5 tasks
@loshz loshz restored the loshz/NET-3772 branch May 15, 2023 11:10
@loshz loshz deleted the loshz/NET-3772 branch May 15, 2023 11:11
This was referenced May 15, 2023
Merged
Merged
@hc-github-team-consul-core hc-github-team-consul-core mentioned this pull request May 16, 2023
Merged
@p-linnane p-linnane mentioned this pull request Jun 1, 2023
Merged
@markusschuh
Copy link

markusschuh commented Jul 16, 2023 •
edited
Loading

A feedback too small for a new enhancement issue on its own:

The default of the new parameter server_rejoin_age_max is set to

server_rejoin_age_max = "168h"

I'd say, the documentation should use this value - and not translate it to "7d", which is an unsupported format. This is an unnecessary challenge for the less experienced reader - though I agree, it is a small one as the supported syntax is documented at https://developer.hashicorp.com/consul/docs/agent/config/config-files#time-to-live-values

@david-yu david-yu mentioned this pull request Jul 17, 2023
Merged
4 tasks
@david-yu
Copy link
Contributor

Thanks for the suggestion @markusschuh PR is here: #18154

david-yu pushed a commit that referenced this pull request Jul 17, 2023
Change docs to say 168h instead of 7d for server_rejoin_age_max (#18154)
e52ea0e 
### Description

Addresses
#17171 (comment)
This was referenced Jul 17, 2023
Merged
Merged
hc-github-team-consul-core added a commit that referenced this pull request Jul 17, 2023
@hc-github-team-consul-core
Backport of Change docs to say 168h instead of 7d for server_rejoin_a…
e17c8f7 
…ge_max into release/1.15.x (#18155)

## Backport

This PR is auto-generated from #18154 to be assessed for backporting due
to the inclusion of the label backport/1.15.



The below text is copied from the body of the original PR.

---

### Description

Addresses
#17171 (comment)
 
### Testing & Reproduction steps

<!--

* In the case of bugs, describe how to replicate
* If any manual tests were done, document the steps and the conditions
to replicate
* Call out any important/ relevant unit tests, e2e tests or integration
tests you have added or are adding

-->

### Links

<!--

Include any links here that might be helpful for people reviewing your
PR (Tickets, GH issues, API docs, external benchmarks, tools docs, etc).
If there are none, feel free to delete this section.

Please be mindful not to leak any customer or confidential information.
HashiCorp employees may want to use our internal URL shortener to
obfuscate links.

-->

### PR Checklist

* [ ] updated test coverage
* [ ] external facing docs updated
* [ ] appropriate backport labels added
* [ ] not a security concern


---

<details>
<summary> Overview of commits </summary>

  - f5a6411 

</details>

Co-authored-by: David Yu <[email protected]>
hc-github-team-consul-core added a commit that referenced this pull request Jul 17, 2023
@hc-github-team-consul-core
Backport of Change docs to say 168h instead of 7d for server_rejoin_a…
f02d214 
…ge_max into release/1.16.x (#18156)

## Backport

This PR is auto-generated from #18154 to be assessed for backporting due
to the inclusion of the label backport/1.16.



The below text is copied from the body of the original PR.

---

### Description

Addresses
#17171 (comment)
 
### Testing & Reproduction steps

<!--

* In the case of bugs, describe how to replicate
* If any manual tests were done, document the steps and the conditions
to replicate
* Call out any important/ relevant unit tests, e2e tests or integration
tests you have added or are adding

-->

### Links

<!--

Include any links here that might be helpful for people reviewing your
PR (Tickets, GH issues, API docs, external benchmarks, tools docs, etc).
If there are none, feel free to delete this section.

Please be mindful not to leak any customer or confidential information.
HashiCorp employees may want to use our internal URL shortener to
obfuscate links.

-->

### PR Checklist

* [ ] updated test coverage
* [ ] external facing docs updated
* [ ] appropriate backport labels added
* [ ] not a security concern


---

<details>
<summary> Overview of commits </summary>

  - f5a6411 

</details>

Co-authored-by: David Yu <[email protected]>
hc-github-team-consul-core added a commit that referenced this pull request Aug 1, 2023
@hc-github-team-consul-core @zalimeni
@roncodingenthusiast @erichaberkorn @lkysow @rboyer @trujillo-adam @boruszak @mkeeler @nathancoleman @JadhavPoonam @im2nguyen @cthain @ramramhariram @sfarkas-hashicorp @Jeff-Apple @absolutelightning @DanStough @curtbushko @tcraxs @jkirschner-hashicorp @analogue @dependabot @chapmanc @hashi-derek @jmurret @markcampv @boxofrad @stevenzamborsky @gbolo @xwa153 @huikang @cn0047 @ishustava @shamil @dhiaayachi @loshz @sarahalsmiller @nvanthao @mr-miles @natemollica-nm @jm96441n @beautifulentropy @Ranjandas @evanphx @karras @jcjones @fulviodenza @krastin @david3a @nfi-hashicorp @t-davies @vijayraghav-io @eddie-rowe @emilymianeil @nv-hashi @cocolavayen @joselo85 @freddygv @NiniOak @hashicorp-tsccr @blake @iberlot @ezfepo @ndhanushkodi @jjacobson93 @lornasong @judithpatudith
Backport of [CC-5719] Add support for builtin global-read-only policy…
fa0746e 
… into release/1.16.x (#18345)

* [OSS] Post Consul 1.16 updates (#17606)

* chore: update dev build to 1.17

* chore(ci): add nightly 1.16 test

Drop the oldest and add the newest running release branch to nightly
builds.

* Add writeAuditRPCEvent to agent_oss (#17607)

* Add writeAuditRPCEvent to agent_oss

* fix the other diffs

* backport change log

* Add Envoy and Consul version constraints to Envoy extensions (#17612)

* [API Gateway] Fix trust domain for external peered services in synthesis code (#17609)

* [API Gateway] Fix trust domain for external peered services in synthesis code

* Add changelog

* backport ent changes to oss (#17614)

* backport ent changes to oss

* Update .changelog/_5669.txt

Co-authored-by: Michael Zalimeni <[email protected]>

---------

Co-authored-by: Michael Zalimeni <[email protected]>

* Update intentions.mdx (#17619)

Make behaviour of L7 intentions clearer

* enterprise changelog update for audit (#17625)

* Update list of Envoy versions (#17546)

* [API Gateway] Fix rate limiting for API gateways (#17631)

* [API Gateway] Fix rate limiting for API gateways

* Add changelog

* Fix failing unit tests

* Fix operator usage tests for api package

* sort some imports that are wonky between oss and ent (#17637)

* PmTLS and tproxy improvements with failover and L7 traffic mgmt for k8s (#17624)

* porting over changes from enterprise repo to oss

* applied feedback on service mesh for k8s overview

* fixed typo

* removed ent-only build script file

* Apply suggestions from code review

Co-authored-by: Jeff Boruszak <[email protected]>

* Apply suggestions from code review

Co-authored-by: David Yu <[email protected]>
Co-authored-by: Jeff Boruszak <[email protected]>

---------

Co-authored-by: Jeff Boruszak <[email protected]>
Co-authored-by: David Yu <[email protected]>

* Delete check-legacy-links-format.yml (#17647)

* docs: Reference doc updates for permissive mTLS settings (#17371)

* Reference doc updates for permissive mTLS settings
* Document config entry filtering
* Fix minor doc errors (double slashes in link url paths)

---------

Co-authored-by: trujillo-adam <[email protected]>

* Add generic experiments configuration and use it to enable catalog v2 resources (#17604)

* Add generic experiments configuration and use it to enable catalog v2 resources

* Run formatting with -s as CI will validate that this has been done

* api-gateway: stop adding all header filters to virtual host when generating xDS (#17644)

* Add header filter to api-gateway xDS golden test

* Stop adding all header filters to virtual host when generating xDS for api-gateway

* Regenerate xDS golden file for api-gateway w/ header filter

* fix: add agent info reporting log (#17654)

* Add new Consul 1.16 docs (#17651)

* Merge pull request #5773 from hashicorp/docs/rate-limiting-from-ip-addresses-1.16

updated docs for rate limiting for IP addresses - 1.16

* Merge pull request #5609 from hashicorp/docs/enterprise-utilization-reporting

Add docs for enterprise utilization reporting

* Merge pull request #5734 from hashicorp/docs/envoy-ext-1.16

Docs/envoy ext 1.16

* Merge pull request #5773 from hashicorp/docs/rate-limiting-from-ip-addresses-1.16

updated docs for rate limiting for IP addresses - 1.16

* Merge pull request #5609 from hashicorp/docs/enterprise-utilization-reporting

Add docs for enterprise utilization reporting

* Merge pull request #5734 from hashicorp/docs/envoy-ext-1.16

Docs/envoy ext 1.16

* fix build errors

---------

Co-authored-by: trujillo-adam <[email protected]>

* Default `ProxyType` for builtin extensions (#17657)

* Post 1.16.0-rc1 updates (#17663)

- Update changelog to include new entries from release
- Update submodule versions to latest published

* Update service-defaults.mdx (#17656)

* docs: Sameness Groups (#17628)

* port from enterprise branch

* Apply suggestions from code review

Co-authored-by: shanafarkas <[email protected]>

* Update website/content/docs/connect/cluster-peering/usage/create-sameness-groups.mdx

* next steps

* Update website/content/docs/connect/cluster-peering/usage/create-sameness-groups.mdx

Co-authored-by: trujillo-adam <[email protected]>

* Update website/content/docs/k8s/connect/cluster-peering/usage/create-sameness-groups.mdx

Co-authored-by: trujillo-adam <[email protected]>

---------

Co-authored-by: shanafarkas <[email protected]>
Co-authored-by: trujillo-adam <[email protected]>

* Remove "BETA" marker from config entries (#17670)

* CAPIgw for K8s installation updates for 1.16 (#17627)

* trimmed CRD step and reqs from installation

* updated tech specs

* Apply suggestions from code review

Co-authored-by: Jeff Boruszak <[email protected]>
Co-authored-by: Jeff Apple <[email protected]>

* added upgrade instruction

* removed tcp port req

* described downtime and DT-less upgrades

* applied additional review feedback

---------

Co-authored-by: Jeff Boruszak <[email protected]>
Co-authored-by: Jeff Apple <[email protected]>

* additional feedback on API gateway upgrades (#17677)

* additional feedback

* Update website/content/docs/api-gateway/upgrades.mdx

Co-authored-by: Jeff Apple <[email protected]>

---------

Co-authored-by: Jeff Apple <[email protected]>

* docs: JWT Authorization for intentions (#17643)

* Initial page/nav creation

* configuration entry reference page

* Usage + fixes

* service intentions page

* usage

* description

* config entry updates

* formatting fixes

* Update website/content/docs/connect/config-entries/service-intentions.mdx

Co-authored-by: Paul Glass <[email protected]>

* service intentions review fixes

* Overview page review fixes

* Apply suggestions from code review

Co-authored-by: trujillo-adam <[email protected]>

---------

Co-authored-by: Paul Glass <[email protected]>
Co-authored-by: trujillo-adam <[email protected]>

* docs: minor fixes to JWT auth docs (#17680)

* Fixes

* service intentions fixes

* Fix two WAL metrics in docs/agent/telemetry.mdx (#17593)

* updated failover for k8s w-tproxy page title (#17683)

* Add release notes 1.16 rc (#17665)

* Merge pull request #5773 from hashicorp/docs/rate-limiting-from-ip-addresses-1.16

updated docs for rate limiting for IP addresses - 1.16

* Merge pull request #5609 from hashicorp/docs/enterprise-utilization-reporting

Add docs for enterprise utilization reporting

* Merge pull request #5734 from hashicorp/docs/envoy-ext-1.16

Docs/envoy ext 1.16

* Add release notes for 1.16-rc

* Add consul-e license utlization reporting

* Update with rc absolute links

* Update with rc absolute links

* fix typo

* Apply suggestions from code review

Co-authored-by: trujillo-adam <[email protected]>

* Update to use callout component

* address typo

* docs: FIPS 140-2 Compliance (#17668)

* Page + nav + formatting

* link fix

* Update website/content/docs/enterprise/fips.mdx

Co-authored-by: trujillo-adam <[email protected]>

* Update website/content/docs/enterprise/fips.mdx

Co-authored-by: trujillo-adam <[email protected]>

* Update website/content/docs/enterprise/fips.mdx

Co-authored-by: trujillo-adam <[email protected]>

* Update website/content/docs/enterprise/fips.mdx

Co-authored-by: trujillo-adam <[email protected]>

* Update website/content/docs/enterprise/fips.mdx

Co-authored-by: trujillo-adam <[email protected]>

* Update website/content/docs/enterprise/fips.mdx

Co-authored-by: trujillo-adam <[email protected]>

* Update website/content/docs/enterprise/fips.mdx

Co-authored-by: trujillo-adam <[email protected]>

* Update website/content/docs/enterprise/fips.mdx

Co-authored-by: trujillo-adam <[email protected]>

* Update website/content/docs/enterprise/fips.mdx

Co-authored-by: trujillo-adam <[email protected]>

* Update website/content/docs/enterprise/fips.mdx

Co-authored-by: trujillo-adam <[email protected]>

* link fix

* Apply suggestions from code review

Co-authored-by: Jeff Apple <[email protected]>

* Update website/content/docs/enterprise/fips.mdx

---------

Co-authored-by: trujillo-adam <[email protected]>
Co-authored-by: Jeff Apple <[email protected]>

* fix apigw install values file

* fix typos in release notes

---------

Co-authored-by: trujillo-adam <[email protected]>
Co-authored-by: Jeff Boruszak <[email protected]>
Co-authored-by: Jeff Apple <[email protected]>

* fix release notes links (#17687)

* adding redirects for tproxy and envoy extensions (#17688)

* adding redirects

* Apply suggestions from code review

* Fix FIPS copy (#17691)

* fix release notes links

* fix typos on fips docs

* [NET-4107][Supportability] Log Level set to TRACE and duration set to 5m for consul-debug (#17596)

* changed duration to 5 mins and log level to trace

* documentation update

* change log

* ENT merge of ext-authz extension updates (#17684)

* docs: Update default values for Envoy extension proxy types (#17676)

* fix: stop peering delete routine on leader loss (#17483)

* Refactor disco chain prioritize by locality structs (#17696)

This includes prioritize by localities on disco chain targets rather than
resolvers, allowing different targets within the same partition to have
different policies.

* agent: remove agent cache dependency from service mesh leaf certificate management (#17075)

* agent: remove agent cache dependency from service mesh leaf certificate management

This extracts the leaf cert management from within the agent cache.

This code was produced by the following process:

1. All tests in agent/cache, agent/cache-types, agent/auto-config,
   agent/consul/servercert were run at each stage.

    - The tests in agent matching .*Leaf were run at each stage.

    - The tests in agent/leafcert were run at each stage after they
      existed.

2. The former leaf cert Fetch implementation was extracted into a new
   package behind a "fake RPC" endpoint to make it look almost like all
   other cache type internals.

3. The old cache type was shimmed to use the fake RPC endpoint and
   generally cleaned up.

4. I selectively duplicated all of Get/Notify/NotifyCallback/Prepopulate
   from the agent/cache.Cache implementation over into the new package.
   This was renamed as leafcert.Manager.

    - Code that was irrelevant to the leaf cert type was deleted
      (inlining blocking=true, refresh=false)

5. Everything that used the leaf cert cache type (including proxycfg
   stuff) was shifted to use the leafcert.Manager instead.

6. agent/cache-types tests were moved and gently replumbed to execute
   as-is against a leafcert.Manager.

7. Inspired by some of the locking changes from derek's branch I split
   the fat lock into N+1 locks.

8. The waiter chan struct{} was eventually replaced with a
   singleflight.Group around cache updates, which was likely the biggest
   net structural change.

9. The awkward two layers or logic produced as a byproduct of marrying
   the agent cache management code with the leaf cert type code was
   slowly coalesced and flattened to remove confusion.

10. The .*Leaf tests from the agent package were copied and made to work
    directly against a leafcert.Manager to increase direct coverage.

I have done a best effort attempt to port the previous leaf-cert cache
type's tests over in spirit, as well as to take the e2e-ish tests in the
agent package with Leaf in the test name and copy those into the
agent/leafcert package to get more direct coverage, rather than coverage
tangled up in the agent logic.

There is no net-new test coverage, just coverage that was pushed around
from elsewhere.

* [core]: Pin github action workflows (#17695)

* docs: missing changelog for _5517 (#17706)

* add enterprise notes for IP-based rate limits (#17711)

* add enterprise notes for IP-based rate limits

* Apply suggestions from code review

Co-authored-by: Tu Nguyen <[email protected]>
Co-authored-by: David Yu <[email protected]>

* added bolded 'Enterprise' in list items.

---------

Co-authored-by: Tu Nguyen <[email protected]>
Co-authored-by: David Yu <[email protected]>

* Update compatibility.mdx (#17713)

* Remove extraneous version info for Config entries (#17716)

* Update terminating-gateway.mdx
* Update exported-services.mdx
* Update mesh.mdx

* fix: typo in link to section (#17527)

Co-authored-by: trujillo-adam <[email protected]>

* Bump Alpine to 3.18 (#17719)

* Update Dockerfile

* Create 17719.txt

* NET-1825: New ACL token creation docs (#16465)

Co-authored-by: trujillo-adam <[email protected]>
Co-authored-by: Jared Kirschner <[email protected]>

* [NET-3865] [Supportability] Additional Information in the output of 'consul operator raft list-peers' (#17582)

* init

* fix tests

* added -detailed in docs

* added change log

* fix doc

* checking for entry in map

* fix tests

* removed detailed flag

* removed detailed flag

* revert unwanted changes

* removed unwanted changes

* updated change log

* pr review comment changes

* pr comment changes single API instead of two

* fix change log

* fix tests

* fix tests

* fix test operator raft endpoint test

* Update .changelog/17582.txt

Co-authored-by: Semir Patel <[email protected]>

* nits

* updated docs

---------

Co-authored-by: Semir Patel <[email protected]>

* OSS merge: Update error handling login when applying extensions (#17740)

* Bump atlassian/gajira-transition from 3.0.0 to 3.0.1 (#17741)

Bumps [atlassian/gajira-transition](https://github.com/atlassian/gajira-transition) from 3.0.0 to 3.0.1.
- [Release notes](https://github.com/atlassian/gajira-transition/releases)
- [Commits](https://github.com/atlassian/gajira-transition/compare/4749176faf14633954d72af7a44d7f2af01cc92b...38fc9cd61b03d6a53dd35fcccda172fe04b36de3)

---
updated-dependencies:
- dependency-name: atlassian/gajira-transition
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Add truncation to body (#17723)

* docs: Failover overview minor fix (#17743)

* Incorrect symbol

* Clarification

* slight edit for clarity

* docs - update Envoy and Dataplane compat matrix (#17752)

* Update envoy.mdx

added more detail around default versus other compatible versions

* validate localities on agent configs and registration endpoints (#17712)

* Updated docs added explanation. (#17751)

* init

* fix tests

* added -detailed in docs

* added change log

* fix doc

* checking for entry in map

* fix tests

* removed detailed flag

* removed detailed flag

* revert unwanted changes

* removed unwanted changes

* updated change log

* pr review comment changes

* pr comment changes single API instead of two

* fix change log

* fix tests

* fix tests

* fix test operator raft endpoint test

* Update .changelog/17582.txt

Co-authored-by: Semir Patel <[email protected]>

* nits

* updated docs

* explanation added

---------

Co-authored-by: Semir Patel <[email protected]>

* Update index.mdx (#17749)

* added redirects and updated links (#17764)

* Add transparent proxy enhancements changelog (#17757)

* docs - remove use of consul leave during upgrade instructions (#17758)

* Fix issue with streaming service health watches. (#17775)

Fix issue with streaming service health watches.

This commit fixes an issue where the health streams were unaware of service
export changes. Whenever an exported-services config entry is modified, it is
effectively an ACL change.

The bug would be triggered by the following situation:

- no services are exported
- an upstream watch to service X is spawned
- the streaming backend filters out data for service X (due to lack of exports)
- service X is finally exported

In the situation above, the streaming backend does not trigger a refresh of its
data.  This means that any events that were supposed to have been received prior
to the export are NOT backfilled, and the watches never see service X spawning.

We currently have decided to not trigger a stream refresh in this situation due
to the potential for a thundering herd effect (touching exports would cause a
re-fetch of all watches for that partition, potentially).  Therefore, a local
blocking-query approach was added by this commit for agentless.

It's also worth noting that the streaming subscription is currently bypassed
most of the time with agentful, because proxycfg has a `req.Source.Node != ""`
which prevents the `streamingEnabled` check from passing.  This means that while
agents should technically have this same issue, they don't experience it with
mesh health watches.

Note that this is a temporary fix that solves the issue for proxycfg, but not
service-discovery use cases.

* Property Override validation improvements (#17759)

* Reject inbound Prop Override patch with Services

Services filtering is only supported for outbound TrafficDirection patches.

* Improve Prop Override unexpected type validation

- Guard against additional invalid parent and target types
- Add specific error handling for Any fields (unsupported)

* Fixes (#17765)

* Update license get explanation (#17782)

This PR is to clarify what happens if the license get command is run on a follower if the leader hasn't been updated with a newer license.

* Add Patch index to Prop Override validation errors (#17777)

When a patch is found invalid, include its index for easier debugging
when multiple patches are provided.

* Stop referenced jwt providers from being deleted (#17755)

* Stop referenced jwt providers from being deleted

* Implement a Catalog Controllers Lifecycle Integration Test (#17435)

* Implement a Catalog Controllers Lifecycle Integration Test

* Prevent triggering the race detector.

This allows defining some variables for protobuf constants and using those in comparisons. Without that, something internal in the fmt package ended up looking at the protobuf message size cache and triggering the race detector.

* HCP Add node id/name to config (#17750)

* Catalog V2 Container Based Integration Test (#17674)

* Implement the Catalog V2 controller integration container tests

This now allows the container tests to import things from the root module. However for now we want to be very restrictive about which packages we allow importing.

* Add an upgrade test for the new catalog

Currently this should be dormant and not executed. However its put in place to detect breaking changes in the future and show an example of how to do an upgrade test with integration tests structured like catalog v2.

* Make testutil.Retry capable of performing cleanup operations

These cleanup operations are executed after each retry attempt.

* Move TestContext to taking an interface instead of a concrete testing.T

This allows this to be used on a retry.R or generally anything that meets the interface.

* Move to using TestContext instead of background contexts

Also this forces all test methods to implement the Cleanup method now instead of that being an optional interface.


Co-authored-by: Daniel Upton <[email protected]>

* Fix Docs for Trails Leader By (#17763)

* init

* fix tests

* added -detailed in docs

* added change log

* fix doc

* checking for entry in map

* fix tests

* removed detailed flag

* removed detailed flag

* revert unwanted changes

* removed unwanted changes

* updated change log

* pr review comment changes

* pr comment changes single API instead of two

* fix change log

* fix tests

* fix tests

* fix test operator raft endpoint test

* Update .changelog/17582.txt

Co-authored-by: Semir Patel <[email protected]>

* nits

* updated docs

* explanation added

* fix doc

* fix docs

---------

Co-authored-by: Semir Patel <[email protected]>

* Improve Prop Override docs examples (#17799)

- Provide more realistics examples for setting properties not already
  supported natively by Consul
- Remove superfluous commas from HCL, correct target service name, and
  fix service defaults vs. proxy defaults in examples
- Align existing integration test to updated docs

* Test permissive mTLS filter chain not configured with tproxy disabled (#17747)

* Add documentation for remote debugging of integration tests. (#17800)

* Add documentation for remote debugging of integration tests.

* add link from main docs page.

* changes related to PR feedback

* Clarify limitations of Prop Override extension (#17801)

Explicitly document the limitations of the extension, particularly what
kind of fields it is capable of modifying.

* Fix formatting for webhook-certs Consul tutorial (#17810)

* Fix formatting for webhook-certs Consul tutorial
* Make a small grammar change to also pick up whitespace changes necessary for formatting

---------

Co-authored-by: David Yu <[email protected]>

* Add jwt-authn metrics to jwt-provider docs (#17816)

* [NET-3095] add jwt-authn metrics docs

* Change URLs for redirects from RC to default latest (#17822)

* Set GOPRIVATE for all hashicorp repos in CI (#17817)

Consistently set GOPRIVATE to include all hashicorp repos, s.t. private
modules are successfully pulled in enterprise CI.

* Make locality aware routing xDS changes (#17826)

* Fixup consul-container/test/debugging.md (#17815)

Add missing `-t` flag and fix minor typo.

* fixes #17732 - AccessorID in request body should be optional when updating ACL token (#17739)

* AccessorID in request body should be optional when updating ACL token

* add a test case

* fix test case

* add changelog entry for PR #17739

* CA provider doc updates and Vault provider minor update (#17831)

Update CA provider docs

Clarify that providers can differ between
primary and secondary datacenters

Provide a comparison chart for consul vs
vault CA providers

Loosen Vault CA provider validation for RootPKIPath

Update Vault CA provider documentation

* ext-authz Envoy extension: support `localhost` as a valid target URI. (#17821)

* CI Updates (#17834)

* Ensure that git access to private repos uses the ELEVATED_GITHUB_TOKEN

* Bump the runner size for the protobuf generation check

This has failed previously when the runner process that communicates with GitHub gets starved causing the job to fail.

* counter part of ent pr (#17618)

* watch: support -filter for consul watch: checks, services, nodes, service (#17780)

* watch: support -filter for watch checks

* Add filter for watch nodes, services, and service
- unit test added
- Add changelog
- update doc

* Trigger OSS => ENT merge for all release branches (#17853)

Previously, this only triggered for release/*.*.x branches; however, our release process involves cutting a release/1.16.0 branch, for example, at time of code freeze these days. Any PRs to that branch after code freeze today do not make their way to consul-enterprise. This will make behavior for a .0 branch consistent with current behavior for a .x branch.

* Update service-mesh.mdx (#17845)

Deleted two commas which looks quite like some leftovers.

* Add docs for sameness groups with resolvers. (#17851)

* docs: add note about path prefix matching behavior for HTTPRoute config (#17860)

* Add note about path prefix matching behavior for HTTPRoute config

* Update website/content/docs/connect/gateways/api-gateway/configuration/http-route.mdx

Co-authored-by: trujillo-adam <[email protected]>

---------

Co-authored-by: trujillo-adam <[email protected]>

* docs: update upgrade to consul-dataplane docs on k8s (#17852)

* resource: add `AuthorizerContext` helper method (#17393)

* resource: enforce consistent naming of resource types (#17611)

For consistency, resource type names must follow these rules:

- `Group` must be snake case, and in most cases a single word.
- `GroupVersion` must be lowercase, start with a "v" and end with a number.
- `Kind` must be pascal case.

These were chosen because they map to our protobuf type naming
conventions.

* tooling: generate protoset file (#17364)

Extends the `proto` make target to generate a protoset file for use with
grpcurl etc.

* Fix a bug that wrongly trims domains when there is an overlap with DC name (#17160)

* Fix a bug that wrongly trims domains when there is an overlap with DC name

Before this change, when DC name and domain/alt-domain overlap, the domain name incorrectly trimmed from the query.

Example:

Given: datacenter = dc-test, alt-domain = test.consul.
Querying for "test-node.node.dc-test.consul" will faile, because the
code was trimming "test.consul" instead of just ".consul"

This change, fixes the issue by adding dot (.) before trimming

* trimDomain: ensure domain trimmed without modyfing original domains

* update changelog

---------

Co-authored-by: Dhia Ayachi <[email protected]>

* deps: aws-sdk-go v1.44.289 (#17876)

Signed-off-by: Dan Bond <[email protected]>

* api-gateway: add operation cannot be fulfilled error to common errors (#17874)

* add error message

* Update website/content/docs/api-gateway/usage/errors.mdx

Co-authored-by: Nathan Coleman <[email protected]>

* fix formating issues

---------

Co-authored-by: Nathan Coleman <[email protected]>

* api-gateway: add step to upgrade instructions for creating intentions (#17875)

* Changelog - add 1.13.9, 1.14.8, and 1.15.4 (#17889)

* docs: update config enable_debug (#17866)

* update doc for config enable_debug

* Update website/content/docs/agent/config/config-files.mdx

Co-authored-by: trujillo-adam <[email protected]>

---------

Co-authored-by: trujillo-adam <[email protected]>

* Update wording on WAN fed and intermediate_pki_path (#17850)

* Allow service identity tokens the ability to read jwt-providers (#17893)

* Allow service identity tokens the ability to read jwt-providers

* more tests

* service_prefix tests

* Update docs (#17476)

Co-authored-by: trujillo-adam <[email protected]>

* Add emit_tags_as_labels to envoy bootstrap config when using Consul Telemetry Collector (#17888)

* Fix command from kg to kubectl get (#17903)

* Create and update release notes for 1.16 and 1.2 (#17895)

* update release notes for 1.16 and 1.2

* update latest consul core release

* Propose new changes to APIgw upgrade instructions (#17693)

* Propose new changes to APIgw upgrade instructions

* fix build error

* update callouts to render correctly

* Add hideClipboard to log messages

* Added clarification around consul k8s and crds

* Add workflow to verify linux release packages (#17904)

* adding docker files to verify linux packages.

* add verifr-release-linux.yml

* updating name

* pass inputs directly into jobs

* add other linux package platforms

* remove on push

* fix TARGETARCH on debian and ubuntu so it can check arm64 and amd64

* fixing amazon to use the continue line

* add ubuntu i386

* fix comment lines

* working

* remove commented out workflow jobs

* Apply suggestions from code review

Co-authored-by: Nathan Coleman <[email protected]>

* update fedora and ubuntu to use latest tag

---------

Co-authored-by: Nathan Coleman <[email protected]>

* Reference hashicorp/consul instead of consul for Docker image (#17914)

* Reference hashicorp/consul instead of consul for Docker image

* Update Make targets that pull consul directly

* Update Consul K8s Upgrade Doc Updates (#17921)

Updating upgrade procedures to encompass expected errors during upgrade process from v1.13.x to v1.14.x.

* Update sameness-group.mdx (#17915)

* Update create-sameness-groups.mdx (#17927)

* deps: coredns v1.10.1 (#17912)

* Ensure RSA keys are at least 2048 bits in length (#17911)

* Ensure RSA keys are at least 2048 bits in length

* Add changelog

* update key length check for FIPS compliance

* Fix no new variables error and failing to return when error exists from
validating

* clean up code for better readability

* actually return value

* tlsutil: Fix check TLS configuration (#17481)

* tlsutil: Fix check TLS configuration
* Rewording docs.
* Update website/content/docs/services/configuration/checks-configuration-reference.mdx
Co-authored-by: trujillo-adam <[email protected]>
* Fix typos and add changelog entry.
---------

Co-authored-by: trujillo-adam <[email protected]>

* docs: Deprecations for connect-native SDK and specific connect native APIs (#17937)

* Update v1_16_x.mdx
* Update connect native golang page

---------

Co-authored-by: trujillo-adam <[email protected]>

* Revert "Add workflow to verify linux release packages (#17904)" (#17942)

This reverts commit 3368f14fab500ebe9f6aeab5631dd1d5f5a453e5.

* Fixes Secondary ConnectCA update (#17846)

This fixes a bug that was identified which resulted in subsequent
ConnectCA configuration update not to persist in the cluster.

* fixing typo in link to jwt-validations-with-intentions doc (#17955)

* Fix streaming backend link (#17958)

* Fix streaming backend link
* Update health.mdx

* Dynamically create jwks clusters for jwt-providers (#17944)

* website: remove deprecated agent rpc docs (#17962)

* Fix missing BalanceOutboundConnections in v2 catalog. (#17964)

* feature - [NET - 4005]  - [Supportability] Reloadable Configuration - enable_debug (#17565)

* # This is a combination of 9 commits.
# This is the 1st commit message:

init without tests

# This is the commit message #2:

change log

# This is the commit message #3:

fix tests

# This is the commit message #4:

fix tests

# This is the commit message #5:

added tests

# This is the commit message #6:

change log breaking change

# This is the commit message #7:

removed breaking change

# This is the commit message #8:

fix test

# This is the commit message #9:

keeping the test behaviour same

* # This is a combination of 12 commits.
# This is the 1st commit message:

init without tests

# This is the commit message #2:

change log

# This is the commit message #3:

fix tests

# This is the commit message #4:

fix tests

# This is the commit message #5:

added tests

# This is the commit message #6:

change log breaking change

# This is the commit message #7:

removed breaking change

# This is the commit message #8:

fix test

# This is the commit message #9:

keeping the test behaviour same

# This is the commit message #10:

made enable debug atomic bool

# This is the commit message #11:

fix lint

# This is the commit message #12:

fix test true enable debug

* parent 10f500e895d92cc3691ade7b74a33db755d22039
author absolutelightning <[email protected]> 1687352587 +0530
committer absolutelightning <[email protected]> 1687352592 +0530

init without tests

change log

fix tests

fix tests

added tests

change log breaking change

removed breaking change

fix test

keeping the test behaviour same

made enable debug atomic bool

fix lint

fix test true enable debug

using enable debug in agent as atomic bool

test fixes

fix tests

fix tests

added update on correct locaiton

fix tests

fix reloadable config enable debug

fix tests

fix init and acl 403

* revert commit

* Fix formatting codeblocks on APIgw docs (#17970)

* fix formatting codeblocks

* remove unnecessary indents

* Remove POC code (#17974)

* update doc (#17910)

* update doc

* update link

* Remove duplicate and unused newDecodeConfigEntry func (#17979)

* docs: samenessGroup YAML examples (#17984)

* configuration entry syntax

* Example config

* Add changelog entry for 1.16.0 (#17987)

* Fix typo (#17198)

servcies => services

* Expose JWKS cluster config through JWTProviderConfigEntry (#17978)

* Expose JWKS cluster config through JWTProviderConfigEntry

* fix typos, rename trustedCa to trustedCA

* Integration test for ext-authz Envoy extension (#17980)

* Fix incorrect protocol for transparent proxy upstreams. (#17894)

This PR fixes a bug that was introduced in:
https://github.com/hashicorp/consul/pull/16021

A user setting a protocol in proxy-defaults would cause tproxy implicit
upstreams to not honor the upstream service's protocol set in its
`ServiceDefaults.Protocol` field, and would instead always use the
proxy-defaults value.

Due to the fact that upstreams configured with "tcp" can successfully contact
upstream "http" services, this issue was not recognized until recently (a
proxy-defaults with "tcp" and a listening service with "http" would make
successful requests, but not the opposite).

As a temporary work-around, users experiencing this issue can explicitly set
the protocol on the `ServiceDefaults.UpstreamConfig.Overrides`, which should
take precedence.

The fix in this PR removes the proxy-defaults protocol from the wildcard
upstream that tproxy uses to configure implicit upstreams. When the protocol
was included, it would always overwrite the value during discovery chain
compilation, which was not correct. The discovery chain compiler also consumes
proxy defaults to determine the protocol, so simply excluding it from the
wildcard upstream config map resolves the issue.

* feat: include nodes count in operator usage endpoint and cli command (#17939)

* feat: update operator usage api endpoint to include nodes count

* feat: update operator usange cli command to includes nodes count

* [OSS] Improve Gateway Test Coverage of Catalog Health (#18011)

* fix(cli): remove failing check from 'connect envoy' registration for api gateway

* test(integration): add tests to check catalog statsus of gateways on startup

* remove extra sleep comment

* Update test/integration/consul-container/libs/assert/service.go

* changelog

* Fixes Traffic rate limitting docs (#17997)

* Fix removed service-to-service peering links (#17221)

* docs: fix removed service-to-service peering links

* docs: extend peering-via-mesh-gateways intro (thanks @trujillo-adam)

---------

Co-authored-by: trujillo-adam <[email protected]>

* docs: Sameness "beta" warning (#18017)

* Warning updates

* .x

* updated typo in tab heading (#18022)

* updated typo in tab heading

* updated tab group typo, too

* Document that DNS lookups can target cluster peers (#17990)

Static DNS lookups, in addition to explicitly targeting a datacenter,
can target a cluster peer. This was added in 95dc0c7b301b70a6b955a8b7c9737c9b86f03df6 but didn't make the documentation.

The driving function for the change is `parseLocality` here: https://github.com/hashicorp/consul/blob/0b1299c28d8127129d61310ee4280055298438e0/agent/dns_oss.go#L25

The biggest change in this is to adjust the standard lookup syntax to tie
`.<datacenter>` to `.dc` as required-together, and to append in the similar `.<cluster-peer>.peer` optional argument, both to A record and SRV record lookups.

Co-authored-by: David Yu <[email protected]>

* Add first integration test for jwt auth with intention (#18005)

* fix stand-in text for name field (#18030)

* removed sameness conf entry from failover nav (#18033)

* docs - add service sync annotations and k8s service weight annotation (#18032)

* Docs for https://github.com/hashicorp/consul-k8s/pull/2293
* remove versions for enterprise features since they are old

---------

Co-authored-by: Tu Nguyen <[email protected]>

* docs - add jobs use case for service mesh k8s (#18037)

* docs - add jobs use case for service mesh k8s
* add code blocks

* address feedback (#18045)

* Add verify server hostname to tls default (#17155)

* [OSS] Fix initial_fetch_timeout to wait for all xDS resources (#18024)

* fix(connect): set initial_fetch_time to wait indefinitely

* changelog

* PR feedback 1

* ui: fix typos for peer service imports (#17999)

* test: fix FIPS inline cert test message (#18076)

* Fix a couple typos in Agent Telemetry Metrics docs (#18080)

* Fix metrics docs

* Add changelog

Signed-off-by: josh <[email protected]>

---------

Signed-off-by: josh <[email protected]>

* docs updates - cluster peering and virtual services (#18069)

* Update route-to-virtual-services.mdx
* Update establish-peering.mdx

* Update service-mesh-compare.mdx (#17279)

grammar change

* Update helm docs on main (#18085)

* ci: use gotestsum v1.10.1 [NET-4042] (#18088)

* Docs: Update proxy lifecycle annotations and consul-dataplane flags (#18075)

* Update proxy lifecycle annotations and consul-dataplane flags

* Pass configured role name to Vault for AWS auth in Connect CA (#17885)

* Docs for dataplane upgrade on k8s (#18051)

* Docs for dataplane upgrade on k8s

---------

Co-authored-by: David Yu <[email protected]>
Co-authored-by: trujillo-adam <[email protected]>

* docs - update upgrade index page to not recommend consul leave. (#18100)

* Displays Consul version of each nodes in UI nodes section (#17754)

* update UINodes and UINodeInfo response with consul-version info added as NodeMeta, fetched from serf members

* update test cases TestUINodes, TestUINodeInfo

* added nil check for map

* add consul-version in local agent node metadata

* get consul version from serf member and add this as node meta in catalog register request

* updated ui mock response to include consul versions as node meta

* updated ui trans and added version as query param to node list route

* updates in ui templates to display consul version with filter and sorts

* updates in ui - model class, serializers,comparators,predicates for consul version feature

* added change log for Consul Version Feature

* updated to get version from consul service, if for some reason not available from serf

* updated changelog text

* updated dependent testcases

* multiselection version filter

* Update agent/consul/state/catalog.go

comments updated

Co-authored-by: Jared Kirschner <[email protected]>

---------

Co-authored-by: Jared Kirschner <[email protected]>

* api gw 1.16 updates (#18081)

* api gw 1.16 updates

* Apply suggestions from code review

Co-authored-by: Jeff Boruszak <[email protected]>

* update CodeBlockConfig filename

* Apply suggestions from code review

Co-authored-by: trujillo-adam <[email protected]>
Co-authored-by: Jeff Boruszak <[email protected]>

* remove non-standard intentions page

* Update website/content/docs/api-gateway/configuration/index.mdx

Co-authored-by: trujillo-adam <[email protected]>

---------

Co-authored-by: Jeff Boruszak <[email protected]>
Co-authored-by: trujillo-adam <[email protected]>

* [NET-4103] ci: build s390x (#18067)

* ci: build s390x

* ci: test s390x

* ci: dev build s390x

* no GOOS

* ent only

* build: publish s390x

* fix syntax error

* fix syntax error again

* fix syntax error again x2

* test branch

* Move s390x conditionals to step level

* remove test branch

---------

Co-authored-by: emilymianeil <[email protected]>

* :ermahgerd "Sevice Mesh" -> "Service Mesh" (#18116)

Just a typo in the docs.

* Split pbmesh.UpstreamsConfiguration as a resource out of pbmesh.Upstreams (#17991)

Configuration that previously was inlined into the Upstreams resource
applies to both explicit and implicit upstreams and so it makes sense to
split it out into its own resource.

It also has other minor changes:
- Renames `proxy.proto` proxy_configuration.proto`
- Changes the type of `Upstream.destination_ref` from `pbresource.ID` to
`pbresource.Reference`
- Adds comments to fields that didn't have them

* [NET-4895] ci - api tests and consul container tests error because of dependency bugs with go 1.20.6.  Pin go to 1.20.5. (#18124)

### Description
The following jobs started failing when go 1.20.6 was released:
- `go-test-api-1-19`
- `go-test-api-1-20`
- `compatibility-integration-tests`
- `upgrade-integration-tests`

`compatibility-integration-tests` and `compatibility-integration-tests`
to this testcontainers issue:
https://github.com/testcontainers/testcontainers-go/issues/1359. This
issue calls for testcontainers to release a new version when one of
their dependencies is fixed. When that is done, we will unpin the go
versions in `compatibility-integration-tests` and
`compatibility-integration-tests`.

### Testing & Reproduction steps

See these jobs broken in CI and then see them work with this PR.

---------

Co-authored-by: Chris Thain <[email protected]>

* Add ingress gateway deprecation notices to docs (#18102)

### Description

This adds notices, that ingress gateway is deprecated, to several places
in the product docs where ingress gateway is the topic.

### Testing & Reproduction steps

Tested with a local copy of the website.

### Links

Deprecation of ingress gateway was announced in the Release Notes for
Consul 1.16 and Consul-K8s 1.2. See:

[https://developer.hashicorp.com/consul/docs/release-notes/consul/v1_16_x#what-s-deprecated](https://developer.hashicorp.com/consul/docs/release-notes/consul/v1_16_x#what-s-deprecated
)

[https://developer.hashicorp.com/consul/docs/release-notes/consul-k8s/v1_2_x#what-s-deprecated](https://developer.hashicorp.com/consul/docs/release-notes/consul-k8s/v1_2_x#what-s-deprecated)

### PR Checklist

* [N/A] updated test coverage
* [X] external facing docs updated
* [X] appropriate backport labels added
* [X] not a security concern

---------

Co-authored-by: trujillo-adam <[email protected]>

* Add docs for jwt cluster configuration (#18004)

### Description

<!-- Please describe why you're making this change, in plain English.
-->

- Add jwt-provider docs for jwks cluster configuration. The
configuration was added here:
https://github.com/hashicorp/consul/pull/17978

* Docs: fix unmatched bracket for health checks page (#18134)

* NET-4657/add resource service client (#18053)

### Description

<!-- Please describe why you're making this change, in plain English.
-->
Dan had already started on this
[task](https://github.com/hashicorp/consul/pull/17849) which is needed
to start building the HTTP APIs. This just needed some cleanup to get it
ready for review.

Overview:

- Rename `internalResourceServiceClient` to
`insecureResourceServiceClient` for name consistency
- Configure a `secureResourceServiceClient` with auth enabled

### PR Checklist

* [ ] ~updated test coverage~
* [ ] ~external facing docs updated~
* [x] appropriate backport labels added
* [ ] ~not a security concern~

* Fix bug with Vault CA provider (#18112)

Updating RootPKIPath but not IntermediatePKIPath would not update 
leaf signing certs with the new root. Unsure if this happens in practice 
but manual testing showed it is a bug that would break mesh and agent 
connections once the old root is pruned.

* [NET-4897] net/http host header is now verified and request.host that contains socked now error (#18129)

### Description

This is related to https://github.com/hashicorp/consul/pull/18124 where
we pinned the go versions in CI to 1.20.5 and 1.19.10.

go 1.20.6 and 1.19.11 now validate request host headers for validity,
including the hostname cannot be prefixed with slashes.

For local communications (npipe://, unix://), the hostname is not used,
but we need valid and meaningful hostname. Prior versions go Go would
clean the host header, and strip slashes in the process, but go1.20.6
and go1.19.11 no longer do, and reject the host header. Around the
community we are seeing that others are intercepting the req.host and if
it starts with a slash or ends with .sock, they changing the host to
localhost or another dummy value.

[client: define a "dummy" hostname to use for local connections by
thaJeztah · Pull Request #45942 ·
moby/moby](https://github.com/moby/moby/pull/45942)

### Testing & Reproduction steps

Check CI tests.

### Links
* [ ] updated test coverage
* [ ] external facing docs updated
* [ ] appropriate backport labels added
* [ ] not a security concern

* add a conditional around setting LANFilter.AllSegments to make sure it is valid (#18139)

### Description

This is to correct a code problem because this assumes all segments, but
when you get to Enterprise, you can be in partition that is not the
default partition, in which case specifying all segments does not
validate and fails. This is to correct the setting of this filter with
`AllSegments` to `true` to only occur when in the the `default`
partition.

### Testing & Reproduction steps

<!--

* In the case of bugs, describe how to replicate
* If any manual tests were done, document the steps and the conditions
to replicate
* Call out any important/ relevant unit tests, e2e tests or integration
tests you have added or are adding

-->

### Links

<!--

Include any links here that might be helpful for people reviewing your
PR (Tickets, GH issues, API docs, external benchmarks, tools docs, etc).
If there are none, feel free to delete this section.

Please be mindful not to leak any customer or confidential information.
HashiCorp employees may want to use our internal URL shortener to
obfuscate links.

-->

### PR Checklist

* [ ] updated test coverage
* [ ] external facing docs updated
* [ ] appropriate backport labels added
* [ ] not a security concern

* chore: bump upgrade integrations tests to 1.15, 116 [NET-4743] (#18130)

* re org resource type registry (#18133)

* fix: update delegateMock used in ENT (#18149)

### Description

<!-- Please describe why you're making this change, in plain English.
-->
The mock is used in `http_ent_test` file which caused lint failures. For
OSS->ENT parity adding the same change here.

### Links

<!--

Include any links here that might be helpful for people reviewing your
PR (Tickets, GH issues, API docs, external benchmarks, tools docs, etc).
If there are none, feel free to delete this section.

Please be mindful not to leak any customer or confidential information.
HashiCorp employees may want to use our internal URL shortener to
obfuscate links.

-->

Identified in OSS->ENT [merge
PR](https://github.com/hashicorp/consul-enterprise/pull/6328)

### PR Checklist

* [ ] ~updated test coverage~
* [ ] ~external facing docs updated~
* [x] appropriate backport labels added
* [ ] ~not a security concern~

* Use JWT-auth filter in metadata mode & Delegate validation to RBAC filter (#18062)

### Description

<!-- Please describe why you're making this change, in plain English.
-->

- Currently the jwt-auth filter doesn't take into account the service
identity when validating jwt-auth, it only takes into account the path
and jwt provider during validation. This causes issues when multiple
source intentions restrict access to an endpoint with different JWT
providers.
- To fix these issues, rather than use the JWT auth filter for
validation, we use it in metadata mode and allow it to forward the
successful validated JWT token payload to the RBAC filter which will
make the decisions.

This PR ensures requests with and without JWT tokens successfully go
through the jwt-authn filter. The filter however only forwards the data
for successful/valid tokens. On the RBAC filter level, we check the
payload for claims and token issuer + existing rbac rules.

### Testing & Reproduction steps

<!--

* In the case of bugs, describe how to replicate
* If any manual tests were done, document the steps and the conditions
to replicate
* Call out any important/ relevant unit tests, e2e tests or integration
tests you have added or are adding

-->

- This test covers a multi level jwt requirements (requirements at top
level and permissions level). It also assumes you have envoy running,
you have a redis and a sidecar proxy service registered, and have a way
to generate jwks with jwt. I mostly use:
https://www.scottbrady91.com/tools/jwt for this.

- first write your proxy defaults
```
Kind = "proxy-defaults"
name = "global"
config {
  protocol = "http"
}
```
- Create two providers 
```
Kind = "jwt-provider"
Name = "auth0"
Issuer = "https://ronald.local"

JSONWebKeySet = {
    Local = {
     JWKS = "eyJrZXlzIjog....."
    }
}
```

```
Kind = "jwt-provider"
Name = "okta"
Issuer = "https://ronald.local"

JSONWebKeySet = {
   Local = {
     JWKS = "eyJrZXlzIjogW3...."
    }
}
```

- add a service intention
```
Kind = "service-intentions"
Name = "redis"

JWT = {
  Providers = [
    {
      Name = "okta"
    },
  ]
}

Sources = [
  {
    Name = "*"
    Permissions = [{
      Action = "allow"
      HTTP = {
        PathPrefix = "/workspace"
      }
      JWT = {
        Providers = [
          {
            Name = "okta"
            VerifyClaims = [
              {
                  Path = ["aud"]
                  Value = "my_client_app"
              },
              {
                Path = ["sub"]
                Value = "5be86359073c434bad2da3932222dabe"
              }
            ]
          },
        ]
      }

    },
    {
      Action = "allow"
      HTTP = {
        PathPrefix = "/"
      }
      JWT = {
        Providers = [
          {
            Name = "auth0"
          },
        ]
      }

    }]
  }
]
```
- generate 3 jwt tokens: 1 from auth0 jwks, 1 from okta jwks with
different claims than `/workspace` expects and 1 with correct claims
- connect to your envoy (change service and address as needed) to view
logs and potential errors. You can add: `-- --log-level debug` to see
what data is being forwarded
```
consul connect envoy -sidecar-for redis1 -grpc-addr 127.0.0.1:8502
```
- Make the following requests: 
```
curl -s -H "Authorization: Bearer $Auth0_TOKEN" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v

RBAC filter denied

curl -s -H "Authorization: Bearer $Okta_TOKEN_with_wrong_claims" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v

RBAC filter denied

curl -s -H "Authorization: Bearer $Okta_TOKEN_with_correct_claims" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v

Successful request
```


### TODO

* [x] Update test coverage
* [ ] update integration tests (follow-up PR)
* [x] appropriate backport labels added

* Support Consul Connect Envoy Command on Windows (#17694)

### Description

Add support for consul connect envoy command on windows. This PR fixes
the comments of PR - https://github.com/hashicorp/consul/pull/15114

### Testing
* Built consul.exe from this branch on windows and hosted here - [AWS
S3](https://asheshvidyut-bucket.s3.ap-southeast-2.amazonaws.com/consul.zip)
* Updated the
[tutorial](https://developer.hashicorp.com/consul/tutorials/developer-mesh/consul-windows-workloads)
and changed the `consul_url.default` value to [AWS
S3](https://asheshvidyut-bucket.s3.ap-southeast-2.amazonaws.com/consul.zip)
* Followed the steps in the tutorial and verified that everything is
working as described.

### PR Checklist

* [x] updated test coverage
* [ ] external facing docs updated
* [x] appropriate backport labels added
* [x] not a security concern

---------

Co-authored-by: Franco Bruno Lavayen <[email protected]>
Co-authored-by: Jose Ignacio Lorenzo <[email protected]>
Co-authored-by: Jose Ignacio Lorenzo <[email protected]>
Co-authored-by: Dhia Ayachi <[email protected]>

* Change docs to say 168h instead of 7d for server_rejoin_age_max (#18154)

### Description

Addresses
https://github.com/hashicorp/consul/pull/17171#issuecomment-1636930705

* [OSS] test: improve xDS listener code coverage (#18138)

test: improve xDS listener code coverage

* Re-order expected/actual for assertContainerState in consul container tests (#18157)

Re-order expected/actual, consul container tests

* group and document make file (#17943)

* group and document make file

* Add `testing/deployer` (neé `consul-topology`) [NET-4610] (#17823)

Co-authored-by: R.B. Boyer <[email protected]>
Co-authored-by: R.B. Boyer <[email protected]>
Co-authored-by: Freddy <[email protected]>

* [NET-4792] Add integrations tests for jwt-auth (#18169)

* Add FIPS reference to consul enterprise docs (#18028)

* Add FIPS reference to consul enterprise docs

* Update website/content/docs/enterprise/index.mdx

Co-authored-by: David Yu <[email protected]>

* remove support for ecs client (fips)

---------

Co-authored-by: David Yu <[email protected]>

* add peering_commontopo tests [NET-3700] (#17951)

Co-authored-by: R.B. Boyer <[email protected]>
Co-authored-by: R.B. Boyer <[email protected]>
Co-authored-by: Freddy <[email protected]>
Co-authored-by: NiniOak <[email protected]>

* docs - remove Sentinel from enterprise features list (#18176)

* Update index.mdx
* Update kv.mdx
* Update docs-nav-data.json
* delete sentinel.mdx
* Update redirects.js

---------

Co-authored-by: Tu Nguyen <[email protected]>

* [NET-4865] Bump golang.org/x/net to 0.12.0 (#18186)

Bump golang.org/x/net to 0.12.0

While not necessary to directly address CVE-2023-29406 (which should be
handled by using a patched version of Go when building), an
accompanying change to HTTP/2 error handling does impact agent code.

See https://go-review.googlesource.com/c/net/+/506995 for the HTTP/2
change.

Bump this dependency across our submodules as well for the sake of
potential indirect consumers of `x/net/http`.

* Call resource mutate hook before validate hook (NET-4907) (#18178)

* [NET-4865] security: Update Go version to 1.20.6 (#18190)

Update Go version to 1.20.6

This resolves [CVE-2023-29406]
(https://nvd.nist.gov/vuln/detail/CVE-2023-29406) for uses of the
`net/http` standard library.

Note that until the follow-up to #18124 is done, the version of Go used
in those impacted tests will need to remain on 1.20.5.

* Improve XDS test coverage: JWT auth edition (#18183)

* Improve XDS test coverage: JWT auth edition

more tests

* test: xds coverage for jwt listeners

---------

Co-authored-by: DanStough <[email protected]>

* update readme.md (#18191)

u[date readme.md

* Update submodules to latest following 1.16.0 (#18197)

Align all our internal use of submodules on the latest versions.

* SEC-090: Automated trusted workflow pinning (2023-07-18) (#18174)

Result of tsccr-helper -log-level=info -pin-all-workflows .

Co-authored-by: hashicorp-tsccr[bot] <hashicorp-tsccr[bot]@users.noreply.github.com>

* Fix Backport Assistant PR commenting (#18200)

* Fix Backport Assistant failure PR commenting

For general comments on a PR, it looks like you have to use the `/issue`
endpoint rather than `/pulls`, which requires commit/other
review-specific target details.

This matches the endpoint used in `backport-reminder.yml`.

* Remove Backport Reminder workflow

This is noisy (even when adding multiple labels, individual comments per
label are generated), and likely no longer needed: we haven't had this
work in a long time due to an expired GH token, and we now have better
automation for backport PR assignment.

* resource: Pass resource to Write ACL hook instead of just resource Id [NET-4908] (#18192)

* Explicitly enable WebSocket upgrades (#18150)

This PR explicitly enables WebSocket upgrades in Envoy's UpgradeConfig for all
proxy types. (API Gateway, Ingress, and Sidecar.)

Fixes #8283

* docs: fix the description of client rpc (#18206)

* NET-4804: Add dashboard for monitoring consul-k8s (#18208)

* [OSS] Improve xDS Code Coverage - Clusters  (#18165)

test: improve xDS cluster code coverage

* NET-4222 take config file consul container (#18218)

Net 4222 take config file consul container

* Envoy Integration Test Windows (#18007)

* [CONSUL-395] Update check_hostport and Usage (#40)

* [CONSUL-397] Copy envoy binary from Image (#41)

* [CONSUL-382] Support openssl in unique test dockerfile (#43)

* [CONSUL-405] Add bats to single container (#44)

* [CONSUL-414] Run Prometheus Test Cases and Validate Changes (#46)

* [CONSUL-410] Run Jaeger in Single container (#45)

* [CONSUL-412] Run test-sds-server in single container (#48)

* [CONSUL-408] Clean containers (#47)

* [CONSUL-384] Rebase and sync fork (#50)

* [CONSUL-415] Create Scenarios Troubleshooting Docs (#49)

* [CONSUL-417] Update Docs Single Container (#51)

* [CONSUL-428] Add Socat to single container (#54)

* [CONSUL-424] Replace pkill in kill_envoy function (#52)

* [CONSUL-434] Modify Docker run functions in Helper script (#53)

* [CONSUL-435] Replace docker run in set_ttl_check_state & wait_for_agent_service_register functions (#55)

* [CONSUL-438] Add netcat (nc) in the Single container Dockerfile (#56)

* [CONSUL-429] Replace Docker run with Docker exec (#57)

* [CONSUL-436] Curl timeout and run tests (#58)

* [CONSUL-443] Create dogstatsd Function (#59)

* [CONSUL-431] Update Docs Netcat (#60)

* [CONSUL-439] Parse nc Command in function (#61)

* [CONSUL-463] Review curl Exec and get_ca_root Func (#63)

* [CONSUL-453] Docker hostname in Helper functions (#64)

* [CONSUL-461] Test wipe volumes without extra cont (#66)

* [CONSUL-454] Check ports in the Server and Agent containers (#65)

* [CONSUL-441] Update windows dockerfile with version (#62)

* [CONSUL-466] Review case-grpc Failing Test (#67)

* [CONSUL-494] Review case-cfg-resolver-svc-failover (#68)

* [CONSUL-496] Replace docker_wget & docker_curl (#69)

* [CONSUL-499] Cleanup Scripts - Remove nanoserver (#70)

* [CONSUL-500] Update Troubleshooting Docs (#72)

* [CONSUL-502] Pull & Tag Envoy Windows Image (#73)

* [CONSUL-504] Replace docker run in docker_consul (#76)

* [CONSUL-505] Change admin_bind

* [CONSUL-399] Update envoy to 1.23.1 (#78)

* [CONSUL-510] Support case-wanfed-gw on Windows (#79)

* [CONSUL-506] Update troubleshooting Documentation (#80)

* [CONSUL-512] Review debug_dump_volumes Function (#81)

* [CONSUL-514] Add zipkin to Docker Image (#82)

* [CONSUL-515] Update Documentation (#83)

* [CONSUL-529] Support case-consul-exec (#86)

* [CONSUL-530] Update Documentation (#87)

* [CONSUL-530] Update default consul version 1.13.3

* [CONSUL-539] Cleanup (#91)

* [CONSUL-546] Scripts Clean-up (#92)

* [CONSUL-491] Support admin_access_log_path value for Windows (#71)

* [CONSUL-519] Implement mkfifo Alternative (#84)

* [CONSUL-542] Create OS Specific Files for Envoy Package (#88)

* [CONSUL-543] Create exec_supported.go (#89)

* [CONSUL-544] Test and Build Changes (#90)

* Implement os.DevNull

* using mmap instead of disk files

* fix import in exec-unix

* fix nmap open too many arguemtn

* go fmt on file

* changelog file

* fix go mod

* Update .changelog/17694.txt

Co-authored-by: Dhia Ayachi <[email protected]>

* different mmap library

* fix bootstrap json

* some fixes

* chocolatey version fix and image fix

* using different library

* fix Map funciton call

* fix mmap call

* fix tcp dump

* fix tcp dump

* windows tcp dump

* Fix docker run

* fix tests

* fix go mod

* fix version 16.0

* fix version

* fix version dev

* sleep to debug

* fix sleep

* fix permission issue

* fix permission issue

* fix permission issue

* fix command

* fix command

* fix funciton

* fix assert config entry status command not found

* fix command not found assert_cert_has_cn

* fix command not found assert_upstream_missing

* fix command not found assert_upstream_missing_once

* fix command not found get_upstream_endpoint

* fix command not found get_envoy_public_listener_once

* fix command not found

* fix test cases

* windows integration test workflow github

* made code similar to unix using npipe

* fix go.mod

* fix dialing of npipe

* dont wait

* check size of written json

* fix undefined n

* running

* fix dep

* fix syntax error

* fix workflow file

* windows runner

* fix runner

* fix from json

* fix runs on

* merge connect envoy

* fix cin path

* build

* fix file name

* fix file name

* fix dev build

* remove unwanted code

* fix upload

* fix bin name

* fix path

* checkout current branch

* fix path

* fix tests

* fix shell bash for windows sh files

* fix permission of run-test.sh

* removed docker dev

* added shell bash for tests

* fix tag

* fix win=true

* fix cd

* added dev

* fix variable undefined

* removed failing tests

* fix tcp dump image

* fix curl

* fix curl

* tcp dump path

* fix tcpdump path

* fix curl

* fix curl install

* stop removing intermediate containers

* fix tcpdump docker image

* revert -rm

* --rm=false

* makeing docker image before

* fix tcpdump

* removed case consul exec

* removed terminating gateway simple

* comment case wasm

* removed data dog

* comment out upload coverage

* uncomment case-consul-exec

* comment case consul exec

* if always

* logs

* using consul 1.17.0

* fix quotes

* revert quotes

* redirect to dev null

* Revert version

* revert consul connect

* fix version

* removed envoy connect

* not using function

* change log

* docker logs

* fix logs

* restructure bad authz

* rmeoved dev null

* output

* fix file descriptor

* fix cacert

* fix cacert

* fix ca cert

* cacert does not work in windows curl

* fix func

* removed docker logs

* added sleep

* fix tls

* commented case-consul-exec

* removed echo

* retry docker consul

* fix upload bin

* uncomment consul exec

* copying consul.exe to docker image

* copy fix

* fix paths

* fix path

* github workspace path

* latest version

* Revert "latest version"

This reverts commit 5a7d7b82d9e7553bcb01b02557ec8969f9deba1d.

* commented consul exec

* added ssl revoke best effort

* revert best effort

* removed unused files

* rename var name and change dir

* windows runner

* permission

* needs setup fix

* swtich to github runner

* fix file path

* fix path

* fix path

* fix path

* fix path

* fix path

* fix build paths

* fix tag

* nightly runs

* added matrix in github workflow, renamed files

* fix job

* fix matrix

* removed brackes

* from json

* without using job matrix

* fix quotes

* revert job matrix

* fix workflow

* fix comment

* added comment

* nightly runs

* removed datadog ci as it is already measured in linux one

* running test

* Revert "running test"

This reverts commit 7013d15a2…
absolutelightning added a commit that referenced this pull request Sep 4, 2023
@hc-github-team-consul-core @nathancoleman
@natemollica-nm @loshz @jm96441n @beautifulentropy @trujillo-adam @jmurret @Ranjandas @roncodingenthusiast @hashi-derek @absolutelightning @im2nguyen @xwa153 @cthain @boruszak @evanphx @JadhavPoonam @DanStough @karras @jcjones @fulviodenza @krastin @david3a @curtbushko @nfi-hashicorp @t-davies @lkysow @vijayraghav-io @jkirschner-hashicorp @eddie-rowe @emilymianeil @nv-hashi @ishustava @Jeff-Apple @huikang @cocolavayen @joselo85 @dhiaayachi @rboyer @freddygv @NiniOak @zalimeni @analogue @hashicorp-tsccr @blake @iberlot @ezfepo @ndhanushkodi @jjacobson93 @lornasong @judithpatudith @gautambaghel @apollo13 @cuishuang @johnlanda @Achooo @ilpianista @mkeeler @sarahalsmiller @nvanthao @hashicorp-copywrite @boxofrad @natmegs @hdkshingala
Backport of NET 1594 - Snapshot Agent Filename Should Include Consul …
332ba62 
…Version / Datacenter into release/1.15.x (#18639)

* Reference hashicorp/consul instead of consul for Docker image (#17914)

* Reference hashicorp/consul instead of consul for Docker image

* Update Make targets that pull consul directly

* Update Consul K8s Upgrade Doc Updates (#17921)

Updating upgrade procedures to encompass expected errors during upgrade process from v1.13.x to v1.14.x.

* Update sameness-group.mdx (#17915)

* Update create-sameness-groups.mdx (#17927)

* deps: coredns v1.10.1 (#17912)

* Ensure RSA keys are at least 2048 bits in length (#17911)

* Ensure RSA keys are at least 2048 bits in length

* Add changelog

* update key length check for FIPS compliance

* Fix no new variables error and failing to return when error exists from
validating

* clean up code for better readability

* actually return value

* tlsutil: Fix check TLS configuration (#17481)

* tlsutil: Fix check TLS configuration
* Rewording docs.
* Update website/content/docs/services/configuration/checks-configuration-reference.mdx
Co-authored-by: trujillo-adam <[email protected]>
* Fix typos and add changelog entry.
---------

Co-authored-by: trujillo-adam <[email protected]>

* docs: Deprecations for connect-native SDK and specific connect native APIs (#17937)

* Update v1_16_x.mdx
* Update connect native golang page

---------

Co-authored-by: trujillo-adam <[email protected]>

* Revert "Add workflow to verify linux release packages (#17904)" (#17942)

This reverts commit 3368f14fab500ebe9f6aeab5631dd1d5f5a453e5.

* Fixes Secondary ConnectCA update (#17846)

This fixes a bug that was identified which resulted in subsequent
ConnectCA configuration update not to persist in the cluster.

* fixing typo in link to jwt-validations-with-intentions doc (#17955)

* Fix streaming backend link (#17958)

* Fix streaming backend link
* Update health.mdx

* Dynamically create jwks clusters for jwt-providers (#17944)

* website: remove deprecated agent rpc docs (#17962)

* Fix missing BalanceOutboundConnections in v2 catalog. (#17964)

* feature - [NET - 4005]  - [Supportability] Reloadable Configuration - enable_debug (#17565)

* # This is a combination of 9 commits.
# This is the 1st commit message:

init without tests

# This is the commit message #2:

change log

# This is the commit message #3:

fix tests

# This is the commit message #4:

fix tests

# This is the commit message #5:

added tests

# This is the commit message #6:

change log breaking change

# This is the commit message #7:

removed breaking change

# This is the commit message #8:

fix test

# This is the commit message #9:

keeping the test behaviour same

* # This is a combination of 12 commits.
# This is the 1st commit message:

init without tests

# This is the commit message #2:

change log

# This is the commit message #3:

fix tests

# This is the commit message #4:

fix tests

# This is the commit message #5:

added tests

# This is the commit message #6:

change log breaking change

# This is the commit message #7:

removed breaking change

# This is the commit message #8:

fix test

# This is the commit message #9:

keeping the test behaviour same

# This is the commit message #10:

made enable debug atomic bool

# This is the commit message #11:

fix lint

# This is the commit message #12:

fix test true enable debug

* parent 10f500e895d92cc3691ade7b74a33db755d22039
author absolutelightning <[email protected]> 1687352587 +0530
committer absolutelightning <[email protected]> 1687352592 +0530

init without tests

change log

fix tests

fix tests

added tests

change log breaking change

removed breaking change

fix test

keeping the test behaviour same

made enable debug atomic bool

fix lint

fix test true enable debug

using enable debug in agent as atomic bool

test fixes

fix tests

fix tests

added update on correct locaiton

fix tests

fix reloadable config enable debug

fix tests

fix init and acl 403

* revert commit

* Fix formatting codeblocks on APIgw docs (#17970)

* fix formatting codeblocks

* remove unnecessary indents

* Remove POC code (#17974)

* update doc (#17910)

* update doc

* update link

* Remove duplicate and unused newDecodeConfigEntry func (#17979)

* docs: samenessGroup YAML examples (#17984)

* configuration entry syntax

* Example config

* Add changelog entry for 1.16.0 (#17987)

* Fix typo (#17198)

servcies => services

* Expose JWKS cluster config through JWTProviderConfigEntry (#17978)

* Expose JWKS cluster config through JWTProviderConfigEntry

* fix typos, rename trustedCa to trustedCA

* Integration test for ext-authz Envoy extension (#17980)

* Fix incorrect protocol for transparent proxy upstreams. (#17894)

This PR fixes a bug that was introduced in:
https://github.com/hashicorp/consul/pull/16021

A user setting a protocol in proxy-defaults would cause tproxy implicit
upstreams to not honor the upstream service's protocol set in its
`ServiceDefaults.Protocol` field, and would instead always use the
proxy-defaults value.

Due to the fact that upstreams configured with "tcp" can successfully contact
upstream "http" services, this issue was not recognized until recently (a
proxy-defaults with "tcp" and a listening service with "http" would make
successful requests, but not the opposite).

As a temporary work-around, users experiencing this issue can explicitly set
the protocol on the `ServiceDefaults.UpstreamConfig.Overrides`, which should
take precedence.

The fix in this PR removes the proxy-defaults protocol from the wildcard
upstream that tproxy uses to configure implicit upstreams. When the protocol
was included, it would always overwrite the value during discovery chain
compilation, which was not correct. The discovery chain compiler also consumes
proxy defaults to determine the protocol, so simply excluding it from the
wildcard upstream config map resolves the issue.

* feat: include nodes count in operator usage endpoint and cli command (#17939)

* feat: update operator usage api endpoint to include nodes count

* feat: update operator usange cli command to includes nodes count

* [OSS] Improve Gateway Test Coverage of Catalog Health (#18011)

* fix(cli): remove failing check from 'connect envoy' registration for api gateway

* test(integration): add tests to check catalog statsus of gateways on startup

* remove extra sleep comment

* Update test/integration/consul-container/libs/assert/service.go

* changelog

* Fixes Traffic rate limitting docs (#17997)

* Fix removed service-to-service peering links (#17221)

* docs: fix removed service-to-service peering links

* docs: extend peering-via-mesh-gateways intro (thanks @trujillo-adam)

---------

Co-authored-by: trujillo-adam <[email protected]>

* docs: Sameness "beta" warning (#18017)

* Warning updates

* .x

* updated typo in tab heading (#18022)

* updated typo in tab heading

* updated tab group typo, too

* Document that DNS lookups can target cluster peers (#17990)

Static DNS lookups, in addition to explicitly targeting a datacenter,
can target a cluster peer. This was added in 95dc0c7b301b70a6b955a8b7c9737c9b86f03df6 but didn't make the documentation.

The driving function for the change is `parseLocality` here: https://github.com/hashicorp/consul/blob/0b1299c28d8127129d61310ee4280055298438e0/agent/dns_oss.go#L25

The biggest change in this is to adjust the standard lookup syntax to tie
`.<datacenter>` to `.dc` as required-together, and to append in the similar `.<cluster-peer>.peer` optional argument, both to A record and SRV record lookups.

Co-authored-by: David Yu <[email protected]>

* Add first integration test for jwt auth with intention (#18005)

* fix stand-in text for name field (#18030)

* removed sameness conf entry from failover nav (#18033)

* docs - add service sync annotations and k8s service weight annotation (#18032)

* Docs for https://github.com/hashicorp/consul-k8s/pull/2293
* remove versions for enterprise features since they are old

---------

Co-authored-by: Tu Nguyen <[email protected]>

* docs - add jobs use case for service mesh k8s (#18037)

* docs - add jobs use case for service mesh k8s
* add code blocks

* address feedback (#18045)

* Add verify server hostname to tls default (#17155)

* [OSS] Fix initial_fetch_timeout to wait for all xDS resources (#18024)

* fix(connect): set initial_fetch_time to wait indefinitely

* changelog

* PR feedback 1

* ui: fix typos for peer service imports (#17999)

* test: fix FIPS inline cert test message (#18076)

* Fix a couple typos in Agent Telemetry Metrics docs (#18080)

* Fix metrics docs

* Add changelog

Signed-off-by: josh <[email protected]>

---------

Signed-off-by: josh <[email protected]>

* docs updates - cluster peering and virtual services (#18069)

* Update route-to-virtual-services.mdx
* Update establish-peering.mdx

* Update service-mesh-compare.mdx (#17279)

grammar change

* Update helm docs on main (#18085)

* ci: use gotestsum v1.10.1 [NET-4042] (#18088)

* Docs: Update proxy lifecycle annotations and consul-dataplane flags (#18075)

* Update proxy lifecycle annotations and consul-dataplane flags

* Pass configured role name to Vault for AWS auth in Connect CA (#17885)

* Docs for dataplane upgrade on k8s (#18051)

* Docs for dataplane upgrade on k8s

---------

Co-authored-by: David Yu <[email protected]>
Co-authored-by: trujillo-adam <[email protected]>

* docs - update upgrade index page to not recommend consul leave. (#18100)

* Displays Consul version of each nodes in UI nodes section (#17754)

* update UINodes and UINodeInfo response with consul-version info added as NodeMeta, fetched from serf members

* update test cases TestUINodes, TestUINodeInfo

* added nil check for map

* add consul-version in local agent node metadata

* get consul version from serf member and add this as node meta in catalog register request

* updated ui mock response to include consul versions as node meta

* updated ui trans and added version as query param to node list route

* updates in ui templates to display consul version with filter and sorts

* updates in ui - model class, serializers,comparators,predicates for consul version feature

* added change log for Consul Version Feature

* updated to get version from consul service, if for some reason not available from serf

* updated changelog text

* updated dependent testcases

* multiselection version filter

* Update agent/consul/state/catalog.go

comments updated

Co-authored-by: Jared Kirschner <[email protected]>

---------

Co-authored-by: Jared Kirschner <[email protected]>

* api gw 1.16 updates (#18081)

* api gw 1.16 updates

* Apply suggestions from code review

Co-authored-by: Jeff Boruszak <[email protected]>

* update CodeBlockConfig filename

* Apply suggestions from code review

Co-authored-by: trujillo-adam <[email protected]>
Co-authored-by: Jeff Boruszak <[email protected]>

* remove non-standard intentions page

* Update website/content/docs/api-gateway/configuration/index.mdx

Co-authored-by: trujillo-adam <[email protected]>

---------

Co-authored-by: Jeff Boruszak <[email protected]>
Co-authored-by: trujillo-adam <[email protected]>

* [NET-4103] ci: build s390x (#18067)

* ci: build s390x

* ci: test s390x

* ci: dev build s390x

* no GOOS

* ent only

* build: publish s390x

* fix syntax error

* fix syntax error again

* fix syntax error again x2

* test branch

* Move s390x conditionals to step level

* remove test branch

---------

Co-authored-by: emilymianeil <[email protected]>

* :ermahgerd "Sevice Mesh" -> "Service Mesh" (#18116)

Just a typo in the docs.

* Split pbmesh.UpstreamsConfiguration as a resource out of pbmesh.Upstreams (#17991)

Configuration that previously was inlined into the Upstreams resource
applies to both explicit and implicit upstreams and so it makes sense to
split it out into its own resource.

It also has other minor changes:
- Renames `proxy.proto` proxy_configuration.proto`
- Changes the type of `Upstream.destination_ref` from `pbresource.ID` to
`pbresource.Reference`
- Adds comments to fields that didn't have them

* [NET-4895] ci - api tests and consul container tests error because of dependency bugs with go 1.20.6.  Pin go to 1.20.5. (#18124)

### Description
The following jobs started failing when go 1.20.6 was released:
- `go-test-api-1-19`
- `go-test-api-1-20`
- `compatibility-integration-tests`
- `upgrade-integration-tests`

`compatibility-integration-tests` and `compatibility-integration-tests`
to this testcontainers issue:
https://github.com/testcontainers/testcontainers-go/issues/1359. This
issue calls for testcontainers to release a new version when one of
their dependencies is fixed. When that is done, we will unpin the go
versions in `compatibility-integration-tests` and
`compatibility-integration-tests`.

### Testing & Reproduction steps

See these jobs broken in CI and then see them work with this PR.

---------

Co-authored-by: Chris Thain <[email protected]>

* Add ingress gateway deprecation notices to docs (#18102)

### Description

This adds notices, that ingress gateway is deprecated, to several places
in the product docs where ingress gateway is the topic.

### Testing & Reproduction steps

Tested with a local copy of the website.

### Links

Deprecation of ingress gateway was announced in the Release Notes for
Consul 1.16 and Consul-K8s 1.2. See:

[https://developer.hashicorp.com/consul/docs/release-notes/consul/v1_16_x#what-s-deprecated](https://developer.hashicorp.com/consul/docs/release-notes/consul/v1_16_x#what-s-deprecated
)

[https://developer.hashicorp.com/consul/docs/release-notes/consul-k8s/v1_2_x#what-s-deprecated](https://developer.hashicorp.com/consul/docs/release-notes/consul-k8s/v1_2_x#what-s-deprecated)

### PR Checklist

* [N/A] updated test coverage
* [X] external facing docs updated
* [X] appropriate backport labels added
* [X] not a security concern

---------

Co-authored-by: trujillo-adam <[email protected]>

* Add docs for jwt cluster configuration (#18004)

### Description

<!-- Please describe why you're making this change, in plain English.
-->

- Add jwt-provider docs for jwks cluster configuration. The
configuration was added here:
https://github.com/hashicorp/consul/pull/17978

* Docs: fix unmatched bracket for health checks page (#18134)

* NET-4657/add resource service client (#18053)

### Description

<!-- Please describe why you're making this change, in plain English.
-->
Dan had already started on this
[task](https://github.com/hashicorp/consul/pull/17849) which is needed
to start building the HTTP APIs. This just needed some cleanup to get it
ready for review.

Overview:

- Rename `internalResourceServiceClient` to
`insecureResourceServiceClient` for name consistency
- Configure a `secureResourceServiceClient` with auth enabled

### PR Checklist

* [ ] ~updated test coverage~
* [ ] ~external facing docs updated~
* [x] appropriate backport labels added
* [ ] ~not a security concern~

* Fix bug with Vault CA provider (#18112)

Updating RootPKIPath but not IntermediatePKIPath would not update 
leaf signing certs with the new root. Unsure if this happens in practice 
but manual testing showed it is a bug that would break mesh and agent 
connections once the old root is pruned.

* [NET-4897] net/http host header is now verified and request.host that contains socked now error (#18129)

### Description

This is related to https://github.com/hashicorp/consul/pull/18124 where
we pinned the go versions in CI to 1.20.5 and 1.19.10.

go 1.20.6 and 1.19.11 now validate request host headers for validity,
including the hostname cannot be prefixed with slashes.

For local communications (npipe://, unix://), the hostname is not used,
but we need valid and meaningful hostname. Prior versions go Go would
clean the host header, and strip slashes in the process, but go1.20.6
and go1.19.11 no longer do, and reject the host header. Around the
community we are seeing that others are intercepting the req.host and if
it starts with a slash or ends with .sock, they changing the host to
localhost or another dummy value.

[client: define a "dummy" hostname to use for local connections by
thaJeztah · Pull Request #45942 ·
moby/moby](https://github.com/moby/moby/pull/45942)

### Testing & Reproduction steps

Check CI tests.

### Links
* [ ] updated test coverage
* [ ] external facing docs updated
* [ ] appropriate backport labels added
* [ ] not a security concern

* add a conditional around setting LANFilter.AllSegments to make sure it is valid (#18139)

### Description

This is to correct a code problem because this assumes all segments, but
when you get to Enterprise, you can be in partition that is not the
default partition, in which case specifying all segments does not
validate and fails. This is to correct the setting of this filter with
`AllSegments` to `true` to only occur when in the the `default`
partition.

### Testing & Reproduction steps

<!--

* In the case of bugs, describe how to replicate
* If any manual tests were done, document the steps and the conditions
to replicate
* Call out any important/ relevant unit tests, e2e tests or integration
tests you have added or are adding

-->

### Links

<!--

Include any links here that might be helpful for people reviewing your
PR (Tickets, GH issues, API docs, external benchmarks, tools docs, etc).
If there are none, feel free to delete this section.

Please be mindful not to leak any customer or confidential information.
HashiCorp employees may want to use our internal URL shortener to
obfuscate links.

-->

### PR Checklist

* [ ] updated test coverage
* [ ] external facing docs updated
* [ ] appropriate backport labels added
* [ ] not a security concern

* chore: bump upgrade integrations tests to 1.15, 116 [NET-4743] (#18130)

* re org resource type registry (#18133)

* fix: update delegateMock used in ENT (#18149)

### Description

<!-- Please describe why you're making this change, in plain English.
-->
The mock is used in `http_ent_test` file which caused lint failures. For
OSS->ENT parity adding the same change here.

### Links

<!--

Include any links here that might be helpful for people reviewing your
PR (Tickets, GH issues, API docs, external benchmarks, tools docs, etc).
If there are none, feel free to delete this section.

Please be mindful not to leak any customer or confidential information.
HashiCorp employees may want to use our internal URL shortener to
obfuscate links.

-->

Identified in OSS->ENT [merge
PR](https://github.com/hashicorp/consul-enterprise/pull/6328)

### PR Checklist

* [ ] ~updated test coverage~
* [ ] ~external facing docs updated~
* [x] appropriate backport labels added
* [ ] ~not a security concern~

* Use JWT-auth filter in metadata mode & Delegate validation to RBAC filter (#18062)

### Description

<!-- Please describe why you're making this change, in plain English.
-->

- Currently the jwt-auth filter doesn't take into account the service
identity when validating jwt-auth, it only takes into account the path
and jwt provider during validation. This causes issues when multiple
source intentions restrict access to an endpoint with different JWT
providers.
- To fix these issues, rather than use the JWT auth filter for
validation, we use it in metadata mode and allow it to forward the
successful validated JWT token payload to the RBAC filter which will
make the decisions.

This PR ensures requests with and without JWT tokens successfully go
through the jwt-authn filter. The filter however only forwards the data
for successful/valid tokens. On the RBAC filter level, we check the
payload for claims and token issuer + existing rbac rules.

### Testing & Reproduction steps

<!--

* In the case of bugs, describe how to replicate
* If any manual tests were done, document the steps and the conditions
to replicate
* Call out any important/ relevant unit tests, e2e tests or integration
tests you have added or are adding

-->

- This test covers a multi level jwt requirements (requirements at top
level and permissions level). It also assumes you have envoy running,
you have a redis and a sidecar proxy service registered, and have a way
to generate jwks with jwt. I mostly use:
https://www.scottbrady91.com/tools/jwt for this.

- first write your proxy defaults
```
Kind = "proxy-defaults"
name = "global"
config {
  protocol = "http"
}
```
- Create two providers 
```
Kind = "jwt-provider"
Name = "auth0"
Issuer = "https://ronald.local"

JSONWebKeySet = {
    Local = {
     JWKS = "eyJrZXlzIjog....."
    }
}
```

```
Kind = "jwt-provider"
Name = "okta"
Issuer = "https://ronald.local"

JSONWebKeySet = {
   Local = {
     JWKS = "eyJrZXlzIjogW3...."
    }
}
```

- add a service intention
```
Kind = "service-intentions"
Name = "redis"

JWT = {
  Providers = [
    {
      Name = "okta"
    },
  ]
}

Sources = [
  {
    Name = "*"
    Permissions = [{
      Action = "allow"
      HTTP = {
        PathPrefix = "/workspace"
      }
      JWT = {
        Providers = [
          {
            Name = "okta"
            VerifyClaims = [
              {
                  Path = ["aud"]
                  Value = "my_client_app"
              },
              {
                Path = ["sub"]
                Value = "5be86359073c434bad2da3932222dabe"
              }
            ]
          },
        ]
      }

    },
    {
      Action = "allow"
      HTTP = {
        PathPrefix = "/"
      }
      JWT = {
        Providers = [
          {
            Name = "auth0"
          },
        ]
      }

    }]
  }
]
```
- generate 3 jwt tokens: 1 from auth0 jwks, 1 from okta jwks with
different claims than `/workspace` expects and 1 with correct claims
- connect to your envoy (change service and address as needed) to view
logs and potential errors. You can add: `-- --log-level debug` to see
what data is being forwarded
```
consul connect envoy -sidecar-for redis1 -grpc-addr 127.0.0.1:8502
```
- Make the following requests: 
```
curl -s -H "Authorization: Bearer $Auth0_TOKEN" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v

RBAC filter denied

curl -s -H "Authorization: Bearer $Okta_TOKEN_with_wrong_claims" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v

RBAC filter denied

curl -s -H "Authorization: Bearer $Okta_TOKEN_with_correct_claims" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v

Successful request
```


### TODO

* [x] Update test coverage
* [ ] update integration tests (follow-up PR)
* [x] appropriate backport labels added

* Support Consul Connect Envoy Command on Windows (#17694)

### Description

Add support for consul connect envoy command on windows. This PR fixes
the comments of PR - https://github.com/hashicorp/consul/pull/15114

### Testing
* Built consul.exe from this branch on windows and hosted here - [AWS
S3](https://asheshvidyut-bucket.s3.ap-southeast-2.amazonaws.com/consul.zip)
* Updated the
[tutorial](https://developer.hashicorp.com/consul/tutorials/developer-mesh/consul-windows-workloads)
and changed the `consul_url.default` value to [AWS
S3](https://asheshvidyut-bucket.s3.ap-southeast-2.amazonaws.com/consul.zip)
* Followed the steps in the tutorial and verified that everything is
working as described.

### PR Checklist

* [x] updated test coverage
* [ ] external facing docs updated
* [x] appropriate backport labels added
* [x] not a security concern

---------

Co-authored-by: Franco Bruno Lavayen <[email protected]>
Co-authored-by: Jose Ignacio Lorenzo <[email protected]>
Co-authored-by: Jose Ignacio Lorenzo <[email protected]>
Co-authored-by: Dhia Ayachi <[email protected]>

* Change docs to say 168h instead of 7d for server_rejoin_age_max (#18154)

### Description

Addresses
https://github.com/hashicorp/consul/pull/17171#issuecomment-1636930705

* [OSS] test: improve xDS listener code coverage (#18138)

test: improve xDS listener code coverage

* Re-order expected/actual for assertContainerState in consul container tests (#18157)

Re-order expected/actual, consul container tests

* group and document make file (#17943)

* group and document make file

* Add `testing/deployer` (neé `consul-topology`) [NET-4610] (#17823)

Co-authored-by: R.B. Boyer <[email protected]>
Co-authored-by: R.B. Boyer <[email protected]>
Co-authored-by: Freddy <[email protected]>

* [NET-4792] Add integrations tests for jwt-auth (#18169)

* Add FIPS reference to consul enterprise docs (#18028)

* Add FIPS reference to consul enterprise docs

* Update website/content/docs/enterprise/index.mdx

Co-authored-by: David Yu <[email protected]>

* remove support for ecs client (fips)

---------

Co-authored-by: David Yu <[email protected]>

* add peering_commontopo tests [NET-3700] (#17951)

Co-authored-by: R.B. Boyer <[email protected]>
Co-authored-by: R.B. Boyer <[email protected]>
Co-authored-by: Freddy <[email protected]>
Co-authored-by: NiniOak <[email protected]>

* docs - remove Sentinel from enterprise features list (#18176)

* Update index.mdx
* Update kv.mdx
* Update docs-nav-data.json
* delete sentinel.mdx
* Update redirects.js

---------

Co-authored-by: Tu Nguyen <[email protected]>

* [NET-4865] Bump golang.org/x/net to 0.12.0 (#18186)

Bump golang.org/x/net to 0.12.0

While not necessary to directly address CVE-2023-29406 (which should be
handled by using a patched version of Go when building), an
accompanying change to HTTP/2 error handling does impact agent code.

See https://go-review.googlesource.com/c/net/+/506995 for the HTTP/2
change.

Bump this dependency across our submodules as well for the sake of
potential indirect consumers of `x/net/http`.

* Call resource mutate hook before validate hook (NET-4907) (#18178)

* [NET-4865] security: Update Go version to 1.20.6 (#18190)

Update Go version to 1.20.6

This resolves [CVE-2023-29406]
(https://nvd.nist.gov/vuln/detail/CVE-2023-29406) for uses of the
`net/http` standard library.

Note that until the follow-up to #18124 is done, the version of Go used
in those impacted tests will need to remain on 1.20.5.

* Improve XDS test coverage: JWT auth edition (#18183)

* Improve XDS test coverage: JWT auth edition

more tests

* test: xds coverage for jwt listeners

---------

Co-authored-by: DanStough <[email protected]>

* update readme.md (#18191)

u[date readme.md

* Update submodules to latest following 1.16.0 (#18197)

Align all our internal use of submodules on the latest versions.

* SEC-090: Automated trusted workflow pinning (2023-07-18) (#18174)

Result of tsccr-helper -log-level=info -pin-all-workflows .

Co-authored-by: hashicorp-tsccr[bot] <hashicorp-tsccr[bot]@users.noreply.github.com>

* Fix Backport Assistant PR commenting (#18200)

* Fix Backport Assistant failure PR commenting

For general comments on a PR, it looks like you have to use the `/issue`
endpoint rather than `/pulls`, which requires commit/other
review-specific target details.

This matches the endpoint used in `backport-reminder.yml`.

* Remove Backport Reminder workflow

This is noisy (even when adding multiple labels, individual comments per
label are generated), and likely no longer needed: we haven't had this
work in a long time due to an expired GH token, and we now have better
automation for backport PR assignment.

* resource: Pass resource to Write ACL hook instead of just resource Id [NET-4908] (#18192)

* Explicitly enable WebSocket upgrades (#18150)

This PR explicitly enables WebSocket upgrades in Envoy's UpgradeConfig for all
proxy types. (API Gateway, Ingress, and Sidecar.)

Fixes #8283

* docs: fix the description of client rpc (#18206)

* NET-4804: Add dashboard for monitoring consul-k8s (#18208)

* [OSS] Improve xDS Code Coverage - Clusters  (#18165)

test: improve xDS cluster code coverage

* NET-4222 take config file consul container (#18218)

Net 4222 take config file consul container

* Envoy Integration Test Windows (#18007)

* [CONSUL-395] Update check_hostport and Usage (#40)

* [CONSUL-397] Copy envoy binary from Image (#41)

* [CONSUL-382] Support openssl in unique test dockerfile (#43)

* [CONSUL-405] Add bats to single container (#44)

* [CONSUL-414] Run Prometheus Test Cases and Validate Changes (#46)

* [CONSUL-410] Run Jaeger in Single container (#45)

* [CONSUL-412] Run test-sds-server in single container (#48)

* [CONSUL-408] Clean containers (#47)

* [CONSUL-384] Rebase and sync fork (#50)

* [CONSUL-415] Create Scenarios Troubleshooting Docs (#49)

* [CONSUL-417] Update Docs Single Container (#51)

* [CONSUL-428] Add Socat to single container (#54)

* [CONSUL-424] Replace pkill in kill_envoy function (#52)

* [CONSUL-434] Modify Docker run functions in Helper script (#53)

* [CONSUL-435] Replace docker run in set_ttl_check_state & wait_for_agent_service_register functions (#55)

* [CONSUL-438] Add netcat (nc) in the Single container Dockerfile (#56)

* [CONSUL-429] Replace Docker run with Docker exec (#57)

* [CONSUL-436] Curl timeout and run tests (#58)

* [CONSUL-443] Create dogstatsd Function (#59)

* [CONSUL-431] Update Docs Netcat (#60)

* [CONSUL-439] Parse nc Command in function (#61)

* [CONSUL-463] Review curl Exec and get_ca_root Func (#63)

* [CONSUL-453] Docker hostname in Helper functions (#64)

* [CONSUL-461] Test wipe volumes without extra cont (#66)

* [CONSUL-454] Check ports in the Server and Agent containers (#65)

* [CONSUL-441] Update windows dockerfile with version (#62)

* [CONSUL-466] Review case-grpc Failing Test (#67)

* [CONSUL-494] Review case-cfg-resolver-svc-failover (#68)

* [CONSUL-496] Replace docker_wget & docker_curl (#69)

* [CONSUL-499] Cleanup Scripts - Remove nanoserver (#70)

* [CONSUL-500] Update Troubleshooting Docs (#72)

* [CONSUL-502] Pull & Tag Envoy Windows Image (#73)

* [CONSUL-504] Replace docker run in docker_consul (#76)

* [CONSUL-505] Change admin_bind

* [CONSUL-399] Update envoy to 1.23.1 (#78)

* [CONSUL-510] Support case-wanfed-gw on Windows (#79)

* [CONSUL-506] Update troubleshooting Documentation (#80)

* [CONSUL-512] Review debug_dump_volumes Function (#81)

* [CONSUL-514] Add zipkin to Docker Image (#82)

* [CONSUL-515] Update Documentation (#83)

* [CONSUL-529] Support case-consul-exec (#86)

* [CONSUL-530] Update Documentation (#87)

* [CONSUL-530] Update default consul version 1.13.3

* [CONSUL-539] Cleanup (#91)

* [CONSUL-546] Scripts Clean-up (#92)

* [CONSUL-491] Support admin_access_log_path value for Windows (#71)

* [CONSUL-519] Implement mkfifo Alternative (#84)

* [CONSUL-542] Create OS Specific Files for Envoy Package (#88)

* [CONSUL-543] Create exec_supported.go (#89)

* [CONSUL-544] Test and Build Changes (#90)

* Implement os.DevNull

* using mmap instead of disk files

* fix import in exec-unix

* fix nmap open too many arguemtn

* go fmt on file

* changelog file

* fix go mod

* Update .changelog/17694.txt

Co-authored-by: Dhia Ayachi <[email protected]>

* different mmap library

* fix bootstrap json

* some fixes

* chocolatey version fix and image fix

* using different library

* fix Map funciton call

* fix mmap call

* fix tcp dump

* fix tcp dump

* windows tcp dump

* Fix docker run

* fix tests

* fix go mod

* fix version 16.0

* fix version

* fix version dev

* sleep to debug

* fix sleep

* fix permission issue

* fix permission issue

* fix permission issue

* fix command

* fix command

* fix funciton

* fix assert config entry status command not found

* fix command not found assert_cert_has_cn

* fix command not found assert_upstream_missing

* fix command not found assert_upstream_missing_once

* fix command not found get_upstream_endpoint

* fix command not found get_envoy_public_listener_once

* fix command not found

* fix test cases

* windows integration test workflow github

* made code similar to unix using npipe

* fix go.mod

* fix dialing of npipe

* dont wait

* check size of written json

* fix undefined n

* running

* fix dep

* fix syntax error

* fix workflow file

* windows runner

* fix runner

* fix from json

* fix runs on

* merge connect envoy

* fix cin path

* build

* fix file name

* fix file name

* fix dev build

* remove unwanted code

* fix upload

* fix bin name

* fix path

* checkout current branch

* fix path

* fix tests

* fix shell bash for windows sh files

* fix permission of run-test.sh

* removed docker dev

* added shell bash for tests

* fix tag

* fix win=true

* fix cd

* added dev

* fix variable undefined

* removed failing tests

* fix tcp dump image

* fix curl

* fix curl

* tcp dump path

* fix tcpdump path

* fix curl

* fix curl install

* stop removing intermediate containers

* fix tcpdump docker image

* revert -rm

* --rm=false

* makeing docker image before

* fix tcpdump

* removed case consul exec

* removed terminating gateway simple

* comment case wasm

* removed data dog

* comment out upload coverage

* uncomment case-consul-exec

* comment case consul exec

* if always

* logs

* using consul 1.17.0

* fix quotes

* revert quotes

* redirect to dev null

* Revert version

* revert consul connect

* fix version

* removed envoy connect

* not using function

* change log

* docker logs

* fix logs

* restructure bad authz

* rmeoved dev null

* output

* fix file descriptor

* fix cacert

* fix cacert

* fix ca cert

* cacert does not work in windows curl

* fix func

* removed docker logs

* added sleep

* fix tls

* commented case-consul-exec

* removed echo

* retry docker consul

* fix upload bin

* uncomment consul exec

* copying consul.exe to docker image

* copy fix

* fix paths

* fix path

* github workspace path

* latest version

* Revert "latest version"

This reverts commit 5a7d7b82d9e7553bcb01b02557ec8969f9deba1d.

* commented consul exec

* added ssl revoke best effort

* revert best effort

* removed unused files

* rename var name and change dir

* windows runner

* permission

* needs setup fix

* swtich to github runner

* fix file path

* fix path

* fix path

* fix path

* fix path

* fix path

* fix build paths

* fix tag

* nightly runs

* added matrix in github workflow, renamed files

* fix job

* fix matrix

* removed brackes

* from json

* without using job matrix

* fix quotes

* revert job matrix

* fix workflow

* fix comment

* added comment

* nightly runs

* removed datadog ci as it is already measured in linux one

* running test

* Revert "running test"

This reverts commit 7013d15a23732179d18ec5d17336e16b26fab5d4.

* pr comment fixes

* running test now

* running subset of test

* running subset of test

* job matrix

* shell bash

* removed bash shell

* linux machine for job matrix

* fix output

* added cat to debug

* using ubuntu latest

* fix job matrix

* fix win true

* fix go test

* revert job matrix

---------

Co-authored-by: Jose Ignacio Lorenzo <[email protected]>
Co-authored-by: Franco Bruno Lavayen <[email protected]>
Co-authored-by: Ivan K Berlot <[email protected]>
Co-authored-by: Ezequiel Fernández Ponce <[email protected]>
Co-authored-by: joselo85 <[email protected]>
Co-authored-by: Ezequiel Fernández Ponce <[email protected]>
Co-authored-by: Dhia Ayachi <[email protected]>

* fix typos and update ecs compat table (#18215)

* fix typos and update ecs compat table

* real info for the ecs compat matrix table

* Update website/content/docs/ecs/compatibility.mdx

Co-authored-by: Chris Thain <[email protected]>

---------

Co-authored-by: Chris Thain <[email protected]>

* [OSS] proxystate: add proxystate protos (#18216)

* proxystate: add proxystate protos to pbmesh and resolve imports and conflicts between message names

* ci: don't verify s390x (#18224)

* [CC-5718] Remove HCP token requirement during bootstrap (#18140)

* [CC-5718] Remove HCP token requirement during bootstrap

* Re-add error for loading HCP management token

* Remove old comment

* Add changelog entry

* Remove extra validation line

* Apply suggestions from code review

Co-authored-by: lornasong <[email protected]>

---------

Co-authored-by: lornasong <[email protected]>

* [NET-4122] Doc guidance for federation with externalServers (#18207)

Doc guidance for federation with externalServers

Add guidance for proper configuration when joining to a secondary
cluster using WAN fed with external servers also enabled.

Also clarify federation requirements and fix formatting for an
unrelated value.

Update both the Helm chart reference (synced from `consul-k8s`, see
hashicorp/consul-k8s#2583) and the docs on using `externalServers`.

* [OSS] Improve xDS Code Coverage - Endpoints and Misc (#18222)

test: improve xDS endpoints code coverage

* Clarify license reporting timing and GDPR compliance (#18237)

Add Alicia's edits to clarify log timing and other details

* Fix Github Workflow File (#18241)

* [CONSUL-382] Support openssl in unique test dockerfile (#43)

* [CONSUL-405] Add bats to single container (#44)

* [CONSUL-414] Run Prometheus Test Cases and Validate Changes (#46)

* [CONSUL-410] Run Jaeger in Single container (#45)

* [CONSUL-412] Run test-sds-server in single container (#48)

* [CONSUL-408] Clean containers (#47)

* [CONSUL-384] Rebase and sync fork (#50)

* [CONSUL-415] Create Scenarios Troubleshooting Docs (#49)

* [CONSUL-417] Update Docs Single Container (#51)

* [CONSUL-428] Add Socat to single container (#54)

* [CONSUL-424] Replace pkill in kill_envoy function (#52)

* [CONSUL-434] Modify Docker run functions in Helper script (#53)

* [CONSUL-435] Replace docker run in set_ttl_check_state & wait_for_agent_service_register functions (#55)

* [CONSUL-438] Add netcat (nc) in the Single container Dockerfile (#56)

* [CONSUL-429] Replace Docker run with Docker exec (#57)

* [CONSUL-436] Curl timeout and run tests (#58)

* [CONSUL-443] Create dogstatsd Function (#59)

* [CONSUL-431] Update Docs Netcat (#60)

* [CONSUL-439] Parse nc Command in function (#61)

* [CONSUL-463] Review curl Exec and get_ca_root Func (#63)

* [CONSUL-453] Docker hostname in Helper functions (#64)

* [CONSUL-461] Test wipe volumes without extra cont (#66)

* [CONSUL-454] Check ports in the Server and Agent containers (#65)

* [CONSUL-441] Update windows dockerfile with version (#62)

* [CONSUL-466] Review case-grpc Failing Test (#67)

* [CONSUL-494] Review case-cfg-resolver-svc-failover (#68)

* [CONSUL-496] Replace docker_wget & docker_curl (#69)

* [CONSUL-499] Cleanup Scripts - Remove nanoserver (#70)

* [CONSUL-500] Update Troubleshooting Docs (#72)

* [CONSUL-502] Pull & Tag Envoy Windows Image (#73)

* [CONSUL-504] Replace docker run in docker_consul (#76)

* [CONSUL-505] Change admin_bind

* [CONSUL-399] Update envoy to 1.23.1 (#78)

* [CONSUL-510] Support case-wanfed-gw on Windows (#79)

* [CONSUL-506] Update troubleshooting Documentation (#80)

* [CONSUL-512] Review debug_dump_volumes Function (#81)

* [CONSUL-514] Add zipkin to Docker Image (#82)

* [CONSUL-515] Update Documentation (#83)

* [CONSUL-529] Support case-consul-exec (#86)

* [CONSUL-530] Update Documentation (#87)

* [CONSUL-530] Update default consul version 1.13.3

* [CONSUL-539] Cleanup (#91)

* [CONSUL-546] Scripts Clean-up (#92)

* [CONSUL-491] Support admin_access_log_path value for Windows (#71)

* [CONSUL-519] Implement mkfifo Alternative (#84)

* [CONSUL-542] Create OS Specific Files for Envoy Package (#88)

* [CONSUL-543] Create exec_supported.go (#89)

* [CONSUL-544] Test and Build Changes (#90)

* Implement os.DevNull

* using mmap instead of disk files

* fix import in exec-unix

* fix nmap open too many arguemtn

* go fmt on file

* changelog file

* fix go mod

* Update .changelog/17694.txt

Co-authored-by: Dhia Ayachi <[email protected]>

* different mmap library

* fix bootstrap json

* some fixes

* chocolatey version fix and image fix

* using different library

* fix Map funciton call

* fix mmap call

* fix tcp dump

* fix tcp dump

* windows tcp dump

* Fix docker run

* fix tests

* fix go mod

* fix version 16.0

* fix version

* fix version dev

* sleep to debug

* fix sleep

* fix permission issue

* fix permission issue

* fix permission issue

* fix command

* fix command

* fix funciton

* fix assert config entry status command not found

* fix command not found assert_cert_has_cn

* fix command not found assert_upstream_missing

* fix command not found assert_upstream_missing_once

* fix command not found get_upstream_endpoint

* fix command not found get_envoy_public_listener_once

* fix command not found

* fix test cases

* windows integration test workflow github

* made code similar to unix using npipe

* fix go.mod

* fix dialing of npipe

* dont wait

* check size of written json

* fix undefined n

* running

* fix dep

* fix syntax error

* fix workflow file

* windows runner

* fix runner

* fix from json

* fix runs on

* merge connect envoy

* fix cin path

* build

* fix file name

* fix file name

* fix dev build

* remove unwanted code

* fix upload

* fix bin name

* fix path

* checkout current branch

* fix path

* fix tests

* fix shell bash for windows sh files

* fix permission of run-test.sh

* removed docker dev

* added shell bash for tests

* fix tag

* fix win=true

* fix cd

* added dev

* fix variable undefined

* removed failing tests

* fix tcp dump image

* fix curl

* fix curl

* tcp dump path

* fix tcpdump path

* fix curl

* fix curl install

* stop removing intermediate containers

* fix tcpdump docker image

* revert -rm

* --rm=false

* makeing docker image before

* fix tcpdump

* removed case consul exec

* removed terminating gateway simple

* comment case wasm

* removed data dog

* comment out upload coverage

* uncomment case-consul-exec

* comment case consul exec

* if always

* logs

* using consul 1.17.0

* fix quotes

* revert quotes

* redirect to dev null

* Revert version

* revert consul connect

* fix version

* removed envoy connect

* not using function

* change log

* docker logs

* fix logs

* restructure bad authz

* rmeoved dev null

* output

* fix file descriptor

* fix cacert

* fix cacert

* fix ca cert

* cacert does not work in windows curl

* fix func

* removed docker logs

* added sleep

* fix tls

* commented case-consul-exec

* removed echo

* retry docker consul

* fix upload bin

* uncomment consul exec

* copying consul.exe to docker image

* copy fix

* fix paths

* fix path

* github workspace path

* latest version

* Revert "latest version"

This reverts commit 5a7d7b82d9e7553bcb01b02557ec8969f9deba1d.

* commented consul exec

* added ssl revoke best effort

* revert best effort

* removed unused files

* rename var name and change dir

* windows runner

* permission

* needs setup fix

* swtich to github runner

* fix file path

* fix path

* fix path

* fix path

* fix path

* fix path

* fix build paths

* fix tag

* nightly runs

* added matrix in github workflow, renamed files

* fix job

* fix matrix

* removed brackes

* from json

* without using job matrix

* fix quotes

* revert job matrix

* fix workflow

* fix comment

* added comment

* nightly runs

* removed datadog ci as it is already measured in linux one

* running test

* Revert "running test"

This reverts commit 7013d15a23732179d18ec5d17336e16b26fab5d4.

* pr comment fixes

* running test now

* running subset of test

* running subset of test

* job matrix

* shell bash

* removed bash shell

* linux machine for job matrix

* fix output

* added cat to debug

* using ubuntu latest

* fix job matrix

* fix win true

* fix go test

* revert job matrix

* Fix tests

---------

Co-authored-by: Ivan K Berlot <[email protected]>
Co-authored-by: Jose Ignacio Lorenzo <[email protected]>
Co-authored-by: Franco Bruno Lavayen <[email protected]>
Co-authored-by: Ezequiel Fernández Ponce <[email protected]>
Co-authored-by: joselo85 <[email protected]>
Co-authored-by: Ezequiel Fernández Ponce <[email protected]>
Co-authored-by: Dhia Ayachi <[email protected]>

* NET-4996 - filter go-tests and test-integration workflows from running on docs only and ui only changes (#18236)

* Align build arch matrix with enterprise (#18235)

Ensure that OSS remains in sync w/ Enterprise by aligning the format of
arch matrix args for various build jobs.

* Revert "NET-4996 - filter go-tests and test-integration workflows from running on docs only and ui only changes" (#18248)

Revert "NET-4996 - filter go-tests and test-integration workflows from running on docs only and ui only changes (#18236)"

This reverts commit a11dba710e6ce6f172c0fa6c9b61567cc1efffc8.

* resource: Add scope to resource type registration [NET-4976] (#18214)

Enables querying a resource type's registration to determine if a resource is cluster, partition, or partition and namespace scoped.

* Fix some inconsistencies in jwt docs (#18234)

* NET-1825: More new ACL token creation docs (#18063)

Co-authored-by: trujillo-adam <[email protected]>

* grafana: add the panel resource usage of connect injector (#18247)

* [NET-3700] Backfill changelog entry for c2bbe67 and 7402d06 (#18259)

Backfill changelog entry for c2bbe67 and 7402d06

Add a changelog entry for the follow-up PR since it was specific to the
fix and references the original change.

* NET-4897 - update comment to include the current issue url from the go team. (#18263)

* fix typos, style, and improper links (#18269)

* member cli: add -filter expression to flags (#18223)

* member cli: add -filter expression to flags

* changelog

* update doc

* Add test cases

* use quote

* go-tests: disable s390x (#18273)

* docs: Update ext-authz documentation for kubernetes (#18281)

Update ext-authz documentation for kubernetes

* docs: Consul on Kubernetes specific upgrade info (#18230)

* Compatibility page - dataplanes mention

* Upgrading higher-level dataplane mention

* `exec=` string callout

* More visible for upgrade page

* Apply suggestions from code review

Co-authored-by: Tu Nguyen <[email protected]>

---------

Co-authored-by: Tu Nguyen <[email protected]>
Co-authored-by: John Murret <[email protected]>

* Fix typo in Envoy extensions doc (#18284)

* docs: K8s secondary DC requirements (#18280)

* Requested edit

* Apply suggestions from code review

Co-authored-by: trujillo-adam <[email protected]>

---------

Co-authored-by: trujillo-adam <[email protected]>

* api-gateway: subscribe to bound-api-gateway only after receiving api-gateway (#18291)

* api-gateway: subscribe to bound-api-gateway only after receiving api-gateway

This fixes a race condition due to our dependency on having the listener(s) from the api-gateway config entry in order to fully and properly process the resources on the bound-api-gateway config entry.

* Apply suggestions from code review

* Add changelog entry

* Update K8s changelog to address cloud auto-join change in 1.0.0 (#18293)

* Update list of Envoy versions (#18300)

Update supported envoy versions to 1.24.10, 1.25.9, 1.26.4, 1.27.0.

* [NET-4904] Update list of Envoy versions in docs (#18306)

Update list of Envoy versions in docs

Update supported Envoy versions across Consul release versions.

* Update actions for TSCCR (#18317)

Update action versions before deadline

* Fix topology view when displaying mixed connect-native/normal services. (#13023)

* Fix topoloy intention with mixed connect-native/normal services.

If a service is registered twice, once with connect-native and once
without, the topology views would prune the existing intentions. This
change brings the code more in line with the transparent proxy behavior.

* Dedupe nodes in the ServiceTopology ui endpoint (like done with tags).

* Consider a service connect-native as soon as one instance is.

* Stop JWT provider from being written in non default namespace (#18325)

* docs: Fix some comments (#17118)

Signed-off-by: cui fliter <[email protected]>

* [NET-4703] Prevent partial application of Envoy extensions (#18068)

Prevent partial application of Envoy extensions

Ensure that non-required extensions do not change xDS resources before
exiting on failure by cloning proto messages prior to applying each
extension.

To support this change, also move `CanApply` checks up a layer and make
them prior to attempting extension application, s.t. we avoid
unnecessary copies where extensions can't be applied.

Last, ensure that we do not allow panics from `CanApply` or `Extend`
checks to escape the attempted extension application.

* docs: Simplify example jq commands by removing pipes (#18327)

Simplify jq command examples by removing pipes to other commands.

* fix typo in create a mesh token docs (#18337)

* [CC-5719] Add support for builtin global-read-only policy (#18319)

* [CC-5719] Add support for builtin global-read-only policy

* Add changelog

* Add read-only to docs

* Fix some minor issues.

* Change from ReplaceAll to Sprintf

* Change IsValidPolicy name to return an error instead of bool

* Fix PolicyList test

* Fix other tests

* Apply suggestions from code review

Co-authored-by: Paul Glass <[email protected]>

* Fix state store test for policy list.

* Fix naming issues

* Update acl/validation.go

Co-authored-by: Chris Thain <[email protected]>

* Update agent/consul/acl_endpoint.go

---------

Co-authored-by: Paul Glass <[email protected]>
Co-authored-by: Chris Thain <[email protected]>

* [NET-5121] proxystate: move protos to subdirectory to avoid conflicts (#18335)

* also makes a few protos updates

* resource: adding various helpers for working with resources (#18342)

This is a bit of a grab bag of helpers that I found useful for working with them when authoring substantial Controllers. Subsequent PRs will make use of them.

* Wasm integration tests for local and remote wasm files (#17756)

* wasm integration tests for local and remote wasm files

refactoring and cleanup for wasm testing

remove wasm debug logging

PR feedback, wasm build lock

correct path pattern for wasm build files

Add new helper function to minimize changes to existing test code

Remove extra param

mod tidy

add custom service setup to test lib

add wait until static server sidecar can reach nginx sidecar

Doc comments

PR feedback

Update workflows to compile wasm for integration tests

Fix docker build path

Fix package name for linter

Update makefile, fix redeclared function

Update expected wasm filename

Debug test ls in workflow

remove pwd in favor of relative path

more debugging

Build wasm in compatability tests as well

Build wasm directly in ci rather than in container

Debug tinygo and llvm version

Change wasm file extension

Remove tinygo debugging

Remove extra comments

* Add compiled wasm and build instructions

* [HCP Telemetry] Periodic Refresh for Dynamic Telemetry Configuration (#18168)

* OTElExporter now uses an EndpointProvider to discover the endpoint

* OTELSink uses a ConfigProvider to obtain filters and labels configuration

* improve tests for otel_sink

* Regex logic is moved into client for a method on the TelemetryConfig object

* Create a telemetry_config_provider and update deps to use it

* Fix conversion

* fix import newline

* Add logger to hcp client and move telemetry_config out of the client.go file

* Add a telemetry_config.go to refactor client.go

* Update deps

* update hcp deps test

* Modify telemetry_config_providers

* Check for nil filters

* PR review updates

* Fix comments and move around pieces

* Fix comments

* Remove context from client struct

* Moved ctx out of sink struct and fixed filters, added a test

* Remove named imports, use errors.New if not fformatting

* Remove HCP dependencies in telemetry package

* Add success metric and move lock only to grab the t.cfgHahs

* Update hash

* fix nits

* Create an equals method and add tests

* Improve telemetry_config_provider.go tests

* Add race test

* Add missing godoc

* Remove mock for MetricsClient

* Avoid goroutine test panics

* trying to kick CI lint issues by upgrading mod

* imprve test code and add hasher for testing

* Use structure logging for filters, fix error constants, and default to allow all regex

* removed hashin and modify logic to simplify

* Improve race test and fix PR feedback by removing hash equals and avoid testing the timer.Ticker logic, and instead unit test

* Ran make go-mod-tidy

* Use errtypes in the test

* Add changelog

* add safety check for exporter endpoint

* remove require.Contains by using error types, fix structure logging, and fix success metric typo in exporter

* Fixed race test to have changing config values

* Send success metric before modifying config

* Avoid the defer and move the success metric under

* NET-4240 - Snapshots are failing on Windows  (#18302)

* fix go mod

* fix go sum

* added change log

* ran make go mod tidy

* Register ProxyStateTemplate Resource (#18316)

  Also, change the ProxyState.id to identity. This is because we already have the id of this proxy
  from the resource, and this id should be name-aligned with the workload it represents. It should
  also have the owner ref set to the workload ID if we need that. And so the id field seems unnecessary.
  We do, however, need a reference to workload identity so that we can authorize the proxy when it initially
  connects to the xDS server.

* [NET-5146] security: Update Go version to 1.20.7 and `x/net` to 0.13.0 (#18358)

* Update Go version to 1.20.7

This resolves [CVE-2023-29409]
(https://nvd.nist.gov/vuln/detail/CVE-2023-29409)(`crypto/tls`).

* Bump golang.org/x/net to 0.13.0

Addresses [CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978)
for security scans (non-impacting).

* mesh: adding the protobuf types and resources backing mesh config v2 (#18351)

* [OSS] test: xds coverage for routes (#18369)

test: xds coverage for routes

* Fix policy lookup to allow for slashes (#18347)

* Fix policy lookup to allow for slashes

* Fix suggestions

* Fix other test

* Revert some lines

* add some initial CODEOWNERS (#18346)

* Add redirects for mesh-gateway docs (#18377)

* expose grpc as http endpoint (#18221)

expose resource grpc endpoints as http endpoints

* bimapper: fix a bug and add some more test coverage (#18387)

* [docs] Fix ServiceDefaults example in distributed tracing (#17212)

Fix ServiceDefaults example in distributed tracing.

* Fix #17730 - Dev mode has new line (#18367)

* adding new line only in case of pretty in url not in dev mode

* change log added

* chore: make go-mod-tidy (#18388)

* resource: Make resource read tenancy aware (#18397)

* Not using chmod - fixed integration test for Enterprise (#18401)

* Not using chmod

* checking icacls

* Removed push

* replaced ordered list of rate limit ops with flow diagram (#18398)

* replaced ordered list of rate limit ops with flow diagram

* made diagram font bigger

* updated colors for dark mode img

* fixed typo

* recentered dark mode image

* Apply suggestions from code review

Co-authored-by: Jeff Boruszak <[email protected]>

---------

Co-authored-by: Jeff Boruszak <[email protected]>

* Upgrade test: remove outdated test and disable log due to verbosity (#18403)

* remove outdated test

* disable log since we have too many parallel tests

* bump testcontainers-go from 0.22.0 and remove pinned go version in in… (#18395)

* bump testcontainers-go from 0.22.0 and remove pinned go version in integ test

* go mod tidy

* Replace deprecated target.Authority with target.URL.Host

* Add ServiceEndpoints Mutation hook tests (#18404)

* Add ServiceEndpoints Mutation hook tests

* Move endpoint owner validation into the validation hook

Also there were some minor changes to error validation to account for go-cmp not liking to peer through an errors.errorstring type that get created by errors.New

* catalog: add FailoverPolicy mutation and validation hooks (#18390)

Add most of the validation and mutation hooks for the FailoverPolicy resource.

* NET-5115 Add retry + timeout filters for api-gateway (#18324)

* squash, implement retry/timeout in consul core

* update tests

* catalog: adding a controller to reconcile FailoverPolicy resources (#18399)

Add most of the semantic cross-resource validation for FailoverPolicy resources using a new controller.

* fix the error in ent repo (#18421)

fix the error in ent repo

* build: updates for 1.16.1 release (#18415)

* build: updates for 1.16.1 release

* build: fix missing replace directive for envoyextensions

* build: go mod tidy testing/deployer

* update ECS links (#18419)

* docs: fix incorrect proxy-defaults config in Lua Envoy extension (#18418)

fix incorrect proxy-defaults config

* resource: Make resource write tenancy aware (#18423)

* [NET-5217] [OSS] Derive sidecar proxy locality from parent service (#18437)

* Add logging to locality policy application

In OSS, this is currently a no-op.

* Inherit locality when registering sidecars

When sidecar locality is not explicitly configured, inherit locality
from the proxied service.

* NET-4984: Update APIGW Config Entries for JWT Auth (#18366)

* Added oss config entries for Policy and JWT on APIGW

* Updated structs for config entry

* Updated comments, ran deep-copy

* Move JWT configuration into OSS file

* Add in the config entry OSS file for jwts

* Added changelog

* fixing proto spacing

* Moved to using manually written deep copy method

* Use pointers for override/default fields in apigw config entries

* Run gen scripts for changed types

* k8s compat - Openshift versions (#18307)

* Update compatibility.mdx

Co-authored-by: trujillo-adam <[email protected]>

* APIGW: Update HTTPRouteConfigEntry for JWT Auth (#18422)

* Updated httproute config entry for JWT Filters

* Added manual deepcopy method for httproute jwt filter

* Fix test

* Update JWTFilter to be in oss file

* Add changelog

* Add build tags for deepcopy oss file

* [COMPLIANCE] License changes (#18443)

* Adding explicit MPL license for sub-package

This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository.

* Adding explicit MPL license for sub-package

This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository.

* Updating the license from MPL to Business Source License

Going forward, this project will be licensed under the Business Source License v1.1. Please see our blog post for more details at <Blog URL>, FAQ at www.hashicorp.com/licensing-faq, and details of the license at www.hashicorp.com/bsl.

* add missing license headers

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

---------

Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com>

* Net-2708/delete resource endpoint (#18420)

* feat: add http delete endpoint for resource service

* refactor: clean up

* Disable deep-copy codegen verification for now. (#18446)

Once we figure out what to do with license headers for these files we should re-enable this check.

* build: upgrade to latest buf v1.26.0 (#18426)

* NET-4952 Add docs for export command (#18425)

* Init file for services export command docs

* Add link for export command to nav

* Add export to list of subcommands for services

* Add usage and basic command options

* Add API options using includes

* Add section for enterprise options

* Include argument value in flag format

* Add examples

* Apply suggestions from code review

Co-authored-by: Jeff Boruszak <[email protected]>

---------

Co-authored-by: Jeff Boruszak <[email protected]>

* Net-2712/resource hcl parsing (#18250)

* Initial protohcl implementation

Co-authored-by: Matt Keeler <[email protected]>
Co-authored-by: Daniel Upton <[email protected]>

* resourcehcl: implement resource decoding on top of protohcl

Co-authored-by: Daniel Upton <[email protected]>

* fix: resolve ci failures

* test: add additional unmarshalling tests

* refactor: update function test to clean protohcl package imports

---------

Co-authored-by: Matt Keeler <[email protected]>
Co-authored-by: Daniel Upton <[email protected]>

* read endpoint (#18268)

implement http read endpoint to expose resource grpc service read method

* Net-2707/list resource endpoint (#18444)

feat: list resources endpoint

* Fix incorrect yaml in examples (#18463)

* NET-5187: Upgrade test timeout due to log producer errors (#18461)

Stop log producer before restarting container

* [NET-4799] [OSS] xdsv2: listeners L4 support for connect proxies (#18436)

* refactor to avoid future import cycles

* resource: Make resource list …
absolutelightning added a commit that referenced this pull request Sep 4, 2023
@hc-github-team-consul-core @sarahalsmiller
@nathancoleman @jmurret @nvanthao @trujillo-adam @roncodingenthusiast @mr-miles @lkysow @im2nguyen @natemollica-nm @loshz @jm96441n @beautifulentropy @Ranjandas @hashi-derek @absolutelightning @xwa153 @cthain @boruszak @evanphx @JadhavPoonam @DanStough @karras @jcjones @fulviodenza @krastin @david3a @curtbushko @nfi-hashicorp @t-davies @vijayraghav-io @jkirschner-hashicorp @eddie-rowe @emilymianeil @nv-hashi @ishustava @Jeff-Apple @huikang @cocolavayen @joselo85 @dhiaayachi @rboyer @freddygv @NiniOak @zalimeni @analogue @hashicorp-tsccr @blake @iberlot @ezfepo @ndhanushkodi @jjacobson93 @lornasong @judithpatudith @gautambaghel @apollo13 @cuishuang @johnlanda @Achooo @ilpianista @mkeeler @hashicorp-copywrite @boxofrad @natmegs
Backport of NET-3181 - Allow log file naming like Nomad into release/…
c575321 
…1.14.x (#18628)

* api-gateway: add operation cannot be fulfilled error to common errors (#17874)

* add error message

* Update website/content/docs/api-gateway/usage/errors.mdx

Co-authored-by: Nathan Coleman <[email protected]>

* fix formating issues

---------

Co-authored-by: Nathan Coleman <[email protected]>

* api-gateway: add step to upgrade instructions for creating intentions (#17875)

* Changelog - add 1.13.9, 1.14.8, and 1.15.4 (#17889)

* docs: update config enable_debug (#17866)

* update doc for config enable_debug

* Update website/content/docs/agent/config/config-files.mdx

Co-authored-by: trujillo-adam <[email protected]>

---------

Co-authored-by: trujillo-adam <[email protected]>

* Update wording on WAN fed and intermediate_pki_path (#17850)

* Allow service identity tokens the ability to read jwt-providers (#17893)

* Allow service identity tokens the ability to read jwt-providers

* more tests

* service_prefix tests

* Update docs (#17476)

Co-authored-by: trujillo-adam <[email protected]>

* Add emit_tags_as_labels to envoy bootstrap config when using Consul Telemetry Collector (#17888)

* Fix command from kg to kubectl get (#17903)

* Create and update release notes for 1.16 and 1.2 (#17895)

* update release notes for 1.16 and 1.2

* update latest consul core release

* Propose new changes to APIgw upgrade instructions (#17693)

* Propose new changes to APIgw upgrade instructions

* fix build error

* update callouts to render correctly

* Add hideClipboard to log messages

* Added clarification around consul k8s and crds

* Add workflow to verify linux release packages (#17904)

* adding docker files to verify linux packages.

* add verifr-release-linux.yml

* updating name

* pass inputs directly into jobs

* add other linux package platforms

* remove on push

* fix TARGETARCH on debian and ubuntu so it can check arm64 and amd64

* fixing amazon to use the continue line

* add ubuntu i386

* fix comment lines

* working

* remove commented out workflow jobs

* Apply suggestions from code review

Co-authored-by: Nathan Coleman <[email protected]>

* update fedora and ubuntu to use latest tag

---------

Co-authored-by: Nathan Coleman <[email protected]>

* Reference hashicorp/consul instead of consul for Docker image (#17914)

* Reference hashicorp/consul instead of consul for Docker image

* Update Make targets that pull consul directly

* Update Consul K8s Upgrade Doc Updates (#17921)

Updating upgrade procedures to encompass expected errors during upgrade process from v1.13.x to v1.14.x.

* Update sameness-group.mdx (#17915)

* Update create-sameness-groups.mdx (#17927)

* deps: coredns v1.10.1 (#17912)

* Ensure RSA keys are at least 2048 bits in length (#17911)

* Ensure RSA keys are at least 2048 bits in length

* Add changelog

* update key length check for FIPS compliance

* Fix no new variables error and failing to return when error exists from
validating

* clean up code for better readability

* actually return value

* tlsutil: Fix check TLS configuration (#17481)

* tlsutil: Fix check TLS configuration
* Rewording docs.
* Update website/content/docs/services/configuration/checks-configuration-reference.mdx
Co-authored-by: trujillo-adam <[email protected]>
* Fix typos and add changelog entry.
---------

Co-authored-by: trujillo-adam <[email protected]>

* docs: Deprecations for connect-native SDK and specific connect native APIs (#17937)

* Update v1_16_x.mdx
* Update connect native golang page

---------

Co-authored-by: trujillo-adam <[email protected]>

* Revert "Add workflow to verify linux release packages (#17904)" (#17942)

This reverts commit 3368f14fab500ebe9f6aeab5631dd1d5f5a453e5.

* Fixes Secondary ConnectCA update (#17846)

This fixes a bug that was identified which resulted in subsequent
ConnectCA configuration update not to persist in the cluster.

* fixing typo in link to jwt-validations-with-intentions doc (#17955)

* Fix streaming backend link (#17958)

* Fix streaming backend link
* Update health.mdx

* Dynamically create jwks clusters for jwt-providers (#17944)

* website: remove deprecated agent rpc docs (#17962)

* Fix missing BalanceOutboundConnections in v2 catalog. (#17964)

* feature - [NET - 4005]  - [Supportability] Reloadable Configuration - enable_debug (#17565)

* # This is a combination of 9 commits.
# This is the 1st commit message:

init without tests

# This is the commit message #2:

change log

# This is the commit message #3:

fix tests

# This is the commit message #4:

fix tests

# This is the commit message #5:

added tests

# This is the commit message #6:

change log breaking change

# This is the commit message #7:

removed breaking change

# This is the commit message #8:

fix test

# This is the commit message #9:

keeping the test behaviour same

* # This is a combination of 12 commits.
# This is the 1st commit message:

init without tests

# This is the commit message #2:

change log

# This is the commit message #3:

fix tests

# This is the commit message #4:

fix tests

# This is the commit message #5:

added tests

# This is the commit message #6:

change log breaking change

# This is the commit message #7:

removed breaking change

# This is the commit message #8:

fix test

# This is the commit message #9:

keeping the test behaviour same

# This is the commit message #10:

made enable debug atomic bool

# This is the commit message #11:

fix lint

# This is the commit message #12:

fix test true enable debug

* parent 10f500e895d92cc3691ade7b74a33db755d22039
author absolutelightning <[email protected]> 1687352587 +0530
committer absolutelightning <[email protected]> 1687352592 +0530

init without tests

change log

fix tests

fix tests

added tests

change log breaking change

removed breaking change

fix test

keeping the test behaviour same

made enable debug atomic bool

fix lint

fix test true enable debug

using enable debug in agent as atomic bool

test fixes

fix tests

fix tests

added update on correct locaiton

fix tests

fix reloadable config enable debug

fix tests

fix init and acl 403

* revert commit

* Fix formatting codeblocks on APIgw docs (#17970)

* fix formatting codeblocks

* remove unnecessary indents

* Remove POC code (#17974)

* update doc (#17910)

* update doc

* update link

* Remove duplicate and unused newDecodeConfigEntry func (#17979)

* docs: samenessGroup YAML examples (#17984)

* configuration entry syntax

* Example config

* Add changelog entry for 1.16.0 (#17987)

* Fix typo (#17198)

servcies => services

* Expose JWKS cluster config through JWTProviderConfigEntry (#17978)

* Expose JWKS cluster config through JWTProviderConfigEntry

* fix typos, rename trustedCa to trustedCA

* Integration test for ext-authz Envoy extension (#17980)

* Fix incorrect protocol for transparent proxy upstreams. (#17894)

This PR fixes a bug that was introduced in:
https://github.com/hashicorp/consul/pull/16021

A user setting a protocol in proxy-defaults would cause tproxy implicit
upstreams to not honor the upstream service's protocol set in its
`ServiceDefaults.Protocol` field, and would instead always use the
proxy-defaults value.

Due to the fact that upstreams configured with "tcp" can successfully contact
upstream "http" services, this issue was not recognized until recently (a
proxy-defaults with "tcp" and a listening service with "http" would make
successful requests, but not the opposite).

As a temporary work-around, users experiencing this issue can explicitly set
the protocol on the `ServiceDefaults.UpstreamConfig.Overrides`, which should
take precedence.

The fix in this PR removes the proxy-defaults protocol from the wildcard
upstream that tproxy uses to configure implicit upstreams. When the protocol
was included, it would always overwrite the value during discovery chain
compilation, which was not correct. The discovery chain compiler also consumes
proxy defaults to determine the protocol, so simply excluding it from the
wildcard upstream config map resolves the issue.

* feat: include nodes count in operator usage endpoint and cli command (#17939)

* feat: update operator usage api endpoint to include nodes count

* feat: update operator usange cli command to includes nodes count

* [OSS] Improve Gateway Test Coverage of Catalog Health (#18011)

* fix(cli): remove failing check from 'connect envoy' registration for api gateway

* test(integration): add tests to check catalog statsus of gateways on startup

* remove extra sleep comment

* Update test/integration/consul-container/libs/assert/service.go

* changelog

* Fixes Traffic rate limitting docs (#17997)

* Fix removed service-to-service peering links (#17221)

* docs: fix removed service-to-service peering links

* docs: extend peering-via-mesh-gateways intro (thanks @trujillo-adam)

---------

Co-authored-by: trujillo-adam <[email protected]>

* docs: Sameness "beta" warning (#18017)

* Warning updates

* .x

* updated typo in tab heading (#18022)

* updated typo in tab heading

* updated tab group typo, too

* Document that DNS lookups can target cluster peers (#17990)

Static DNS lookups, in addition to explicitly targeting a datacenter,
can target a cluster peer. This was added in 95dc0c7b301b70a6b955a8b7c9737c9b86f03df6 but didn't make the documentation.

The driving function for the change is `parseLocality` here: https://github.com/hashicorp/consul/blob/0b1299c28d8127129d61310ee4280055298438e0/agent/dns_oss.go#L25

The biggest change in this is to adjust the standard lookup syntax to tie
`.<datacenter>` to `.dc` as required-together, and to append in the similar `.<cluster-peer>.peer` optional argument, both to A record and SRV record lookups.

Co-authored-by: David Yu <[email protected]>

* Add first integration test for jwt auth with intention (#18005)

* fix stand-in text for name field (#18030)

* removed sameness conf entry from failover nav (#18033)

* docs - add service sync annotations and k8s service weight annotation (#18032)

* Docs for https://github.com/hashicorp/consul-k8s/pull/2293
* remove versions for enterprise features since they are old

---------

Co-authored-by: Tu Nguyen <[email protected]>

* docs - add jobs use case for service mesh k8s (#18037)

* docs - add jobs use case for service mesh k8s
* add code blocks

* address feedback (#18045)

* Add verify server hostname to tls default (#17155)

* [OSS] Fix initial_fetch_timeout to wait for all xDS resources (#18024)

* fix(connect): set initial_fetch_time to wait indefinitely

* changelog

* PR feedback 1

* ui: fix typos for peer service imports (#17999)

* test: fix FIPS inline cert test message (#18076)

* Fix a couple typos in Agent Telemetry Metrics docs (#18080)

* Fix metrics docs

* Add changelog

Signed-off-by: josh <[email protected]>

---------

Signed-off-by: josh <[email protected]>

* docs updates - cluster peering and virtual services (#18069)

* Update route-to-virtual-services.mdx
* Update establish-peering.mdx

* Update service-mesh-compare.mdx (#17279)

grammar change

* Update helm docs on main (#18085)

* ci: use gotestsum v1.10.1 [NET-4042] (#18088)

* Docs: Update proxy lifecycle annotations and consul-dataplane flags (#18075)

* Update proxy lifecycle annotations and consul-dataplane flags

* Pass configured role name to Vault for AWS auth in Connect CA (#17885)

* Docs for dataplane upgrade on k8s (#18051)

* Docs for dataplane upgrade on k8s

---------

Co-authored-by: David Yu <[email protected]>
Co-authored-by: trujillo-adam <[email protected]>

* docs - update upgrade index page to not recommend consul leave. (#18100)

* Displays Consul version of each nodes in UI nodes section (#17754)

* update UINodes and UINodeInfo response with consul-version info added as NodeMeta, fetched from serf members

* update test cases TestUINodes, TestUINodeInfo

* added nil check for map

* add consul-version in local agent node metadata

* get consul version from serf member and add this as node meta in catalog register request

* updated ui mock response to include consul versions as node meta

* updated ui trans and added version as query param to node list route

* updates in ui templates to display consul version with filter and sorts

* updates in ui - model class, serializers,comparators,predicates for consul version feature

* added change log for Consul Version Feature

* updated to get version from consul service, if for some reason not available from serf

* updated changelog text

* updated dependent testcases

* multiselection version filter

* Update agent/consul/state/catalog.go

comments updated

Co-authored-by: Jared Kirschner <[email protected]>

---------

Co-authored-by: Jared Kirschner <[email protected]>

* api gw 1.16 updates (#18081)

* api gw 1.16 updates

* Apply suggestions from code review

Co-authored-by: Jeff Boruszak <[email protected]>

* update CodeBlockConfig filename

* Apply suggestions from code review

Co-authored-by: trujillo-adam <[email protected]>
Co-authored-by: Jeff Boruszak <[email protected]>

* remove non-standard intentions page

* Update website/content/docs/api-gateway/configuration/index.mdx

Co-authored-by: trujillo-adam <[email protected]>

---------

Co-authored-by: Jeff Boruszak <[email protected]>
Co-authored-by: trujillo-adam <[email protected]>

* [NET-4103] ci: build s390x (#18067)

* ci: build s390x

* ci: test s390x

* ci: dev build s390x

* no GOOS

* ent only

* build: publish s390x

* fix syntax error

* fix syntax error again

* fix syntax error again x2

* test branch

* Move s390x conditionals to step level

* remove test branch

---------

Co-authored-by: emilymianeil <[email protected]>

* :ermahgerd "Sevice Mesh" -> "Service Mesh" (#18116)

Just a typo in the docs.

* Split pbmesh.UpstreamsConfiguration as a resource out of pbmesh.Upstreams (#17991)

Configuration that previously was inlined into the Upstreams resource
applies to both explicit and implicit upstreams and so it makes sense to
split it out into its own resource.

It also has other minor changes:
- Renames `proxy.proto` proxy_configuration.proto`
- Changes the type of `Upstream.destination_ref` from `pbresource.ID` to
`pbresource.Reference`
- Adds comments to fields that didn't have them

* [NET-4895] ci - api tests and consul container tests error because of dependency bugs with go 1.20.6.  Pin go to 1.20.5. (#18124)

### Description
The following jobs started failing when go 1.20.6 was released:
- `go-test-api-1-19`
- `go-test-api-1-20`
- `compatibility-integration-tests`
- `upgrade-integration-tests`

`compatibility-integration-tests` and `compatibility-integration-tests`
to this testcontainers issue:
https://github.com/testcontainers/testcontainers-go/issues/1359. This
issue calls for testcontainers to release a new version when one of
their dependencies is fixed. When that is done, we will unpin the go
versions in `compatibility-integration-tests` and
`compatibility-integration-tests`.

### Testing & Reproduction steps

See these jobs broken in CI and then see them work with this PR.

---------

Co-authored-by: Chris Thain <[email protected]>

* Add ingress gateway deprecation notices to docs (#18102)

### Description

This adds notices, that ingress gateway is deprecated, to several places
in the product docs where ingress gateway is the topic.

### Testing & Reproduction steps

Tested with a local copy of the website.

### Links

Deprecation of ingress gateway was announced in the Release Notes for
Consul 1.16 and Consul-K8s 1.2. See:

[https://developer.hashicorp.com/consul/docs/release-notes/consul/v1_16_x#what-s-deprecated](https://developer.hashicorp.com/consul/docs/release-notes/consul/v1_16_x#what-s-deprecated
)

[https://developer.hashicorp.com/consul/docs/release-notes/consul-k8s/v1_2_x#what-s-deprecated](https://developer.hashicorp.com/consul/docs/release-notes/consul-k8s/v1_2_x#what-s-deprecated)

### PR Checklist

* [N/A] updated test coverage
* [X] external facing docs updated
* [X] appropriate backport labels added
* [X] not a security concern

---------

Co-authored-by: trujillo-adam <[email protected]>

* Add docs for jwt cluster configuration (#18004)

### Description

<!-- Please describe why you're making this change, in plain English.
-->

- Add jwt-provider docs for jwks cluster configuration. The
configuration was added here:
https://github.com/hashicorp/consul/pull/17978

* Docs: fix unmatched bracket for health checks page (#18134)

* NET-4657/add resource service client (#18053)

### Description

<!-- Please describe why you're making this change, in plain English.
-->
Dan had already started on this
[task](https://github.com/hashicorp/consul/pull/17849) which is needed
to start building the HTTP APIs. This just needed some cleanup to get it
ready for review.

Overview:

- Rename `internalResourceServiceClient` to
`insecureResourceServiceClient` for name consistency
- Configure a `secureResourceServiceClient` with auth enabled

### PR Checklist

* [ ] ~updated test coverage~
* [ ] ~external facing docs updated~
* [x] appropriate backport labels added
* [ ] ~not a security concern~

* Fix bug with Vault CA provider (#18112)

Updating RootPKIPath but not IntermediatePKIPath would not update 
leaf signing certs with the new root. Unsure if this happens in practice 
but manual testing showed it is a bug that would break mesh and agent 
connections once the old root is pruned.

* [NET-4897] net/http host header is now verified and request.host that contains socked now error (#18129)

### Description

This is related to https://github.com/hashicorp/consul/pull/18124 where
we pinned the go versions in CI to 1.20.5 and 1.19.10.

go 1.20.6 and 1.19.11 now validate request host headers for validity,
including the hostname cannot be prefixed with slashes.

For local communications (npipe://, unix://), the hostname is not used,
but we need valid and meaningful hostname. Prior versions go Go would
clean the host header, and strip slashes in the process, but go1.20.6
and go1.19.11 no longer do, and reject the host header. Around the
community we are seeing that others are intercepting the req.host and if
it starts with a slash or ends with .sock, they changing the host to
localhost or another dummy value.

[client: define a "dummy" hostname to use for local connections by
thaJeztah · Pull Request #45942 ·
moby/moby](https://github.com/moby/moby/pull/45942)

### Testing & Reproduction steps

Check CI tests.

### Links
* [ ] updated test coverage
* [ ] external facing docs updated
* [ ] appropriate backport labels added
* [ ] not a security concern

* add a conditional around setting LANFilter.AllSegments to make sure it is valid (#18139)

### Description

This is to correct a code problem because this assumes all segments, but
when you get to Enterprise, you can be in partition that is not the
default partition, in which case specifying all segments does not
validate and fails. This is to correct the setting of this filter with
`AllSegments` to `true` to only occur when in the the `default`
partition.

### Testing & Reproduction steps

<!--

* In the case of bugs, describe how to replicate
* If any manual tests were done, document the steps and the conditions
to replicate
* Call out any important/ relevant unit tests, e2e tests or integration
tests you have added or are adding

-->

### Links

<!--

Include any links here that might be helpful for people reviewing your
PR (Tickets, GH issues, API docs, external benchmarks, tools docs, etc).
If there are none, feel free to delete this section.

Please be mindful not to leak any customer or confidential information.
HashiCorp employees may want to use our internal URL shortener to
obfuscate links.

-->

### PR Checklist

* [ ] updated test coverage
* [ ] external facing docs updated
* [ ] appropriate backport labels added
* [ ] not a security concern

* chore: bump upgrade integrations tests to 1.15, 116 [NET-4743] (#18130)

* re org resource type registry (#18133)

* fix: update delegateMock used in ENT (#18149)

### Description

<!-- Please describe why you're making this change, in plain English.
-->
The mock is used in `http_ent_test` file which caused lint failures. For
OSS->ENT parity adding the same change here.

### Links

<!--

Include any links here that might be helpful for people reviewing your
PR (Tickets, GH issues, API docs, external benchmarks, tools docs, etc).
If there are none, feel free to delete this section.

Please be mindful not to leak any customer or confidential information.
HashiCorp employees may want to use our internal URL shortener to
obfuscate links.

-->

Identified in OSS->ENT [merge
PR](https://github.com/hashicorp/consul-enterprise/pull/6328)

### PR Checklist

* [ ] ~updated test coverage~
* [ ] ~external facing docs updated~
* [x] appropriate backport labels added
* [ ] ~not a security concern~

* Use JWT-auth filter in metadata mode & Delegate validation to RBAC filter (#18062)

### Description

<!-- Please describe why you're making this change, in plain English.
-->

- Currently the jwt-auth filter doesn't take into account the service
identity when validating jwt-auth, it only takes into account the path
and jwt provider during validation. This causes issues when multiple
source intentions restrict access to an endpoint with different JWT
providers.
- To fix these issues, rather than use the JWT auth filter for
validation, we use it in metadata mode and allow it to forward the
successful validated JWT token payload to the RBAC filter which will
make the decisions.

This PR ensures requests with and without JWT tokens successfully go
through the jwt-authn filter. The filter however only forwards the data
for successful/valid tokens. On the RBAC filter level, we check the
payload for claims and token issuer + existing rbac rules.

### Testing & Reproduction steps

<!--

* In the case of bugs, describe how to replicate
* If any manual tests were done, document the steps and the conditions
to replicate
* Call out any important/ relevant unit tests, e2e tests or integration
tests you have added or are adding

-->

- This test covers a multi level jwt requirements (requirements at top
level and permissions level). It also assumes you have envoy running,
you have a redis and a sidecar proxy service registered, and have a way
to generate jwks with jwt. I mostly use:
https://www.scottbrady91.com/tools/jwt for this.

- first write your proxy defaults
```
Kind = "proxy-defaults"
name = "global"
config {
  protocol = "http"
}
```
- Create two providers 
```
Kind = "jwt-provider"
Name = "auth0"
Issuer = "https://ronald.local"

JSONWebKeySet = {
    Local = {
     JWKS = "eyJrZXlzIjog....."
    }
}
```

```
Kind = "jwt-provider"
Name = "okta"
Issuer = "https://ronald.local"

JSONWebKeySet = {
   Local = {
     JWKS = "eyJrZXlzIjogW3...."
    }
}
```

- add a service intention
```
Kind = "service-intentions"
Name = "redis"

JWT = {
  Providers = [
    {
      Name = "okta"
    },
  ]
}

Sources = [
  {
    Name = "*"
    Permissions = [{
      Action = "allow"
      HTTP = {
        PathPrefix = "/workspace"
      }
      JWT = {
        Providers = [
          {
            Name = "okta"
            VerifyClaims = [
              {
                  Path = ["aud"]
                  Value = "my_client_app"
              },
              {
                Path = ["sub"]
                Value = "5be86359073c434bad2da3932222dabe"
              }
            ]
          },
        ]
      }

    },
    {
      Action = "allow"
      HTTP = {
        PathPrefix = "/"
      }
      JWT = {
        Providers = [
          {
            Name = "auth0"
          },
        ]
      }

    }]
  }
]
```
- generate 3 jwt tokens: 1 from auth0 jwks, 1 from okta jwks with
different claims than `/workspace` expects and 1 with correct claims
- connect to your envoy (change service and address as needed) to view
logs and potential errors. You can add: `-- --log-level debug` to see
what data is being forwarded
```
consul connect envoy -sidecar-for redis1 -grpc-addr 127.0.0.1:8502
```
- Make the following requests: 
```
curl -s -H "Authorization: Bearer $Auth0_TOKEN" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v

RBAC filter denied

curl -s -H "Authorization: Bearer $Okta_TOKEN_with_wrong_claims" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v

RBAC filter denied

curl -s -H "Authorization: Bearer $Okta_TOKEN_with_correct_claims" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v

Successful request
```


### TODO

* [x] Update test coverage
* [ ] update integration tests (follow-up PR)
* [x] appropriate backport labels added

* Support Consul Connect Envoy Command on Windows (#17694)

### Description

Add support for consul connect envoy command on windows. This PR fixes
the comments of PR - https://github.com/hashicorp/consul/pull/15114

### Testing
* Built consul.exe from this branch on windows and hosted here - [AWS
S3](https://asheshvidyut-bucket.s3.ap-southeast-2.amazonaws.com/consul.zip)
* Updated the
[tutorial](https://developer.hashicorp.com/consul/tutorials/developer-mesh/consul-windows-workloads)
and changed the `consul_url.default` value to [AWS
S3](https://asheshvidyut-bucket.s3.ap-southeast-2.amazonaws.com/consul.zip)
* Followed the steps in the tutorial and verified that everything is
working as described.

### PR Checklist

* [x] updated test coverage
* [ ] external facing docs updated
* [x] appropriate backport labels added
* [x] not a security concern

---------

Co-authored-by: Franco Bruno Lavayen <[email protected]>
Co-authored-by: Jose Ignacio Lorenzo <[email protected]>
Co-authored-by: Jose Ignacio Lorenzo <[email protected]>
Co-authored-by: Dhia Ayachi <[email protected]>

* Change docs to say 168h instead of 7d for server_rejoin_age_max (#18154)

### Description

Addresses
https://github.com/hashicorp/consul/pull/17171#issuecomment-1636930705

* [OSS] test: improve xDS listener code coverage (#18138)

test: improve xDS listener code coverage

* Re-order expected/actual for assertContainerState in consul container tests (#18157)

Re-order expected/actual, consul container tests

* group and document make file (#17943)

* group and document make file

* Add `testing/deployer` (neé `consul-topology`) [NET-4610] (#17823)

Co-authored-by: R.B. Boyer <[email protected]>
Co-authored-by: R.B. Boyer <[email protected]>
Co-authored-by: Freddy <[email protected]>

* [NET-4792] Add integrations tests for jwt-auth (#18169)

* Add FIPS reference to consul enterprise docs (#18028)

* Add FIPS reference to consul enterprise docs

* Update website/content/docs/enterprise/index.mdx

Co-authored-by: David Yu <[email protected]>

* remove support for ecs client (fips)

---------

Co-authored-by: David Yu <[email protected]>

* add peering_commontopo tests [NET-3700] (#17951)

Co-authored-by: R.B. Boyer <[email protected]>
Co-authored-by: R.B. Boyer <[email protected]>
Co-authored-by: Freddy <[email protected]>
Co-authored-by: NiniOak <[email protected]>

* docs - remove Sentinel from enterprise features list (#18176)

* Update index.mdx
* Update kv.mdx
* Update docs-nav-data.json
* delete sentinel.mdx
* Update redirects.js

---------

Co-authored-by: Tu Nguyen <[email protected]>

* [NET-4865] Bump golang.org/x/net to 0.12.0 (#18186)

Bump golang.org/x/net to 0.12.0

While not necessary to directly address CVE-2023-29406 (which should be
handled by using a patched version of Go when building), an
accompanying change to HTTP/2 error handling does impact agent code.

See https://go-review.googlesource.com/c/net/+/506995 for the HTTP/2
change.

Bump this dependency across our submodules as well for the sake of
potential indirect consumers of `x/net/http`.

* Call resource mutate hook before validate hook (NET-4907) (#18178)

* [NET-4865] security: Update Go version to 1.20.6 (#18190)

Update Go version to 1.20.6

This resolves [CVE-2023-29406]
(https://nvd.nist.gov/vuln/detail/CVE-2023-29406) for uses of the
`net/http` standard library.

Note that until the follow-up to #18124 is done, the version of Go used
in those impacted tests will need to remain on 1.20.5.

* Improve XDS test coverage: JWT auth edition (#18183)

* Improve XDS test coverage: JWT auth edition

more tests

* test: xds coverage for jwt listeners

---------

Co-authored-by: DanStough <[email protected]>

* update readme.md (#18191)

u[date readme.md

* Update submodules to latest following 1.16.0 (#18197)

Align all our internal use of submodules on the latest versions.

* SEC-090: Automated trusted workflow pinning (2023-07-18) (#18174)

Result of tsccr-helper -log-level=info -pin-all-workflows .

Co-authored-by: hashicorp-tsccr[bot] <hashicorp-tsccr[bot]@users.noreply.github.com>

* Fix Backport Assistant PR commenting (#18200)

* Fix Backport Assistant failure PR commenting

For general comments on a PR, it looks like you have to use the `/issue`
endpoint rather than `/pulls`, which requires commit/other
review-specific target details.

This matches the endpoint used in `backport-reminder.yml`.

* Remove Backport Reminder workflow

This is noisy (even when adding multiple labels, individual comments per
label are generated), and likely no longer needed: we haven't had this
work in a long time due to an expired GH token, and we now have better
automation for backport PR assignment.

* resource: Pass resource to Write ACL hook instead of just resource Id [NET-4908] (#18192)

* Explicitly enable WebSocket upgrades (#18150)

This PR explicitly enables WebSocket upgrades in Envoy's UpgradeConfig for all
proxy types. (API Gateway, Ingress, and Sidecar.)

Fixes #8283

* docs: fix the description of client rpc (#18206)

* NET-4804: Add dashboard for monitoring consul-k8s (#18208)

* [OSS] Improve xDS Code Coverage - Clusters  (#18165)

test: improve xDS cluster code coverage

* NET-4222 take config file consul container (#18218)

Net 4222 take config file consul container

* Envoy Integration Test Windows (#18007)

* [CONSUL-395] Update check_hostport and Usage (#40)

* [CONSUL-397] Copy envoy binary from Image (#41)

* [CONSUL-382] Support openssl in unique test dockerfile (#43)

* [CONSUL-405] Add bats to single container (#44)

* [CONSUL-414] Run Prometheus Test Cases and Validate Changes (#46)

* [CONSUL-410] Run Jaeger in Single container (#45)

* [CONSUL-412] Run test-sds-server in single container (#48)

* [CONSUL-408] Clean containers (#47)

* [CONSUL-384] Rebase and sync fork (#50)

* [CONSUL-415] Create Scenarios Troubleshooting Docs (#49)

* [CONSUL-417] Update Docs Single Container (#51)

* [CONSUL-428] Add Socat to single container (#54)

* [CONSUL-424] Replace pkill in kill_envoy function (#52)

* [CONSUL-434] Modify Docker run functions in Helper script (#53)

* [CONSUL-435] Replace docker run in set_ttl_check_state & wait_for_agent_service_register functions (#55)

* [CONSUL-438] Add netcat (nc) in the Single container Dockerfile (#56)

* [CONSUL-429] Replace Docker run with Docker exec (#57)

* [CONSUL-436] Curl timeout and run tests (#58)

* [CONSUL-443] Create dogstatsd Function (#59)

* [CONSUL-431] Update Docs Netcat (#60)

* [CONSUL-439] Parse nc Command in function (#61)

* [CONSUL-463] Review curl Exec and get_ca_root Func (#63)

* [CONSUL-453] Docker hostname in Helper functions (#64)

* [CONSUL-461] Test wipe volumes without extra cont (#66)

* [CONSUL-454] Check ports in the Server and Agent containers (#65)

* [CONSUL-441] Update windows dockerfile with version (#62)

* [CONSUL-466] Review case-grpc Failing Test (#67)

* [CONSUL-494] Review case-cfg-resolver-svc-failover (#68)

* [CONSUL-496] Replace docker_wget & docker_curl (#69)

* [CONSUL-499] Cleanup Scripts - Remove nanoserver (#70)

* [CONSUL-500] Update Troubleshooting Docs (#72)

* [CONSUL-502] Pull & Tag Envoy Windows Image (#73)

* [CONSUL-504] Replace docker run in docker_consul (#76)

* [CONSUL-505] Change admin_bind

* [CONSUL-399] Update envoy to 1.23.1 (#78)

* [CONSUL-510] Support case-wanfed-gw on Windows (#79)

* [CONSUL-506] Update troubleshooting Documentation (#80)

* [CONSUL-512] Review debug_dump_volumes Function (#81)

* [CONSUL-514] Add zipkin to Docker Image (#82)

* [CONSUL-515] Update Documentation (#83)

* [CONSUL-529] Support case-consul-exec (#86)

* [CONSUL-530] Update Documentation (#87)

* [CONSUL-530] Update default consul version 1.13.3

* [CONSUL-539] Cleanup (#91)

* [CONSUL-546] Scripts Clean-up (#92)

* [CONSUL-491] Support admin_access_log_path value for Windows (#71)

* [CONSUL-519] Implement mkfifo Alternative (#84)

* [CONSUL-542] Create OS Specific Files for Envoy Package (#88)

* [CONSUL-543] Create exec_supported.go (#89)

* [CONSUL-544] Test and Build Changes (#90)

* Implement os.DevNull

* using mmap instead of disk files

* fix import in exec-unix

* fix nmap open too many arguemtn

* go fmt on file

* changelog file

* fix go mod

* Update .changelog/17694.txt

Co-authored-by: Dhia Ayachi <[email protected]>

* different mmap library

* fix bootstrap json

* some fixes

* chocolatey version fix and image fix

* using different library

* fix Map funciton call

* fix mmap call

* fix tcp dump

* fix tcp dump

* windows tcp dump

* Fix docker run

* fix tests

* fix go mod

* fix version 16.0

* fix version

* fix version dev

* sleep to debug

* fix sleep

* fix permission issue

* fix permission issue

* fix permission issue

* fix command

* fix command

* fix funciton

* fix assert config entry status command not found

* fix command not found assert_cert_has_cn

* fix command not found assert_upstream_missing

* fix command not found assert_upstream_missing_once

* fix command not found get_upstream_endpoint

* fix command not found get_envoy_public_listener_once

* fix command not found

* fix test cases

* windows integration test workflow github

* made code similar to unix using npipe

* fix go.mod

* fix dialing of npipe

* dont wait

* check size of written json

* fix undefined n

* running

* fix dep

* fix syntax error

* fix workflow file

* windows runner

* fix runner

* fix from json

* fix runs on

* merge connect envoy

* fix cin path

* build

* fix file name

* fix file name

* fix dev build

* remove unwanted code

* fix upload

* fix bin name

* fix path

* checkout current branch

* fix path

* fix tests

* fix shell bash for windows sh files

* fix permission of run-test.sh

* removed docker dev

* added shell bash for tests

* fix tag

* fix win=true

* fix cd

* added dev

* fix variable undefined

* removed failing tests

* fix tcp dump image

* fix curl

* fix curl

* tcp dump path

* fix tcpdump path

* fix curl

* fix curl install

* stop removing intermediate containers

* fix tcpdump docker image

* revert -rm

* --rm=false

* makeing docker image before

* fix tcpdump

* removed case consul exec

* removed terminating gateway simple

* comment case wasm

* removed data dog

* comment out upload coverage

* uncomment case-consul-exec

* comment case consul exec

* if always

* logs

* using consul 1.17.0

* fix quotes

* revert quotes

* redirect to dev null

* Revert version

* revert consul connect

* fix version

* removed envoy connect

* not using function

* change log

* docker logs

* fix logs

* restructure bad authz

* rmeoved dev null

* output

* fix file descriptor

* fix cacert

* fix cacert

* fix ca cert

* cacert does not work in windows curl

* fix func

* removed docker logs

* added sleep

* fix tls

* commented case-consul-exec

* removed echo

* retry docker consul

* fix upload bin

* uncomment consul exec

* copying consul.exe to docker image

* copy fix

* fix paths

* fix path

* github workspace path

* latest version

* Revert "latest version"

This reverts commit 5a7d7b82d9e7553bcb01b02557ec8969f9deba1d.

* commented consul exec

* added ssl revoke best effort

* revert best effort

* removed unused files

* rename var name and change dir

* windows runner

* permission

* needs setup fix

* swtich to github runner

* fix file path

* fix path

* fix path

* fix path

* fix path

* fix path

* fix build paths

* fix tag

* nightly runs

* added matrix in github workflow, renamed files

* fix job

* fix matrix

* removed brackes

* from json

* without using job matrix

* fix quotes

* revert job matrix

* fix workflow

* fix comment

* added comment

* nightly runs

* removed datadog ci as it is already measured in linux one

* running test

* Revert "running test"

This reverts commit 7013d15a23732179d18ec5d17336e16b26fab5d4.

* pr comment fixes

* running test now

* running subset of test

* running subset of test

* job matrix

* shell bash

* removed bash shell

* linux machine for job matrix

* fix output

* added cat to debug

* using ubuntu latest

* fix job matrix

* fix win true

* fix go test

* revert job matrix

---------

Co-authored-by: Jose Ignacio Lorenzo <[email protected]>
Co-authored-by: Franco Bruno Lavayen <[email protected]>
Co-authored-by: Ivan K Berlot <[email protected]>
Co-authored-by: Ezequiel Fernández Ponce <[email protected]>
Co-authored-by: joselo85 <[email protected]>
Co-authored-by: Ezequiel Fernández Ponce <[email protected]>
Co-authored-by: Dhia Ayachi <[email protected]>

* fix typos and update ecs compat table (#18215)

* fix typos and update ecs compat table

* real info for the ecs compat matrix table

* Update website/content/docs/ecs/compatibility.mdx

Co-authored-by: Chris Thain <[email protected]>

---------

Co-authored-by: Chris Thain <[email protected]>

* [OSS] proxystate: add proxystate protos (#18216)

* proxystate: add proxystate protos to pbmesh and resolve imports and conflicts between message names

* ci: don't verify s390x (#18224)

* [CC-5718] Remove HCP token requirement during bootstrap (#18140)

* [CC-5718] Remove HCP token requirement during bootstrap

* Re-add error for loading HCP management token

* Remove old comment

* Add changelog entry

* Remove extra validation line

* Apply suggestions from code review

Co-authored-by: lornasong <[email protected]>

---------

Co-authored-by: lornasong <[email protected]>

* [NET-4122] Doc guidance for federation with externalServers (#18207)

Doc guidance for federation with externalServers

Add guidance for proper configuration when joining to a secondary
cluster using WAN fed with external servers also enabled.

Also clarify federation requirements and fix formatting for an
unrelated value.

Update both the Helm chart reference (synced from `consul-k8s`, see
hashicorp/consul-k8s#2583) and the docs on using `externalServers`.

* [OSS] Improve xDS Code Coverage - Endpoints and Misc (#18222)

test: improve xDS endpoints code coverage

* Clarify license reporting timing and GDPR compliance (#18237)

Add Alicia's edits to clarify log timing and other details

* Fix Github Workflow File (#18241)

* [CONSUL-382] Support openssl in unique test dockerfile (#43)

* [CONSUL-405] Add bats to single container (#44)

* [CONSUL-414] Run Prometheus Test Cases and Validate Changes (#46)

* [CONSUL-410] Run Jaeger in Single container (#45)

* [CONSUL-412] Run test-sds-server in single container (#48)

* [CONSUL-408] Clean containers (#47)

* [CONSUL-384] Rebase and sync fork (#50)

* [CONSUL-415] Create Scenarios Troubleshooting Docs (#49)

* [CONSUL-417] Update Docs Single Container (#51)

* [CONSUL-428] Add Socat to single container (#54)

* [CONSUL-424] Replace pkill in kill_envoy function (#52)

* [CONSUL-434] Modify Docker run functions in Helper script (#53)

* [CONSUL-435] Replace docker run in set_ttl_check_state & wait_for_agent_service_register functions (#55)

* [CONSUL-438] Add netcat (nc) in the Single container Dockerfile (#56)

* [CONSUL-429] Replace Docker run with Docker exec (#57)

* [CONSUL-436] Curl timeout and run tests (#58)

* [CONSUL-443] Create dogstatsd Function (#59)

* [CONSUL-431] Update Docs Netcat (#60)

* [CONSUL-439] Parse nc Command in function (#61)

* [CONSUL-463] Review curl Exec and get_ca_root Func (#63)

* [CONSUL-453] Docker hostname in Helper functions (#64)

* [CONSUL-461] Test wipe volumes without extra cont (#66)

* [CONSUL-454] Check ports in the Server and Agent containers (#65)

* [CONSUL-441] Update windows dockerfile with version (#62)

* [CONSUL-466] Review case-grpc Failing Test (#67)

* [CONSUL-494] Review case-cfg-resolver-svc-failover (#68)

* [CONSUL-496] Replace docker_wget & docker_curl (#69)

* [CONSUL-499] Cleanup Scripts - Remove nanoserver (#70)

* [CONSUL-500] Update Troubleshooting Docs (#72)

* [CONSUL-502] Pull & Tag Envoy Windows Image (#73)

* [CONSUL-504] Replace docker run in docker_consul (#76)

* [CONSUL-505] Change admin_bind

* [CONSUL-399] Update envoy to 1.23.1 (#78)

* [CONSUL-510] Support case-wanfed-gw on Windows (#79)

* [CONSUL-506] Update troubleshooting Documentation (#80)

* [CONSUL-512] Review debug_dump_volumes Function (#81)

* [CONSUL-514] Add zipkin to Docker Image (#82)

* [CONSUL-515] Update Documentation (#83)

* [CONSUL-529] Support case-consul-exec (#86)

* [CONSUL-530] Update Documentation (#87)

* [CONSUL-530] Update default consul version 1.13.3

* [CONSUL-539] Cleanup (#91)

* [CONSUL-546] Scripts Clean-up (#92)

* [CONSUL-491] Support admin_access_log_path value for Windows (#71)

* [CONSUL-519] Implement mkfifo Alternative (#84)

* [CONSUL-542] Create OS Specific Files for Envoy Package (#88)

* [CONSUL-543] Create exec_supported.go (#89)

* [CONSUL-544] Test and Build Changes (#90)

* Implement os.DevNull

* using mmap instead of disk files

* fix import in exec-unix

* fix nmap open too many arguemtn

* go fmt on file

* changelog file

* fix go mod

* Update .changelog/17694.txt

Co-authored-by: Dhia Ayachi <[email protected]>

* different mmap library

* fix bootstrap json

* some fixes

* chocolatey version fix and image fix

* using different library

* fix Map funciton call

* fix mmap call

* fix tcp dump

* fix tcp dump

* windows tcp dump

* Fix docker run

* fix tests

* fix go mod

* fix version 16.0

* fix version

* fix version dev

* sleep to debug

* fix sleep

* fix permission issue

* fix permission issue

* fix permission issue

* fix command

* fix command

* fix funciton

* fix assert config entry status command not found

* fix command not found assert_cert_has_cn

* fix command not found assert_upstream_missing

* fix command not found assert_upstream_missing_once

* fix command not found get_upstream_endpoint

* fix command not found get_envoy_public_listener_once

* fix command not found

* fix test cases

* windows integration test workflow github

* made code similar to unix using npipe

* fix go.mod

* fix dialing of npipe

* dont wait

* check size of written json

* fix undefined n

* running

* fix dep

* fix syntax error

* fix workflow file

* windows runner

* fix runner

* fix from json

* fix runs on

* merge connect envoy

* fix cin path

* build

* fix file name

* fix file name

* fix dev build

* remove unwanted code

* fix upload

* fix bin name

* fix path

* checkout current branch

* fix path

* fix tests

* fix shell bash for windows sh files

* fix permission of run-test.sh

* removed docker dev

* added shell bash for tests

* fix tag

* fix win=true

* fix cd

* added dev

* fix variable undefined

* removed failing tests

* fix tcp dump image

* fix curl

* fix curl

* tcp dump path

* fix tcpdump path

* fix curl

* fix curl install

* stop removing intermediate containers

* fix tcpdump docker image

* revert -rm

* --rm=false

* makeing docker image before

* fix tcpdump

* removed case consul exec

* removed terminating gateway simple

* comment case wasm

* removed data dog

* comment out upload coverage

* uncomment case-consul-exec

* comment case consul exec

* if always

* logs

* using consul 1.17.0

* fix quotes

* revert quotes

* redirect to dev null

* Revert version

* revert consul connect

* fix version

* removed envoy connect

* not using function

* change log

* docker logs

* fix logs

* restructure bad authz

* rmeoved dev null

* output

* fix file descriptor

* fix cacert

* fix cacert

* fix ca cert

* cacert does not work in windows curl

* fix func

* removed docker logs

* added sleep

* fix tls

* commented case-consul-exec

* removed echo

* retry docker consul

* fix upload bin

* uncomment consul exec

* copying consul.exe to docker image

* copy fix

* fix paths

* fix path

* github workspace path

* latest version

* Revert "latest version"

This reverts commit 5a7d7b82d9e7553bcb01b02557ec8969f9deba1d.

* commented consul exec

* added ssl revoke best effort

* revert best effort

* removed unused files

* rename var name and change dir

* windows runner

* permission

* needs setup fix

* swtich to github runner

* fix file path

* fix path

* fix path

* fix path

* fix path

* fix path

* fix build paths

* fix tag

* nightly runs

* added matrix in github workflow, renamed files

* fix job

* fix matrix

* removed brackes

* from json

* without using job matrix

* fix quotes

* revert job matrix

* fix workflow

* fix comment

* added comment

* nightly runs

* removed datadog ci as it is already measured in linux one

* running test

* Revert "running test"

This reverts commit 7013d15a23732179d18ec5d17336e16b26fab5d4.

* pr comment fixes

* running test now

* running subset of test

* running subset of test

* job matrix

* shell bash

* removed bash shell

* linux machine for job matrix

* fix output

* added cat to debug

* using ubuntu latest

* fix job matrix

* fix win true

* fix go test

* revert job matrix

* Fix tests

---------

Co-authored-by: Ivan K Berlot <[email protected]>
Co-authored-by: Jose Ignacio Lorenzo <[email protected]>
Co-authored-by: Franco Bruno Lavayen <[email protected]>
Co-authored-by: Ezequiel Fernández Ponce <[email protected]>
Co-authored-by: joselo85 <[email protected]>
Co-authored-by: Ezequiel Fernández Ponce <[email protected]>
Co-authored-by: Dhia Ayachi <[email protected]>

* NET-4996 - filter go-tests and test-integration workflows from running on docs only and ui only changes (#18236)

* Align build arch matrix with enterprise (#18235)

Ensure that OSS remains in sync w/ Enterprise by aligning the format of
arch matrix args for various build jobs.

* Revert "NET-4996 - filter go-tests and test-integration workflows from running on docs only and ui only changes" (#18248)

Revert "NET-4996 - filter go-tests and test-integration workflows from running on docs only and ui only changes (#18236)"

This reverts commit a11dba710e6ce6f172c0fa6c9b61567cc1efffc8.

* resource: Add scope to resource type registration [NET-4976] (#18214)

Enables querying a resource type's registration to determine if a resource is cluster, partition, or partition and namespace scoped.

* Fix some inconsistencies in jwt docs (#18234)

* NET-1825: More new ACL token creation docs (#18063)

Co-authored-by: trujillo-adam <[email protected]>

* grafana: add the panel resource usage of connect injector (#18247)

* [NET-3700] Backfill changelog entry for c2bbe67 and 7402d06 (#18259)

Backfill changelog entry for c2bbe67 and 7402d06

Add a changelog entry for the follow-up PR since it was specific to the
fix and references the original change.

* NET-4897 - update comment to include the current issue url from the go team. (#18263)

* fix typos, style, and improper links (#18269)

* member cli: add -filter expression to flags (#18223)

* member cli: add -filter expression to flags

* changelog

* update doc

* Add test cases

* use quote

* go-tests: disable s390x (#18273)

* docs: Update ext-authz documentation for kubernetes (#18281)

Update ext-authz documentation for kubernetes

* docs: Consul on Kubernetes specific upgrade info (#18230)

* Compatibility page - dataplanes mention

* Upgrading higher-level dataplane mention

* `exec=` string callout

* More visible for upgrade page

* Apply suggestions from code review

Co-authored-by: Tu Nguyen <[email protected]>

---------

Co-authored-by: Tu Nguyen <[email protected]>
Co-authored-by: John Murret <[email protected]>

* Fix typo in Envoy extensions doc (#18284)

* docs: K8s secondary DC requirements (#18280)

* Requested edit

* Apply suggestions from code review

Co-authored-by: trujillo-adam <[email protected]>

---------

Co-authored-by: trujillo-adam <[email protected]>

* api-gateway: subscribe to bound-api-gateway only after receiving api-gateway (#18291)

* api-gateway: subscribe to bound-api-gateway only after receiving api-gateway

This fixes a race condition due to our dependency on having the listener(s) from the api-gateway config entry in order to fully and properly process the resources on the bound-api-gateway config entry.

* Apply suggestions from code review

* Add changelog entry

* Update K8s changelog to address cloud auto-join change in 1.0.0 (#18293)

* Update list of Envoy versions (#18300)

Update supported envoy versions to 1.24.10, 1.25.9, 1.26.4, 1.27.0.

* [NET-4904] Update list of Envoy versions in docs (#18306)

Update list of Envoy versions in docs

Update supported Envoy versions across Consul release versions.

* Update actions for TSCCR (#18317)

Update action versions before deadline

* Fix topology view when displaying mixed connect-native/normal services. (#13023)

* Fix topoloy intention with mixed connect-native/normal services.

If a service is registered twice, once with connect-native and once
without, the topology views would prune the existing intentions. This
change brings the code more in line with the transparent proxy behavior.

* Dedupe nodes in the ServiceTopology ui endpoint (like done with tags).

* Consider a service connect-native as soon as one instance is.

* Stop JWT provider from being written in non default namespace (#18325)

* docs: Fix some comments (#17118)

Signed-off-by: cui fliter <[email protected]>

* [NET-4703] Prevent partial application of Envoy extensions (#18068)

Prevent partial application of Envoy extensions

Ensure that non-required extensions do not change xDS resources before
exiting on failure by cloning proto messages prior to applying each
extension.

To support this change, also move `CanApply` checks up a layer and make
them prior to attempting extension application, s.t. we avoid
unnecessary copies where extensions can't be applied.

Last, ensure that we do not allow panics from `CanApply` or `Extend`
checks to escape the attempted extension application.

* docs: Simplify example jq commands by removing pipes (#18327)

Simplify jq command examples by removing pipes to other commands.

* fix typo in create a mesh token docs (#18337)

* [CC-5719] Add support for builtin global-read-only policy (#18319)

* [CC-5719] Add support for builtin global-read-only policy

* Add changelog

* Add read-only to docs

* Fix some minor issues.

* Change from ReplaceAll to Sprintf

* Change IsValidPolicy name to return an error instead of bool

* Fix PolicyList test

* Fix other tests

* Apply suggestions from code review

Co-authored-by: Paul Glass <[email protected]>

* Fix state store test for policy list.

* Fix naming issues

* Update acl/validation.go

Co-authored-by: Chris Thain <[email protected]>

* Update agent/consul/acl_endpoint.go

---------

Co-authored-by: Paul Glass <[email protected]>
Co-authored-by: Chris Thain <[email protected]>

* [NET-5121] proxystate: move protos to subdirectory to avoid conflicts (#18335)

* also makes a few protos updates

* resource: adding various helpers for working with resources (#18342)

This is a bit of a grab bag of helpers that I found useful for working with them when authoring substantial Controllers. Subsequent PRs will make use of them.

* Wasm integration tests for local and remote wasm files (#17756)

* wasm integration tests for local and remote wasm files

refactoring and cleanup for wasm testing

remove wasm debug logging

PR feedback, wasm build lock

correct path pattern for wasm build files

Add new helper function to minimize changes to existing test code

Remove extra param

mod tidy

add custom service setup to test lib

add wait until static server sidecar can reach nginx sidecar

Doc comments

PR feedback

Update workflows to compile wasm for integration tests

Fix docker build path

Fix package name for linter

Update makefile, fix redeclared function

Update expected wasm filename

Debug test ls in workflow

remove pwd in favor of relative path

more debugging

Build wasm in compatability tests as well

Build wasm directly in ci rather than in container

Debug tinygo and llvm version

Change wasm file extension

Remove tinygo debugging

Remove extra comments

* Add compiled wasm and build instructions

* [HCP Telemetry] Periodic Refresh for Dynamic Telemetry Configuration (#18168)

* OTElExporter now uses an EndpointProvider to discover the endpoint

* OTELSink uses a ConfigProvider to obtain filters and labels configuration

* improve tests for otel_sink

* Regex logic is moved into client for a method on the TelemetryConfig object

* Create a telemetry_config_provider and update deps to use it

* Fix conversion

* fix import newline

* Add logger to hcp client and move telemetry_config out of the client.go file

* Add a telemetry_config.go to refactor client.go

* Update deps

* update hcp deps test

* Modify telemetry_config_providers

* Check for nil filters

* PR review updates

* Fix comments and move around pieces

* Fix comments

* Remove context from client struct

* Moved ctx out of sink struct and fixed filters, added a test

* Remove named imports, use errors.New if not fformatting

* Remove HCP dependencies in telemetry package

* Add success metric and move lock only to grab the t.cfgHahs

* Update hash

* fix nits

* Create an equals method and add tests

* Improve telemetry_config_provider.go tests

* Add race test

* Add missing godoc

* Remove mock for MetricsClient

* Avoid goroutine test panics

* trying to kick CI lint issues by upgrading mod

* imprve test code and add hasher for testing

* Use structure logging for filters, fix error constants, and default to allow all regex

* removed hashin and modify logic to simplify

* Improve race test and fix PR feedback by removing hash equals and avoid testing the timer.Ticker logic, and instead unit test

* Ran make go-mod-tidy

* Use errtypes in the test

* Add changelog

* add safety check for exporter endpoint

* remove require.Contains by using error types, fix structure logging, and fix success metric typo in exporter

* Fixed race test to have changing config values

* Send success metric before modifying config

* Avoid the defer and move the success metric under

* NET-4240 - Snapshots are failing on Windows  (#18302)

* fix go mod

* fix go sum

* added change log

* ran make go mod tidy

* Register ProxyStateTemplate Resource (#18316)

  Also, change the ProxyState.id to identity. This is because we already have the id of this proxy
  from the resource, and this id should be name-aligned with the workload it represents. It should
  also have the owner ref set to the workload ID if we need that. And so the id field seems unnecessary.
  We do, however, need a reference to workload identity so that we can authorize the proxy when it initially
  connects to the xDS server.

* [NET-5146] security: Update Go version to 1.20.7 and `x/net` to 0.13.0 (#18358)

* Update Go version to 1.20.7

This resolves [CVE-2023-29409]
(https://nvd.nist.gov/vuln/detail/CVE-2023-29409)(`crypto/tls`).

* Bump golang.org/x/net to 0.13.0

Addresses [CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978)
for security scans (non-impacting).

* mesh: adding the protobuf types and resources backing mesh config v2 (#18351)

* [OSS] test: xds coverage for routes (#18369)

test: xds coverage for routes

* Fix policy lookup to allow for slashes (#18347)

* Fix policy lookup to allow for slashes

* Fix suggestions

* Fix other test

* Revert some lines

* add some initial CODEOWNERS (#18346)

* Add redirects for mesh-gateway docs (#18377)

* expose grpc as http endpoint (#18221)

expose resource grpc endpoints as http endpoints

* bimapper: fix a bug and add some more test coverage (#18387)

* [docs] Fix ServiceDefaults example in distributed tracing (#17212)

Fix ServiceDefaults example in distributed tracing.

* Fix #17730 - Dev mode has new line (#18367)

* adding new line only in case of pretty in url not in dev mode

* change log added

* chore: make go-mod-tidy (#18388)

* resource: Make resource read tenancy aware (#18397)

* Not using chmod - fixed integration test for Enterprise (#18401)

* Not using chmod

* checking icacls

* Removed push

* replaced ordered list of rate limit ops with flow diagram (#18398)

* replaced ordered list of rate limit ops with flow diagram

* made diagram font bigger

* updated colors for dark mode img

* fixed typo

* recentered dark mode image

* Apply suggestions from code review

Co-authored-by: Jeff Boruszak <[email protected]>

---------

Co-authored-by: Jeff Boruszak <[email protected]>

* Upgrade test: remove outdated test and disable log due to verbosity (#18403)

* remove outdated test

* disable log since we have too many parallel tests

* bump testcontainers-go from 0.22.0 and remove pinned go version in in… (#18395)

* bump testcontainers-go from 0.22.0 and remove pinned go version in integ test

* go mod tidy

* Replace deprecated target.Authority with target.URL.Host

* Add ServiceEndpoints Mutation hook tests (#18404)

* Add ServiceEndpoints Mutation hook tests

* Move endpoint owner validation into the validation hook

Also there were some minor changes to error validation to account for go-cmp not liking to peer through an errors.errorstring type that get created by errors.New

* catalog: add FailoverPolicy mutation and validation hooks (#18390)

Add most of the validation and mutation hooks for the FailoverPolicy resource.

* NET-5115 Add retry + timeout filters for api-gateway (#18324)

* squash, implement retry/timeout in consul core

* update tests

* catalog: adding a controller to reconcile FailoverPolicy resources (#18399)

Add most of the semantic cross-resource validation for FailoverPolicy resources using a new controller.

* fix the error in ent repo (#18421)

fix the error in ent repo

* build: updates for 1.16.1 release (#18415)

* build: updates for 1.16.1 release

* build: fix missing replace directive for envoyextensions

* build: go mod tidy testing/deployer

* update ECS links (#18419)

* docs: fix incorrect proxy-defaults config in Lua Envoy extension (#18418)

fix incorrect proxy-defaults config

* resource: Make resource write tenancy aware (#18423)

* [NET-5217] [OSS] Derive sidecar proxy locality from parent service (#18437)

* Add logging to locality policy application

In OSS, this is currently a no-op.

* Inherit locality when registering sidecars

When sidecar locality is not explicitly configured, inherit locality
from the proxied service.

* NET-4984: Update APIGW Config Entries for JWT Auth (#18366)

* Added oss config entries for Policy and JWT on APIGW

* Updated structs for config entry

* Updated comments, ran deep-copy

* Move JWT configuration into OSS file

* Add in the config entry OSS file for jwts

* Added changelog

* fixing proto spacing

* Moved to using manually written deep copy method

* Use pointers for override/default fields in apigw config entries

* Run gen scripts for changed types

* k8s compat - Openshift versions (#18307)

* Update compatibility.mdx

Co-authored-by: trujillo-adam <[email protected]>

* APIGW: Update HTTPRouteConfigEntry for JWT Auth (#18422)

* Updated httproute config entry for JWT Filters

* Added manual deepcopy method for httproute jwt filter

* Fix test

* Update JWTFilter to be in oss file

* Add changelog

* Add build tags for deepcopy oss file

* [COMPLIANCE] License changes (#18443)

* Adding explicit MPL license for sub-package

This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository.

* Adding explicit MPL license for sub-package

This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository.

* Updating the license from MPL to Business Source License

Going forward, this project will be licensed under the Business Source License v1.1. Please see our blog post for more details at <Blog URL>, FAQ at www.hashicorp.com/licensing-faq, and details of the license at www.hashicorp.com/bsl.

* add missing license headers

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Up…
absolutelightning added a commit that referenced this pull request Sep 4, 2023
@hc-github-team-consul-core @nathancoleman
@jmurret @nvanthao @trujillo-adam @roncodingenthusiast @mr-miles @lkysow @im2nguyen @natemollica-nm @loshz @jm96441n @beautifulentropy @Ranjandas @hashi-derek @absolutelightning @xwa153 @cthain @boruszak @evanphx @JadhavPoonam @DanStough @karras @jcjones @fulviodenza @krastin @david3a @curtbushko @nfi-hashicorp @t-davies @vijayraghav-io @jkirschner-hashicorp @eddie-rowe @emilymianeil @nv-hashi @ishustava @Jeff-Apple @huikang @cocolavayen @joselo85 @dhiaayachi @rboyer @freddygv @NiniOak @zalimeni @analogue @hashicorp-tsccr @blake @iberlot @ezfepo @ndhanushkodi @jjacobson93 @lornasong @judithpatudith @gautambaghel @apollo13 @cuishuang @johnlanda @Achooo @ilpianista @mkeeler @sarahalsmiller @hashicorp-copywrite @boxofrad @natmegs
Backport of NET-3181 - Allow log file naming like Nomad into release/…
0cfe6f8 
…1.16.x (#18630)

* api-gateway: add step to upgrade instructions for creating intentions (#17875)

* Changelog - add 1.13.9, 1.14.8, and 1.15.4 (#17889)

* docs: update config enable_debug (#17866)

* update doc for config enable_debug

* Update website/content/docs/agent/config/config-files.mdx

Co-authored-by: trujillo-adam <[email protected]>

---------

Co-authored-by: trujillo-adam <[email protected]>

* Update wording on WAN fed and intermediate_pki_path (#17850)

* Allow service identity tokens the ability to read jwt-providers (#17893)

* Allow service identity tokens the ability to read jwt-providers

* more tests

* service_prefix tests

* Update docs (#17476)

Co-authored-by: trujillo-adam <[email protected]>

* Add emit_tags_as_labels to envoy bootstrap config when using Consul Telemetry Collector (#17888)

* Fix command from kg to kubectl get (#17903)

* Create and update release notes for 1.16 and 1.2 (#17895)

* update release notes for 1.16 and 1.2

* update latest consul core release

* Propose new changes to APIgw upgrade instructions (#17693)

* Propose new changes to APIgw upgrade instructions

* fix build error

* update callouts to render correctly

* Add hideClipboard to log messages

* Added clarification around consul k8s and crds

* Add workflow to verify linux release packages (#17904)

* adding docker files to verify linux packages.

* add verifr-release-linux.yml

* updating name

* pass inputs directly into jobs

* add other linux package platforms

* remove on push

* fix TARGETARCH on debian and ubuntu so it can check arm64 and amd64

* fixing amazon to use the continue line

* add ubuntu i386

* fix comment lines

* working

* remove commented out workflow jobs

* Apply suggestions from code review

Co-authored-by: Nathan Coleman <[email protected]>

* update fedora and ubuntu to use latest tag

---------

Co-authored-by: Nathan Coleman <[email protected]>

* Reference hashicorp/consul instead of consul for Docker image (#17914)

* Reference hashicorp/consul instead of consul for Docker image

* Update Make targets that pull consul directly

* Update Consul K8s Upgrade Doc Updates (#17921)

Updating upgrade procedures to encompass expected errors during upgrade process from v1.13.x to v1.14.x.

* Update sameness-group.mdx (#17915)

* Update create-sameness-groups.mdx (#17927)

* deps: coredns v1.10.1 (#17912)

* Ensure RSA keys are at least 2048 bits in length (#17911)

* Ensure RSA keys are at least 2048 bits in length

* Add changelog

* update key length check for FIPS compliance

* Fix no new variables error and failing to return when error exists from
validating

* clean up code for better readability

* actually return value

* tlsutil: Fix check TLS configuration (#17481)

* tlsutil: Fix check TLS configuration
* Rewording docs.
* Update website/content/docs/services/configuration/checks-configuration-reference.mdx
Co-authored-by: trujillo-adam <[email protected]>
* Fix typos and add changelog entry.
---------

Co-authored-by: trujillo-adam <[email protected]>

* docs: Deprecations for connect-native SDK and specific connect native APIs (#17937)

* Update v1_16_x.mdx
* Update connect native golang page

---------

Co-authored-by: trujillo-adam <[email protected]>

* Revert "Add workflow to verify linux release packages (#17904)" (#17942)

This reverts commit 3368f14fab500ebe9f6aeab5631dd1d5f5a453e5.

* Fixes Secondary ConnectCA update (#17846)

This fixes a bug that was identified which resulted in subsequent
ConnectCA configuration update not to persist in the cluster.

* fixing typo in link to jwt-validations-with-intentions doc (#17955)

* Fix streaming backend link (#17958)

* Fix streaming backend link
* Update health.mdx

* Dynamically create jwks clusters for jwt-providers (#17944)

* website: remove deprecated agent rpc docs (#17962)

* Fix missing BalanceOutboundConnections in v2 catalog. (#17964)

* feature - [NET - 4005]  - [Supportability] Reloadable Configuration - enable_debug (#17565)

* # This is a combination of 9 commits.
# This is the 1st commit message:

init without tests

# This is the commit message #2:

change log

# This is the commit message #3:

fix tests

# This is the commit message #4:

fix tests

# This is the commit message #5:

added tests

# This is the commit message #6:

change log breaking change

# This is the commit message #7:

removed breaking change

# This is the commit message #8:

fix test

# This is the commit message #9:

keeping the test behaviour same

* # This is a combination of 12 commits.
# This is the 1st commit message:

init without tests

# This is the commit message #2:

change log

# This is the commit message #3:

fix tests

# This is the commit message #4:

fix tests

# This is the commit message #5:

added tests

# This is the commit message #6:

change log breaking change

# This is the commit message #7:

removed breaking change

# This is the commit message #8:

fix test

# This is the commit message #9:

keeping the test behaviour same

# This is the commit message #10:

made enable debug atomic bool

# This is the commit message #11:

fix lint

# This is the commit message #12:

fix test true enable debug

* parent 10f500e895d92cc3691ade7b74a33db755d22039
author absolutelightning <[email protected]> 1687352587 +0530
committer absolutelightning <[email protected]> 1687352592 +0530

init without tests

change log

fix tests

fix tests

added tests

change log breaking change

removed breaking change

fix test

keeping the test behaviour same

made enable debug atomic bool

fix lint

fix test true enable debug

using enable debug in agent as atomic bool

test fixes

fix tests

fix tests

added update on correct locaiton

fix tests

fix reloadable config enable debug

fix tests

fix init and acl 403

* revert commit

* Fix formatting codeblocks on APIgw docs (#17970)

* fix formatting codeblocks

* remove unnecessary indents

* Remove POC code (#17974)

* update doc (#17910)

* update doc

* update link

* Remove duplicate and unused newDecodeConfigEntry func (#17979)

* docs: samenessGroup YAML examples (#17984)

* configuration entry syntax

* Example config

* Add changelog entry for 1.16.0 (#17987)

* Fix typo (#17198)

servcies => services

* Expose JWKS cluster config through JWTProviderConfigEntry (#17978)

* Expose JWKS cluster config through JWTProviderConfigEntry

* fix typos, rename trustedCa to trustedCA

* Integration test for ext-authz Envoy extension (#17980)

* Fix incorrect protocol for transparent proxy upstreams. (#17894)

This PR fixes a bug that was introduced in:
https://github.com/hashicorp/consul/pull/16021

A user setting a protocol in proxy-defaults would cause tproxy implicit
upstreams to not honor the upstream service's protocol set in its
`ServiceDefaults.Protocol` field, and would instead always use the
proxy-defaults value.

Due to the fact that upstreams configured with "tcp" can successfully contact
upstream "http" services, this issue was not recognized until recently (a
proxy-defaults with "tcp" and a listening service with "http" would make
successful requests, but not the opposite).

As a temporary work-around, users experiencing this issue can explicitly set
the protocol on the `ServiceDefaults.UpstreamConfig.Overrides`, which should
take precedence.

The fix in this PR removes the proxy-defaults protocol from the wildcard
upstream that tproxy uses to configure implicit upstreams. When the protocol
was included, it would always overwrite the value during discovery chain
compilation, which was not correct. The discovery chain compiler also consumes
proxy defaults to determine the protocol, so simply excluding it from the
wildcard upstream config map resolves the issue.

* feat: include nodes count in operator usage endpoint and cli command (#17939)

* feat: update operator usage api endpoint to include nodes count

* feat: update operator usange cli command to includes nodes count

* [OSS] Improve Gateway Test Coverage of Catalog Health (#18011)

* fix(cli): remove failing check from 'connect envoy' registration for api gateway

* test(integration): add tests to check catalog statsus of gateways on startup

* remove extra sleep comment

* Update test/integration/consul-container/libs/assert/service.go

* changelog

* Fixes Traffic rate limitting docs (#17997)

* Fix removed service-to-service peering links (#17221)

* docs: fix removed service-to-service peering links

* docs: extend peering-via-mesh-gateways intro (thanks @trujillo-adam)

---------

Co-authored-by: trujillo-adam <[email protected]>

* docs: Sameness "beta" warning (#18017)

* Warning updates

* .x

* updated typo in tab heading (#18022)

* updated typo in tab heading

* updated tab group typo, too

* Document that DNS lookups can target cluster peers (#17990)

Static DNS lookups, in addition to explicitly targeting a datacenter,
can target a cluster peer. This was added in 95dc0c7b301b70a6b955a8b7c9737c9b86f03df6 but didn't make the documentation.

The driving function for the change is `parseLocality` here: https://github.com/hashicorp/consul/blob/0b1299c28d8127129d61310ee4280055298438e0/agent/dns_oss.go#L25

The biggest change in this is to adjust the standard lookup syntax to tie
`.<datacenter>` to `.dc` as required-together, and to append in the similar `.<cluster-peer>.peer` optional argument, both to A record and SRV record lookups.

Co-authored-by: David Yu <[email protected]>

* Add first integration test for jwt auth with intention (#18005)

* fix stand-in text for name field (#18030)

* removed sameness conf entry from failover nav (#18033)

* docs - add service sync annotations and k8s service weight annotation (#18032)

* Docs for https://github.com/hashicorp/consul-k8s/pull/2293
* remove versions for enterprise features since they are old

---------

Co-authored-by: Tu Nguyen <[email protected]>

* docs - add jobs use case for service mesh k8s (#18037)

* docs - add jobs use case for service mesh k8s
* add code blocks

* address feedback (#18045)

* Add verify server hostname to tls default (#17155)

* [OSS] Fix initial_fetch_timeout to wait for all xDS resources (#18024)

* fix(connect): set initial_fetch_time to wait indefinitely

* changelog

* PR feedback 1

* ui: fix typos for peer service imports (#17999)

* test: fix FIPS inline cert test message (#18076)

* Fix a couple typos in Agent Telemetry Metrics docs (#18080)

* Fix metrics docs

* Add changelog

Signed-off-by: josh <[email protected]>

---------

Signed-off-by: josh <[email protected]>

* docs updates - cluster peering and virtual services (#18069)

* Update route-to-virtual-services.mdx
* Update establish-peering.mdx

* Update service-mesh-compare.mdx (#17279)

grammar change

* Update helm docs on main (#18085)

* ci: use gotestsum v1.10.1 [NET-4042] (#18088)

* Docs: Update proxy lifecycle annotations and consul-dataplane flags (#18075)

* Update proxy lifecycle annotations and consul-dataplane flags

* Pass configured role name to Vault for AWS auth in Connect CA (#17885)

* Docs for dataplane upgrade on k8s (#18051)

* Docs for dataplane upgrade on k8s

---------

Co-authored-by: David Yu <[email protected]>
Co-authored-by: trujillo-adam <[email protected]>

* docs - update upgrade index page to not recommend consul leave. (#18100)

* Displays Consul version of each nodes in UI nodes section (#17754)

* update UINodes and UINodeInfo response with consul-version info added as NodeMeta, fetched from serf members

* update test cases TestUINodes, TestUINodeInfo

* added nil check for map

* add consul-version in local agent node metadata

* get consul version from serf member and add this as node meta in catalog register request

* updated ui mock response to include consul versions as node meta

* updated ui trans and added version as query param to node list route

* updates in ui templates to display consul version with filter and sorts

* updates in ui - model class, serializers,comparators,predicates for consul version feature

* added change log for Consul Version Feature

* updated to get version from consul service, if for some reason not available from serf

* updated changelog text

* updated dependent testcases

* multiselection version filter

* Update agent/consul/state/catalog.go

comments updated

Co-authored-by: Jared Kirschner <[email protected]>

---------

Co-authored-by: Jared Kirschner <[email protected]>

* api gw 1.16 updates (#18081)

* api gw 1.16 updates

* Apply suggestions from code review

Co-authored-by: Jeff Boruszak <[email protected]>

* update CodeBlockConfig filename

* Apply suggestions from code review

Co-authored-by: trujillo-adam <[email protected]>
Co-authored-by: Jeff Boruszak <[email protected]>

* remove non-standard intentions page

* Update website/content/docs/api-gateway/configuration/index.mdx

Co-authored-by: trujillo-adam <[email protected]>

---------

Co-authored-by: Jeff Boruszak <[email protected]>
Co-authored-by: trujillo-adam <[email protected]>

* [NET-4103] ci: build s390x (#18067)

* ci: build s390x

* ci: test s390x

* ci: dev build s390x

* no GOOS

* ent only

* build: publish s390x

* fix syntax error

* fix syntax error again

* fix syntax error again x2

* test branch

* Move s390x conditionals to step level

* remove test branch

---------

Co-authored-by: emilymianeil <[email protected]>

* :ermahgerd "Sevice Mesh" -> "Service Mesh" (#18116)

Just a typo in the docs.

* Split pbmesh.UpstreamsConfiguration as a resource out of pbmesh.Upstreams (#17991)

Configuration that previously was inlined into the Upstreams resource
applies to both explicit and implicit upstreams and so it makes sense to
split it out into its own resource.

It also has other minor changes:
- Renames `proxy.proto` proxy_configuration.proto`
- Changes the type of `Upstream.destination_ref` from `pbresource.ID` to
`pbresource.Reference`
- Adds comments to fields that didn't have them

* [NET-4895] ci - api tests and consul container tests error because of dependency bugs with go 1.20.6.  Pin go to 1.20.5. (#18124)

### Description
The following jobs started failing when go 1.20.6 was released:
- `go-test-api-1-19`
- `go-test-api-1-20`
- `compatibility-integration-tests`
- `upgrade-integration-tests`

`compatibility-integration-tests` and `compatibility-integration-tests`
to this testcontainers issue:
https://github.com/testcontainers/testcontainers-go/issues/1359. This
issue calls for testcontainers to release a new version when one of
their dependencies is fixed. When that is done, we will unpin the go
versions in `compatibility-integration-tests` and
`compatibility-integration-tests`.

### Testing & Reproduction steps

See these jobs broken in CI and then see them work with this PR.

---------

Co-authored-by: Chris Thain <[email protected]>

* Add ingress gateway deprecation notices to docs (#18102)

### Description

This adds notices, that ingress gateway is deprecated, to several places
in the product docs where ingress gateway is the topic.

### Testing & Reproduction steps

Tested with a local copy of the website.

### Links

Deprecation of ingress gateway was announced in the Release Notes for
Consul 1.16 and Consul-K8s 1.2. See:

[https://developer.hashicorp.com/consul/docs/release-notes/consul/v1_16_x#what-s-deprecated](https://developer.hashicorp.com/consul/docs/release-notes/consul/v1_16_x#what-s-deprecated
)

[https://developer.hashicorp.com/consul/docs/release-notes/consul-k8s/v1_2_x#what-s-deprecated](https://developer.hashicorp.com/consul/docs/release-notes/consul-k8s/v1_2_x#what-s-deprecated)

### PR Checklist

* [N/A] updated test coverage
* [X] external facing docs updated
* [X] appropriate backport labels added
* [X] not a security concern

---------

Co-authored-by: trujillo-adam <[email protected]>

* Add docs for jwt cluster configuration (#18004)

### Description

<!-- Please describe why you're making this change, in plain English.
-->

- Add jwt-provider docs for jwks cluster configuration. The
configuration was added here:
https://github.com/hashicorp/consul/pull/17978

* Docs: fix unmatched bracket for health checks page (#18134)

* NET-4657/add resource service client (#18053)

### Description

<!-- Please describe why you're making this change, in plain English.
-->
Dan had already started on this
[task](https://github.com/hashicorp/consul/pull/17849) which is needed
to start building the HTTP APIs. This just needed some cleanup to get it
ready for review.

Overview:

- Rename `internalResourceServiceClient` to
`insecureResourceServiceClient` for name consistency
- Configure a `secureResourceServiceClient` with auth enabled

### PR Checklist

* [ ] ~updated test coverage~
* [ ] ~external facing docs updated~
* [x] appropriate backport labels added
* [ ] ~not a security concern~

* Fix bug with Vault CA provider (#18112)

Updating RootPKIPath but not IntermediatePKIPath would not update 
leaf signing certs with the new root. Unsure if this happens in practice 
but manual testing showed it is a bug that would break mesh and agent 
connections once the old root is pruned.

* [NET-4897] net/http host header is now verified and request.host that contains socked now error (#18129)

### Description

This is related to https://github.com/hashicorp/consul/pull/18124 where
we pinned the go versions in CI to 1.20.5 and 1.19.10.

go 1.20.6 and 1.19.11 now validate request host headers for validity,
including the hostname cannot be prefixed with slashes.

For local communications (npipe://, unix://), the hostname is not used,
but we need valid and meaningful hostname. Prior versions go Go would
clean the host header, and strip slashes in the process, but go1.20.6
and go1.19.11 no longer do, and reject the host header. Around the
community we are seeing that others are intercepting the req.host and if
it starts with a slash or ends with .sock, they changing the host to
localhost or another dummy value.

[client: define a "dummy" hostname to use for local connections by
thaJeztah · Pull Request #45942 ·
moby/moby](https://github.com/moby/moby/pull/45942)

### Testing & Reproduction steps

Check CI tests.

### Links
* [ ] updated test coverage
* [ ] external facing docs updated
* [ ] appropriate backport labels added
* [ ] not a security concern

* add a conditional around setting LANFilter.AllSegments to make sure it is valid (#18139)

### Description

This is to correct a code problem because this assumes all segments, but
when you get to Enterprise, you can be in partition that is not the
default partition, in which case specifying all segments does not
validate and fails. This is to correct the setting of this filter with
`AllSegments` to `true` to only occur when in the the `default`
partition.

### Testing & Reproduction steps

<!--

* In the case of bugs, describe how to replicate
* If any manual tests were done, document the steps and the conditions
to replicate
* Call out any important/ relevant unit tests, e2e tests or integration
tests you have added or are adding

-->

### Links

<!--

Include any links here that might be helpful for people reviewing your
PR (Tickets, GH issues, API docs, external benchmarks, tools docs, etc).
If there are none, feel free to delete this section.

Please be mindful not to leak any customer or confidential information.
HashiCorp employees may want to use our internal URL shortener to
obfuscate links.

-->

### PR Checklist

* [ ] updated test coverage
* [ ] external facing docs updated
* [ ] appropriate backport labels added
* [ ] not a security concern

* chore: bump upgrade integrations tests to 1.15, 116 [NET-4743] (#18130)

* re org resource type registry (#18133)

* fix: update delegateMock used in ENT (#18149)

### Description

<!-- Please describe why you're making this change, in plain English.
-->
The mock is used in `http_ent_test` file which caused lint failures. For
OSS->ENT parity adding the same change here.

### Links

<!--

Include any links here that might be helpful for people reviewing your
PR (Tickets, GH issues, API docs, external benchmarks, tools docs, etc).
If there are none, feel free to delete this section.

Please be mindful not to leak any customer or confidential information.
HashiCorp employees may want to use our internal URL shortener to
obfuscate links.

-->

Identified in OSS->ENT [merge
PR](https://github.com/hashicorp/consul-enterprise/pull/6328)

### PR Checklist

* [ ] ~updated test coverage~
* [ ] ~external facing docs updated~
* [x] appropriate backport labels added
* [ ] ~not a security concern~

* Use JWT-auth filter in metadata mode & Delegate validation to RBAC filter (#18062)

### Description

<!-- Please describe why you're making this change, in plain English.
-->

- Currently the jwt-auth filter doesn't take into account the service
identity when validating jwt-auth, it only takes into account the path
and jwt provider during validation. This causes issues when multiple
source intentions restrict access to an endpoint with different JWT
providers.
- To fix these issues, rather than use the JWT auth filter for
validation, we use it in metadata mode and allow it to forward the
successful validated JWT token payload to the RBAC filter which will
make the decisions.

This PR ensures requests with and without JWT tokens successfully go
through the jwt-authn filter. The filter however only forwards the data
for successful/valid tokens. On the RBAC filter level, we check the
payload for claims and token issuer + existing rbac rules.

### Testing & Reproduction steps

<!--

* In the case of bugs, describe how to replicate
* If any manual tests were done, document the steps and the conditions
to replicate
* Call out any important/ relevant unit tests, e2e tests or integration
tests you have added or are adding

-->

- This test covers a multi level jwt requirements (requirements at top
level and permissions level). It also assumes you have envoy running,
you have a redis and a sidecar proxy service registered, and have a way
to generate jwks with jwt. I mostly use:
https://www.scottbrady91.com/tools/jwt for this.

- first write your proxy defaults
```
Kind = "proxy-defaults"
name = "global"
config {
  protocol = "http"
}
```
- Create two providers 
```
Kind = "jwt-provider"
Name = "auth0"
Issuer = "https://ronald.local"

JSONWebKeySet = {
    Local = {
     JWKS = "eyJrZXlzIjog....."
    }
}
```

```
Kind = "jwt-provider"
Name = "okta"
Issuer = "https://ronald.local"

JSONWebKeySet = {
   Local = {
     JWKS = "eyJrZXlzIjogW3...."
    }
}
```

- add a service intention
```
Kind = "service-intentions"
Name = "redis"

JWT = {
  Providers = [
    {
      Name = "okta"
    },
  ]
}

Sources = [
  {
    Name = "*"
    Permissions = [{
      Action = "allow"
      HTTP = {
        PathPrefix = "/workspace"
      }
      JWT = {
        Providers = [
          {
            Name = "okta"
            VerifyClaims = [
              {
                  Path = ["aud"]
                  Value = "my_client_app"
              },
              {
                Path = ["sub"]
                Value = "5be86359073c434bad2da3932222dabe"
              }
            ]
          },
        ]
      }

    },
    {
      Action = "allow"
      HTTP = {
        PathPrefix = "/"
      }
      JWT = {
        Providers = [
          {
            Name = "auth0"
          },
        ]
      }

    }]
  }
]
```
- generate 3 jwt tokens: 1 from auth0 jwks, 1 from okta jwks with
different claims than `/workspace` expects and 1 with correct claims
- connect to your envoy (change service and address as needed) to view
logs and potential errors. You can add: `-- --log-level debug` to see
what data is being forwarded
```
consul connect envoy -sidecar-for redis1 -grpc-addr 127.0.0.1:8502
```
- Make the following requests: 
```
curl -s -H "Authorization: Bearer $Auth0_TOKEN" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v

RBAC filter denied

curl -s -H "Authorization: Bearer $Okta_TOKEN_with_wrong_claims" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v

RBAC filter denied

curl -s -H "Authorization: Bearer $Okta_TOKEN_with_correct_claims" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v

Successful request
```


### TODO

* [x] Update test coverage
* [ ] update integration tests (follow-up PR)
* [x] appropriate backport labels added

* Support Consul Connect Envoy Command on Windows (#17694)

### Description

Add support for consul connect envoy command on windows. This PR fixes
the comments of PR - https://github.com/hashicorp/consul/pull/15114

### Testing
* Built consul.exe from this branch on windows and hosted here - [AWS
S3](https://asheshvidyut-bucket.s3.ap-southeast-2.amazonaws.com/consul.zip)
* Updated the
[tutorial](https://developer.hashicorp.com/consul/tutorials/developer-mesh/consul-windows-workloads)
and changed the `consul_url.default` value to [AWS
S3](https://asheshvidyut-bucket.s3.ap-southeast-2.amazonaws.com/consul.zip)
* Followed the steps in the tutorial and verified that everything is
working as described.

### PR Checklist

* [x] updated test coverage
* [ ] external facing docs updated
* [x] appropriate backport labels added
* [x] not a security concern

---------

Co-authored-by: Franco Bruno Lavayen <[email protected]>
Co-authored-by: Jose Ignacio Lorenzo <[email protected]>
Co-authored-by: Jose Ignacio Lorenzo <[email protected]>
Co-authored-by: Dhia Ayachi <[email protected]>

* Change docs to say 168h instead of 7d for server_rejoin_age_max (#18154)

### Description

Addresses
https://github.com/hashicorp/consul/pull/17171#issuecomment-1636930705

* [OSS] test: improve xDS listener code coverage (#18138)

test: improve xDS listener code coverage

* Re-order expected/actual for assertContainerState in consul container tests (#18157)

Re-order expected/actual, consul container tests

* group and document make file (#17943)

* group and document make file

* Add `testing/deployer` (neé `consul-topology`) [NET-4610] (#17823)

Co-authored-by: R.B. Boyer <[email protected]>
Co-authored-by: R.B. Boyer <[email protected]>
Co-authored-by: Freddy <[email protected]>

* [NET-4792] Add integrations tests for jwt-auth (#18169)

* Add FIPS reference to consul enterprise docs (#18028)

* Add FIPS reference to consul enterprise docs

* Update website/content/docs/enterprise/index.mdx

Co-authored-by: David Yu <[email protected]>

* remove support for ecs client (fips)

---------

Co-authored-by: David Yu <[email protected]>

* add peering_commontopo tests [NET-3700] (#17951)

Co-authored-by: R.B. Boyer <[email protected]>
Co-authored-by: R.B. Boyer <[email protected]>
Co-authored-by: Freddy <[email protected]>
Co-authored-by: NiniOak <[email protected]>

* docs - remove Sentinel from enterprise features list (#18176)

* Update index.mdx
* Update kv.mdx
* Update docs-nav-data.json
* delete sentinel.mdx
* Update redirects.js

---------

Co-authored-by: Tu Nguyen <[email protected]>

* [NET-4865] Bump golang.org/x/net to 0.12.0 (#18186)

Bump golang.org/x/net to 0.12.0

While not necessary to directly address CVE-2023-29406 (which should be
handled by using a patched version of Go when building), an
accompanying change to HTTP/2 error handling does impact agent code.

See https://go-review.googlesource.com/c/net/+/506995 for the HTTP/2
change.

Bump this dependency across our submodules as well for the sake of
potential indirect consumers of `x/net/http`.

* Call resource mutate hook before validate hook (NET-4907) (#18178)

* [NET-4865] security: Update Go version to 1.20.6 (#18190)

Update Go version to 1.20.6

This resolves [CVE-2023-29406]
(https://nvd.nist.gov/vuln/detail/CVE-2023-29406) for uses of the
`net/http` standard library.

Note that until the follow-up to #18124 is done, the version of Go used
in those impacted tests will need to remain on 1.20.5.

* Improve XDS test coverage: JWT auth edition (#18183)

* Improve XDS test coverage: JWT auth edition

more tests

* test: xds coverage for jwt listeners

---------

Co-authored-by: DanStough <[email protected]>

* update readme.md (#18191)

u[date readme.md

* Update submodules to latest following 1.16.0 (#18197)

Align all our internal use of submodules on the latest versions.

* SEC-090: Automated trusted workflow pinning (2023-07-18) (#18174)

Result of tsccr-helper -log-level=info -pin-all-workflows .

Co-authored-by: hashicorp-tsccr[bot] <hashicorp-tsccr[bot]@users.noreply.github.com>

* Fix Backport Assistant PR commenting (#18200)

* Fix Backport Assistant failure PR commenting

For general comments on a PR, it looks like you have to use the `/issue`
endpoint rather than `/pulls`, which requires commit/other
review-specific target details.

This matches the endpoint used in `backport-reminder.yml`.

* Remove Backport Reminder workflow

This is noisy (even when adding multiple labels, individual comments per
label are generated), and likely no longer needed: we haven't had this
work in a long time due to an expired GH token, and we now have better
automation for backport PR assignment.

* resource: Pass resource to Write ACL hook instead of just resource Id [NET-4908] (#18192)

* Explicitly enable WebSocket upgrades (#18150)

This PR explicitly enables WebSocket upgrades in Envoy's UpgradeConfig for all
proxy types. (API Gateway, Ingress, and Sidecar.)

Fixes #8283

* docs: fix the description of client rpc (#18206)

* NET-4804: Add dashboard for monitoring consul-k8s (#18208)

* [OSS] Improve xDS Code Coverage - Clusters  (#18165)

test: improve xDS cluster code coverage

* NET-4222 take config file consul container (#18218)

Net 4222 take config file consul container

* Envoy Integration Test Windows (#18007)

* [CONSUL-395] Update check_hostport and Usage (#40)

* [CONSUL-397] Copy envoy binary from Image (#41)

* [CONSUL-382] Support openssl in unique test dockerfile (#43)

* [CONSUL-405] Add bats to single container (#44)

* [CONSUL-414] Run Prometheus Test Cases and Validate Changes (#46)

* [CONSUL-410] Run Jaeger in Single container (#45)

* [CONSUL-412] Run test-sds-server in single container (#48)

* [CONSUL-408] Clean containers (#47)

* [CONSUL-384] Rebase and sync fork (#50)

* [CONSUL-415] Create Scenarios Troubleshooting Docs (#49)

* [CONSUL-417] Update Docs Single Container (#51)

* [CONSUL-428] Add Socat to single container (#54)

* [CONSUL-424] Replace pkill in kill_envoy function (#52)

* [CONSUL-434] Modify Docker run functions in Helper script (#53)

* [CONSUL-435] Replace docker run in set_ttl_check_state & wait_for_agent_service_register functions (#55)

* [CONSUL-438] Add netcat (nc) in the Single container Dockerfile (#56)

* [CONSUL-429] Replace Docker run with Docker exec (#57)

* [CONSUL-436] Curl timeout and run tests (#58)

* [CONSUL-443] Create dogstatsd Function (#59)

* [CONSUL-431] Update Docs Netcat (#60)

* [CONSUL-439] Parse nc Command in function (#61)

* [CONSUL-463] Review curl Exec and get_ca_root Func (#63)

* [CONSUL-453] Docker hostname in Helper functions (#64)

* [CONSUL-461] Test wipe volumes without extra cont (#66)

* [CONSUL-454] Check ports in the Server and Agent containers (#65)

* [CONSUL-441] Update windows dockerfile with version (#62)

* [CONSUL-466] Review case-grpc Failing Test (#67)

* [CONSUL-494] Review case-cfg-resolver-svc-failover (#68)

* [CONSUL-496] Replace docker_wget & docker_curl (#69)

* [CONSUL-499] Cleanup Scripts - Remove nanoserver (#70)

* [CONSUL-500] Update Troubleshooting Docs (#72)

* [CONSUL-502] Pull & Tag Envoy Windows Image (#73)

* [CONSUL-504] Replace docker run in docker_consul (#76)

* [CONSUL-505] Change admin_bind

* [CONSUL-399] Update envoy to 1.23.1 (#78)

* [CONSUL-510] Support case-wanfed-gw on Windows (#79)

* [CONSUL-506] Update troubleshooting Documentation (#80)

* [CONSUL-512] Review debug_dump_volumes Function (#81)

* [CONSUL-514] Add zipkin to Docker Image (#82)

* [CONSUL-515] Update Documentation (#83)

* [CONSUL-529] Support case-consul-exec (#86)

* [CONSUL-530] Update Documentation (#87)

* [CONSUL-530] Update default consul version 1.13.3

* [CONSUL-539] Cleanup (#91)

* [CONSUL-546] Scripts Clean-up (#92)

* [CONSUL-491] Support admin_access_log_path value for Windows (#71)

* [CONSUL-519] Implement mkfifo Alternative (#84)

* [CONSUL-542] Create OS Specific Files for Envoy Package (#88)

* [CONSUL-543] Create exec_supported.go (#89)

* [CONSUL-544] Test and Build Changes (#90)

* Implement os.DevNull

* using mmap instead of disk files

* fix import in exec-unix

* fix nmap open too many arguemtn

* go fmt on file

* changelog file

* fix go mod

* Update .changelog/17694.txt

Co-authored-by: Dhia Ayachi <[email protected]>

* different mmap library

* fix bootstrap json

* some fixes

* chocolatey version fix and image fix

* using different library

* fix Map funciton call

* fix mmap call

* fix tcp dump

* fix tcp dump

* windows tcp dump

* Fix docker run

* fix tests

* fix go mod

* fix version 16.0

* fix version

* fix version dev

* sleep to debug

* fix sleep

* fix permission issue

* fix permission issue

* fix permission issue

* fix command

* fix command

* fix funciton

* fix assert config entry status command not found

* fix command not found assert_cert_has_cn

* fix command not found assert_upstream_missing

* fix command not found assert_upstream_missing_once

* fix command not found get_upstream_endpoint

* fix command not found get_envoy_public_listener_once

* fix command not found

* fix test cases

* windows integration test workflow github

* made code similar to unix using npipe

* fix go.mod

* fix dialing of npipe

* dont wait

* check size of written json

* fix undefined n

* running

* fix dep

* fix syntax error

* fix workflow file

* windows runner

* fix runner

* fix from json

* fix runs on

* merge connect envoy

* fix cin path

* build

* fix file name

* fix file name

* fix dev build

* remove unwanted code

* fix upload

* fix bin name

* fix path

* checkout current branch

* fix path

* fix tests

* fix shell bash for windows sh files

* fix permission of run-test.sh

* removed docker dev

* added shell bash for tests

* fix tag

* fix win=true

* fix cd

* added dev

* fix variable undefined

* removed failing tests

* fix tcp dump image

* fix curl

* fix curl

* tcp dump path

* fix tcpdump path

* fix curl

* fix curl install

* stop removing intermediate containers

* fix tcpdump docker image

* revert -rm

* --rm=false

* makeing docker image before

* fix tcpdump

* removed case consul exec

* removed terminating gateway simple

* comment case wasm

* removed data dog

* comment out upload coverage

* uncomment case-consul-exec

* comment case consul exec

* if always

* logs

* using consul 1.17.0

* fix quotes

* revert quotes

* redirect to dev null

* Revert version

* revert consul connect

* fix version

* removed envoy connect

* not using function

* change log

* docker logs

* fix logs

* restructure bad authz

* rmeoved dev null

* output

* fix file descriptor

* fix cacert

* fix cacert

* fix ca cert

* cacert does not work in windows curl

* fix func

* removed docker logs

* added sleep

* fix tls

* commented case-consul-exec

* removed echo

* retry docker consul

* fix upload bin

* uncomment consul exec

* copying consul.exe to docker image

* copy fix

* fix paths

* fix path

* github workspace path

* latest version

* Revert "latest version"

This reverts commit 5a7d7b82d9e7553bcb01b02557ec8969f9deba1d.

* commented consul exec

* added ssl revoke best effort

* revert best effort

* removed unused files

* rename var name and change dir

* windows runner

* permission

* needs setup fix

* swtich to github runner

* fix file path

* fix path

* fix path

* fix path

* fix path

* fix path

* fix build paths

* fix tag

* nightly runs

* added matrix in github workflow, renamed files

* fix job

* fix matrix

* removed brackes

* from json

* without using job matrix

* fix quotes

* revert job matrix

* fix workflow

* fix comment

* added comment

* nightly runs

* removed datadog ci as it is already measured in linux one

* running test

* Revert "running test"

This reverts commit 7013d15a23732179d18ec5d17336e16b26fab5d4.

* pr comment fixes

* running test now

* running subset of test

* running subset of test

* job matrix

* shell bash

* removed bash shell

* linux machine for job matrix

* fix output

* added cat to debug

* using ubuntu latest

* fix job matrix

* fix win true

* fix go test

* revert job matrix

---------

Co-authored-by: Jose Ignacio Lorenzo <[email protected]>
Co-authored-by: Franco Bruno Lavayen <[email protected]>
Co-authored-by: Ivan K Berlot <[email protected]>
Co-authored-by: Ezequiel Fernández Ponce <[email protected]>
Co-authored-by: joselo85 <[email protected]>
Co-authored-by: Ezequiel Fernández Ponce <[email protected]>
Co-authored-by: Dhia Ayachi <[email protected]>

* fix typos and update ecs compat table (#18215)

* fix typos and update ecs compat table

* real info for the ecs compat matrix table

* Update website/content/docs/ecs/compatibility.mdx

Co-authored-by: Chris Thain <[email protected]>

---------

Co-authored-by: Chris Thain <[email protected]>

* [OSS] proxystate: add proxystate protos (#18216)

* proxystate: add proxystate protos to pbmesh and resolve imports and conflicts between message names

* ci: don't verify s390x (#18224)

* [CC-5718] Remove HCP token requirement during bootstrap (#18140)

* [CC-5718] Remove HCP token requirement during bootstrap

* Re-add error for loading HCP management token

* Remove old comment

* Add changelog entry

* Remove extra validation line

* Apply suggestions from code review

Co-authored-by: lornasong <[email protected]>

---------

Co-authored-by: lornasong <[email protected]>

* [NET-4122] Doc guidance for federation with externalServers (#18207)

Doc guidance for federation with externalServers

Add guidance for proper configuration when joining to a secondary
cluster using WAN fed with external servers also enabled.

Also clarify federation requirements and fix formatting for an
unrelated value.

Update both the Helm chart reference (synced from `consul-k8s`, see
hashicorp/consul-k8s#2583) and the docs on using `externalServers`.

* [OSS] Improve xDS Code Coverage - Endpoints and Misc (#18222)

test: improve xDS endpoints code coverage

* Clarify license reporting timing and GDPR compliance (#18237)

Add Alicia's edits to clarify log timing and other details

* Fix Github Workflow File (#18241)

* [CONSUL-382] Support openssl in unique test dockerfile (#43)

* [CONSUL-405] Add bats to single container (#44)

* [CONSUL-414] Run Prometheus Test Cases and Validate Changes (#46)

* [CONSUL-410] Run Jaeger in Single container (#45)

* [CONSUL-412] Run test-sds-server in single container (#48)

* [CONSUL-408] Clean containers (#47)

* [CONSUL-384] Rebase and sync fork (#50)

* [CONSUL-415] Create Scenarios Troubleshooting Docs (#49)

* [CONSUL-417] Update Docs Single Container (#51)

* [CONSUL-428] Add Socat to single container (#54)

* [CONSUL-424] Replace pkill in kill_envoy function (#52)

* [CONSUL-434] Modify Docker run functions in Helper script (#53)

* [CONSUL-435] Replace docker run in set_ttl_check_state & wait_for_agent_service_register functions (#55)

* [CONSUL-438] Add netcat (nc) in the Single container Dockerfile (#56)

* [CONSUL-429] Replace Docker run with Docker exec (#57)

* [CONSUL-436] Curl timeout and run tests (#58)

* [CONSUL-443] Create dogstatsd Function (#59)

* [CONSUL-431] Update Docs Netcat (#60)

* [CONSUL-439] Parse nc Command in function (#61)

* [CONSUL-463] Review curl Exec and get_ca_root Func (#63)

* [CONSUL-453] Docker hostname in Helper functions (#64)

* [CONSUL-461] Test wipe volumes without extra cont (#66)

* [CONSUL-454] Check ports in the Server and Agent containers (#65)

* [CONSUL-441] Update windows dockerfile with version (#62)

* [CONSUL-466] Review case-grpc Failing Test (#67)

* [CONSUL-494] Review case-cfg-resolver-svc-failover (#68)

* [CONSUL-496] Replace docker_wget & docker_curl (#69)

* [CONSUL-499] Cleanup Scripts - Remove nanoserver (#70)

* [CONSUL-500] Update Troubleshooting Docs (#72)

* [CONSUL-502] Pull & Tag Envoy Windows Image (#73)

* [CONSUL-504] Replace docker run in docker_consul (#76)

* [CONSUL-505] Change admin_bind

* [CONSUL-399] Update envoy to 1.23.1 (#78)

* [CONSUL-510] Support case-wanfed-gw on Windows (#79)

* [CONSUL-506] Update troubleshooting Documentation (#80)

* [CONSUL-512] Review debug_dump_volumes Function (#81)

* [CONSUL-514] Add zipkin to Docker Image (#82)

* [CONSUL-515] Update Documentation (#83)

* [CONSUL-529] Support case-consul-exec (#86)

* [CONSUL-530] Update Documentation (#87)

* [CONSUL-530] Update default consul version 1.13.3

* [CONSUL-539] Cleanup (#91)

* [CONSUL-546] Scripts Clean-up (#92)

* [CONSUL-491] Support admin_access_log_path value for Windows (#71)

* [CONSUL-519] Implement mkfifo Alternative (#84)

* [CONSUL-542] Create OS Specific Files for Envoy Package (#88)

* [CONSUL-543] Create exec_supported.go (#89)

* [CONSUL-544] Test and Build Changes (#90)

* Implement os.DevNull

* using mmap instead of disk files

* fix import in exec-unix

* fix nmap open too many arguemtn

* go fmt on file

* changelog file

* fix go mod

* Update .changelog/17694.txt

Co-authored-by: Dhia Ayachi <[email protected]>

* different mmap library

* fix bootstrap json

* some fixes

* chocolatey version fix and image fix

* using different library

* fix Map funciton call

* fix mmap call

* fix tcp dump

* fix tcp dump

* windows tcp dump

* Fix docker run

* fix tests

* fix go mod

* fix version 16.0

* fix version

* fix version dev

* sleep to debug

* fix sleep

* fix permission issue

* fix permission issue

* fix permission issue

* fix command

* fix command

* fix funciton

* fix assert config entry status command not found

* fix command not found assert_cert_has_cn

* fix command not found assert_upstream_missing

* fix command not found assert_upstream_missing_once

* fix command not found get_upstream_endpoint

* fix command not found get_envoy_public_listener_once

* fix command not found

* fix test cases

* windows integration test workflow github

* made code similar to unix using npipe

* fix go.mod

* fix dialing of npipe

* dont wait

* check size of written json

* fix undefined n

* running

* fix dep

* fix syntax error

* fix workflow file

* windows runner

* fix runner

* fix from json

* fix runs on

* merge connect envoy

* fix cin path

* build

* fix file name

* fix file name

* fix dev build

* remove unwanted code

* fix upload

* fix bin name

* fix path

* checkout current branch

* fix path

* fix tests

* fix shell bash for windows sh files

* fix permission of run-test.sh

* removed docker dev

* added shell bash for tests

* fix tag

* fix win=true

* fix cd

* added dev

* fix variable undefined

* removed failing tests

* fix tcp dump image

* fix curl

* fix curl

* tcp dump path

* fix tcpdump path

* fix curl

* fix curl install

* stop removing intermediate containers

* fix tcpdump docker image

* revert -rm

* --rm=false

* makeing docker image before

* fix tcpdump

* removed case consul exec

* removed terminating gateway simple

* comment case wasm

* removed data dog

* comment out upload coverage

* uncomment case-consul-exec

* comment case consul exec

* if always

* logs

* using consul 1.17.0

* fix quotes

* revert quotes

* redirect to dev null

* Revert version

* revert consul connect

* fix version

* removed envoy connect

* not using function

* change log

* docker logs

* fix logs

* restructure bad authz

* rmeoved dev null

* output

* fix file descriptor

* fix cacert

* fix cacert

* fix ca cert

* cacert does not work in windows curl

* fix func

* removed docker logs

* added sleep

* fix tls

* commented case-consul-exec

* removed echo

* retry docker consul

* fix upload bin

* uncomment consul exec

* copying consul.exe to docker image

* copy fix

* fix paths

* fix path

* github workspace path

* latest version

* Revert "latest version"

This reverts commit 5a7d7b82d9e7553bcb01b02557ec8969f9deba1d.

* commented consul exec

* added ssl revoke best effort

* revert best effort

* removed unused files

* rename var name and change dir

* windows runner

* permission

* needs setup fix

* swtich to github runner

* fix file path

* fix path

* fix path

* fix path

* fix path

* fix path

* fix build paths

* fix tag

* nightly runs

* added matrix in github workflow, renamed files

* fix job

* fix matrix

* removed brackes

* from json

* without using job matrix

* fix quotes

* revert job matrix

* fix workflow

* fix comment

* added comment

* nightly runs

* removed datadog ci as it is already measured in linux one

* running test

* Revert "running test"

This reverts commit 7013d15a23732179d18ec5d17336e16b26fab5d4.

* pr comment fixes

* running test now

* running subset of test

* running subset of test

* job matrix

* shell bash

* removed bash shell

* linux machine for job matrix

* fix output

* added cat to debug

* using ubuntu latest

* fix job matrix

* fix win true

* fix go test

* revert job matrix

* Fix tests

---------

Co-authored-by: Ivan K Berlot <[email protected]>
Co-authored-by: Jose Ignacio Lorenzo <[email protected]>
Co-authored-by: Franco Bruno Lavayen <[email protected]>
Co-authored-by: Ezequiel Fernández Ponce <[email protected]>
Co-authored-by: joselo85 <[email protected]>
Co-authored-by: Ezequiel Fernández Ponce <[email protected]>
Co-authored-by: Dhia Ayachi <[email protected]>

* NET-4996 - filter go-tests and test-integration workflows from running on docs only and ui only changes (#18236)

* Align build arch matrix with enterprise (#18235)

Ensure that OSS remains in sync w/ Enterprise by aligning the format of
arch matrix args for various build jobs.

* Revert "NET-4996 - filter go-tests and test-integration workflows from running on docs only and ui only changes" (#18248)

Revert "NET-4996 - filter go-tests and test-integration workflows from running on docs only and ui only changes (#18236)"

This reverts commit a11dba710e6ce6f172c0fa6c9b61567cc1efffc8.

* resource: Add scope to resource type registration [NET-4976] (#18214)

Enables querying a resource type's registration to determine if a resource is cluster, partition, or partition and namespace scoped.

* Fix some inconsistencies in jwt docs (#18234)

* NET-1825: More new ACL token creation docs (#18063)

Co-authored-by: trujillo-adam <[email protected]>

* grafana: add the panel resource usage of connect injector (#18247)

* [NET-3700] Backfill changelog entry for c2bbe67 and 7402d06 (#18259)

Backfill changelog entry for c2bbe67 and 7402d06

Add a changelog entry for the follow-up PR since it was specific to the
fix and references the original change.

* NET-4897 - update comment to include the current issue url from the go team. (#18263)

* fix typos, style, and improper links (#18269)

* member cli: add -filter expression to flags (#18223)

* member cli: add -filter expression to flags

* changelog

* update doc

* Add test cases

* use quote

* go-tests: disable s390x (#18273)

* docs: Update ext-authz documentation for kubernetes (#18281)

Update ext-authz documentation for kubernetes

* docs: Consul on Kubernetes specific upgrade info (#18230)

* Compatibility page - dataplanes mention

* Upgrading higher-level dataplane mention

* `exec=` string callout

* More visible for upgrade page

* Apply suggestions from code review

Co-authored-by: Tu Nguyen <[email protected]>

---------

Co-authored-by: Tu Nguyen <[email protected]>
Co-authored-by: John Murret <[email protected]>

* Fix typo in Envoy extensions doc (#18284)

* docs: K8s secondary DC requirements (#18280)

* Requested edit

* Apply suggestions from code review

Co-authored-by: trujillo-adam <[email protected]>

---------

Co-authored-by: trujillo-adam <[email protected]>

* api-gateway: subscribe to bound-api-gateway only after receiving api-gateway (#18291)

* api-gateway: subscribe to bound-api-gateway only after receiving api-gateway

This fixes a race condition due to our dependency on having the listener(s) from the api-gateway config entry in order to fully and properly process the resources on the bound-api-gateway config entry.

* Apply suggestions from code review

* Add changelog entry

* Update K8s changelog to address cloud auto-join change in 1.0.0 (#18293)

* Update list of Envoy versions (#18300)

Update supported envoy versions to 1.24.10, 1.25.9, 1.26.4, 1.27.0.

* [NET-4904] Update list of Envoy versions in docs (#18306)

Update list of Envoy versions in docs

Update supported Envoy versions across Consul release versions.

* Update actions for TSCCR (#18317)

Update action versions before deadline

* Fix topology view when displaying mixed connect-native/normal services. (#13023)

* Fix topoloy intention with mixed connect-native/normal services.

If a service is registered twice, once with connect-native and once
without, the topology views would prune the existing intentions. This
change brings the code more in line with the transparent proxy behavior.

* Dedupe nodes in the ServiceTopology ui endpoint (like done with tags).

* Consider a service connect-native as soon as one instance is.

* Stop JWT provider from being written in non default namespace (#18325)

* docs: Fix some comments (#17118)

Signed-off-by: cui fliter <[email protected]>

* [NET-4703] Prevent partial application of Envoy extensions (#18068)

Prevent partial application of Envoy extensions

Ensure that non-required extensions do not change xDS resources before
exiting on failure by cloning proto messages prior to applying each
extension.

To support this change, also move `CanApply` checks up a layer and make
them prior to attempting extension application, s.t. we avoid
unnecessary copies where extensions can't be applied.

Last, ensure that we do not allow panics from `CanApply` or `Extend`
checks to escape the attempted extension application.

* docs: Simplify example jq commands by removing pipes (#18327)

Simplify jq command examples by removing pipes to other commands.

* fix typo in create a mesh token docs (#18337)

* [CC-5719] Add support for builtin global-read-only policy (#18319)

* [CC-5719] Add support for builtin global-read-only policy

* Add changelog

* Add read-only to docs

* Fix some minor issues.

* Change from ReplaceAll to Sprintf

* Change IsValidPolicy name to return an error instead of bool

* Fix PolicyList test

* Fix other tests

* Apply suggestions from code review

Co-authored-by: Paul Glass <[email protected]>

* Fix state store test for policy list.

* Fix naming issues

* Update acl/validation.go

Co-authored-by: Chris Thain <[email protected]>

* Update agent/consul/acl_endpoint.go

---------

Co-authored-by: Paul Glass <[email protected]>
Co-authored-by: Chris Thain <[email protected]>

* [NET-5121] proxystate: move protos to subdirectory to avoid conflicts (#18335)

* also makes a few protos updates

* resource: adding various helpers for working with resources (#18342)

This is a bit of a grab bag of helpers that I found useful for working with them when authoring substantial Controllers. Subsequent PRs will make use of them.

* Wasm integration tests for local and remote wasm files (#17756)

* wasm integration tests for local and remote wasm files

refactoring and cleanup for wasm testing

remove wasm debug logging

PR feedback, wasm build lock

correct path pattern for wasm build files

Add new helper function to minimize changes to existing test code

Remove extra param

mod tidy

add custom service setup to test lib

add wait until static server sidecar can reach nginx sidecar

Doc comments

PR feedback

Update workflows to compile wasm for integration tests

Fix docker build path

Fix package name for linter

Update makefile, fix redeclared function

Update expected wasm filename

Debug test ls in workflow

remove pwd in favor of relative path

more debugging

Build wasm in compatability tests as well

Build wasm directly in ci rather than in container

Debug tinygo and llvm version

Change wasm file extension

Remove tinygo debugging

Remove extra comments

* Add compiled wasm and build instructions

* [HCP Telemetry] Periodic Refresh for Dynamic Telemetry Configuration (#18168)

* OTElExporter now uses an EndpointProvider to discover the endpoint

* OTELSink uses a ConfigProvider to obtain filters and labels configuration

* improve tests for otel_sink

* Regex logic is moved into client for a method on the TelemetryConfig object

* Create a telemetry_config_provider and update deps to use it

* Fix conversion

* fix import newline

* Add logger to hcp client and move telemetry_config out of the client.go file

* Add a telemetry_config.go to refactor client.go

* Update deps

* update hcp deps test

* Modify telemetry_config_providers

* Check for nil filters

* PR review updates

* Fix comments and move around pieces

* Fix comments

* Remove context from client struct

* Moved ctx out of sink struct and fixed filters, added a test

* Remove named imports, use errors.New if not fformatting

* Remove HCP dependencies in telemetry package

* Add success metric and move lock only to grab the t.cfgHahs

* Update hash

* fix nits

* Create an equals method and add tests

* Improve telemetry_config_provider.go tests

* Add race test

* Add missing godoc

* Remove mock for MetricsClient

* Avoid goroutine test panics

* trying to kick CI lint issues by upgrading mod

* imprve test code and add hasher for testing

* Use structure logging for filters, fix error constants, and default to allow all regex

* removed hashin and modify logic to simplify

* Improve race test and fix PR feedback by removing hash equals and avoid testing the timer.Ticker logic, and instead unit test

* Ran make go-mod-tidy

* Use errtypes in the test

* Add changelog

* add safety check for exporter endpoint

* remove require.Contains by using error types, fix structure logging, and fix success metric typo in exporter

* Fixed race test to have changing config values

* Send success metric before modifying config

* Avoid the defer and move the success metric under

* NET-4240 - Snapshots are failing on Windows  (#18302)

* fix go mod

* fix go sum

* added change log

* ran make go mod tidy

* Register ProxyStateTemplate Resource (#18316)

  Also, change the ProxyState.id to identity. This is because we already have the id of this proxy
  from the resource, and this id should be name-aligned with the workload it represents. It should
  also have the owner ref set to the workload ID if we need that. And so the id field seems unnecessary.
  We do, however, need a reference to workload identity so that we can authorize the proxy when it initially
  connects to the xDS server.

* [NET-5146] security: Update Go version to 1.20.7 and `x/net` to 0.13.0 (#18358)

* Update Go version to 1.20.7

This resolves [CVE-2023-29409]
(https://nvd.nist.gov/vuln/detail/CVE-2023-29409)(`crypto/tls`).

* Bump golang.org/x/net to 0.13.0

Addresses [CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978)
for security scans (non-impacting).

* mesh: adding the protobuf types and resources backing mesh config v2 (#18351)

* [OSS] test: xds coverage for routes (#18369)

test: xds coverage for routes

* Fix policy lookup to allow for slashes (#18347)

* Fix policy lookup to allow for slashes

* Fix suggestions

* Fix other test

* Revert some lines

* add some initial CODEOWNERS (#18346)

* Add redirects for mesh-gateway docs (#18377)

* expose grpc as http endpoint (#18221)

expose resource grpc endpoints as http endpoints

* bimapper: fix a bug and add some more test coverage (#18387)

* [docs] Fix ServiceDefaults example in distributed tracing (#17212)

Fix ServiceDefaults example in distributed tracing.

* Fix #17730 - Dev mode has new line (#18367)

* adding new line only in case of pretty in url not in dev mode

* change log added

* chore: make go-mod-tidy (#18388)

* resource: Make resource read tenancy aware (#18397)

* Not using chmod - fixed integration test for Enterprise (#18401)

* Not using chmod

* checking icacls

* Removed push

* replaced ordered list of rate limit ops with flow diagram (#18398)

* replaced ordered list of rate limit ops with flow diagram

* made diagram font bigger

* updated colors for dark mode img

* fixed typo

* recentered dark mode image

* Apply suggestions from code review

Co-authored-by: Jeff Boruszak <[email protected]>

---------

Co-authored-by: Jeff Boruszak <[email protected]>

* Upgrade test: remove outdated test and disable log due to verbosity (#18403)

* remove outdated test

* disable log since we have too many parallel tests

* bump testcontainers-go from 0.22.0 and remove pinned go version in in… (#18395)

* bump testcontainers-go from 0.22.0 and remove pinned go version in integ test

* go mod tidy

* Replace deprecated target.Authority with target.URL.Host

* Add ServiceEndpoints Mutation hook tests (#18404)

* Add ServiceEndpoints Mutation hook tests

* Move endpoint owner validation into the validation hook

Also there were some minor changes to error validation to account for go-cmp not liking to peer through an errors.errorstring type that get created by errors.New

* catalog: add FailoverPolicy mutation and validation hooks (#18390)

Add most of the validation and mutation hooks for the FailoverPolicy resource.

* NET-5115 Add retry + timeout filters for api-gateway (#18324)

* squash, implement retry/timeout in consul core

* update tests

* catalog: adding a controller to reconcile FailoverPolicy resources (#18399)

Add most of the semantic cross-resource validation for FailoverPolicy resources using a new controller.

* fix the error in ent repo (#18421)

fix the error in ent repo

* build: updates for 1.16.1 release (#18415)

* build: updates for 1.16.1 release

* build: fix missing replace directive for envoyextensions

* build: go mod tidy testing/deployer

* update ECS links (#18419)

* docs: fix incorrect proxy-defaults config in Lua Envoy extension (#18418)

fix incorrect proxy-defaults config

* resource: Make resource write tenancy aware (#18423)

* [NET-5217] [OSS] Derive sidecar proxy locality from parent service (#18437)

* Add logging to locality policy application

In OSS, this is currently a no-op.

* Inherit locality when registering sidecars

When sidecar locality is not explicitly configured, inherit locality
from the proxied service.

* NET-4984: Update APIGW Config Entries for JWT Auth (#18366)

* Added oss config entries for Policy and JWT on APIGW

* Updated structs for config entry

* Updated comments, ran deep-copy

* Move JWT configuration into OSS file

* Add in the config entry OSS file for jwts

* Added changelog

* fixing proto spacing

* Moved to using manually written deep copy method

* Use pointers for override/default fields in apigw config entries

* Run gen scripts for changed types

* k8s compat - Openshift versions (#18307)

* Update compatibility.mdx

Co-authored-by: trujillo-adam <[email protected]>

* APIGW: Update HTTPRouteConfigEntry for JWT Auth (#18422)

* Updated httproute config entry for JWT Filters

* Added manual deepcopy method for httproute jwt filter

* Fix test

* Update JWTFilter to be in oss file

* Add changelog

* Add build tags for deepcopy oss file

* [COMPLIANCE] License changes (#18443)

* Adding explicit MPL license for sub-package

This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository.

* Adding explicit MPL license for sub-package

This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository.

* Updating the license from MPL to Business Source License

Going forward, this project will be licensed under the Business Source License v1.1. Please see our blog post for more details at <Blog URL>, FAQ at www.hashicorp.com/licensing-faq, and details of the license at www.hashicorp.com/bsl.

* add missing license headers

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

---------

Co-authored-by: hashicorp-copywrite[bot] <11042…
absolutelightning added a commit that referenced this pull request Sep 4, 2023
@hc-github-team-consul-core @sarahalsmiller
@nathancoleman @jmurret @nvanthao @trujillo-adam @roncodingenthusiast @mr-miles @lkysow @im2nguyen @natemollica-nm @loshz @jm96441n @beautifulentropy @Ranjandas @hashi-derek @absolutelightning @xwa153 @cthain @boruszak @evanphx @JadhavPoonam @DanStough @karras @jcjones @fulviodenza @krastin @david3a @curtbushko @nfi-hashicorp @t-davies @vijayraghav-io @jkirschner-hashicorp @eddie-rowe @emilymianeil @nv-hashi @ishustava @Jeff-Apple @huikang @cocolavayen @joselo85 @dhiaayachi @rboyer @freddygv @NiniOak @zalimeni @analogue @hashicorp-tsccr @blake @iberlot @ezfepo @ndhanushkodi @jjacobson93 @lornasong @judithpatudith @gautambaghel @apollo13 @cuishuang @johnlanda @Achooo @ilpianista @mkeeler @hashicorp-copywrite @boxofrad @natmegs
Backport of Net 3181 consul gh issue 15709 allow log file naming like…
d904b88 
… nomad - fix bug into release/1.14.x (#18640)

* api-gateway: add operation cannot be fulfilled error to common errors (#17874)

* add error message

* Update website/content/docs/api-gateway/usage/errors.mdx

Co-authored-by: Nathan Coleman <[email protected]>

* fix formating issues

---------

Co-authored-by: Nathan Coleman <[email protected]>

* api-gateway: add step to upgrade instructions for creating intentions (#17875)

* Changelog - add 1.13.9, 1.14.8, and 1.15.4 (#17889)

* docs: update config enable_debug (#17866)

* update doc for config enable_debug

* Update website/content/docs/agent/config/config-files.mdx

Co-authored-by: trujillo-adam <[email protected]>

---------

Co-authored-by: trujillo-adam <[email protected]>

* Update wording on WAN fed and intermediate_pki_path (#17850)

* Allow service identity tokens the ability to read jwt-providers (#17893)

* Allow service identity tokens the ability to read jwt-providers

* more tests

* service_prefix tests

* Update docs (#17476)

Co-authored-by: trujillo-adam <[email protected]>

* Add emit_tags_as_labels to envoy bootstrap config when using Consul Telemetry Collector (#17888)

* Fix command from kg to kubectl get (#17903)

* Create and update release notes for 1.16 and 1.2 (#17895)

* update release notes for 1.16 and 1.2

* update latest consul core release

* Propose new changes to APIgw upgrade instructions (#17693)

* Propose new changes to APIgw upgrade instructions

* fix build error

* update callouts to render correctly

* Add hideClipboard to log messages

* Added clarification around consul k8s and crds

* Add workflow to verify linux release packages (#17904)

* adding docker files to verify linux packages.

* add verifr-release-linux.yml

* updating name

* pass inputs directly into jobs

* add other linux package platforms

* remove on push

* fix TARGETARCH on debian and ubuntu so it can check arm64 and amd64

* fixing amazon to use the continue line

* add ubuntu i386

* fix comment lines

* working

* remove commented out workflow jobs

* Apply suggestions from code review

Co-authored-by: Nathan Coleman <[email protected]>

* update fedora and ubuntu to use latest tag

---------

Co-authored-by: Nathan Coleman <[email protected]>

* Reference hashicorp/consul instead of consul for Docker image (#17914)

* Reference hashicorp/consul instead of consul for Docker image

* Update Make targets that pull consul directly

* Update Consul K8s Upgrade Doc Updates (#17921)

Updating upgrade procedures to encompass expected errors during upgrade process from v1.13.x to v1.14.x.

* Update sameness-group.mdx (#17915)

* Update create-sameness-groups.mdx (#17927)

* deps: coredns v1.10.1 (#17912)

* Ensure RSA keys are at least 2048 bits in length (#17911)

* Ensure RSA keys are at least 2048 bits in length

* Add changelog

* update key length check for FIPS compliance

* Fix no new variables error and failing to return when error exists from
validating

* clean up code for better readability

* actually return value

* tlsutil: Fix check TLS configuration (#17481)

* tlsutil: Fix check TLS configuration
* Rewording docs.
* Update website/content/docs/services/configuration/checks-configuration-reference.mdx
Co-authored-by: trujillo-adam <[email protected]>
* Fix typos and add changelog entry.
---------

Co-authored-by: trujillo-adam <[email protected]>

* docs: Deprecations for connect-native SDK and specific connect native APIs (#17937)

* Update v1_16_x.mdx
* Update connect native golang page

---------

Co-authored-by: trujillo-adam <[email protected]>

* Revert "Add workflow to verify linux release packages (#17904)" (#17942)

This reverts commit 3368f14fab500ebe9f6aeab5631dd1d5f5a453e5.

* Fixes Secondary ConnectCA update (#17846)

This fixes a bug that was identified which resulted in subsequent
ConnectCA configuration update not to persist in the cluster.

* fixing typo in link to jwt-validations-with-intentions doc (#17955)

* Fix streaming backend link (#17958)

* Fix streaming backend link
* Update health.mdx

* Dynamically create jwks clusters for jwt-providers (#17944)

* website: remove deprecated agent rpc docs (#17962)

* Fix missing BalanceOutboundConnections in v2 catalog. (#17964)

* feature - [NET - 4005]  - [Supportability] Reloadable Configuration - enable_debug (#17565)

* # This is a combination of 9 commits.
# This is the 1st commit message:

init without tests

# This is the commit message #2:

change log

# This is the commit message #3:

fix tests

# This is the commit message #4:

fix tests

# This is the commit message #5:

added tests

# This is the commit message #6:

change log breaking change

# This is the commit message #7:

removed breaking change

# This is the commit message #8:

fix test

# This is the commit message #9:

keeping the test behaviour same

* # This is a combination of 12 commits.
# This is the 1st commit message:

init without tests

# This is the commit message #2:

change log

# This is the commit message #3:

fix tests

# This is the commit message #4:

fix tests

# This is the commit message #5:

added tests

# This is the commit message #6:

change log breaking change

# This is the commit message #7:

removed breaking change

# This is the commit message #8:

fix test

# This is the commit message #9:

keeping the test behaviour same

# This is the commit message #10:

made enable debug atomic bool

# This is the commit message #11:

fix lint

# This is the commit message #12:

fix test true enable debug

* parent 10f500e895d92cc3691ade7b74a33db755d22039
author absolutelightning <[email protected]> 1687352587 +0530
committer absolutelightning <[email protected]> 1687352592 +0530

init without tests

change log

fix tests

fix tests

added tests

change log breaking change

removed breaking change

fix test

keeping the test behaviour same

made enable debug atomic bool

fix lint

fix test true enable debug

using enable debug in agent as atomic bool

test fixes

fix tests

fix tests

added update on correct locaiton

fix tests

fix reloadable config enable debug

fix tests

fix init and acl 403

* revert commit

* Fix formatting codeblocks on APIgw docs (#17970)

* fix formatting codeblocks

* remove unnecessary indents

* Remove POC code (#17974)

* update doc (#17910)

* update doc

* update link

* Remove duplicate and unused newDecodeConfigEntry func (#17979)

* docs: samenessGroup YAML examples (#17984)

* configuration entry syntax

* Example config

* Add changelog entry for 1.16.0 (#17987)

* Fix typo (#17198)

servcies => services

* Expose JWKS cluster config through JWTProviderConfigEntry (#17978)

* Expose JWKS cluster config through JWTProviderConfigEntry

* fix typos, rename trustedCa to trustedCA

* Integration test for ext-authz Envoy extension (#17980)

* Fix incorrect protocol for transparent proxy upstreams. (#17894)

This PR fixes a bug that was introduced in:
https://github.com/hashicorp/consul/pull/16021

A user setting a protocol in proxy-defaults would cause tproxy implicit
upstreams to not honor the upstream service's protocol set in its
`ServiceDefaults.Protocol` field, and would instead always use the
proxy-defaults value.

Due to the fact that upstreams configured with "tcp" can successfully contact
upstream "http" services, this issue was not recognized until recently (a
proxy-defaults with "tcp" and a listening service with "http" would make
successful requests, but not the opposite).

As a temporary work-around, users experiencing this issue can explicitly set
the protocol on the `ServiceDefaults.UpstreamConfig.Overrides`, which should
take precedence.

The fix in this PR removes the proxy-defaults protocol from the wildcard
upstream that tproxy uses to configure implicit upstreams. When the protocol
was included, it would always overwrite the value during discovery chain
compilation, which was not correct. The discovery chain compiler also consumes
proxy defaults to determine the protocol, so simply excluding it from the
wildcard upstream config map resolves the issue.

* feat: include nodes count in operator usage endpoint and cli command (#17939)

* feat: update operator usage api endpoint to include nodes count

* feat: update operator usange cli command to includes nodes count

* [OSS] Improve Gateway Test Coverage of Catalog Health (#18011)

* fix(cli): remove failing check from 'connect envoy' registration for api gateway

* test(integration): add tests to check catalog statsus of gateways on startup

* remove extra sleep comment

* Update test/integration/consul-container/libs/assert/service.go

* changelog

* Fixes Traffic rate limitting docs (#17997)

* Fix removed service-to-service peering links (#17221)

* docs: fix removed service-to-service peering links

* docs: extend peering-via-mesh-gateways intro (thanks @trujillo-adam)

---------

Co-authored-by: trujillo-adam <[email protected]>

* docs: Sameness "beta" warning (#18017)

* Warning updates

* .x

* updated typo in tab heading (#18022)

* updated typo in tab heading

* updated tab group typo, too

* Document that DNS lookups can target cluster peers (#17990)

Static DNS lookups, in addition to explicitly targeting a datacenter,
can target a cluster peer. This was added in 95dc0c7b301b70a6b955a8b7c9737c9b86f03df6 but didn't make the documentation.

The driving function for the change is `parseLocality` here: https://github.com/hashicorp/consul/blob/0b1299c28d8127129d61310ee4280055298438e0/agent/dns_oss.go#L25

The biggest change in this is to adjust the standard lookup syntax to tie
`.<datacenter>` to `.dc` as required-together, and to append in the similar `.<cluster-peer>.peer` optional argument, both to A record and SRV record lookups.

Co-authored-by: David Yu <[email protected]>

* Add first integration test for jwt auth with intention (#18005)

* fix stand-in text for name field (#18030)

* removed sameness conf entry from failover nav (#18033)

* docs - add service sync annotations and k8s service weight annotation (#18032)

* Docs for https://github.com/hashicorp/consul-k8s/pull/2293
* remove versions for enterprise features since they are old

---------

Co-authored-by: Tu Nguyen <[email protected]>

* docs - add jobs use case for service mesh k8s (#18037)

* docs - add jobs use case for service mesh k8s
* add code blocks

* address feedback (#18045)

* Add verify server hostname to tls default (#17155)

* [OSS] Fix initial_fetch_timeout to wait for all xDS resources (#18024)

* fix(connect): set initial_fetch_time to wait indefinitely

* changelog

* PR feedback 1

* ui: fix typos for peer service imports (#17999)

* test: fix FIPS inline cert test message (#18076)

* Fix a couple typos in Agent Telemetry Metrics docs (#18080)

* Fix metrics docs

* Add changelog

Signed-off-by: josh <[email protected]>

---------

Signed-off-by: josh <[email protected]>

* docs updates - cluster peering and virtual services (#18069)

* Update route-to-virtual-services.mdx
* Update establish-peering.mdx

* Update service-mesh-compare.mdx (#17279)

grammar change

* Update helm docs on main (#18085)

* ci: use gotestsum v1.10.1 [NET-4042] (#18088)

* Docs: Update proxy lifecycle annotations and consul-dataplane flags (#18075)

* Update proxy lifecycle annotations and consul-dataplane flags

* Pass configured role name to Vault for AWS auth in Connect CA (#17885)

* Docs for dataplane upgrade on k8s (#18051)

* Docs for dataplane upgrade on k8s

---------

Co-authored-by: David Yu <[email protected]>
Co-authored-by: trujillo-adam <[email protected]>

* docs - update upgrade index page to not recommend consul leave. (#18100)

* Displays Consul version of each nodes in UI nodes section (#17754)

* update UINodes and UINodeInfo response with consul-version info added as NodeMeta, fetched from serf members

* update test cases TestUINodes, TestUINodeInfo

* added nil check for map

* add consul-version in local agent node metadata

* get consul version from serf member and add this as node meta in catalog register request

* updated ui mock response to include consul versions as node meta

* updated ui trans and added version as query param to node list route

* updates in ui templates to display consul version with filter and sorts

* updates in ui - model class, serializers,comparators,predicates for consul version feature

* added change log for Consul Version Feature

* updated to get version from consul service, if for some reason not available from serf

* updated changelog text

* updated dependent testcases

* multiselection version filter

* Update agent/consul/state/catalog.go

comments updated

Co-authored-by: Jared Kirschner <[email protected]>

---------

Co-authored-by: Jared Kirschner <[email protected]>

* api gw 1.16 updates (#18081)

* api gw 1.16 updates

* Apply suggestions from code review

Co-authored-by: Jeff Boruszak <[email protected]>

* update CodeBlockConfig filename

* Apply suggestions from code review

Co-authored-by: trujillo-adam <[email protected]>
Co-authored-by: Jeff Boruszak <[email protected]>

* remove non-standard intentions page

* Update website/content/docs/api-gateway/configuration/index.mdx

Co-authored-by: trujillo-adam <[email protected]>

---------

Co-authored-by: Jeff Boruszak <[email protected]>
Co-authored-by: trujillo-adam <[email protected]>

* [NET-4103] ci: build s390x (#18067)

* ci: build s390x

* ci: test s390x

* ci: dev build s390x

* no GOOS

* ent only

* build: publish s390x

* fix syntax error

* fix syntax error again

* fix syntax error again x2

* test branch

* Move s390x conditionals to step level

* remove test branch

---------

Co-authored-by: emilymianeil <[email protected]>

* :ermahgerd "Sevice Mesh" -> "Service Mesh" (#18116)

Just a typo in the docs.

* Split pbmesh.UpstreamsConfiguration as a resource out of pbmesh.Upstreams (#17991)

Configuration that previously was inlined into the Upstreams resource
applies to both explicit and implicit upstreams and so it makes sense to
split it out into its own resource.

It also has other minor changes:
- Renames `proxy.proto` proxy_configuration.proto`
- Changes the type of `Upstream.destination_ref` from `pbresource.ID` to
`pbresource.Reference`
- Adds comments to fields that didn't have them

* [NET-4895] ci - api tests and consul container tests error because of dependency bugs with go 1.20.6.  Pin go to 1.20.5. (#18124)

### Description
The following jobs started failing when go 1.20.6 was released:
- `go-test-api-1-19`
- `go-test-api-1-20`
- `compatibility-integration-tests`
- `upgrade-integration-tests`

`compatibility-integration-tests` and `compatibility-integration-tests`
to this testcontainers issue:
https://github.com/testcontainers/testcontainers-go/issues/1359. This
issue calls for testcontainers to release a new version when one of
their dependencies is fixed. When that is done, we will unpin the go
versions in `compatibility-integration-tests` and
`compatibility-integration-tests`.

### Testing & Reproduction steps

See these jobs broken in CI and then see them work with this PR.

---------

Co-authored-by: Chris Thain <[email protected]>

* Add ingress gateway deprecation notices to docs (#18102)

### Description

This adds notices, that ingress gateway is deprecated, to several places
in the product docs where ingress gateway is the topic.

### Testing & Reproduction steps

Tested with a local copy of the website.

### Links

Deprecation of ingress gateway was announced in the Release Notes for
Consul 1.16 and Consul-K8s 1.2. See:

[https://developer.hashicorp.com/consul/docs/release-notes/consul/v1_16_x#what-s-deprecated](https://developer.hashicorp.com/consul/docs/release-notes/consul/v1_16_x#what-s-deprecated
)

[https://developer.hashicorp.com/consul/docs/release-notes/consul-k8s/v1_2_x#what-s-deprecated](https://developer.hashicorp.com/consul/docs/release-notes/consul-k8s/v1_2_x#what-s-deprecated)

### PR Checklist

* [N/A] updated test coverage
* [X] external facing docs updated
* [X] appropriate backport labels added
* [X] not a security concern

---------

Co-authored-by: trujillo-adam <[email protected]>

* Add docs for jwt cluster configuration (#18004)

### Description

<!-- Please describe why you're making this change, in plain English.
-->

- Add jwt-provider docs for jwks cluster configuration. The
configuration was added here:
https://github.com/hashicorp/consul/pull/17978

* Docs: fix unmatched bracket for health checks page (#18134)

* NET-4657/add resource service client (#18053)

### Description

<!-- Please describe why you're making this change, in plain English.
-->
Dan had already started on this
[task](https://github.com/hashicorp/consul/pull/17849) which is needed
to start building the HTTP APIs. This just needed some cleanup to get it
ready for review.

Overview:

- Rename `internalResourceServiceClient` to
`insecureResourceServiceClient` for name consistency
- Configure a `secureResourceServiceClient` with auth enabled

### PR Checklist

* [ ] ~updated test coverage~
* [ ] ~external facing docs updated~
* [x] appropriate backport labels added
* [ ] ~not a security concern~

* Fix bug with Vault CA provider (#18112)

Updating RootPKIPath but not IntermediatePKIPath would not update 
leaf signing certs with the new root. Unsure if this happens in practice 
but manual testing showed it is a bug that would break mesh and agent 
connections once the old root is pruned.

* [NET-4897] net/http host header is now verified and request.host that contains socked now error (#18129)

### Description

This is related to https://github.com/hashicorp/consul/pull/18124 where
we pinned the go versions in CI to 1.20.5 and 1.19.10.

go 1.20.6 and 1.19.11 now validate request host headers for validity,
including the hostname cannot be prefixed with slashes.

For local communications (npipe://, unix://), the hostname is not used,
but we need valid and meaningful hostname. Prior versions go Go would
clean the host header, and strip slashes in the process, but go1.20.6
and go1.19.11 no longer do, and reject the host header. Around the
community we are seeing that others are intercepting the req.host and if
it starts with a slash or ends with .sock, they changing the host to
localhost or another dummy value.

[client: define a "dummy" hostname to use for local connections by
thaJeztah · Pull Request #45942 ·
moby/moby](https://github.com/moby/moby/pull/45942)

### Testing & Reproduction steps

Check CI tests.

### Links
* [ ] updated test coverage
* [ ] external facing docs updated
* [ ] appropriate backport labels added
* [ ] not a security concern

* add a conditional around setting LANFilter.AllSegments to make sure it is valid (#18139)

### Description

This is to correct a code problem because this assumes all segments, but
when you get to Enterprise, you can be in partition that is not the
default partition, in which case specifying all segments does not
validate and fails. This is to correct the setting of this filter with
`AllSegments` to `true` to only occur when in the the `default`
partition.

### Testing & Reproduction steps

<!--

* In the case of bugs, describe how to replicate
* If any manual tests were done, document the steps and the conditions
to replicate
* Call out any important/ relevant unit tests, e2e tests or integration
tests you have added or are adding

-->

### Links

<!--

Include any links here that might be helpful for people reviewing your
PR (Tickets, GH issues, API docs, external benchmarks, tools docs, etc).
If there are none, feel free to delete this section.

Please be mindful not to leak any customer or confidential information.
HashiCorp employees may want to use our internal URL shortener to
obfuscate links.

-->

### PR Checklist

* [ ] updated test coverage
* [ ] external facing docs updated
* [ ] appropriate backport labels added
* [ ] not a security concern

* chore: bump upgrade integrations tests to 1.15, 116 [NET-4743] (#18130)

* re org resource type registry (#18133)

* fix: update delegateMock used in ENT (#18149)

### Description

<!-- Please describe why you're making this change, in plain English.
-->
The mock is used in `http_ent_test` file which caused lint failures. For
OSS->ENT parity adding the same change here.

### Links

<!--

Include any links here that might be helpful for people reviewing your
PR (Tickets, GH issues, API docs, external benchmarks, tools docs, etc).
If there are none, feel free to delete this section.

Please be mindful not to leak any customer or confidential information.
HashiCorp employees may want to use our internal URL shortener to
obfuscate links.

-->

Identified in OSS->ENT [merge
PR](https://github.com/hashicorp/consul-enterprise/pull/6328)

### PR Checklist

* [ ] ~updated test coverage~
* [ ] ~external facing docs updated~
* [x] appropriate backport labels added
* [ ] ~not a security concern~

* Use JWT-auth filter in metadata mode & Delegate validation to RBAC filter (#18062)

### Description

<!-- Please describe why you're making this change, in plain English.
-->

- Currently the jwt-auth filter doesn't take into account the service
identity when validating jwt-auth, it only takes into account the path
and jwt provider during validation. This causes issues when multiple
source intentions restrict access to an endpoint with different JWT
providers.
- To fix these issues, rather than use the JWT auth filter for
validation, we use it in metadata mode and allow it to forward the
successful validated JWT token payload to the RBAC filter which will
make the decisions.

This PR ensures requests with and without JWT tokens successfully go
through the jwt-authn filter. The filter however only forwards the data
for successful/valid tokens. On the RBAC filter level, we check the
payload for claims and token issuer + existing rbac rules.

### Testing & Reproduction steps

<!--

* In the case of bugs, describe how to replicate
* If any manual tests were done, document the steps and the conditions
to replicate
* Call out any important/ relevant unit tests, e2e tests or integration
tests you have added or are adding

-->

- This test covers a multi level jwt requirements (requirements at top
level and permissions level). It also assumes you have envoy running,
you have a redis and a sidecar proxy service registered, and have a way
to generate jwks with jwt. I mostly use:
https://www.scottbrady91.com/tools/jwt for this.

- first write your proxy defaults
```
Kind = "proxy-defaults"
name = "global"
config {
  protocol = "http"
}
```
- Create two providers 
```
Kind = "jwt-provider"
Name = "auth0"
Issuer = "https://ronald.local"

JSONWebKeySet = {
    Local = {
     JWKS = "eyJrZXlzIjog....."
    }
}
```

```
Kind = "jwt-provider"
Name = "okta"
Issuer = "https://ronald.local"

JSONWebKeySet = {
   Local = {
     JWKS = "eyJrZXlzIjogW3...."
    }
}
```

- add a service intention
```
Kind = "service-intentions"
Name = "redis"

JWT = {
  Providers = [
    {
      Name = "okta"
    },
  ]
}

Sources = [
  {
    Name = "*"
    Permissions = [{
      Action = "allow"
      HTTP = {
        PathPrefix = "/workspace"
      }
      JWT = {
        Providers = [
          {
            Name = "okta"
            VerifyClaims = [
              {
                  Path = ["aud"]
                  Value = "my_client_app"
              },
              {
                Path = ["sub"]
                Value = "5be86359073c434bad2da3932222dabe"
              }
            ]
          },
        ]
      }

    },
    {
      Action = "allow"
      HTTP = {
        PathPrefix = "/"
      }
      JWT = {
        Providers = [
          {
            Name = "auth0"
          },
        ]
      }

    }]
  }
]
```
- generate 3 jwt tokens: 1 from auth0 jwks, 1 from okta jwks with
different claims than `/workspace` expects and 1 with correct claims
- connect to your envoy (change service and address as needed) to view
logs and potential errors. You can add: `-- --log-level debug` to see
what data is being forwarded
```
consul connect envoy -sidecar-for redis1 -grpc-addr 127.0.0.1:8502
```
- Make the following requests: 
```
curl -s -H "Authorization: Bearer $Auth0_TOKEN" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v

RBAC filter denied

curl -s -H "Authorization: Bearer $Okta_TOKEN_with_wrong_claims" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v

RBAC filter denied

curl -s -H "Authorization: Bearer $Okta_TOKEN_with_correct_claims" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v

Successful request
```


### TODO

* [x] Update test coverage
* [ ] update integration tests (follow-up PR)
* [x] appropriate backport labels added

* Support Consul Connect Envoy Command on Windows (#17694)

### Description

Add support for consul connect envoy command on windows. This PR fixes
the comments of PR - https://github.com/hashicorp/consul/pull/15114

### Testing
* Built consul.exe from this branch on windows and hosted here - [AWS
S3](https://asheshvidyut-bucket.s3.ap-southeast-2.amazonaws.com/consul.zip)
* Updated the
[tutorial](https://developer.hashicorp.com/consul/tutorials/developer-mesh/consul-windows-workloads)
and changed the `consul_url.default` value to [AWS
S3](https://asheshvidyut-bucket.s3.ap-southeast-2.amazonaws.com/consul.zip)
* Followed the steps in the tutorial and verified that everything is
working as described.

### PR Checklist

* [x] updated test coverage
* [ ] external facing docs updated
* [x] appropriate backport labels added
* [x] not a security concern

---------

Co-authored-by: Franco Bruno Lavayen <[email protected]>
Co-authored-by: Jose Ignacio Lorenzo <[email protected]>
Co-authored-by: Jose Ignacio Lorenzo <[email protected]>
Co-authored-by: Dhia Ayachi <[email protected]>

* Change docs to say 168h instead of 7d for server_rejoin_age_max (#18154)

### Description

Addresses
https://github.com/hashicorp/consul/pull/17171#issuecomment-1636930705

* [OSS] test: improve xDS listener code coverage (#18138)

test: improve xDS listener code coverage

* Re-order expected/actual for assertContainerState in consul container tests (#18157)

Re-order expected/actual, consul container tests

* group and document make file (#17943)

* group and document make file

* Add `testing/deployer` (neé `consul-topology`) [NET-4610] (#17823)

Co-authored-by: R.B. Boyer <[email protected]>
Co-authored-by: R.B. Boyer <[email protected]>
Co-authored-by: Freddy <[email protected]>

* [NET-4792] Add integrations tests for jwt-auth (#18169)

* Add FIPS reference to consul enterprise docs (#18028)

* Add FIPS reference to consul enterprise docs

* Update website/content/docs/enterprise/index.mdx

Co-authored-by: David Yu <[email protected]>

* remove support for ecs client (fips)

---------

Co-authored-by: David Yu <[email protected]>

* add peering_commontopo tests [NET-3700] (#17951)

Co-authored-by: R.B. Boyer <[email protected]>
Co-authored-by: R.B. Boyer <[email protected]>
Co-authored-by: Freddy <[email protected]>
Co-authored-by: NiniOak <[email protected]>

* docs - remove Sentinel from enterprise features list (#18176)

* Update index.mdx
* Update kv.mdx
* Update docs-nav-data.json
* delete sentinel.mdx
* Update redirects.js

---------

Co-authored-by: Tu Nguyen <[email protected]>

* [NET-4865] Bump golang.org/x/net to 0.12.0 (#18186)

Bump golang.org/x/net to 0.12.0

While not necessary to directly address CVE-2023-29406 (which should be
handled by using a patched version of Go when building), an
accompanying change to HTTP/2 error handling does impact agent code.

See https://go-review.googlesource.com/c/net/+/506995 for the HTTP/2
change.

Bump this dependency across our submodules as well for the sake of
potential indirect consumers of `x/net/http`.

* Call resource mutate hook before validate hook (NET-4907) (#18178)

* [NET-4865] security: Update Go version to 1.20.6 (#18190)

Update Go version to 1.20.6

This resolves [CVE-2023-29406]
(https://nvd.nist.gov/vuln/detail/CVE-2023-29406) for uses of the
`net/http` standard library.

Note that until the follow-up to #18124 is done, the version of Go used
in those impacted tests will need to remain on 1.20.5.

* Improve XDS test coverage: JWT auth edition (#18183)

* Improve XDS test coverage: JWT auth edition

more tests

* test: xds coverage for jwt listeners

---------

Co-authored-by: DanStough <[email protected]>

* update readme.md (#18191)

u[date readme.md

* Update submodules to latest following 1.16.0 (#18197)

Align all our internal use of submodules on the latest versions.

* SEC-090: Automated trusted workflow pinning (2023-07-18) (#18174)

Result of tsccr-helper -log-level=info -pin-all-workflows .

Co-authored-by: hashicorp-tsccr[bot] <hashicorp-tsccr[bot]@users.noreply.github.com>

* Fix Backport Assistant PR commenting (#18200)

* Fix Backport Assistant failure PR commenting

For general comments on a PR, it looks like you have to use the `/issue`
endpoint rather than `/pulls`, which requires commit/other
review-specific target details.

This matches the endpoint used in `backport-reminder.yml`.

* Remove Backport Reminder workflow

This is noisy (even when adding multiple labels, individual comments per
label are generated), and likely no longer needed: we haven't had this
work in a long time due to an expired GH token, and we now have better
automation for backport PR assignment.

* resource: Pass resource to Write ACL hook instead of just resource Id [NET-4908] (#18192)

* Explicitly enable WebSocket upgrades (#18150)

This PR explicitly enables WebSocket upgrades in Envoy's UpgradeConfig for all
proxy types. (API Gateway, Ingress, and Sidecar.)

Fixes #8283

* docs: fix the description of client rpc (#18206)

* NET-4804: Add dashboard for monitoring consul-k8s (#18208)

* [OSS] Improve xDS Code Coverage - Clusters  (#18165)

test: improve xDS cluster code coverage

* NET-4222 take config file consul container (#18218)

Net 4222 take config file consul container

* Envoy Integration Test Windows (#18007)

* [CONSUL-395] Update check_hostport and Usage (#40)

* [CONSUL-397] Copy envoy binary from Image (#41)

* [CONSUL-382] Support openssl in unique test dockerfile (#43)

* [CONSUL-405] Add bats to single container (#44)

* [CONSUL-414] Run Prometheus Test Cases and Validate Changes (#46)

* [CONSUL-410] Run Jaeger in Single container (#45)

* [CONSUL-412] Run test-sds-server in single container (#48)

* [CONSUL-408] Clean containers (#47)

* [CONSUL-384] Rebase and sync fork (#50)

* [CONSUL-415] Create Scenarios Troubleshooting Docs (#49)

* [CONSUL-417] Update Docs Single Container (#51)

* [CONSUL-428] Add Socat to single container (#54)

* [CONSUL-424] Replace pkill in kill_envoy function (#52)

* [CONSUL-434] Modify Docker run functions in Helper script (#53)

* [CONSUL-435] Replace docker run in set_ttl_check_state & wait_for_agent_service_register functions (#55)

* [CONSUL-438] Add netcat (nc) in the Single container Dockerfile (#56)

* [CONSUL-429] Replace Docker run with Docker exec (#57)

* [CONSUL-436] Curl timeout and run tests (#58)

* [CONSUL-443] Create dogstatsd Function (#59)

* [CONSUL-431] Update Docs Netcat (#60)

* [CONSUL-439] Parse nc Command in function (#61)

* [CONSUL-463] Review curl Exec and get_ca_root Func (#63)

* [CONSUL-453] Docker hostname in Helper functions (#64)

* [CONSUL-461] Test wipe volumes without extra cont (#66)

* [CONSUL-454] Check ports in the Server and Agent containers (#65)

* [CONSUL-441] Update windows dockerfile with version (#62)

* [CONSUL-466] Review case-grpc Failing Test (#67)

* [CONSUL-494] Review case-cfg-resolver-svc-failover (#68)

* [CONSUL-496] Replace docker_wget & docker_curl (#69)

* [CONSUL-499] Cleanup Scripts - Remove nanoserver (#70)

* [CONSUL-500] Update Troubleshooting Docs (#72)

* [CONSUL-502] Pull & Tag Envoy Windows Image (#73)

* [CONSUL-504] Replace docker run in docker_consul (#76)

* [CONSUL-505] Change admin_bind

* [CONSUL-399] Update envoy to 1.23.1 (#78)

* [CONSUL-510] Support case-wanfed-gw on Windows (#79)

* [CONSUL-506] Update troubleshooting Documentation (#80)

* [CONSUL-512] Review debug_dump_volumes Function (#81)

* [CONSUL-514] Add zipkin to Docker Image (#82)

* [CONSUL-515] Update Documentation (#83)

* [CONSUL-529] Support case-consul-exec (#86)

* [CONSUL-530] Update Documentation (#87)

* [CONSUL-530] Update default consul version 1.13.3

* [CONSUL-539] Cleanup (#91)

* [CONSUL-546] Scripts Clean-up (#92)

* [CONSUL-491] Support admin_access_log_path value for Windows (#71)

* [CONSUL-519] Implement mkfifo Alternative (#84)

* [CONSUL-542] Create OS Specific Files for Envoy Package (#88)

* [CONSUL-543] Create exec_supported.go (#89)

* [CONSUL-544] Test and Build Changes (#90)

* Implement os.DevNull

* using mmap instead of disk files

* fix import in exec-unix

* fix nmap open too many arguemtn

* go fmt on file

* changelog file

* fix go mod

* Update .changelog/17694.txt

Co-authored-by: Dhia Ayachi <[email protected]>

* different mmap library

* fix bootstrap json

* some fixes

* chocolatey version fix and image fix

* using different library

* fix Map funciton call

* fix mmap call

* fix tcp dump

* fix tcp dump

* windows tcp dump

* Fix docker run

* fix tests

* fix go mod

* fix version 16.0

* fix version

* fix version dev

* sleep to debug

* fix sleep

* fix permission issue

* fix permission issue

* fix permission issue

* fix command

* fix command

* fix funciton

* fix assert config entry status command not found

* fix command not found assert_cert_has_cn

* fix command not found assert_upstream_missing

* fix command not found assert_upstream_missing_once

* fix command not found get_upstream_endpoint

* fix command not found get_envoy_public_listener_once

* fix command not found

* fix test cases

* windows integration test workflow github

* made code similar to unix using npipe

* fix go.mod

* fix dialing of npipe

* dont wait

* check size of written json

* fix undefined n

* running

* fix dep

* fix syntax error

* fix workflow file

* windows runner

* fix runner

* fix from json

* fix runs on

* merge connect envoy

* fix cin path

* build

* fix file name

* fix file name

* fix dev build

* remove unwanted code

* fix upload

* fix bin name

* fix path

* checkout current branch

* fix path

* fix tests

* fix shell bash for windows sh files

* fix permission of run-test.sh

* removed docker dev

* added shell bash for tests

* fix tag

* fix win=true

* fix cd

* added dev

* fix variable undefined

* removed failing tests

* fix tcp dump image

* fix curl

* fix curl

* tcp dump path

* fix tcpdump path

* fix curl

* fix curl install

* stop removing intermediate containers

* fix tcpdump docker image

* revert -rm

* --rm=false

* makeing docker image before

* fix tcpdump

* removed case consul exec

* removed terminating gateway simple

* comment case wasm

* removed data dog

* comment out upload coverage

* uncomment case-consul-exec

* comment case consul exec

* if always

* logs

* using consul 1.17.0

* fix quotes

* revert quotes

* redirect to dev null

* Revert version

* revert consul connect

* fix version

* removed envoy connect

* not using function

* change log

* docker logs

* fix logs

* restructure bad authz

* rmeoved dev null

* output

* fix file descriptor

* fix cacert

* fix cacert

* fix ca cert

* cacert does not work in windows curl

* fix func

* removed docker logs

* added sleep

* fix tls

* commented case-consul-exec

* removed echo

* retry docker consul

* fix upload bin

* uncomment consul exec

* copying consul.exe to docker image

* copy fix

* fix paths

* fix path

* github workspace path

* latest version

* Revert "latest version"

This reverts commit 5a7d7b82d9e7553bcb01b02557ec8969f9deba1d.

* commented consul exec

* added ssl revoke best effort

* revert best effort

* removed unused files

* rename var name and change dir

* windows runner

* permission

* needs setup fix

* swtich to github runner

* fix file path

* fix path

* fix path

* fix path

* fix path

* fix path

* fix build paths

* fix tag

* nightly runs

* added matrix in github workflow, renamed files

* fix job

* fix matrix

* removed brackes

* from json

* without using job matrix

* fix quotes

* revert job matrix

* fix workflow

* fix comment

* added comment

* nightly runs

* removed datadog ci as it is already measured in linux one

* running test

* Revert "running test"

This reverts commit 7013d15a23732179d18ec5d17336e16b26fab5d4.

* pr comment fixes

* running test now

* running subset of test

* running subset of test

* job matrix

* shell bash

* removed bash shell

* linux machine for job matrix

* fix output

* added cat to debug

* using ubuntu latest

* fix job matrix

* fix win true

* fix go test

* revert job matrix

---------

Co-authored-by: Jose Ignacio Lorenzo <[email protected]>
Co-authored-by: Franco Bruno Lavayen <[email protected]>
Co-authored-by: Ivan K Berlot <[email protected]>
Co-authored-by: Ezequiel Fernández Ponce <[email protected]>
Co-authored-by: joselo85 <[email protected]>
Co-authored-by: Ezequiel Fernández Ponce <[email protected]>
Co-authored-by: Dhia Ayachi <[email protected]>

* fix typos and update ecs compat table (#18215)

* fix typos and update ecs compat table

* real info for the ecs compat matrix table

* Update website/content/docs/ecs/compatibility.mdx

Co-authored-by: Chris Thain <[email protected]>

---------

Co-authored-by: Chris Thain <[email protected]>

* [OSS] proxystate: add proxystate protos (#18216)

* proxystate: add proxystate protos to pbmesh and resolve imports and conflicts between message names

* ci: don't verify s390x (#18224)

* [CC-5718] Remove HCP token requirement during bootstrap (#18140)

* [CC-5718] Remove HCP token requirement during bootstrap

* Re-add error for loading HCP management token

* Remove old comment

* Add changelog entry

* Remove extra validation line

* Apply suggestions from code review

Co-authored-by: lornasong <[email protected]>

---------

Co-authored-by: lornasong <[email protected]>

* [NET-4122] Doc guidance for federation with externalServers (#18207)

Doc guidance for federation with externalServers

Add guidance for proper configuration when joining to a secondary
cluster using WAN fed with external servers also enabled.

Also clarify federation requirements and fix formatting for an
unrelated value.

Update both the Helm chart reference (synced from `consul-k8s`, see
hashicorp/consul-k8s#2583) and the docs on using `externalServers`.

* [OSS] Improve xDS Code Coverage - Endpoints and Misc (#18222)

test: improve xDS endpoints code coverage

* Clarify license reporting timing and GDPR compliance (#18237)

Add Alicia's edits to clarify log timing and other details

* Fix Github Workflow File (#18241)

* [CONSUL-382] Support openssl in unique test dockerfile (#43)

* [CONSUL-405] Add bats to single container (#44)

* [CONSUL-414] Run Prometheus Test Cases and Validate Changes (#46)

* [CONSUL-410] Run Jaeger in Single container (#45)

* [CONSUL-412] Run test-sds-server in single container (#48)

* [CONSUL-408] Clean containers (#47)

* [CONSUL-384] Rebase and sync fork (#50)

* [CONSUL-415] Create Scenarios Troubleshooting Docs (#49)

* [CONSUL-417] Update Docs Single Container (#51)

* [CONSUL-428] Add Socat to single container (#54)

* [CONSUL-424] Replace pkill in kill_envoy function (#52)

* [CONSUL-434] Modify Docker run functions in Helper script (#53)

* [CONSUL-435] Replace docker run in set_ttl_check_state & wait_for_agent_service_register functions (#55)

* [CONSUL-438] Add netcat (nc) in the Single container Dockerfile (#56)

* [CONSUL-429] Replace Docker run with Docker exec (#57)

* [CONSUL-436] Curl timeout and run tests (#58)

* [CONSUL-443] Create dogstatsd Function (#59)

* [CONSUL-431] Update Docs Netcat (#60)

* [CONSUL-439] Parse nc Command in function (#61)

* [CONSUL-463] Review curl Exec and get_ca_root Func (#63)

* [CONSUL-453] Docker hostname in Helper functions (#64)

* [CONSUL-461] Test wipe volumes without extra cont (#66)

* [CONSUL-454] Check ports in the Server and Agent containers (#65)

* [CONSUL-441] Update windows dockerfile with version (#62)

* [CONSUL-466] Review case-grpc Failing Test (#67)

* [CONSUL-494] Review case-cfg-resolver-svc-failover (#68)

* [CONSUL-496] Replace docker_wget & docker_curl (#69)

* [CONSUL-499] Cleanup Scripts - Remove nanoserver (#70)

* [CONSUL-500] Update Troubleshooting Docs (#72)

* [CONSUL-502] Pull & Tag Envoy Windows Image (#73)

* [CONSUL-504] Replace docker run in docker_consul (#76)

* [CONSUL-505] Change admin_bind

* [CONSUL-399] Update envoy to 1.23.1 (#78)

* [CONSUL-510] Support case-wanfed-gw on Windows (#79)

* [CONSUL-506] Update troubleshooting Documentation (#80)

* [CONSUL-512] Review debug_dump_volumes Function (#81)

* [CONSUL-514] Add zipkin to Docker Image (#82)

* [CONSUL-515] Update Documentation (#83)

* [CONSUL-529] Support case-consul-exec (#86)

* [CONSUL-530] Update Documentation (#87)

* [CONSUL-530] Update default consul version 1.13.3

* [CONSUL-539] Cleanup (#91)

* [CONSUL-546] Scripts Clean-up (#92)

* [CONSUL-491] Support admin_access_log_path value for Windows (#71)

* [CONSUL-519] Implement mkfifo Alternative (#84)

* [CONSUL-542] Create OS Specific Files for Envoy Package (#88)

* [CONSUL-543] Create exec_supported.go (#89)

* [CONSUL-544] Test and Build Changes (#90)

* Implement os.DevNull

* using mmap instead of disk files

* fix import in exec-unix

* fix nmap open too many arguemtn

* go fmt on file

* changelog file

* fix go mod

* Update .changelog/17694.txt

Co-authored-by: Dhia Ayachi <[email protected]>

* different mmap library

* fix bootstrap json

* some fixes

* chocolatey version fix and image fix

* using different library

* fix Map funciton call

* fix mmap call

* fix tcp dump

* fix tcp dump

* windows tcp dump

* Fix docker run

* fix tests

* fix go mod

* fix version 16.0

* fix version

* fix version dev

* sleep to debug

* fix sleep

* fix permission issue

* fix permission issue

* fix permission issue

* fix command

* fix command

* fix funciton

* fix assert config entry status command not found

* fix command not found assert_cert_has_cn

* fix command not found assert_upstream_missing

* fix command not found assert_upstream_missing_once

* fix command not found get_upstream_endpoint

* fix command not found get_envoy_public_listener_once

* fix command not found

* fix test cases

* windows integration test workflow github

* made code similar to unix using npipe

* fix go.mod

* fix dialing of npipe

* dont wait

* check size of written json

* fix undefined n

* running

* fix dep

* fix syntax error

* fix workflow file

* windows runner

* fix runner

* fix from json

* fix runs on

* merge connect envoy

* fix cin path

* build

* fix file name

* fix file name

* fix dev build

* remove unwanted code

* fix upload

* fix bin name

* fix path

* checkout current branch

* fix path

* fix tests

* fix shell bash for windows sh files

* fix permission of run-test.sh

* removed docker dev

* added shell bash for tests

* fix tag

* fix win=true

* fix cd

* added dev

* fix variable undefined

* removed failing tests

* fix tcp dump image

* fix curl

* fix curl

* tcp dump path

* fix tcpdump path

* fix curl

* fix curl install

* stop removing intermediate containers

* fix tcpdump docker image

* revert -rm

* --rm=false

* makeing docker image before

* fix tcpdump

* removed case consul exec

* removed terminating gateway simple

* comment case wasm

* removed data dog

* comment out upload coverage

* uncomment case-consul-exec

* comment case consul exec

* if always

* logs

* using consul 1.17.0

* fix quotes

* revert quotes

* redirect to dev null

* Revert version

* revert consul connect

* fix version

* removed envoy connect

* not using function

* change log

* docker logs

* fix logs

* restructure bad authz

* rmeoved dev null

* output

* fix file descriptor

* fix cacert

* fix cacert

* fix ca cert

* cacert does not work in windows curl

* fix func

* removed docker logs

* added sleep

* fix tls

* commented case-consul-exec

* removed echo

* retry docker consul

* fix upload bin

* uncomment consul exec

* copying consul.exe to docker image

* copy fix

* fix paths

* fix path

* github workspace path

* latest version

* Revert "latest version"

This reverts commit 5a7d7b82d9e7553bcb01b02557ec8969f9deba1d.

* commented consul exec

* added ssl revoke best effort

* revert best effort

* removed unused files

* rename var name and change dir

* windows runner

* permission

* needs setup fix

* swtich to github runner

* fix file path

* fix path

* fix path

* fix path

* fix path

* fix path

* fix build paths

* fix tag

* nightly runs

* added matrix in github workflow, renamed files

* fix job

* fix matrix

* removed brackes

* from json

* without using job matrix

* fix quotes

* revert job matrix

* fix workflow

* fix comment

* added comment

* nightly runs

* removed datadog ci as it is already measured in linux one

* running test

* Revert "running test"

This reverts commit 7013d15a23732179d18ec5d17336e16b26fab5d4.

* pr comment fixes

* running test now

* running subset of test

* running subset of test

* job matrix

* shell bash

* removed bash shell

* linux machine for job matrix

* fix output

* added cat to debug

* using ubuntu latest

* fix job matrix

* fix win true

* fix go test

* revert job matrix

* Fix tests

---------

Co-authored-by: Ivan K Berlot <[email protected]>
Co-authored-by: Jose Ignacio Lorenzo <[email protected]>
Co-authored-by: Franco Bruno Lavayen <[email protected]>
Co-authored-by: Ezequiel Fernández Ponce <[email protected]>
Co-authored-by: joselo85 <[email protected]>
Co-authored-by: Ezequiel Fernández Ponce <[email protected]>
Co-authored-by: Dhia Ayachi <[email protected]>

* NET-4996 - filter go-tests and test-integration workflows from running on docs only and ui only changes (#18236)

* Align build arch matrix with enterprise (#18235)

Ensure that OSS remains in sync w/ Enterprise by aligning the format of
arch matrix args for various build jobs.

* Revert "NET-4996 - filter go-tests and test-integration workflows from running on docs only and ui only changes" (#18248)

Revert "NET-4996 - filter go-tests and test-integration workflows from running on docs only and ui only changes (#18236)"

This reverts commit a11dba710e6ce6f172c0fa6c9b61567cc1efffc8.

* resource: Add scope to resource type registration [NET-4976] (#18214)

Enables querying a resource type's registration to determine if a resource is cluster, partition, or partition and namespace scoped.

* Fix some inconsistencies in jwt docs (#18234)

* NET-1825: More new ACL token creation docs (#18063)

Co-authored-by: trujillo-adam <[email protected]>

* grafana: add the panel resource usage of connect injector (#18247)

* [NET-3700] Backfill changelog entry for c2bbe67 and 7402d06 (#18259)

Backfill changelog entry for c2bbe67 and 7402d06

Add a changelog entry for the follow-up PR since it was specific to the
fix and references the original change.

* NET-4897 - update comment to include the current issue url from the go team. (#18263)

* fix typos, style, and improper links (#18269)

* member cli: add -filter expression to flags (#18223)

* member cli: add -filter expression to flags

* changelog

* update doc

* Add test cases

* use quote

* go-tests: disable s390x (#18273)

* docs: Update ext-authz documentation for kubernetes (#18281)

Update ext-authz documentation for kubernetes

* docs: Consul on Kubernetes specific upgrade info (#18230)

* Compatibility page - dataplanes mention

* Upgrading higher-level dataplane mention

* `exec=` string callout

* More visible for upgrade page

* Apply suggestions from code review

Co-authored-by: Tu Nguyen <[email protected]>

---------

Co-authored-by: Tu Nguyen <[email protected]>
Co-authored-by: John Murret <[email protected]>

* Fix typo in Envoy extensions doc (#18284)

* docs: K8s secondary DC requirements (#18280)

* Requested edit

* Apply suggestions from code review

Co-authored-by: trujillo-adam <[email protected]>

---------

Co-authored-by: trujillo-adam <[email protected]>

* api-gateway: subscribe to bound-api-gateway only after receiving api-gateway (#18291)

* api-gateway: subscribe to bound-api-gateway only after receiving api-gateway

This fixes a race condition due to our dependency on having the listener(s) from the api-gateway config entry in order to fully and properly process the resources on the bound-api-gateway config entry.

* Apply suggestions from code review

* Add changelog entry

* Update K8s changelog to address cloud auto-join change in 1.0.0 (#18293)

* Update list of Envoy versions (#18300)

Update supported envoy versions to 1.24.10, 1.25.9, 1.26.4, 1.27.0.

* [NET-4904] Update list of Envoy versions in docs (#18306)

Update list of Envoy versions in docs

Update supported Envoy versions across Consul release versions.

* Update actions for TSCCR (#18317)

Update action versions before deadline

* Fix topology view when displaying mixed connect-native/normal services. (#13023)

* Fix topoloy intention with mixed connect-native/normal services.

If a service is registered twice, once with connect-native and once
without, the topology views would prune the existing intentions. This
change brings the code more in line with the transparent proxy behavior.

* Dedupe nodes in the ServiceTopology ui endpoint (like done with tags).

* Consider a service connect-native as soon as one instance is.

* Stop JWT provider from being written in non default namespace (#18325)

* docs: Fix some comments (#17118)

Signed-off-by: cui fliter <[email protected]>

* [NET-4703] Prevent partial application of Envoy extensions (#18068)

Prevent partial application of Envoy extensions

Ensure that non-required extensions do not change xDS resources before
exiting on failure by cloning proto messages prior to applying each
extension.

To support this change, also move `CanApply` checks up a layer and make
them prior to attempting extension application, s.t. we avoid
unnecessary copies where extensions can't be applied.

Last, ensure that we do not allow panics from `CanApply` or `Extend`
checks to escape the attempted extension application.

* docs: Simplify example jq commands by removing pipes (#18327)

Simplify jq command examples by removing pipes to other commands.

* fix typo in create a mesh token docs (#18337)

* [CC-5719] Add support for builtin global-read-only policy (#18319)

* [CC-5719] Add support for builtin global-read-only policy

* Add changelog

* Add read-only to docs

* Fix some minor issues.

* Change from ReplaceAll to Sprintf

* Change IsValidPolicy name to return an error instead of bool

* Fix PolicyList test

* Fix other tests

* Apply suggestions from code review

Co-authored-by: Paul Glass <[email protected]>

* Fix state store test for policy list.

* Fix naming issues

* Update acl/validation.go

Co-authored-by: Chris Thain <[email protected]>

* Update agent/consul/acl_endpoint.go

---------

Co-authored-by: Paul Glass <[email protected]>
Co-authored-by: Chris Thain <[email protected]>

* [NET-5121] proxystate: move protos to subdirectory to avoid conflicts (#18335)

* also makes a few protos updates

* resource: adding various helpers for working with resources (#18342)

This is a bit of a grab bag of helpers that I found useful for working with them when authoring substantial Controllers. Subsequent PRs will make use of them.

* Wasm integration tests for local and remote wasm files (#17756)

* wasm integration tests for local and remote wasm files

refactoring and cleanup for wasm testing

remove wasm debug logging

PR feedback, wasm build lock

correct path pattern for wasm build files

Add new helper function to minimize changes to existing test code

Remove extra param

mod tidy

add custom service setup to test lib

add wait until static server sidecar can reach nginx sidecar

Doc comments

PR feedback

Update workflows to compile wasm for integration tests

Fix docker build path

Fix package name for linter

Update makefile, fix redeclared function

Update expected wasm filename

Debug test ls in workflow

remove pwd in favor of relative path

more debugging

Build wasm in compatability tests as well

Build wasm directly in ci rather than in container

Debug tinygo and llvm version

Change wasm file extension

Remove tinygo debugging

Remove extra comments

* Add compiled wasm and build instructions

* [HCP Telemetry] Periodic Refresh for Dynamic Telemetry Configuration (#18168)

* OTElExporter now uses an EndpointProvider to discover the endpoint

* OTELSink uses a ConfigProvider to obtain filters and labels configuration

* improve tests for otel_sink

* Regex logic is moved into client for a method on the TelemetryConfig object

* Create a telemetry_config_provider and update deps to use it

* Fix conversion

* fix import newline

* Add logger to hcp client and move telemetry_config out of the client.go file

* Add a telemetry_config.go to refactor client.go

* Update deps

* update hcp deps test

* Modify telemetry_config_providers

* Check for nil filters

* PR review updates

* Fix comments and move around pieces

* Fix comments

* Remove context from client struct

* Moved ctx out of sink struct and fixed filters, added a test

* Remove named imports, use errors.New if not fformatting

* Remove HCP dependencies in telemetry package

* Add success metric and move lock only to grab the t.cfgHahs

* Update hash

* fix nits

* Create an equals method and add tests

* Improve telemetry_config_provider.go tests

* Add race test

* Add missing godoc

* Remove mock for MetricsClient

* Avoid goroutine test panics

* trying to kick CI lint issues by upgrading mod

* imprve test code and add hasher for testing

* Use structure logging for filters, fix error constants, and default to allow all regex

* removed hashin and modify logic to simplify

* Improve race test and fix PR feedback by removing hash equals and avoid testing the timer.Ticker logic, and instead unit test

* Ran make go-mod-tidy

* Use errtypes in the test

* Add changelog

* add safety check for exporter endpoint

* remove require.Contains by using error types, fix structure logging, and fix success metric typo in exporter

* Fixed race test to have changing config values

* Send success metric before modifying config

* Avoid the defer and move the success metric under

* NET-4240 - Snapshots are failing on Windows  (#18302)

* fix go mod

* fix go sum

* added change log

* ran make go mod tidy

* Register ProxyStateTemplate Resource (#18316)

  Also, change the ProxyState.id to identity. This is because we already have the id of this proxy
  from the resource, and this id should be name-aligned with the workload it represents. It should
  also have the owner ref set to the workload ID if we need that. And so the id field seems unnecessary.
  We do, however, need a reference to workload identity so that we can authorize the proxy when it initially
  connects to the xDS server.

* [NET-5146] security: Update Go version to 1.20.7 and `x/net` to 0.13.0 (#18358)

* Update Go version to 1.20.7

This resolves [CVE-2023-29409]
(https://nvd.nist.gov/vuln/detail/CVE-2023-29409)(`crypto/tls`).

* Bump golang.org/x/net to 0.13.0

Addresses [CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978)
for security scans (non-impacting).

* mesh: adding the protobuf types and resources backing mesh config v2 (#18351)

* [OSS] test: xds coverage for routes (#18369)

test: xds coverage for routes

* Fix policy lookup to allow for slashes (#18347)

* Fix policy lookup to allow for slashes

* Fix suggestions

* Fix other test

* Revert some lines

* add some initial CODEOWNERS (#18346)

* Add redirects for mesh-gateway docs (#18377)

* expose grpc as http endpoint (#18221)

expose resource grpc endpoints as http endpoints

* bimapper: fix a bug and add some more test coverage (#18387)

* [docs] Fix ServiceDefaults example in distributed tracing (#17212)

Fix ServiceDefaults example in distributed tracing.

* Fix #17730 - Dev mode has new line (#18367)

* adding new line only in case of pretty in url not in dev mode

* change log added

* chore: make go-mod-tidy (#18388)

* resource: Make resource read tenancy aware (#18397)

* Not using chmod - fixed integration test for Enterprise (#18401)

* Not using chmod

* checking icacls

* Removed push

* replaced ordered list of rate limit ops with flow diagram (#18398)

* replaced ordered list of rate limit ops with flow diagram

* made diagram font bigger

* updated colors for dark mode img

* fixed typo

* recentered dark mode image

* Apply suggestions from code review

Co-authored-by: Jeff Boruszak <[email protected]>

---------

Co-authored-by: Jeff Boruszak <[email protected]>

* Upgrade test: remove outdated test and disable log due to verbosity (#18403)

* remove outdated test

* disable log since we have too many parallel tests

* bump testcontainers-go from 0.22.0 and remove pinned go version in in… (#18395)

* bump testcontainers-go from 0.22.0 and remove pinned go version in integ test

* go mod tidy

* Replace deprecated target.Authority with target.URL.Host

* Add ServiceEndpoints Mutation hook tests (#18404)

* Add ServiceEndpoints Mutation hook tests

* Move endpoint owner validation into the validation hook

Also there were some minor changes to error validation to account for go-cmp not liking to peer through an errors.errorstring type that get created by errors.New

* catalog: add FailoverPolicy mutation and validation hooks (#18390)

Add most of the validation and mutation hooks for the FailoverPolicy resource.

* NET-5115 Add retry + timeout filters for api-gateway (#18324)

* squash, implement retry/timeout in consul core

* update tests

* catalog: adding a controller to reconcile FailoverPolicy resources (#18399)

Add most of the semantic cross-resource validation for FailoverPolicy resources using a new controller.

* fix the error in ent repo (#18421)

fix the error in ent repo

* build: updates for 1.16.1 release (#18415)

* build: updates for 1.16.1 release

* build: fix missing replace directive for envoyextensions

* build: go mod tidy testing/deployer

* update ECS links (#18419)

* docs: fix incorrect proxy-defaults config in Lua Envoy extension (#18418)

fix incorrect proxy-defaults config

* resource: Make resource write tenancy aware (#18423)

* [NET-5217] [OSS] Derive sidecar proxy locality from parent service (#18437)

* Add logging to locality policy application

In OSS, this is currently a no-op.

* Inherit locality when registering sidecars

When sidecar locality is not explicitly configured, inherit locality
from the proxied service.

* NET-4984: Update APIGW Config Entries for JWT Auth (#18366)

* Added oss config entries for Policy and JWT on APIGW

* Updated structs for config entry

* Updated comments, ran deep-copy

* Move JWT configuration into OSS file

* Add in the config entry OSS file for jwts

* Added changelog

* fixing proto spacing

* Moved to using manually written deep copy method

* Use pointers for override/default fields in apigw config entries

* Run gen scripts for changed types

* k8s compat - Openshift versions (#18307)

* Update compatibility.mdx

Co-authored-by: trujillo-adam <[email protected]>

* APIGW: Update HTTPRouteConfigEntry for JWT Auth (#18422)

* Updated httproute config entry for JWT Filters

* Added manual deepcopy method for httproute jwt filter

* Fix test

* Update JWTFilter to be in oss file

* Add changelog

* Add build tags for deepcopy oss file

* [COMPLIANCE] License changes (#18443)

* Adding explicit MPL license for sub-package

This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository.

* Adding explicit MPL license for sub-package

This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository.

* Updating the license from MPL to Business Source License

Going forward, this project will be licensed under the Business Source License v1.1. Please see our blog post for more details at <Blog URL>, FAQ at www.hashicorp.com/licensing-faq, and details of the license at www.hashicorp.com/bsl.

* add missing license headers

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright fi…
absolutelightning added a commit that referenced this pull request Sep 4, 2023
@hc-github-team-consul-core @jmurret
@nvanthao @trujillo-adam @roncodingenthusiast @mr-miles @lkysow @im2nguyen @nathancoleman @natemollica-nm @loshz @jm96441n @beautifulentropy @Ranjandas @hashi-derek @absolutelightning @xwa153 @cthain @boruszak @evanphx @JadhavPoonam @DanStough @karras @jcjones @fulviodenza @krastin @david3a @curtbushko @nfi-hashicorp @t-davies @vijayraghav-io @jkirschner-hashicorp @eddie-rowe @emilymianeil @nv-hashi @ishustava @Jeff-Apple @huikang @cocolavayen @joselo85 @dhiaayachi @rboyer @freddygv @NiniOak @zalimeni @analogue @hashicorp-tsccr @blake @iberlot @ezfepo @ndhanushkodi @jjacobson93 @lornasong @judithpatudith @gautambaghel @apollo13 @cuishuang @johnlanda @Achooo @ilpianista @mkeeler @sarahalsmiller @hashicorp-copywrite @boxofrad @natmegs
Backport of Net 3181 consul gh issue 15709 allow log file naming like…
11bb928 
… nomad - fix bug into release/1.16.x (#18642)

* Changelog - add 1.13.9, 1.14.8, and 1.15.4 (#17889)

* docs: update config enable_debug (#17866)

* update doc for config enable_debug

* Update website/content/docs/agent/config/config-files.mdx

Co-authored-by: trujillo-adam <[email protected]>

---------

Co-authored-by: trujillo-adam <[email protected]>

* Update wording on WAN fed and intermediate_pki_path (#17850)

* Allow service identity tokens the ability to read jwt-providers (#17893)

* Allow service identity tokens the ability to read jwt-providers

* more tests

* service_prefix tests

* Update docs (#17476)

Co-authored-by: trujillo-adam <[email protected]>

* Add emit_tags_as_labels to envoy bootstrap config when using Consul Telemetry Collector (#17888)

* Fix command from kg to kubectl get (#17903)

* Create and update release notes for 1.16 and 1.2 (#17895)

* update release notes for 1.16 and 1.2

* update latest consul core release

* Propose new changes to APIgw upgrade instructions (#17693)

* Propose new changes to APIgw upgrade instructions

* fix build error

* update callouts to render correctly

* Add hideClipboard to log messages

* Added clarification around consul k8s and crds

* Add workflow to verify linux release packages (#17904)

* adding docker files to verify linux packages.

* add verifr-release-linux.yml

* updating name

* pass inputs directly into jobs

* add other linux package platforms

* remove on push

* fix TARGETARCH on debian and ubuntu so it can check arm64 and amd64

* fixing amazon to use the continue line

* add ubuntu i386

* fix comment lines

* working

* remove commented out workflow jobs

* Apply suggestions from code review

Co-authored-by: Nathan Coleman <[email protected]>

* update fedora and ubuntu to use latest tag

---------

Co-authored-by: Nathan Coleman <[email protected]>

* Reference hashicorp/consul instead of consul for Docker image (#17914)

* Reference hashicorp/consul instead of consul for Docker image

* Update Make targets that pull consul directly

* Update Consul K8s Upgrade Doc Updates (#17921)

Updating upgrade procedures to encompass expected errors during upgrade process from v1.13.x to v1.14.x.

* Update sameness-group.mdx (#17915)

* Update create-sameness-groups.mdx (#17927)

* deps: coredns v1.10.1 (#17912)

* Ensure RSA keys are at least 2048 bits in length (#17911)

* Ensure RSA keys are at least 2048 bits in length

* Add changelog

* update key length check for FIPS compliance

* Fix no new variables error and failing to return when error exists from
validating

* clean up code for better readability

* actually return value

* tlsutil: Fix check TLS configuration (#17481)

* tlsutil: Fix check TLS configuration
* Rewording docs.
* Update website/content/docs/services/configuration/checks-configuration-reference.mdx
Co-authored-by: trujillo-adam <[email protected]>
* Fix typos and add changelog entry.
---------

Co-authored-by: trujillo-adam <[email protected]>

* docs: Deprecations for connect-native SDK and specific connect native APIs (#17937)

* Update v1_16_x.mdx
* Update connect native golang page

---------

Co-authored-by: trujillo-adam <[email protected]>

* Revert "Add workflow to verify linux release packages (#17904)" (#17942)

This reverts commit 3368f14fab500ebe9f6aeab5631dd1d5f5a453e5.

* Fixes Secondary ConnectCA update (#17846)

This fixes a bug that was identified which resulted in subsequent
ConnectCA configuration update not to persist in the cluster.

* fixing typo in link to jwt-validations-with-intentions doc (#17955)

* Fix streaming backend link (#17958)

* Fix streaming backend link
* Update health.mdx

* Dynamically create jwks clusters for jwt-providers (#17944)

* website: remove deprecated agent rpc docs (#17962)

* Fix missing BalanceOutboundConnections in v2 catalog. (#17964)

* feature - [NET - 4005]  - [Supportability] Reloadable Configuration - enable_debug (#17565)

* # This is a combination of 9 commits.
# This is the 1st commit message:

init without tests

# This is the commit message #2:

change log

# This is the commit message #3:

fix tests

# This is the commit message #4:

fix tests

# This is the commit message #5:

added tests

# This is the commit message #6:

change log breaking change

# This is the commit message #7:

removed breaking change

# This is the commit message #8:

fix test

# This is the commit message #9:

keeping the test behaviour same

* # This is a combination of 12 commits.
# This is the 1st commit message:

init without tests

# This is the commit message #2:

change log

# This is the commit message #3:

fix tests

# This is the commit message #4:

fix tests

# This is the commit message #5:

added tests

# This is the commit message #6:

change log breaking change

# This is the commit message #7:

removed breaking change

# This is the commit message #8:

fix test

# This is the commit message #9:

keeping the test behaviour same

# This is the commit message #10:

made enable debug atomic bool

# This is the commit message #11:

fix lint

# This is the commit message #12:

fix test true enable debug

* parent 10f500e895d92cc3691ade7b74a33db755d22039
author absolutelightning <[email protected]> 1687352587 +0530
committer absolutelightning <[email protected]> 1687352592 +0530

init without tests

change log

fix tests

fix tests

added tests

change log breaking change

removed breaking change

fix test

keeping the test behaviour same

made enable debug atomic bool

fix lint

fix test true enable debug

using enable debug in agent as atomic bool

test fixes

fix tests

fix tests

added update on correct locaiton

fix tests

fix reloadable config enable debug

fix tests

fix init and acl 403

* revert commit

* Fix formatting codeblocks on APIgw docs (#17970)

* fix formatting codeblocks

* remove unnecessary indents

* Remove POC code (#17974)

* update doc (#17910)

* update doc

* update link

* Remove duplicate and unused newDecodeConfigEntry func (#17979)

* docs: samenessGroup YAML examples (#17984)

* configuration entry syntax

* Example config

* Add changelog entry for 1.16.0 (#17987)

* Fix typo (#17198)

servcies => services

* Expose JWKS cluster config through JWTProviderConfigEntry (#17978)

* Expose JWKS cluster config through JWTProviderConfigEntry

* fix typos, rename trustedCa to trustedCA

* Integration test for ext-authz Envoy extension (#17980)

* Fix incorrect protocol for transparent proxy upstreams. (#17894)

This PR fixes a bug that was introduced in:
https://github.com/hashicorp/consul/pull/16021

A user setting a protocol in proxy-defaults would cause tproxy implicit
upstreams to not honor the upstream service's protocol set in its
`ServiceDefaults.Protocol` field, and would instead always use the
proxy-defaults value.

Due to the fact that upstreams configured with "tcp" can successfully contact
upstream "http" services, this issue was not recognized until recently (a
proxy-defaults with "tcp" and a listening service with "http" would make
successful requests, but not the opposite).

As a temporary work-around, users experiencing this issue can explicitly set
the protocol on the `ServiceDefaults.UpstreamConfig.Overrides`, which should
take precedence.

The fix in this PR removes the proxy-defaults protocol from the wildcard
upstream that tproxy uses to configure implicit upstreams. When the protocol
was included, it would always overwrite the value during discovery chain
compilation, which was not correct. The discovery chain compiler also consumes
proxy defaults to determine the protocol, so simply excluding it from the
wildcard upstream config map resolves the issue.

* feat: include nodes count in operator usage endpoint and cli command (#17939)

* feat: update operator usage api endpoint to include nodes count

* feat: update operator usange cli command to includes nodes count

* [OSS] Improve Gateway Test Coverage of Catalog Health (#18011)

* fix(cli): remove failing check from 'connect envoy' registration for api gateway

* test(integration): add tests to check catalog statsus of gateways on startup

* remove extra sleep comment

* Update test/integration/consul-container/libs/assert/service.go

* changelog

* Fixes Traffic rate limitting docs (#17997)

* Fix removed service-to-service peering links (#17221)

* docs: fix removed service-to-service peering links

* docs: extend peering-via-mesh-gateways intro (thanks @trujillo-adam)

---------

Co-authored-by: trujillo-adam <[email protected]>

* docs: Sameness "beta" warning (#18017)

* Warning updates

* .x

* updated typo in tab heading (#18022)

* updated typo in tab heading

* updated tab group typo, too

* Document that DNS lookups can target cluster peers (#17990)

Static DNS lookups, in addition to explicitly targeting a datacenter,
can target a cluster peer. This was added in 95dc0c7b301b70a6b955a8b7c9737c9b86f03df6 but didn't make the documentation.

The driving function for the change is `parseLocality` here: https://github.com/hashicorp/consul/blob/0b1299c28d8127129d61310ee4280055298438e0/agent/dns_oss.go#L25

The biggest change in this is to adjust the standard lookup syntax to tie
`.<datacenter>` to `.dc` as required-together, and to append in the similar `.<cluster-peer>.peer` optional argument, both to A record and SRV record lookups.

Co-authored-by: David Yu <[email protected]>

* Add first integration test for jwt auth with intention (#18005)

* fix stand-in text for name field (#18030)

* removed sameness conf entry from failover nav (#18033)

* docs - add service sync annotations and k8s service weight annotation (#18032)

* Docs for https://github.com/hashicorp/consul-k8s/pull/2293
* remove versions for enterprise features since they are old

---------

Co-authored-by: Tu Nguyen <[email protected]>

* docs - add jobs use case for service mesh k8s (#18037)

* docs - add jobs use case for service mesh k8s
* add code blocks

* address feedback (#18045)

* Add verify server hostname to tls default (#17155)

* [OSS] Fix initial_fetch_timeout to wait for all xDS resources (#18024)

* fix(connect): set initial_fetch_time to wait indefinitely

* changelog

* PR feedback 1

* ui: fix typos for peer service imports (#17999)

* test: fix FIPS inline cert test message (#18076)

* Fix a couple typos in Agent Telemetry Metrics docs (#18080)

* Fix metrics docs

* Add changelog

Signed-off-by: josh <[email protected]>

---------

Signed-off-by: josh <[email protected]>

* docs updates - cluster peering and virtual services (#18069)

* Update route-to-virtual-services.mdx
* Update establish-peering.mdx

* Update service-mesh-compare.mdx (#17279)

grammar change

* Update helm docs on main (#18085)

* ci: use gotestsum v1.10.1 [NET-4042] (#18088)

* Docs: Update proxy lifecycle annotations and consul-dataplane flags (#18075)

* Update proxy lifecycle annotations and consul-dataplane flags

* Pass configured role name to Vault for AWS auth in Connect CA (#17885)

* Docs for dataplane upgrade on k8s (#18051)

* Docs for dataplane upgrade on k8s

---------

Co-authored-by: David Yu <[email protected]>
Co-authored-by: trujillo-adam <[email protected]>

* docs - update upgrade index page to not recommend consul leave. (#18100)

* Displays Consul version of each nodes in UI nodes section (#17754)

* update UINodes and UINodeInfo response with consul-version info added as NodeMeta, fetched from serf members

* update test cases TestUINodes, TestUINodeInfo

* added nil check for map

* add consul-version in local agent node metadata

* get consul version from serf member and add this as node meta in catalog register request

* updated ui mock response to include consul versions as node meta

* updated ui trans and added version as query param to node list route

* updates in ui templates to display consul version with filter and sorts

* updates in ui - model class, serializers,comparators,predicates for consul version feature

* added change log for Consul Version Feature

* updated to get version from consul service, if for some reason not available from serf

* updated changelog text

* updated dependent testcases

* multiselection version filter

* Update agent/consul/state/catalog.go

comments updated

Co-authored-by: Jared Kirschner <[email protected]>

---------

Co-authored-by: Jared Kirschner <[email protected]>

* api gw 1.16 updates (#18081)

* api gw 1.16 updates

* Apply suggestions from code review

Co-authored-by: Jeff Boruszak <[email protected]>

* update CodeBlockConfig filename

* Apply suggestions from code review

Co-authored-by: trujillo-adam <[email protected]>
Co-authored-by: Jeff Boruszak <[email protected]>

* remove non-standard intentions page

* Update website/content/docs/api-gateway/configuration/index.mdx

Co-authored-by: trujillo-adam <[email protected]>

---------

Co-authored-by: Jeff Boruszak <[email protected]>
Co-authored-by: trujillo-adam <[email protected]>

* [NET-4103] ci: build s390x (#18067)

* ci: build s390x

* ci: test s390x

* ci: dev build s390x

* no GOOS

* ent only

* build: publish s390x

* fix syntax error

* fix syntax error again

* fix syntax error again x2

* test branch

* Move s390x conditionals to step level

* remove test branch

---------

Co-authored-by: emilymianeil <[email protected]>

* :ermahgerd "Sevice Mesh" -> "Service Mesh" (#18116)

Just a typo in the docs.

* Split pbmesh.UpstreamsConfiguration as a resource out of pbmesh.Upstreams (#17991)

Configuration that previously was inlined into the Upstreams resource
applies to both explicit and implicit upstreams and so it makes sense to
split it out into its own resource.

It also has other minor changes:
- Renames `proxy.proto` proxy_configuration.proto`
- Changes the type of `Upstream.destination_ref` from `pbresource.ID` to
`pbresource.Reference`
- Adds comments to fields that didn't have them

* [NET-4895] ci - api tests and consul container tests error because of dependency bugs with go 1.20.6.  Pin go to 1.20.5. (#18124)

### Description
The following jobs started failing when go 1.20.6 was released:
- `go-test-api-1-19`
- `go-test-api-1-20`
- `compatibility-integration-tests`
- `upgrade-integration-tests`

`compatibility-integration-tests` and `compatibility-integration-tests`
to this testcontainers issue:
https://github.com/testcontainers/testcontainers-go/issues/1359. This
issue calls for testcontainers to release a new version when one of
their dependencies is fixed. When that is done, we will unpin the go
versions in `compatibility-integration-tests` and
`compatibility-integration-tests`.

### Testing & Reproduction steps

See these jobs broken in CI and then see them work with this PR.

---------

Co-authored-by: Chris Thain <[email protected]>

* Add ingress gateway deprecation notices to docs (#18102)

### Description

This adds notices, that ingress gateway is deprecated, to several places
in the product docs where ingress gateway is the topic.

### Testing & Reproduction steps

Tested with a local copy of the website.

### Links

Deprecation of ingress gateway was announced in the Release Notes for
Consul 1.16 and Consul-K8s 1.2. See:

[https://developer.hashicorp.com/consul/docs/release-notes/consul/v1_16_x#what-s-deprecated](https://developer.hashicorp.com/consul/docs/release-notes/consul/v1_16_x#what-s-deprecated
)

[https://developer.hashicorp.com/consul/docs/release-notes/consul-k8s/v1_2_x#what-s-deprecated](https://developer.hashicorp.com/consul/docs/release-notes/consul-k8s/v1_2_x#what-s-deprecated)

### PR Checklist

* [N/A] updated test coverage
* [X] external facing docs updated
* [X] appropriate backport labels added
* [X] not a security concern

---------

Co-authored-by: trujillo-adam <[email protected]>

* Add docs for jwt cluster configuration (#18004)

### Description

<!-- Please describe why you're making this change, in plain English.
-->

- Add jwt-provider docs for jwks cluster configuration. The
configuration was added here:
https://github.com/hashicorp/consul/pull/17978

* Docs: fix unmatched bracket for health checks page (#18134)

* NET-4657/add resource service client (#18053)

### Description

<!-- Please describe why you're making this change, in plain English.
-->
Dan had already started on this
[task](https://github.com/hashicorp/consul/pull/17849) which is needed
to start building the HTTP APIs. This just needed some cleanup to get it
ready for review.

Overview:

- Rename `internalResourceServiceClient` to
`insecureResourceServiceClient` for name consistency
- Configure a `secureResourceServiceClient` with auth enabled

### PR Checklist

* [ ] ~updated test coverage~
* [ ] ~external facing docs updated~
* [x] appropriate backport labels added
* [ ] ~not a security concern~

* Fix bug with Vault CA provider (#18112)

Updating RootPKIPath but not IntermediatePKIPath would not update 
leaf signing certs with the new root. Unsure if this happens in practice 
but manual testing showed it is a bug that would break mesh and agent 
connections once the old root is pruned.

* [NET-4897] net/http host header is now verified and request.host that contains socked now error (#18129)

### Description

This is related to https://github.com/hashicorp/consul/pull/18124 where
we pinned the go versions in CI to 1.20.5 and 1.19.10.

go 1.20.6 and 1.19.11 now validate request host headers for validity,
including the hostname cannot be prefixed with slashes.

For local communications (npipe://, unix://), the hostname is not used,
but we need valid and meaningful hostname. Prior versions go Go would
clean the host header, and strip slashes in the process, but go1.20.6
and go1.19.11 no longer do, and reject the host header. Around the
community we are seeing that others are intercepting the req.host and if
it starts with a slash or ends with .sock, they changing the host to
localhost or another dummy value.

[client: define a "dummy" hostname to use for local connections by
thaJeztah · Pull Request #45942 ·
moby/moby](https://github.com/moby/moby/pull/45942)

### Testing & Reproduction steps

Check CI tests.

### Links
* [ ] updated test coverage
* [ ] external facing docs updated
* [ ] appropriate backport labels added
* [ ] not a security concern

* add a conditional around setting LANFilter.AllSegments to make sure it is valid (#18139)

### Description

This is to correct a code problem because this assumes all segments, but
when you get to Enterprise, you can be in partition that is not the
default partition, in which case specifying all segments does not
validate and fails. This is to correct the setting of this filter with
`AllSegments` to `true` to only occur when in the the `default`
partition.

### Testing & Reproduction steps

<!--

* In the case of bugs, describe how to replicate
* If any manual tests were done, document the steps and the conditions
to replicate
* Call out any important/ relevant unit tests, e2e tests or integration
tests you have added or are adding

-->

### Links

<!--

Include any links here that might be helpful for people reviewing your
PR (Tickets, GH issues, API docs, external benchmarks, tools docs, etc).
If there are none, feel free to delete this section.

Please be mindful not to leak any customer or confidential information.
HashiCorp employees may want to use our internal URL shortener to
obfuscate links.

-->

### PR Checklist

* [ ] updated test coverage
* [ ] external facing docs updated
* [ ] appropriate backport labels added
* [ ] not a security concern

* chore: bump upgrade integrations tests to 1.15, 116 [NET-4743] (#18130)

* re org resource type registry (#18133)

* fix: update delegateMock used in ENT (#18149)

### Description

<!-- Please describe why you're making this change, in plain English.
-->
The mock is used in `http_ent_test` file which caused lint failures. For
OSS->ENT parity adding the same change here.

### Links

<!--

Include any links here that might be helpful for people reviewing your
PR (Tickets, GH issues, API docs, external benchmarks, tools docs, etc).
If there are none, feel free to delete this section.

Please be mindful not to leak any customer or confidential information.
HashiCorp employees may want to use our internal URL shortener to
obfuscate links.

-->

Identified in OSS->ENT [merge
PR](https://github.com/hashicorp/consul-enterprise/pull/6328)

### PR Checklist

* [ ] ~updated test coverage~
* [ ] ~external facing docs updated~
* [x] appropriate backport labels added
* [ ] ~not a security concern~

* Use JWT-auth filter in metadata mode & Delegate validation to RBAC filter (#18062)

### Description

<!-- Please describe why you're making this change, in plain English.
-->

- Currently the jwt-auth filter doesn't take into account the service
identity when validating jwt-auth, it only takes into account the path
and jwt provider during validation. This causes issues when multiple
source intentions restrict access to an endpoint with different JWT
providers.
- To fix these issues, rather than use the JWT auth filter for
validation, we use it in metadata mode and allow it to forward the
successful validated JWT token payload to the RBAC filter which will
make the decisions.

This PR ensures requests with and without JWT tokens successfully go
through the jwt-authn filter. The filter however only forwards the data
for successful/valid tokens. On the RBAC filter level, we check the
payload for claims and token issuer + existing rbac rules.

### Testing & Reproduction steps

<!--

* In the case of bugs, describe how to replicate
* If any manual tests were done, document the steps and the conditions
to replicate
* Call out any important/ relevant unit tests, e2e tests or integration
tests you have added or are adding

-->

- This test covers a multi level jwt requirements (requirements at top
level and permissions level). It also assumes you have envoy running,
you have a redis and a sidecar proxy service registered, and have a way
to generate jwks with jwt. I mostly use:
https://www.scottbrady91.com/tools/jwt for this.

- first write your proxy defaults
```
Kind = "proxy-defaults"
name = "global"
config {
  protocol = "http"
}
```
- Create two providers 
```
Kind = "jwt-provider"
Name = "auth0"
Issuer = "https://ronald.local"

JSONWebKeySet = {
    Local = {
     JWKS = "eyJrZXlzIjog....."
    }
}
```

```
Kind = "jwt-provider"
Name = "okta"
Issuer = "https://ronald.local"

JSONWebKeySet = {
   Local = {
     JWKS = "eyJrZXlzIjogW3...."
    }
}
```

- add a service intention
```
Kind = "service-intentions"
Name = "redis"

JWT = {
  Providers = [
    {
      Name = "okta"
    },
  ]
}

Sources = [
  {
    Name = "*"
    Permissions = [{
      Action = "allow"
      HTTP = {
        PathPrefix = "/workspace"
      }
      JWT = {
        Providers = [
          {
            Name = "okta"
            VerifyClaims = [
              {
                  Path = ["aud"]
                  Value = "my_client_app"
              },
              {
                Path = ["sub"]
                Value = "5be86359073c434bad2da3932222dabe"
              }
            ]
          },
        ]
      }

    },
    {
      Action = "allow"
      HTTP = {
        PathPrefix = "/"
      }
      JWT = {
        Providers = [
          {
            Name = "auth0"
          },
        ]
      }

    }]
  }
]
```
- generate 3 jwt tokens: 1 from auth0 jwks, 1 from okta jwks with
different claims than `/workspace` expects and 1 with correct claims
- connect to your envoy (change service and address as needed) to view
logs and potential errors. You can add: `-- --log-level debug` to see
what data is being forwarded
```
consul connect envoy -sidecar-for redis1 -grpc-addr 127.0.0.1:8502
```
- Make the following requests: 
```
curl -s -H "Authorization: Bearer $Auth0_TOKEN" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v

RBAC filter denied

curl -s -H "Authorization: Bearer $Okta_TOKEN_with_wrong_claims" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v

RBAC filter denied

curl -s -H "Authorization: Bearer $Okta_TOKEN_with_correct_claims" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v

Successful request
```


### TODO

* [x] Update test coverage
* [ ] update integration tests (follow-up PR)
* [x] appropriate backport labels added

* Support Consul Connect Envoy Command on Windows (#17694)

### Description

Add support for consul connect envoy command on windows. This PR fixes
the comments of PR - https://github.com/hashicorp/consul/pull/15114

### Testing
* Built consul.exe from this branch on windows and hosted here - [AWS
S3](https://asheshvidyut-bucket.s3.ap-southeast-2.amazonaws.com/consul.zip)
* Updated the
[tutorial](https://developer.hashicorp.com/consul/tutorials/developer-mesh/consul-windows-workloads)
and changed the `consul_url.default` value to [AWS
S3](https://asheshvidyut-bucket.s3.ap-southeast-2.amazonaws.com/consul.zip)
* Followed the steps in the tutorial and verified that everything is
working as described.

### PR Checklist

* [x] updated test coverage
* [ ] external facing docs updated
* [x] appropriate backport labels added
* [x] not a security concern

---------

Co-authored-by: Franco Bruno Lavayen <[email protected]>
Co-authored-by: Jose Ignacio Lorenzo <[email protected]>
Co-authored-by: Jose Ignacio Lorenzo <[email protected]>
Co-authored-by: Dhia Ayachi <[email protected]>

* Change docs to say 168h instead of 7d for server_rejoin_age_max (#18154)

### Description

Addresses
https://github.com/hashicorp/consul/pull/17171#issuecomment-1636930705

* [OSS] test: improve xDS listener code coverage (#18138)

test: improve xDS listener code coverage

* Re-order expected/actual for assertContainerState in consul container tests (#18157)

Re-order expected/actual, consul container tests

* group and document make file (#17943)

* group and document make file

* Add `testing/deployer` (neé `consul-topology`) [NET-4610] (#17823)

Co-authored-by: R.B. Boyer <[email protected]>
Co-authored-by: R.B. Boyer <[email protected]>
Co-authored-by: Freddy <[email protected]>

* [NET-4792] Add integrations tests for jwt-auth (#18169)

* Add FIPS reference to consul enterprise docs (#18028)

* Add FIPS reference to consul enterprise docs

* Update website/content/docs/enterprise/index.mdx

Co-authored-by: David Yu <[email protected]>

* remove support for ecs client (fips)

---------

Co-authored-by: David Yu <[email protected]>

* add peering_commontopo tests [NET-3700] (#17951)

Co-authored-by: R.B. Boyer <[email protected]>
Co-authored-by: R.B. Boyer <[email protected]>
Co-authored-by: Freddy <[email protected]>
Co-authored-by: NiniOak <[email protected]>

* docs - remove Sentinel from enterprise features list (#18176)

* Update index.mdx
* Update kv.mdx
* Update docs-nav-data.json
* delete sentinel.mdx
* Update redirects.js

---------

Co-authored-by: Tu Nguyen <[email protected]>

* [NET-4865] Bump golang.org/x/net to 0.12.0 (#18186)

Bump golang.org/x/net to 0.12.0

While not necessary to directly address CVE-2023-29406 (which should be
handled by using a patched version of Go when building), an
accompanying change to HTTP/2 error handling does impact agent code.

See https://go-review.googlesource.com/c/net/+/506995 for the HTTP/2
change.

Bump this dependency across our submodules as well for the sake of
potential indirect consumers of `x/net/http`.

* Call resource mutate hook before validate hook (NET-4907) (#18178)

* [NET-4865] security: Update Go version to 1.20.6 (#18190)

Update Go version to 1.20.6

This resolves [CVE-2023-29406]
(https://nvd.nist.gov/vuln/detail/CVE-2023-29406) for uses of the
`net/http` standard library.

Note that until the follow-up to #18124 is done, the version of Go used
in those impacted tests will need to remain on 1.20.5.

* Improve XDS test coverage: JWT auth edition (#18183)

* Improve XDS test coverage: JWT auth edition

more tests

* test: xds coverage for jwt listeners

---------

Co-authored-by: DanStough <[email protected]>

* update readme.md (#18191)

u[date readme.md

* Update submodules to latest following 1.16.0 (#18197)

Align all our internal use of submodules on the latest versions.

* SEC-090: Automated trusted workflow pinning (2023-07-18) (#18174)

Result of tsccr-helper -log-level=info -pin-all-workflows .

Co-authored-by: hashicorp-tsccr[bot] <hashicorp-tsccr[bot]@users.noreply.github.com>

* Fix Backport Assistant PR commenting (#18200)

* Fix Backport Assistant failure PR commenting

For general comments on a PR, it looks like you have to use the `/issue`
endpoint rather than `/pulls`, which requires commit/other
review-specific target details.

This matches the endpoint used in `backport-reminder.yml`.

* Remove Backport Reminder workflow

This is noisy (even when adding multiple labels, individual comments per
label are generated), and likely no longer needed: we haven't had this
work in a long time due to an expired GH token, and we now have better
automation for backport PR assignment.

* resource: Pass resource to Write ACL hook instead of just resource Id [NET-4908] (#18192)

* Explicitly enable WebSocket upgrades (#18150)

This PR explicitly enables WebSocket upgrades in Envoy's UpgradeConfig for all
proxy types. (API Gateway, Ingress, and Sidecar.)

Fixes #8283

* docs: fix the description of client rpc (#18206)

* NET-4804: Add dashboard for monitoring consul-k8s (#18208)

* [OSS] Improve xDS Code Coverage - Clusters  (#18165)

test: improve xDS cluster code coverage

* NET-4222 take config file consul container (#18218)

Net 4222 take config file consul container

* Envoy Integration Test Windows (#18007)

* [CONSUL-395] Update check_hostport and Usage (#40)

* [CONSUL-397] Copy envoy binary from Image (#41)

* [CONSUL-382] Support openssl in unique test dockerfile (#43)

* [CONSUL-405] Add bats to single container (#44)

* [CONSUL-414] Run Prometheus Test Cases and Validate Changes (#46)

* [CONSUL-410] Run Jaeger in Single container (#45)

* [CONSUL-412] Run test-sds-server in single container (#48)

* [CONSUL-408] Clean containers (#47)

* [CONSUL-384] Rebase and sync fork (#50)

* [CONSUL-415] Create Scenarios Troubleshooting Docs (#49)

* [CONSUL-417] Update Docs Single Container (#51)

* [CONSUL-428] Add Socat to single container (#54)

* [CONSUL-424] Replace pkill in kill_envoy function (#52)

* [CONSUL-434] Modify Docker run functions in Helper script (#53)

* [CONSUL-435] Replace docker run in set_ttl_check_state & wait_for_agent_service_register functions (#55)

* [CONSUL-438] Add netcat (nc) in the Single container Dockerfile (#56)

* [CONSUL-429] Replace Docker run with Docker exec (#57)

* [CONSUL-436] Curl timeout and run tests (#58)

* [CONSUL-443] Create dogstatsd Function (#59)

* [CONSUL-431] Update Docs Netcat (#60)

* [CONSUL-439] Parse nc Command in function (#61)

* [CONSUL-463] Review curl Exec and get_ca_root Func (#63)

* [CONSUL-453] Docker hostname in Helper functions (#64)

* [CONSUL-461] Test wipe volumes without extra cont (#66)

* [CONSUL-454] Check ports in the Server and Agent containers (#65)

* [CONSUL-441] Update windows dockerfile with version (#62)

* [CONSUL-466] Review case-grpc Failing Test (#67)

* [CONSUL-494] Review case-cfg-resolver-svc-failover (#68)

* [CONSUL-496] Replace docker_wget & docker_curl (#69)

* [CONSUL-499] Cleanup Scripts - Remove nanoserver (#70)

* [CONSUL-500] Update Troubleshooting Docs (#72)

* [CONSUL-502] Pull & Tag Envoy Windows Image (#73)

* [CONSUL-504] Replace docker run in docker_consul (#76)

* [CONSUL-505] Change admin_bind

* [CONSUL-399] Update envoy to 1.23.1 (#78)

* [CONSUL-510] Support case-wanfed-gw on Windows (#79)

* [CONSUL-506] Update troubleshooting Documentation (#80)

* [CONSUL-512] Review debug_dump_volumes Function (#81)

* [CONSUL-514] Add zipkin to Docker Image (#82)

* [CONSUL-515] Update Documentation (#83)

* [CONSUL-529] Support case-consul-exec (#86)

* [CONSUL-530] Update Documentation (#87)

* [CONSUL-530] Update default consul version 1.13.3

* [CONSUL-539] Cleanup (#91)

* [CONSUL-546] Scripts Clean-up (#92)

* [CONSUL-491] Support admin_access_log_path value for Windows (#71)

* [CONSUL-519] Implement mkfifo Alternative (#84)

* [CONSUL-542] Create OS Specific Files for Envoy Package (#88)

* [CONSUL-543] Create exec_supported.go (#89)

* [CONSUL-544] Test and Build Changes (#90)

* Implement os.DevNull

* using mmap instead of disk files

* fix import in exec-unix

* fix nmap open too many arguemtn

* go fmt on file

* changelog file

* fix go mod

* Update .changelog/17694.txt

Co-authored-by: Dhia Ayachi <[email protected]>

* different mmap library

* fix bootstrap json

* some fixes

* chocolatey version fix and image fix

* using different library

* fix Map funciton call

* fix mmap call

* fix tcp dump

* fix tcp dump

* windows tcp dump

* Fix docker run

* fix tests

* fix go mod

* fix version 16.0

* fix version

* fix version dev

* sleep to debug

* fix sleep

* fix permission issue

* fix permission issue

* fix permission issue

* fix command

* fix command

* fix funciton

* fix assert config entry status command not found

* fix command not found assert_cert_has_cn

* fix command not found assert_upstream_missing

* fix command not found assert_upstream_missing_once

* fix command not found get_upstream_endpoint

* fix command not found get_envoy_public_listener_once

* fix command not found

* fix test cases

* windows integration test workflow github

* made code similar to unix using npipe

* fix go.mod

* fix dialing of npipe

* dont wait

* check size of written json

* fix undefined n

* running

* fix dep

* fix syntax error

* fix workflow file

* windows runner

* fix runner

* fix from json

* fix runs on

* merge connect envoy

* fix cin path

* build

* fix file name

* fix file name

* fix dev build

* remove unwanted code

* fix upload

* fix bin name

* fix path

* checkout current branch

* fix path

* fix tests

* fix shell bash for windows sh files

* fix permission of run-test.sh

* removed docker dev

* added shell bash for tests

* fix tag

* fix win=true

* fix cd

* added dev

* fix variable undefined

* removed failing tests

* fix tcp dump image

* fix curl

* fix curl

* tcp dump path

* fix tcpdump path

* fix curl

* fix curl install

* stop removing intermediate containers

* fix tcpdump docker image

* revert -rm

* --rm=false

* makeing docker image before

* fix tcpdump

* removed case consul exec

* removed terminating gateway simple

* comment case wasm

* removed data dog

* comment out upload coverage

* uncomment case-consul-exec

* comment case consul exec

* if always

* logs

* using consul 1.17.0

* fix quotes

* revert quotes

* redirect to dev null

* Revert version

* revert consul connect

* fix version

* removed envoy connect

* not using function

* change log

* docker logs

* fix logs

* restructure bad authz

* rmeoved dev null

* output

* fix file descriptor

* fix cacert

* fix cacert

* fix ca cert

* cacert does not work in windows curl

* fix func

* removed docker logs

* added sleep

* fix tls

* commented case-consul-exec

* removed echo

* retry docker consul

* fix upload bin

* uncomment consul exec

* copying consul.exe to docker image

* copy fix

* fix paths

* fix path

* github workspace path

* latest version

* Revert "latest version"

This reverts commit 5a7d7b82d9e7553bcb01b02557ec8969f9deba1d.

* commented consul exec

* added ssl revoke best effort

* revert best effort

* removed unused files

* rename var name and change dir

* windows runner

* permission

* needs setup fix

* swtich to github runner

* fix file path

* fix path

* fix path

* fix path

* fix path

* fix path

* fix build paths

* fix tag

* nightly runs

* added matrix in github workflow, renamed files

* fix job

* fix matrix

* removed brackes

* from json

* without using job matrix

* fix quotes

* revert job matrix

* fix workflow

* fix comment

* added comment

* nightly runs

* removed datadog ci as it is already measured in linux one

* running test

* Revert "running test"

This reverts commit 7013d15a23732179d18ec5d17336e16b26fab5d4.

* pr comment fixes

* running test now

* running subset of test

* running subset of test

* job matrix

* shell bash

* removed bash shell

* linux machine for job matrix

* fix output

* added cat to debug

* using ubuntu latest

* fix job matrix

* fix win true

* fix go test

* revert job matrix

---------

Co-authored-by: Jose Ignacio Lorenzo <[email protected]>
Co-authored-by: Franco Bruno Lavayen <[email protected]>
Co-authored-by: Ivan K Berlot <[email protected]>
Co-authored-by: Ezequiel Fernández Ponce <[email protected]>
Co-authored-by: joselo85 <[email protected]>
Co-authored-by: Ezequiel Fernández Ponce <[email protected]>
Co-authored-by: Dhia Ayachi <[email protected]>

* fix typos and update ecs compat table (#18215)

* fix typos and update ecs compat table

* real info for the ecs compat matrix table

* Update website/content/docs/ecs/compatibility.mdx

Co-authored-by: Chris Thain <[email protected]>

---------

Co-authored-by: Chris Thain <[email protected]>

* [OSS] proxystate: add proxystate protos (#18216)

* proxystate: add proxystate protos to pbmesh and resolve imports and conflicts between message names

* ci: don't verify s390x (#18224)

* [CC-5718] Remove HCP token requirement during bootstrap (#18140)

* [CC-5718] Remove HCP token requirement during bootstrap

* Re-add error for loading HCP management token

* Remove old comment

* Add changelog entry

* Remove extra validation line

* Apply suggestions from code review

Co-authored-by: lornasong <[email protected]>

---------

Co-authored-by: lornasong <[email protected]>

* [NET-4122] Doc guidance for federation with externalServers (#18207)

Doc guidance for federation with externalServers

Add guidance for proper configuration when joining to a secondary
cluster using WAN fed with external servers also enabled.

Also clarify federation requirements and fix formatting for an
unrelated value.

Update both the Helm chart reference (synced from `consul-k8s`, see
hashicorp/consul-k8s#2583) and the docs on using `externalServers`.

* [OSS] Improve xDS Code Coverage - Endpoints and Misc (#18222)

test: improve xDS endpoints code coverage

* Clarify license reporting timing and GDPR compliance (#18237)

Add Alicia's edits to clarify log timing and other details

* Fix Github Workflow File (#18241)

* [CONSUL-382] Support openssl in unique test dockerfile (#43)

* [CONSUL-405] Add bats to single container (#44)

* [CONSUL-414] Run Prometheus Test Cases and Validate Changes (#46)

* [CONSUL-410] Run Jaeger in Single container (#45)

* [CONSUL-412] Run test-sds-server in single container (#48)

* [CONSUL-408] Clean containers (#47)

* [CONSUL-384] Rebase and sync fork (#50)

* [CONSUL-415] Create Scenarios Troubleshooting Docs (#49)

* [CONSUL-417] Update Docs Single Container (#51)

* [CONSUL-428] Add Socat to single container (#54)

* [CONSUL-424] Replace pkill in kill_envoy function (#52)

* [CONSUL-434] Modify Docker run functions in Helper script (#53)

* [CONSUL-435] Replace docker run in set_ttl_check_state & wait_for_agent_service_register functions (#55)

* [CONSUL-438] Add netcat (nc) in the Single container Dockerfile (#56)

* [CONSUL-429] Replace Docker run with Docker exec (#57)

* [CONSUL-436] Curl timeout and run tests (#58)

* [CONSUL-443] Create dogstatsd Function (#59)

* [CONSUL-431] Update Docs Netcat (#60)

* [CONSUL-439] Parse nc Command in function (#61)

* [CONSUL-463] Review curl Exec and get_ca_root Func (#63)

* [CONSUL-453] Docker hostname in Helper functions (#64)

* [CONSUL-461] Test wipe volumes without extra cont (#66)

* [CONSUL-454] Check ports in the Server and Agent containers (#65)

* [CONSUL-441] Update windows dockerfile with version (#62)

* [CONSUL-466] Review case-grpc Failing Test (#67)

* [CONSUL-494] Review case-cfg-resolver-svc-failover (#68)

* [CONSUL-496] Replace docker_wget & docker_curl (#69)

* [CONSUL-499] Cleanup Scripts - Remove nanoserver (#70)

* [CONSUL-500] Update Troubleshooting Docs (#72)

* [CONSUL-502] Pull & Tag Envoy Windows Image (#73)

* [CONSUL-504] Replace docker run in docker_consul (#76)

* [CONSUL-505] Change admin_bind

* [CONSUL-399] Update envoy to 1.23.1 (#78)

* [CONSUL-510] Support case-wanfed-gw on Windows (#79)

* [CONSUL-506] Update troubleshooting Documentation (#80)

* [CONSUL-512] Review debug_dump_volumes Function (#81)

* [CONSUL-514] Add zipkin to Docker Image (#82)

* [CONSUL-515] Update Documentation (#83)

* [CONSUL-529] Support case-consul-exec (#86)

* [CONSUL-530] Update Documentation (#87)

* [CONSUL-530] Update default consul version 1.13.3

* [CONSUL-539] Cleanup (#91)

* [CONSUL-546] Scripts Clean-up (#92)

* [CONSUL-491] Support admin_access_log_path value for Windows (#71)

* [CONSUL-519] Implement mkfifo Alternative (#84)

* [CONSUL-542] Create OS Specific Files for Envoy Package (#88)

* [CONSUL-543] Create exec_supported.go (#89)

* [CONSUL-544] Test and Build Changes (#90)

* Implement os.DevNull

* using mmap instead of disk files

* fix import in exec-unix

* fix nmap open too many arguemtn

* go fmt on file

* changelog file

* fix go mod

* Update .changelog/17694.txt

Co-authored-by: Dhia Ayachi <[email protected]>

* different mmap library

* fix bootstrap json

* some fixes

* chocolatey version fix and image fix

* using different library

* fix Map funciton call

* fix mmap call

* fix tcp dump

* fix tcp dump

* windows tcp dump

* Fix docker run

* fix tests

* fix go mod

* fix version 16.0

* fix version

* fix version dev

* sleep to debug

* fix sleep

* fix permission issue

* fix permission issue

* fix permission issue

* fix command

* fix command

* fix funciton

* fix assert config entry status command not found

* fix command not found assert_cert_has_cn

* fix command not found assert_upstream_missing

* fix command not found assert_upstream_missing_once

* fix command not found get_upstream_endpoint

* fix command not found get_envoy_public_listener_once

* fix command not found

* fix test cases

* windows integration test workflow github

* made code similar to unix using npipe

* fix go.mod

* fix dialing of npipe

* dont wait

* check size of written json

* fix undefined n

* running

* fix dep

* fix syntax error

* fix workflow file

* windows runner

* fix runner

* fix from json

* fix runs on

* merge connect envoy

* fix cin path

* build

* fix file name

* fix file name

* fix dev build

* remove unwanted code

* fix upload

* fix bin name

* fix path

* checkout current branch

* fix path

* fix tests

* fix shell bash for windows sh files

* fix permission of run-test.sh

* removed docker dev

* added shell bash for tests

* fix tag

* fix win=true

* fix cd

* added dev

* fix variable undefined

* removed failing tests

* fix tcp dump image

* fix curl

* fix curl

* tcp dump path

* fix tcpdump path

* fix curl

* fix curl install

* stop removing intermediate containers

* fix tcpdump docker image

* revert -rm

* --rm=false

* makeing docker image before

* fix tcpdump

* removed case consul exec

* removed terminating gateway simple

* comment case wasm

* removed data dog

* comment out upload coverage

* uncomment case-consul-exec

* comment case consul exec

* if always

* logs

* using consul 1.17.0

* fix quotes

* revert quotes

* redirect to dev null

* Revert version

* revert consul connect

* fix version

* removed envoy connect

* not using function

* change log

* docker logs

* fix logs

* restructure bad authz

* rmeoved dev null

* output

* fix file descriptor

* fix cacert

* fix cacert

* fix ca cert

* cacert does not work in windows curl

* fix func

* removed docker logs

* added sleep

* fix tls

* commented case-consul-exec

* removed echo

* retry docker consul

* fix upload bin

* uncomment consul exec

* copying consul.exe to docker image

* copy fix

* fix paths

* fix path

* github workspace path

* latest version

* Revert "latest version"

This reverts commit 5a7d7b82d9e7553bcb01b02557ec8969f9deba1d.

* commented consul exec

* added ssl revoke best effort

* revert best effort

* removed unused files

* rename var name and change dir

* windows runner

* permission

* needs setup fix

* swtich to github runner

* fix file path

* fix path

* fix path

* fix path

* fix path

* fix path

* fix build paths

* fix tag

* nightly runs

* added matrix in github workflow, renamed files

* fix job

* fix matrix

* removed brackes

* from json

* without using job matrix

* fix quotes

* revert job matrix

* fix workflow

* fix comment

* added comment

* nightly runs

* removed datadog ci as it is already measured in linux one

* running test

* Revert "running test"

This reverts commit 7013d15a23732179d18ec5d17336e16b26fab5d4.

* pr comment fixes

* running test now

* running subset of test

* running subset of test

* job matrix

* shell bash

* removed bash shell

* linux machine for job matrix

* fix output

* added cat to debug

* using ubuntu latest

* fix job matrix

* fix win true

* fix go test

* revert job matrix

* Fix tests

---------

Co-authored-by: Ivan K Berlot <[email protected]>
Co-authored-by: Jose Ignacio Lorenzo <[email protected]>
Co-authored-by: Franco Bruno Lavayen <[email protected]>
Co-authored-by: Ezequiel Fernández Ponce <[email protected]>
Co-authored-by: joselo85 <[email protected]>
Co-authored-by: Ezequiel Fernández Ponce <[email protected]>
Co-authored-by: Dhia Ayachi <[email protected]>

* NET-4996 - filter go-tests and test-integration workflows from running on docs only and ui only changes (#18236)

* Align build arch matrix with enterprise (#18235)

Ensure that OSS remains in sync w/ Enterprise by aligning the format of
arch matrix args for various build jobs.

* Revert "NET-4996 - filter go-tests and test-integration workflows from running on docs only and ui only changes" (#18248)

Revert "NET-4996 - filter go-tests and test-integration workflows from running on docs only and ui only changes (#18236)"

This reverts commit a11dba710e6ce6f172c0fa6c9b61567cc1efffc8.

* resource: Add scope to resource type registration [NET-4976] (#18214)

Enables querying a resource type's registration to determine if a resource is cluster, partition, or partition and namespace scoped.

* Fix some inconsistencies in jwt docs (#18234)

* NET-1825: More new ACL token creation docs (#18063)

Co-authored-by: trujillo-adam <[email protected]>

* grafana: add the panel resource usage of connect injector (#18247)

* [NET-3700] Backfill changelog entry for c2bbe67 and 7402d06 (#18259)

Backfill changelog entry for c2bbe67 and 7402d06

Add a changelog entry for the follow-up PR since it was specific to the
fix and references the original change.

* NET-4897 - update comment to include the current issue url from the go team. (#18263)

* fix typos, style, and improper links (#18269)

* member cli: add -filter expression to flags (#18223)

* member cli: add -filter expression to flags

* changelog

* update doc

* Add test cases

* use quote

* go-tests: disable s390x (#18273)

* docs: Update ext-authz documentation for kubernetes (#18281)

Update ext-authz documentation for kubernetes

* docs: Consul on Kubernetes specific upgrade info (#18230)

* Compatibility page - dataplanes mention

* Upgrading higher-level dataplane mention

* `exec=` string callout

* More visible for upgrade page

* Apply suggestions from code review

Co-authored-by: Tu Nguyen <[email protected]>

---------

Co-authored-by: Tu Nguyen <[email protected]>
Co-authored-by: John Murret <[email protected]>

* Fix typo in Envoy extensions doc (#18284)

* docs: K8s secondary DC requirements (#18280)

* Requested edit

* Apply suggestions from code review

Co-authored-by: trujillo-adam <[email protected]>

---------

Co-authored-by: trujillo-adam <[email protected]>

* api-gateway: subscribe to bound-api-gateway only after receiving api-gateway (#18291)

* api-gateway: subscribe to bound-api-gateway only after receiving api-gateway

This fixes a race condition due to our dependency on having the listener(s) from the api-gateway config entry in order to fully and properly process the resources on the bound-api-gateway config entry.

* Apply suggestions from code review

* Add changelog entry

* Update K8s changelog to address cloud auto-join change in 1.0.0 (#18293)

* Update list of Envoy versions (#18300)

Update supported envoy versions to 1.24.10, 1.25.9, 1.26.4, 1.27.0.

* [NET-4904] Update list of Envoy versions in docs (#18306)

Update list of Envoy versions in docs

Update supported Envoy versions across Consul release versions.

* Update actions for TSCCR (#18317)

Update action versions before deadline

* Fix topology view when displaying mixed connect-native/normal services. (#13023)

* Fix topoloy intention with mixed connect-native/normal services.

If a service is registered twice, once with connect-native and once
without, the topology views would prune the existing intentions. This
change brings the code more in line with the transparent proxy behavior.

* Dedupe nodes in the ServiceTopology ui endpoint (like done with tags).

* Consider a service connect-native as soon as one instance is.

* Stop JWT provider from being written in non default namespace (#18325)

* docs: Fix some comments (#17118)

Signed-off-by: cui fliter <[email protected]>

* [NET-4703] Prevent partial application of Envoy extensions (#18068)

Prevent partial application of Envoy extensions

Ensure that non-required extensions do not change xDS resources before
exiting on failure by cloning proto messages prior to applying each
extension.

To support this change, also move `CanApply` checks up a layer and make
them prior to attempting extension application, s.t. we avoid
unnecessary copies where extensions can't be applied.

Last, ensure that we do not allow panics from `CanApply` or `Extend`
checks to escape the attempted extension application.

* docs: Simplify example jq commands by removing pipes (#18327)

Simplify jq command examples by removing pipes to other commands.

* fix typo in create a mesh token docs (#18337)

* [CC-5719] Add support for builtin global-read-only policy (#18319)

* [CC-5719] Add support for builtin global-read-only policy

* Add changelog

* Add read-only to docs

* Fix some minor issues.

* Change from ReplaceAll to Sprintf

* Change IsValidPolicy name to return an error instead of bool

* Fix PolicyList test

* Fix other tests

* Apply suggestions from code review

Co-authored-by: Paul Glass <[email protected]>

* Fix state store test for policy list.

* Fix naming issues

* Update acl/validation.go

Co-authored-by: Chris Thain <[email protected]>

* Update agent/consul/acl_endpoint.go

---------

Co-authored-by: Paul Glass <[email protected]>
Co-authored-by: Chris Thain <[email protected]>

* [NET-5121] proxystate: move protos to subdirectory to avoid conflicts (#18335)

* also makes a few protos updates

* resource: adding various helpers for working with resources (#18342)

This is a bit of a grab bag of helpers that I found useful for working with them when authoring substantial Controllers. Subsequent PRs will make use of them.

* Wasm integration tests for local and remote wasm files (#17756)

* wasm integration tests for local and remote wasm files

refactoring and cleanup for wasm testing

remove wasm debug logging

PR feedback, wasm build lock

correct path pattern for wasm build files

Add new helper function to minimize changes to existing test code

Remove extra param

mod tidy

add custom service setup to test lib

add wait until static server sidecar can reach nginx sidecar

Doc comments

PR feedback

Update workflows to compile wasm for integration tests

Fix docker build path

Fix package name for linter

Update makefile, fix redeclared function

Update expected wasm filename

Debug test ls in workflow

remove pwd in favor of relative path

more debugging

Build wasm in compatability tests as well

Build wasm directly in ci rather than in container

Debug tinygo and llvm version

Change wasm file extension

Remove tinygo debugging

Remove extra comments

* Add compiled wasm and build instructions

* [HCP Telemetry] Periodic Refresh for Dynamic Telemetry Configuration (#18168)

* OTElExporter now uses an EndpointProvider to discover the endpoint

* OTELSink uses a ConfigProvider to obtain filters and labels configuration

* improve tests for otel_sink

* Regex logic is moved into client for a method on the TelemetryConfig object

* Create a telemetry_config_provider and update deps to use it

* Fix conversion

* fix import newline

* Add logger to hcp client and move telemetry_config out of the client.go file

* Add a telemetry_config.go to refactor client.go

* Update deps

* update hcp deps test

* Modify telemetry_config_providers

* Check for nil filters

* PR review updates

* Fix comments and move around pieces

* Fix comments

* Remove context from client struct

* Moved ctx out of sink struct and fixed filters, added a test

* Remove named imports, use errors.New if not fformatting

* Remove HCP dependencies in telemetry package

* Add success metric and move lock only to grab the t.cfgHahs

* Update hash

* fix nits

* Create an equals method and add tests

* Improve telemetry_config_provider.go tests

* Add race test

* Add missing godoc

* Remove mock for MetricsClient

* Avoid goroutine test panics

* trying to kick CI lint issues by upgrading mod

* imprve test code and add hasher for testing

* Use structure logging for filters, fix error constants, and default to allow all regex

* removed hashin and modify logic to simplify

* Improve race test and fix PR feedback by removing hash equals and avoid testing the timer.Ticker logic, and instead unit test

* Ran make go-mod-tidy

* Use errtypes in the test

* Add changelog

* add safety check for exporter endpoint

* remove require.Contains by using error types, fix structure logging, and fix success metric typo in exporter

* Fixed race test to have changing config values

* Send success metric before modifying config

* Avoid the defer and move the success metric under

* NET-4240 - Snapshots are failing on Windows  (#18302)

* fix go mod

* fix go sum

* added change log

* ran make go mod tidy

* Register ProxyStateTemplate Resource (#18316)

  Also, change the ProxyState.id to identity. This is because we already have the id of this proxy
  from the resource, and this id should be name-aligned with the workload it represents. It should
  also have the owner ref set to the workload ID if we need that. And so the id field seems unnecessary.
  We do, however, need a reference to workload identity so that we can authorize the proxy when it initially
  connects to the xDS server.

* [NET-5146] security: Update Go version to 1.20.7 and `x/net` to 0.13.0 (#18358)

* Update Go version to 1.20.7

This resolves [CVE-2023-29409]
(https://nvd.nist.gov/vuln/detail/CVE-2023-29409)(`crypto/tls`).

* Bump golang.org/x/net to 0.13.0

Addresses [CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978)
for security scans (non-impacting).

* mesh: adding the protobuf types and resources backing mesh config v2 (#18351)

* [OSS] test: xds coverage for routes (#18369)

test: xds coverage for routes

* Fix policy lookup to allow for slashes (#18347)

* Fix policy lookup to allow for slashes

* Fix suggestions

* Fix other test

* Revert some lines

* add some initial CODEOWNERS (#18346)

* Add redirects for mesh-gateway docs (#18377)

* expose grpc as http endpoint (#18221)

expose resource grpc endpoints as http endpoints

* bimapper: fix a bug and add some more test coverage (#18387)

* [docs] Fix ServiceDefaults example in distributed tracing (#17212)

Fix ServiceDefaults example in distributed tracing.

* Fix #17730 - Dev mode has new line (#18367)

* adding new line only in case of pretty in url not in dev mode

* change log added

* chore: make go-mod-tidy (#18388)

* resource: Make resource read tenancy aware (#18397)

* Not using chmod - fixed integration test for Enterprise (#18401)

* Not using chmod

* checking icacls

* Removed push

* replaced ordered list of rate limit ops with flow diagram (#18398)

* replaced ordered list of rate limit ops with flow diagram

* made diagram font bigger

* updated colors for dark mode img

* fixed typo

* recentered dark mode image

* Apply suggestions from code review

Co-authored-by: Jeff Boruszak <[email protected]>

---------

Co-authored-by: Jeff Boruszak <[email protected]>

* Upgrade test: remove outdated test and disable log due to verbosity (#18403)

* remove outdated test

* disable log since we have too many parallel tests

* bump testcontainers-go from 0.22.0 and remove pinned go version in in… (#18395)

* bump testcontainers-go from 0.22.0 and remove pinned go version in integ test

* go mod tidy

* Replace deprecated target.Authority with target.URL.Host

* Add ServiceEndpoints Mutation hook tests (#18404)

* Add ServiceEndpoints Mutation hook tests

* Move endpoint owner validation into the validation hook

Also there were some minor changes to error validation to account for go-cmp not liking to peer through an errors.errorstring type that get created by errors.New

* catalog: add FailoverPolicy mutation and validation hooks (#18390)

Add most of the validation and mutation hooks for the FailoverPolicy resource.

* NET-5115 Add retry + timeout filters for api-gateway (#18324)

* squash, implement retry/timeout in consul core

* update tests

* catalog: adding a controller to reconcile FailoverPolicy resources (#18399)

Add most of the semantic cross-resource validation for FailoverPolicy resources using a new controller.

* fix the error in ent repo (#18421)

fix the error in ent repo

* build: updates for 1.16.1 release (#18415)

* build: updates for 1.16.1 release

* build: fix missing replace directive for envoyextensions

* build: go mod tidy testing/deployer

* update ECS links (#18419)

* docs: fix incorrect proxy-defaults config in Lua Envoy extension (#18418)

fix incorrect proxy-defaults config

* resource: Make resource write tenancy aware (#18423)

* [NET-5217] [OSS] Derive sidecar proxy locality from parent service (#18437)

* Add logging to locality policy application

In OSS, this is currently a no-op.

* Inherit locality when registering sidecars

When sidecar locality is not explicitly configured, inherit locality
from the proxied service.

* NET-4984: Update APIGW Config Entries for JWT Auth (#18366)

* Added oss config entries for Policy and JWT on APIGW

* Updated structs for config entry

* Updated comments, ran deep-copy

* Move JWT configuration into OSS file

* Add in the config entry OSS file for jwts

* Added changelog

* fixing proto spacing

* Moved to using manually written deep copy method

* Use pointers for override/default fields in apigw config entries

* Run gen scripts for changed types

* k8s compat - Openshift versions (#18307)

* Update compatibility.mdx

Co-authored-by: trujillo-adam <[email protected]>

* APIGW: Update HTTPRouteConfigEntry for JWT Auth (#18422)

* Updated httproute config entry for JWT Filters

* Added manual deepcopy method for httproute jwt filter

* Fix test

* Update JWTFilter to be in oss file

* Add changelog

* Add build tags for deepcopy oss file

* [COMPLIANCE] License changes (#18443)

* Adding explicit MPL license for sub-package

This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository.

* Adding explicit MPL license for sub-package

This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository.

* Updating the license from MPL to Business Source License

Going forward, this project will be licensed under the Business Source License v1.1. Please see our blog post for more details at <Blog URL>, FAQ at www.hashicorp.com/licensing-faq, and details of the license at www.hashicorp.com/bsl.

* add missing license headers

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

---------

Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com…
trujillo-adam added a commit that referenced this pull request Sep 7, 2023
@hc-github-team-consul-core @natemollica-nm
@loshz @jm96441n @beautifulentropy @trujillo-adam @jmurret @Ranjandas @roncodingenthusiast @hashi-derek @absolutelightning @im2nguyen @xwa153 @cthain @boruszak @nathancoleman @evanphx @JadhavPoonam @DanStough @karras @jcjones @fulviodenza @krastin @david3a @curtbushko @nfi-hashicorp @t-davies @lkysow @vijayraghav-io @jkirschner-hashicorp @eddie-rowe @emilymianeil @nv-hashi @ishustava @Jeff-Apple @huikang @cocolavayen @joselo85 @dhiaayachi @rboyer @freddygv @NiniOak @zalimeni @analogue @hashicorp-tsccr @blake @iberlot @ezfepo @ndhanushkodi @jjacobson93 @lornasong @judithpatudith @gautambaghel @apollo13 @cuishuang @johnlanda @Achooo @ilpianista @mkeeler @sarahalsmiller @nvanthao @hashicorp-copywrite @boxofrad @natmegs @hdkshingala
Backport of Reformat proxy docs refresh into release/1.16.x (#18696)
5290ba3 
* Update Consul K8s Upgrade Doc Updates (#17921)

Updating upgrade procedures to encompass expected errors during upgrade process from v1.13.x to v1.14.x.

* Update sameness-group.mdx (#17915)

* Update create-sameness-groups.mdx (#17927)

* deps: coredns v1.10.1 (#17912)

* Ensure RSA keys are at least 2048 bits in length (#17911)

* Ensure RSA keys are at least 2048 bits in length

* Add changelog

* update key length check for FIPS compliance

* Fix no new variables error and failing to return when error exists from
validating

* clean up code for better readability

* actually return value

* tlsutil: Fix check TLS configuration (#17481)

* tlsutil: Fix check TLS configuration
* Rewording docs.
* Update website/content/docs/services/configuration/checks-configuration-reference.mdx
Co-authored-by: trujillo-adam <[email protected]>
* Fix typos and add changelog entry.
---------

Co-authored-by: trujillo-adam <[email protected]>

* docs: Deprecations for connect-native SDK and specific connect native APIs (#17937)

* Update v1_16_x.mdx
* Update connect native golang page

---------

Co-authored-by: trujillo-adam <[email protected]>

* Revert "Add workflow to verify linux release packages (#17904)" (#17942)

This reverts commit 3368f14fab500ebe9f6aeab5631dd1d5f5a453e5.

* Fixes Secondary ConnectCA update (#17846)

This fixes a bug that was identified which resulted in subsequent
ConnectCA configuration update not to persist in the cluster.

* fixing typo in link to jwt-validations-with-intentions doc (#17955)

* Fix streaming backend link (#17958)

* Fix streaming backend link
* Update health.mdx

* Dynamically create jwks clusters for jwt-providers (#17944)

* website: remove deprecated agent rpc docs (#17962)

* Fix missing BalanceOutboundConnections in v2 catalog. (#17964)

* feature - [NET - 4005]  - [Supportability] Reloadable Configuration - enable_debug (#17565)

* # This is a combination of 9 commits.
# This is the 1st commit message:

init without tests

# This is the commit message #2:

change log

# This is the commit message #3:

fix tests

# This is the commit message #4:

fix tests

# This is the commit message #5:

added tests

# This is the commit message #6:

change log breaking change

# This is the commit message #7:

removed breaking change

# This is the commit message #8:

fix test

# This is the commit message #9:

keeping the test behaviour same

* # This is a combination of 12 commits.
# This is the 1st commit message:

init without tests

# This is the commit message #2:

change log

# This is the commit message #3:

fix tests

# This is the commit message #4:

fix tests

# This is the commit message #5:

added tests

# This is the commit message #6:

change log breaking change

# This is the commit message #7:

removed breaking change

# This is the commit message #8:

fix test

# This is the commit message #9:

keeping the test behaviour same

# This is the commit message #10:

made enable debug atomic bool

# This is the commit message #11:

fix lint

# This is the commit message #12:

fix test true enable debug

* parent 10f500e895d92cc3691ade7b74a33db755d22039
author absolutelightning <[email protected]> 1687352587 +0530
committer absolutelightning <[email protected]> 1687352592 +0530

init without tests

change log

fix tests

fix tests

added tests

change log breaking change

removed breaking change

fix test

keeping the test behaviour same

made enable debug atomic bool

fix lint

fix test true enable debug

using enable debug in agent as atomic bool

test fixes

fix tests

fix tests

added update on correct locaiton

fix tests

fix reloadable config enable debug

fix tests

fix init and acl 403

* revert commit

* Fix formatting codeblocks on APIgw docs (#17970)

* fix formatting codeblocks

* remove unnecessary indents

* Remove POC code (#17974)

* update doc (#17910)

* update doc

* update link

* Remove duplicate and unused newDecodeConfigEntry func (#17979)

* docs: samenessGroup YAML examples (#17984)

* configuration entry syntax

* Example config

* Add changelog entry for 1.16.0 (#17987)

* Fix typo (#17198)

servcies => services

* Expose JWKS cluster config through JWTProviderConfigEntry (#17978)

* Expose JWKS cluster config through JWTProviderConfigEntry

* fix typos, rename trustedCa to trustedCA

* Integration test for ext-authz Envoy extension (#17980)

* Fix incorrect protocol for transparent proxy upstreams. (#17894)

This PR fixes a bug that was introduced in:
https://github.com/hashicorp/consul/pull/16021

A user setting a protocol in proxy-defaults would cause tproxy implicit
upstreams to not honor the upstream service's protocol set in its
`ServiceDefaults.Protocol` field, and would instead always use the
proxy-defaults value.

Due to the fact that upstreams configured with "tcp" can successfully contact
upstream "http" services, this issue was not recognized until recently (a
proxy-defaults with "tcp" and a listening service with "http" would make
successful requests, but not the opposite).

As a temporary work-around, users experiencing this issue can explicitly set
the protocol on the `ServiceDefaults.UpstreamConfig.Overrides`, which should
take precedence.

The fix in this PR removes the proxy-defaults protocol from the wildcard
upstream that tproxy uses to configure implicit upstreams. When the protocol
was included, it would always overwrite the value during discovery chain
compilation, which was not correct. The discovery chain compiler also consumes
proxy defaults to determine the protocol, so simply excluding it from the
wildcard upstream config map resolves the issue.

* feat: include nodes count in operator usage endpoint and cli command (#17939)

* feat: update operator usage api endpoint to include nodes count

* feat: update operator usange cli command to includes nodes count

* [OSS] Improve Gateway Test Coverage of Catalog Health (#18011)

* fix(cli): remove failing check from 'connect envoy' registration for api gateway

* test(integration): add tests to check catalog statsus of gateways on startup

* remove extra sleep comment

* Update test/integration/consul-container/libs/assert/service.go

* changelog

* Fixes Traffic rate limitting docs (#17997)

* Fix removed service-to-service peering links (#17221)

* docs: fix removed service-to-service peering links

* docs: extend peering-via-mesh-gateways intro (thanks @trujillo-adam)

---------

Co-authored-by: trujillo-adam <[email protected]>

* docs: Sameness "beta" warning (#18017)

* Warning updates

* .x

* updated typo in tab heading (#18022)

* updated typo in tab heading

* updated tab group typo, too

* Document that DNS lookups can target cluster peers (#17990)

Static DNS lookups, in addition to explicitly targeting a datacenter,
can target a cluster peer. This was added in 95dc0c7b301b70a6b955a8b7c9737c9b86f03df6 but didn't make the documentation.

The driving function for the change is `parseLocality` here: https://github.com/hashicorp/consul/blob/0b1299c28d8127129d61310ee4280055298438e0/agent/dns_oss.go#L25

The biggest change in this is to adjust the standard lookup syntax to tie
`.<datacenter>` to `.dc` as required-together, and to append in the similar `.<cluster-peer>.peer` optional argument, both to A record and SRV record lookups.

Co-authored-by: David Yu <[email protected]>

* Add first integration test for jwt auth with intention (#18005)

* fix stand-in text for name field (#18030)

* removed sameness conf entry from failover nav (#18033)

* docs - add service sync annotations and k8s service weight annotation (#18032)

* Docs for https://github.com/hashicorp/consul-k8s/pull/2293
* remove versions for enterprise features since they are old

---------

Co-authored-by: Tu Nguyen <[email protected]>

* docs - add jobs use case for service mesh k8s (#18037)

* docs - add jobs use case for service mesh k8s
* add code blocks

* address feedback (#18045)

* Add verify server hostname to tls default (#17155)

* [OSS] Fix initial_fetch_timeout to wait for all xDS resources (#18024)

* fix(connect): set initial_fetch_time to wait indefinitely

* changelog

* PR feedback 1

* ui: fix typos for peer service imports (#17999)

* test: fix FIPS inline cert test message (#18076)

* Fix a couple typos in Agent Telemetry Metrics docs (#18080)

* Fix metrics docs

* Add changelog

Signed-off-by: josh <[email protected]>

---------

Signed-off-by: josh <[email protected]>

* docs updates - cluster peering and virtual services (#18069)

* Update route-to-virtual-services.mdx
* Update establish-peering.mdx

* Update service-mesh-compare.mdx (#17279)

grammar change

* Update helm docs on main (#18085)

* ci: use gotestsum v1.10.1 [NET-4042] (#18088)

* Docs: Update proxy lifecycle annotations and consul-dataplane flags (#18075)

* Update proxy lifecycle annotations and consul-dataplane flags

* Pass configured role name to Vault for AWS auth in Connect CA (#17885)

* Docs for dataplane upgrade on k8s (#18051)

* Docs for dataplane upgrade on k8s

---------

Co-authored-by: David Yu <[email protected]>
Co-authored-by: trujillo-adam <[email protected]>

* docs - update upgrade index page to not recommend consul leave. (#18100)

* Displays Consul version of each nodes in UI nodes section (#17754)

* update UINodes and UINodeInfo response with consul-version info added as NodeMeta, fetched from serf members

* update test cases TestUINodes, TestUINodeInfo

* added nil check for map

* add consul-version in local agent node metadata

* get consul version from serf member and add this as node meta in catalog register request

* updated ui mock response to include consul versions as node meta

* updated ui trans and added version as query param to node list route

* updates in ui templates to display consul version with filter and sorts

* updates in ui - model class, serializers,comparators,predicates for consul version feature

* added change log for Consul Version Feature

* updated to get version from consul service, if for some reason not available from serf

* updated changelog text

* updated dependent testcases

* multiselection version filter

* Update agent/consul/state/catalog.go

comments updated

Co-authored-by: Jared Kirschner <[email protected]>

---------

Co-authored-by: Jared Kirschner <[email protected]>

* api gw 1.16 updates (#18081)

* api gw 1.16 updates

* Apply suggestions from code review

Co-authored-by: Jeff Boruszak <[email protected]>

* update CodeBlockConfig filename

* Apply suggestions from code review

Co-authored-by: trujillo-adam <[email protected]>
Co-authored-by: Jeff Boruszak <[email protected]>

* remove non-standard intentions page

* Update website/content/docs/api-gateway/configuration/index.mdx

Co-authored-by: trujillo-adam <[email protected]>

---------

Co-authored-by: Jeff Boruszak <[email protected]>
Co-authored-by: trujillo-adam <[email protected]>

* [NET-4103] ci: build s390x (#18067)

* ci: build s390x

* ci: test s390x

* ci: dev build s390x

* no GOOS

* ent only

* build: publish s390x

* fix syntax error

* fix syntax error again

* fix syntax error again x2

* test branch

* Move s390x conditionals to step level

* remove test branch

---------

Co-authored-by: emilymianeil <[email protected]>

* :ermahgerd "Sevice Mesh" -> "Service Mesh" (#18116)

Just a typo in the docs.

* Split pbmesh.UpstreamsConfiguration as a resource out of pbmesh.Upstreams (#17991)

Configuration that previously was inlined into the Upstreams resource
applies to both explicit and implicit upstreams and so it makes sense to
split it out into its own resource.

It also has other minor changes:
- Renames `proxy.proto` proxy_configuration.proto`
- Changes the type of `Upstream.destination_ref` from `pbresource.ID` to
`pbresource.Reference`
- Adds comments to fields that didn't have them

* [NET-4895] ci - api tests and consul container tests error because of dependency bugs with go 1.20.6.  Pin go to 1.20.5. (#18124)

### Description
The following jobs started failing when go 1.20.6 was released:
- `go-test-api-1-19`
- `go-test-api-1-20`
- `compatibility-integration-tests`
- `upgrade-integration-tests`

`compatibility-integration-tests` and `compatibility-integration-tests`
to this testcontainers issue:
https://github.com/testcontainers/testcontainers-go/issues/1359. This
issue calls for testcontainers to release a new version when one of
their dependencies is fixed. When that is done, we will unpin the go
versions in `compatibility-integration-tests` and
`compatibility-integration-tests`.

### Testing & Reproduction steps

See these jobs broken in CI and then see them work with this PR.

---------

Co-authored-by: Chris Thain <[email protected]>

* Add ingress gateway deprecation notices to docs (#18102)

### Description

This adds notices, that ingress gateway is deprecated, to several places
in the product docs where ingress gateway is the topic.

### Testing & Reproduction steps

Tested with a local copy of the website.

### Links

Deprecation of ingress gateway was announced in the Release Notes for
Consul 1.16 and Consul-K8s 1.2. See:

[https://developer.hashicorp.com/consul/docs/release-notes/consul/v1_16_x#what-s-deprecated](https://developer.hashicorp.com/consul/docs/release-notes/consul/v1_16_x#what-s-deprecated
)

[https://developer.hashicorp.com/consul/docs/release-notes/consul-k8s/v1_2_x#what-s-deprecated](https://developer.hashicorp.com/consul/docs/release-notes/consul-k8s/v1_2_x#what-s-deprecated)

### PR Checklist

* [N/A] updated test coverage
* [X] external facing docs updated
* [X] appropriate backport labels added
* [X] not a security concern

---------

Co-authored-by: trujillo-adam <[email protected]>

* Add docs for jwt cluster configuration (#18004)

### Description

<!-- Please describe why you're making this change, in plain English.
-->

- Add jwt-provider docs for jwks cluster configuration. The
configuration was added here:
https://github.com/hashicorp/consul/pull/17978

* Docs: fix unmatched bracket for health checks page (#18134)

* NET-4657/add resource service client (#18053)

### Description

<!-- Please describe why you're making this change, in plain English.
-->
Dan had already started on this
[task](https://github.com/hashicorp/consul/pull/17849) which is needed
to start building the HTTP APIs. This just needed some cleanup to get it
ready for review.

Overview:

- Rename `internalResourceServiceClient` to
`insecureResourceServiceClient` for name consistency
- Configure a `secureResourceServiceClient` with auth enabled

### PR Checklist

* [ ] ~updated test coverage~
* [ ] ~external facing docs updated~
* [x] appropriate backport labels added
* [ ] ~not a security concern~

* Fix bug with Vault CA provider (#18112)

Updating RootPKIPath but not IntermediatePKIPath would not update 
leaf signing certs with the new root. Unsure if this happens in practice 
but manual testing showed it is a bug that would break mesh and agent 
connections once the old root is pruned.

* [NET-4897] net/http host header is now verified and request.host that contains socked now error (#18129)

### Description

This is related to https://github.com/hashicorp/consul/pull/18124 where
we pinned the go versions in CI to 1.20.5 and 1.19.10.

go 1.20.6 and 1.19.11 now validate request host headers for validity,
including the hostname cannot be prefixed with slashes.

For local communications (npipe://, unix://), the hostname is not used,
but we need valid and meaningful hostname. Prior versions go Go would
clean the host header, and strip slashes in the process, but go1.20.6
and go1.19.11 no longer do, and reject the host header. Around the
community we are seeing that others are intercepting the req.host and if
it starts with a slash or ends with .sock, they changing the host to
localhost or another dummy value.

[client: define a "dummy" hostname to use for local connections by
thaJeztah · Pull Request #45942 ·
moby/moby](https://github.com/moby/moby/pull/45942)

### Testing & Reproduction steps

Check CI tests.

### Links
* [ ] updated test coverage
* [ ] external facing docs updated
* [ ] appropriate backport labels added
* [ ] not a security concern

* add a conditional around setting LANFilter.AllSegments to make sure it is valid (#18139)

### Description

This is to correct a code problem because this assumes all segments, but
when you get to Enterprise, you can be in partition that is not the
default partition, in which case specifying all segments does not
validate and fails. This is to correct the setting of this filter with
`AllSegments` to `true` to only occur when in the the `default`
partition.

### Testing & Reproduction steps

<!--

* In the case of bugs, describe how to replicate
* If any manual tests were done, document the steps and the conditions
to replicate
* Call out any important/ relevant unit tests, e2e tests or integration
tests you have added or are adding

-->

### Links

<!--

Include any links here that might be helpful for people reviewing your
PR (Tickets, GH issues, API docs, external benchmarks, tools docs, etc).
If there are none, feel free to delete this section.

Please be mindful not to leak any customer or confidential information.
HashiCorp employees may want to use our internal URL shortener to
obfuscate links.

-->

### PR Checklist

* [ ] updated test coverage
* [ ] external facing docs updated
* [ ] appropriate backport labels added
* [ ] not a security concern

* chore: bump upgrade integrations tests to 1.15, 116 [NET-4743] (#18130)

* re org resource type registry (#18133)

* fix: update delegateMock used in ENT (#18149)

### Description

<!-- Please describe why you're making this change, in plain English.
-->
The mock is used in `http_ent_test` file which caused lint failures. For
OSS->ENT parity adding the same change here.

### Links

<!--

Include any links here that might be helpful for people reviewing your
PR (Tickets, GH issues, API docs, external benchmarks, tools docs, etc).
If there are none, feel free to delete this section.

Please be mindful not to leak any customer or confidential information.
HashiCorp employees may want to use our internal URL shortener to
obfuscate links.

-->

Identified in OSS->ENT [merge
PR](https://github.com/hashicorp/consul-enterprise/pull/6328)

### PR Checklist

* [ ] ~updated test coverage~
* [ ] ~external facing docs updated~
* [x] appropriate backport labels added
* [ ] ~not a security concern~

* Use JWT-auth filter in metadata mode & Delegate validation to RBAC filter (#18062)

### Description

<!-- Please describe why you're making this change, in plain English.
-->

- Currently the jwt-auth filter doesn't take into account the service
identity when validating jwt-auth, it only takes into account the path
and jwt provider during validation. This causes issues when multiple
source intentions restrict access to an endpoint with different JWT
providers.
- To fix these issues, rather than use the JWT auth filter for
validation, we use it in metadata mode and allow it to forward the
successful validated JWT token payload to the RBAC filter which will
make the decisions.

This PR ensures requests with and without JWT tokens successfully go
through the jwt-authn filter. The filter however only forwards the data
for successful/valid tokens. On the RBAC filter level, we check the
payload for claims and token issuer + existing rbac rules.

### Testing & Reproduction steps

<!--

* In the case of bugs, describe how to replicate
* If any manual tests were done, document the steps and the conditions
to replicate
* Call out any important/ relevant unit tests, e2e tests or integration
tests you have added or are adding

-->

- This test covers a multi level jwt requirements (requirements at top
level and permissions level). It also assumes you have envoy running,
you have a redis and a sidecar proxy service registered, and have a way
to generate jwks with jwt. I mostly use:
https://www.scottbrady91.com/tools/jwt for this.

- first write your proxy defaults
```
Kind = "proxy-defaults"
name = "global"
config {
  protocol = "http"
}
```
- Create two providers 
```
Kind = "jwt-provider"
Name = "auth0"
Issuer = "https://ronald.local"

JSONWebKeySet = {
    Local = {
     JWKS = "eyJrZXlzIjog....."
    }
}
```

```
Kind = "jwt-provider"
Name = "okta"
Issuer = "https://ronald.local"

JSONWebKeySet = {
   Local = {
     JWKS = "eyJrZXlzIjogW3...."
    }
}
```

- add a service intention
```
Kind = "service-intentions"
Name = "redis"

JWT = {
  Providers = [
    {
      Name = "okta"
    },
  ]
}

Sources = [
  {
    Name = "*"
    Permissions = [{
      Action = "allow"
      HTTP = {
        PathPrefix = "/workspace"
      }
      JWT = {
        Providers = [
          {
            Name = "okta"
            VerifyClaims = [
              {
                  Path = ["aud"]
                  Value = "my_client_app"
              },
              {
                Path = ["sub"]
                Value = "5be86359073c434bad2da3932222dabe"
              }
            ]
          },
        ]
      }

    },
    {
      Action = "allow"
      HTTP = {
        PathPrefix = "/"
      }
      JWT = {
        Providers = [
          {
            Name = "auth0"
          },
        ]
      }

    }]
  }
]
```
- generate 3 jwt tokens: 1 from auth0 jwks, 1 from okta jwks with
different claims than `/workspace` expects and 1 with correct claims
- connect to your envoy (change service and address as needed) to view
logs and potential errors. You can add: `-- --log-level debug` to see
what data is being forwarded
```
consul connect envoy -sidecar-for redis1 -grpc-addr 127.0.0.1:8502
```
- Make the following requests: 
```
curl -s -H "Authorization: Bearer $Auth0_TOKEN" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v

RBAC filter denied

curl -s -H "Authorization: Bearer $Okta_TOKEN_with_wrong_claims" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v

RBAC filter denied

curl -s -H "Authorization: Bearer $Okta_TOKEN_with_correct_claims" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v

Successful request
```


### TODO

* [x] Update test coverage
* [ ] update integration tests (follow-up PR)
* [x] appropriate backport labels added

* Support Consul Connect Envoy Command on Windows (#17694)

### Description

Add support for consul connect envoy command on windows. This PR fixes
the comments of PR - https://github.com/hashicorp/consul/pull/15114

### Testing
* Built consul.exe from this branch on windows and hosted here - [AWS
S3](https://asheshvidyut-bucket.s3.ap-southeast-2.amazonaws.com/consul.zip)
* Updated the
[tutorial](https://developer.hashicorp.com/consul/tutorials/developer-mesh/consul-windows-workloads)
and changed the `consul_url.default` value to [AWS
S3](https://asheshvidyut-bucket.s3.ap-southeast-2.amazonaws.com/consul.zip)
* Followed the steps in the tutorial and verified that everything is
working as described.

### PR Checklist

* [x] updated test coverage
* [ ] external facing docs updated
* [x] appropriate backport labels added
* [x] not a security concern

---------

Co-authored-by: Franco Bruno Lavayen <[email protected]>
Co-authored-by: Jose Ignacio Lorenzo <[email protected]>
Co-authored-by: Jose Ignacio Lorenzo <[email protected]>
Co-authored-by: Dhia Ayachi <[email protected]>

* Change docs to say 168h instead of 7d for server_rejoin_age_max (#18154)

### Description

Addresses
https://github.com/hashicorp/consul/pull/17171#issuecomment-1636930705

* [OSS] test: improve xDS listener code coverage (#18138)

test: improve xDS listener code coverage

* Re-order expected/actual for assertContainerState in consul container tests (#18157)

Re-order expected/actual, consul container tests

* group and document make file (#17943)

* group and document make file

* Add `testing/deployer` (neé `consul-topology`) [NET-4610] (#17823)

Co-authored-by: R.B. Boyer <[email protected]>
Co-authored-by: R.B. Boyer <[email protected]>
Co-authored-by: Freddy <[email protected]>

* [NET-4792] Add integrations tests for jwt-auth (#18169)

* Add FIPS reference to consul enterprise docs (#18028)

* Add FIPS reference to consul enterprise docs

* Update website/content/docs/enterprise/index.mdx

Co-authored-by: David Yu <[email protected]>

* remove support for ecs client (fips)

---------

Co-authored-by: David Yu <[email protected]>

* add peering_commontopo tests [NET-3700] (#17951)

Co-authored-by: R.B. Boyer <[email protected]>
Co-authored-by: R.B. Boyer <[email protected]>
Co-authored-by: Freddy <[email protected]>
Co-authored-by: NiniOak <[email protected]>

* docs - remove Sentinel from enterprise features list (#18176)

* Update index.mdx
* Update kv.mdx
* Update docs-nav-data.json
* delete sentinel.mdx
* Update redirects.js

---------

Co-authored-by: Tu Nguyen <[email protected]>

* [NET-4865] Bump golang.org/x/net to 0.12.0 (#18186)

Bump golang.org/x/net to 0.12.0

While not necessary to directly address CVE-2023-29406 (which should be
handled by using a patched version of Go when building), an
accompanying change to HTTP/2 error handling does impact agent code.

See https://go-review.googlesource.com/c/net/+/506995 for the HTTP/2
change.

Bump this dependency across our submodules as well for the sake of
potential indirect consumers of `x/net/http`.

* Call resource mutate hook before validate hook (NET-4907) (#18178)

* [NET-4865] security: Update Go version to 1.20.6 (#18190)

Update Go version to 1.20.6

This resolves [CVE-2023-29406]
(https://nvd.nist.gov/vuln/detail/CVE-2023-29406) for uses of the
`net/http` standard library.

Note that until the follow-up to #18124 is done, the version of Go used
in those impacted tests will need to remain on 1.20.5.

* Improve XDS test coverage: JWT auth edition (#18183)

* Improve XDS test coverage: JWT auth edition

more tests

* test: xds coverage for jwt listeners

---------

Co-authored-by: DanStough <[email protected]>

* update readme.md (#18191)

u[date readme.md

* Update submodules to latest following 1.16.0 (#18197)

Align all our internal use of submodules on the latest versions.

* SEC-090: Automated trusted workflow pinning (2023-07-18) (#18174)

Result of tsccr-helper -log-level=info -pin-all-workflows .

Co-authored-by: hashicorp-tsccr[bot] <hashicorp-tsccr[bot]@users.noreply.github.com>

* Fix Backport Assistant PR commenting (#18200)

* Fix Backport Assistant failure PR commenting

For general comments on a PR, it looks like you have to use the `/issue`
endpoint rather than `/pulls`, which requires commit/other
review-specific target details.

This matches the endpoint used in `backport-reminder.yml`.

* Remove Backport Reminder workflow

This is noisy (even when adding multiple labels, individual comments per
label are generated), and likely no longer needed: we haven't had this
work in a long time due to an expired GH token, and we now have better
automation for backport PR assignment.

* resource: Pass resource to Write ACL hook instead of just resource Id [NET-4908] (#18192)

* Explicitly enable WebSocket upgrades (#18150)

This PR explicitly enables WebSocket upgrades in Envoy's UpgradeConfig for all
proxy types. (API Gateway, Ingress, and Sidecar.)

Fixes #8283

* docs: fix the description of client rpc (#18206)

* NET-4804: Add dashboard for monitoring consul-k8s (#18208)

* [OSS] Improve xDS Code Coverage - Clusters  (#18165)

test: improve xDS cluster code coverage

* NET-4222 take config file consul container (#18218)

Net 4222 take config file consul container

* Envoy Integration Test Windows (#18007)

* [CONSUL-395] Update check_hostport and Usage (#40)

* [CONSUL-397] Copy envoy binary from Image (#41)

* [CONSUL-382] Support openssl in unique test dockerfile (#43)

* [CONSUL-405] Add bats to single container (#44)

* [CONSUL-414] Run Prometheus Test Cases and Validate Changes (#46)

* [CONSUL-410] Run Jaeger in Single container (#45)

* [CONSUL-412] Run test-sds-server in single container (#48)

* [CONSUL-408] Clean containers (#47)

* [CONSUL-384] Rebase and sync fork (#50)

* [CONSUL-415] Create Scenarios Troubleshooting Docs (#49)

* [CONSUL-417] Update Docs Single Container (#51)

* [CONSUL-428] Add Socat to single container (#54)

* [CONSUL-424] Replace pkill in kill_envoy function (#52)

* [CONSUL-434] Modify Docker run functions in Helper script (#53)

* [CONSUL-435] Replace docker run in set_ttl_check_state & wait_for_agent_service_register functions (#55)

* [CONSUL-438] Add netcat (nc) in the Single container Dockerfile (#56)

* [CONSUL-429] Replace Docker run with Docker exec (#57)

* [CONSUL-436] Curl timeout and run tests (#58)

* [CONSUL-443] Create dogstatsd Function (#59)

* [CONSUL-431] Update Docs Netcat (#60)

* [CONSUL-439] Parse nc Command in function (#61)

* [CONSUL-463] Review curl Exec and get_ca_root Func (#63)

* [CONSUL-453] Docker hostname in Helper functions (#64)

* [CONSUL-461] Test wipe volumes without extra cont (#66)

* [CONSUL-454] Check ports in the Server and Agent containers (#65)

* [CONSUL-441] Update windows dockerfile with version (#62)

* [CONSUL-466] Review case-grpc Failing Test (#67)

* [CONSUL-494] Review case-cfg-resolver-svc-failover (#68)

* [CONSUL-496] Replace docker_wget & docker_curl (#69)

* [CONSUL-499] Cleanup Scripts - Remove nanoserver (#70)

* [CONSUL-500] Update Troubleshooting Docs (#72)

* [CONSUL-502] Pull & Tag Envoy Windows Image (#73)

* [CONSUL-504] Replace docker run in docker_consul (#76)

* [CONSUL-505] Change admin_bind

* [CONSUL-399] Update envoy to 1.23.1 (#78)

* [CONSUL-510] Support case-wanfed-gw on Windows (#79)

* [CONSUL-506] Update troubleshooting Documentation (#80)

* [CONSUL-512] Review debug_dump_volumes Function (#81)

* [CONSUL-514] Add zipkin to Docker Image (#82)

* [CONSUL-515] Update Documentation (#83)

* [CONSUL-529] Support case-consul-exec (#86)

* [CONSUL-530] Update Documentation (#87)

* [CONSUL-530] Update default consul version 1.13.3

* [CONSUL-539] Cleanup (#91)

* [CONSUL-546] Scripts Clean-up (#92)

* [CONSUL-491] Support admin_access_log_path value for Windows (#71)

* [CONSUL-519] Implement mkfifo Alternative (#84)

* [CONSUL-542] Create OS Specific Files for Envoy Package (#88)

* [CONSUL-543] Create exec_supported.go (#89)

* [CONSUL-544] Test and Build Changes (#90)

* Implement os.DevNull

* using mmap instead of disk files

* fix import in exec-unix

* fix nmap open too many arguemtn

* go fmt on file

* changelog file

* fix go mod

* Update .changelog/17694.txt

Co-authored-by: Dhia Ayachi <[email protected]>

* different mmap library

* fix bootstrap json

* some fixes

* chocolatey version fix and image fix

* using different library

* fix Map funciton call

* fix mmap call

* fix tcp dump

* fix tcp dump

* windows tcp dump

* Fix docker run

* fix tests

* fix go mod

* fix version 16.0

* fix version

* fix version dev

* sleep to debug

* fix sleep

* fix permission issue

* fix permission issue

* fix permission issue

* fix command

* fix command

* fix funciton

* fix assert config entry status command not found

* fix command not found assert_cert_has_cn

* fix command not found assert_upstream_missing

* fix command not found assert_upstream_missing_once

* fix command not found get_upstream_endpoint

* fix command not found get_envoy_public_listener_once

* fix command not found

* fix test cases

* windows integration test workflow github

* made code similar to unix using npipe

* fix go.mod

* fix dialing of npipe

* dont wait

* check size of written json

* fix undefined n

* running

* fix dep

* fix syntax error

* fix workflow file

* windows runner

* fix runner

* fix from json

* fix runs on

* merge connect envoy

* fix cin path

* build

* fix file name

* fix file name

* fix dev build

* remove unwanted code

* fix upload

* fix bin name

* fix path

* checkout current branch

* fix path

* fix tests

* fix shell bash for windows sh files

* fix permission of run-test.sh

* removed docker dev

* added shell bash for tests

* fix tag

* fix win=true

* fix cd

* added dev

* fix variable undefined

* removed failing tests

* fix tcp dump image

* fix curl

* fix curl

* tcp dump path

* fix tcpdump path

* fix curl

* fix curl install

* stop removing intermediate containers

* fix tcpdump docker image

* revert -rm

* --rm=false

* makeing docker image before

* fix tcpdump

* removed case consul exec

* removed terminating gateway simple

* comment case wasm

* removed data dog

* comment out upload coverage

* uncomment case-consul-exec

* comment case consul exec

* if always

* logs

* using consul 1.17.0

* fix quotes

* revert quotes

* redirect to dev null

* Revert version

* revert consul connect

* fix version

* removed envoy connect

* not using function

* change log

* docker logs

* fix logs

* restructure bad authz

* rmeoved dev null

* output

* fix file descriptor

* fix cacert

* fix cacert

* fix ca cert

* cacert does not work in windows curl

* fix func

* removed docker logs

* added sleep

* fix tls

* commented case-consul-exec

* removed echo

* retry docker consul

* fix upload bin

* uncomment consul exec

* copying consul.exe to docker image

* copy fix

* fix paths

* fix path

* github workspace path

* latest version

* Revert "latest version"

This reverts commit 5a7d7b82d9e7553bcb01b02557ec8969f9deba1d.

* commented consul exec

* added ssl revoke best effort

* revert best effort

* removed unused files

* rename var name and change dir

* windows runner

* permission

* needs setup fix

* swtich to github runner

* fix file path

* fix path

* fix path

* fix path

* fix path

* fix path

* fix build paths

* fix tag

* nightly runs

* added matrix in github workflow, renamed files

* fix job

* fix matrix

* removed brackes

* from json

* without using job matrix

* fix quotes

* revert job matrix

* fix workflow

* fix comment

* added comment

* nightly runs

* removed datadog ci as it is already measured in linux one

* running test

* Revert "running test"

This reverts commit 7013d15a23732179d18ec5d17336e16b26fab5d4.

* pr comment fixes

* running test now

* running subset of test

* running subset of test

* job matrix

* shell bash

* removed bash shell

* linux machine for job matrix

* fix output

* added cat to debug

* using ubuntu latest

* fix job matrix

* fix win true

* fix go test

* revert job matrix

---------

Co-authored-by: Jose Ignacio Lorenzo <[email protected]>
Co-authored-by: Franco Bruno Lavayen <[email protected]>
Co-authored-by: Ivan K Berlot <[email protected]>
Co-authored-by: Ezequiel Fernández Ponce <[email protected]>
Co-authored-by: joselo85 <[email protected]>
Co-authored-by: Ezequiel Fernández Ponce <[email protected]>
Co-authored-by: Dhia Ayachi <[email protected]>

* fix typos and update ecs compat table (#18215)

* fix typos and update ecs compat table

* real info for the ecs compat matrix table

* Update website/content/docs/ecs/compatibility.mdx

Co-authored-by: Chris Thain <[email protected]>

---------

Co-authored-by: Chris Thain <[email protected]>

* [OSS] proxystate: add proxystate protos (#18216)

* proxystate: add proxystate protos to pbmesh and resolve imports and conflicts between message names

* ci: don't verify s390x (#18224)

* [CC-5718] Remove HCP token requirement during bootstrap (#18140)

* [CC-5718] Remove HCP token requirement during bootstrap

* Re-add error for loading HCP management token

* Remove old comment

* Add changelog entry

* Remove extra validation line

* Apply suggestions from code review

Co-authored-by: lornasong <[email protected]>

---------

Co-authored-by: lornasong <[email protected]>

* [NET-4122] Doc guidance for federation with externalServers (#18207)

Doc guidance for federation with externalServers

Add guidance for proper configuration when joining to a secondary
cluster using WAN fed with external servers also enabled.

Also clarify federation requirements and fix formatting for an
unrelated value.

Update both the Helm chart reference (synced from `consul-k8s`, see
hashicorp/consul-k8s#2583) and the docs on using `externalServers`.

* [OSS] Improve xDS Code Coverage - Endpoints and Misc (#18222)

test: improve xDS endpoints code coverage

* Clarify license reporting timing and GDPR compliance (#18237)

Add Alicia's edits to clarify log timing and other details

* Fix Github Workflow File (#18241)

* [CONSUL-382] Support openssl in unique test dockerfile (#43)

* [CONSUL-405] Add bats to single container (#44)

* [CONSUL-414] Run Prometheus Test Cases and Validate Changes (#46)

* [CONSUL-410] Run Jaeger in Single container (#45)

* [CONSUL-412] Run test-sds-server in single container (#48)

* [CONSUL-408] Clean containers (#47)

* [CONSUL-384] Rebase and sync fork (#50)

* [CONSUL-415] Create Scenarios Troubleshooting Docs (#49)

* [CONSUL-417] Update Docs Single Container (#51)

* [CONSUL-428] Add Socat to single container (#54)

* [CONSUL-424] Replace pkill in kill_envoy function (#52)

* [CONSUL-434] Modify Docker run functions in Helper script (#53)

* [CONSUL-435] Replace docker run in set_ttl_check_state & wait_for_agent_service_register functions (#55)

* [CONSUL-438] Add netcat (nc) in the Single container Dockerfile (#56)

* [CONSUL-429] Replace Docker run with Docker exec (#57)

* [CONSUL-436] Curl timeout and run tests (#58)

* [CONSUL-443] Create dogstatsd Function (#59)

* [CONSUL-431] Update Docs Netcat (#60)

* [CONSUL-439] Parse nc Command in function (#61)

* [CONSUL-463] Review curl Exec and get_ca_root Func (#63)

* [CONSUL-453] Docker hostname in Helper functions (#64)

* [CONSUL-461] Test wipe volumes without extra cont (#66)

* [CONSUL-454] Check ports in the Server and Agent containers (#65)

* [CONSUL-441] Update windows dockerfile with version (#62)

* [CONSUL-466] Review case-grpc Failing Test (#67)

* [CONSUL-494] Review case-cfg-resolver-svc-failover (#68)

* [CONSUL-496] Replace docker_wget & docker_curl (#69)

* [CONSUL-499] Cleanup Scripts - Remove nanoserver (#70)

* [CONSUL-500] Update Troubleshooting Docs (#72)

* [CONSUL-502] Pull & Tag Envoy Windows Image (#73)

* [CONSUL-504] Replace docker run in docker_consul (#76)

* [CONSUL-505] Change admin_bind

* [CONSUL-399] Update envoy to 1.23.1 (#78)

* [CONSUL-510] Support case-wanfed-gw on Windows (#79)

* [CONSUL-506] Update troubleshooting Documentation (#80)

* [CONSUL-512] Review debug_dump_volumes Function (#81)

* [CONSUL-514] Add zipkin to Docker Image (#82)

* [CONSUL-515] Update Documentation (#83)

* [CONSUL-529] Support case-consul-exec (#86)

* [CONSUL-530] Update Documentation (#87)

* [CONSUL-530] Update default consul version 1.13.3

* [CONSUL-539] Cleanup (#91)

* [CONSUL-546] Scripts Clean-up (#92)

* [CONSUL-491] Support admin_access_log_path value for Windows (#71)

* [CONSUL-519] Implement mkfifo Alternative (#84)

* [CONSUL-542] Create OS Specific Files for Envoy Package (#88)

* [CONSUL-543] Create exec_supported.go (#89)

* [CONSUL-544] Test and Build Changes (#90)

* Implement os.DevNull

* using mmap instead of disk files

* fix import in exec-unix

* fix nmap open too many arguemtn

* go fmt on file

* changelog file

* fix go mod

* Update .changelog/17694.txt

Co-authored-by: Dhia Ayachi <[email protected]>

* different mmap library

* fix bootstrap json

* some fixes

* chocolatey version fix and image fix

* using different library

* fix Map funciton call

* fix mmap call

* fix tcp dump

* fix tcp dump

* windows tcp dump

* Fix docker run

* fix tests

* fix go mod

* fix version 16.0

* fix version

* fix version dev

* sleep to debug

* fix sleep

* fix permission issue

* fix permission issue

* fix permission issue

* fix command

* fix command

* fix funciton

* fix assert config entry status command not found

* fix command not found assert_cert_has_cn

* fix command not found assert_upstream_missing

* fix command not found assert_upstream_missing_once

* fix command not found get_upstream_endpoint

* fix command not found get_envoy_public_listener_once

* fix command not found

* fix test cases

* windows integration test workflow github

* made code similar to unix using npipe

* fix go.mod

* fix dialing of npipe

* dont wait

* check size of written json

* fix undefined n

* running

* fix dep

* fix syntax error

* fix workflow file

* windows runner

* fix runner

* fix from json

* fix runs on

* merge connect envoy

* fix cin path

* build

* fix file name

* fix file name

* fix dev build

* remove unwanted code

* fix upload

* fix bin name

* fix path

* checkout current branch

* fix path

* fix tests

* fix shell bash for windows sh files

* fix permission of run-test.sh

* removed docker dev

* added shell bash for tests

* fix tag

* fix win=true

* fix cd

* added dev

* fix variable undefined

* removed failing tests

* fix tcp dump image

* fix curl

* fix curl

* tcp dump path

* fix tcpdump path

* fix curl

* fix curl install

* stop removing intermediate containers

* fix tcpdump docker image

* revert -rm

* --rm=false

* makeing docker image before

* fix tcpdump

* removed case consul exec

* removed terminating gateway simple

* comment case wasm

* removed data dog

* comment out upload coverage

* uncomment case-consul-exec

* comment case consul exec

* if always

* logs

* using consul 1.17.0

* fix quotes

* revert quotes

* redirect to dev null

* Revert version

* revert consul connect

* fix version

* removed envoy connect

* not using function

* change log

* docker logs

* fix logs

* restructure bad authz

* rmeoved dev null

* output

* fix file descriptor

* fix cacert

* fix cacert

* fix ca cert

* cacert does not work in windows curl

* fix func

* removed docker logs

* added sleep

* fix tls

* commented case-consul-exec

* removed echo

* retry docker consul

* fix upload bin

* uncomment consul exec

* copying consul.exe to docker image

* copy fix

* fix paths

* fix path

* github workspace path

* latest version

* Revert "latest version"

This reverts commit 5a7d7b82d9e7553bcb01b02557ec8969f9deba1d.

* commented consul exec

* added ssl revoke best effort

* revert best effort

* removed unused files

* rename var name and change dir

* windows runner

* permission

* needs setup fix

* swtich to github runner

* fix file path

* fix path

* fix path

* fix path

* fix path

* fix path

* fix build paths

* fix tag

* nightly runs

* added matrix in github workflow, renamed files

* fix job

* fix matrix

* removed brackes

* from json

* without using job matrix

* fix quotes

* revert job matrix

* fix workflow

* fix comment

* added comment

* nightly runs

* removed datadog ci as it is already measured in linux one

* running test

* Revert "running test"

This reverts commit 7013d15a23732179d18ec5d17336e16b26fab5d4.

* pr comment fixes

* running test now

* running subset of test

* running subset of test

* job matrix

* shell bash

* removed bash shell

* linux machine for job matrix

* fix output

* added cat to debug

* using ubuntu latest

* fix job matrix

* fix win true

* fix go test

* revert job matrix

* Fix tests

---------

Co-authored-by: Ivan K Berlot <[email protected]>
Co-authored-by: Jose Ignacio Lorenzo <[email protected]>
Co-authored-by: Franco Bruno Lavayen <[email protected]>
Co-authored-by: Ezequiel Fernández Ponce <[email protected]>
Co-authored-by: joselo85 <[email protected]>
Co-authored-by: Ezequiel Fernández Ponce <[email protected]>
Co-authored-by: Dhia Ayachi <[email protected]>

* NET-4996 - filter go-tests and test-integration workflows from running on docs only and ui only changes (#18236)

* Align build arch matrix with enterprise (#18235)

Ensure that OSS remains in sync w/ Enterprise by aligning the format of
arch matrix args for various build jobs.

* Revert "NET-4996 - filter go-tests and test-integration workflows from running on docs only and ui only changes" (#18248)

Revert "NET-4996 - filter go-tests and test-integration workflows from running on docs only and ui only changes (#18236)"

This reverts commit a11dba710e6ce6f172c0fa6c9b61567cc1efffc8.

* resource: Add scope to resource type registration [NET-4976] (#18214)

Enables querying a resource type's registration to determine if a resource is cluster, partition, or partition and namespace scoped.

* Fix some inconsistencies in jwt docs (#18234)

* NET-1825: More new ACL token creation docs (#18063)

Co-authored-by: trujillo-adam <[email protected]>

* grafana: add the panel resource usage of connect injector (#18247)

* [NET-3700] Backfill changelog entry for c2bbe67 and 7402d06 (#18259)

Backfill changelog entry for c2bbe67 and 7402d06

Add a changelog entry for the follow-up PR since it was specific to the
fix and references the original change.

* NET-4897 - update comment to include the current issue url from the go team. (#18263)

* fix typos, style, and improper links (#18269)

* member cli: add -filter expression to flags (#18223)

* member cli: add -filter expression to flags

* changelog

* update doc

* Add test cases

* use quote

* go-tests: disable s390x (#18273)

* docs: Update ext-authz documentation for kubernetes (#18281)

Update ext-authz documentation for kubernetes

* docs: Consul on Kubernetes specific upgrade info (#18230)

* Compatibility page - dataplanes mention

* Upgrading higher-level dataplane mention

* `exec=` string callout

* More visible for upgrade page

* Apply suggestions from code review

Co-authored-by: Tu Nguyen <[email protected]>

---------

Co-authored-by: Tu Nguyen <[email protected]>
Co-authored-by: John Murret <[email protected]>

* Fix typo in Envoy extensions doc (#18284)

* docs: K8s secondary DC requirements (#18280)

* Requested edit

* Apply suggestions from code review

Co-authored-by: trujillo-adam <[email protected]>

---------

Co-authored-by: trujillo-adam <[email protected]>

* api-gateway: subscribe to bound-api-gateway only after receiving api-gateway (#18291)

* api-gateway: subscribe to bound-api-gateway only after receiving api-gateway

This fixes a race condition due to our dependency on having the listener(s) from the api-gateway config entry in order to fully and properly process the resources on the bound-api-gateway config entry.

* Apply suggestions from code review

* Add changelog entry

* Update K8s changelog to address cloud auto-join change in 1.0.0 (#18293)

* Update list of Envoy versions (#18300)

Update supported envoy versions to 1.24.10, 1.25.9, 1.26.4, 1.27.0.

* [NET-4904] Update list of Envoy versions in docs (#18306)

Update list of Envoy versions in docs

Update supported Envoy versions across Consul release versions.

* Update actions for TSCCR (#18317)

Update action versions before deadline

* Fix topology view when displaying mixed connect-native/normal services. (#13023)

* Fix topoloy intention with mixed connect-native/normal services.

If a service is registered twice, once with connect-native and once
without, the topology views would prune the existing intentions. This
change brings the code more in line with the transparent proxy behavior.

* Dedupe nodes in the ServiceTopology ui endpoint (like done with tags).

* Consider a service connect-native as soon as one instance is.

* Stop JWT provider from being written in non default namespace (#18325)

* docs: Fix some comments (#17118)

Signed-off-by: cui fliter <[email protected]>

* [NET-4703] Prevent partial application of Envoy extensions (#18068)

Prevent partial application of Envoy extensions

Ensure that non-required extensions do not change xDS resources before
exiting on failure by cloning proto messages prior to applying each
extension.

To support this change, also move `CanApply` checks up a layer and make
them prior to attempting extension application, s.t. we avoid
unnecessary copies where extensions can't be applied.

Last, ensure that we do not allow panics from `CanApply` or `Extend`
checks to escape the attempted extension application.

* docs: Simplify example jq commands by removing pipes (#18327)

Simplify jq command examples by removing pipes to other commands.

* fix typo in create a mesh token docs (#18337)

* [CC-5719] Add support for builtin global-read-only policy (#18319)

* [CC-5719] Add support for builtin global-read-only policy

* Add changelog

* Add read-only to docs

* Fix some minor issues.

* Change from ReplaceAll to Sprintf

* Change IsValidPolicy name to return an error instead of bool

* Fix PolicyList test

* Fix other tests

* Apply suggestions from code review

Co-authored-by: Paul Glass <[email protected]>

* Fix state store test for policy list.

* Fix naming issues

* Update acl/validation.go

Co-authored-by: Chris Thain <[email protected]>

* Update agent/consul/acl_endpoint.go

---------

Co-authored-by: Paul Glass <[email protected]>
Co-authored-by: Chris Thain <[email protected]>

* [NET-5121] proxystate: move protos to subdirectory to avoid conflicts (#18335)

* also makes a few protos updates

* resource: adding various helpers for working with resources (#18342)

This is a bit of a grab bag of helpers that I found useful for working with them when authoring substantial Controllers. Subsequent PRs will make use of them.

* Wasm integration tests for local and remote wasm files (#17756)

* wasm integration tests for local and remote wasm files

refactoring and cleanup for wasm testing

remove wasm debug logging

PR feedback, wasm build lock

correct path pattern for wasm build files

Add new helper function to minimize changes to existing test code

Remove extra param

mod tidy

add custom service setup to test lib

add wait until static server sidecar can reach nginx sidecar

Doc comments

PR feedback

Update workflows to compile wasm for integration tests

Fix docker build path

Fix package name for linter

Update makefile, fix redeclared function

Update expected wasm filename

Debug test ls in workflow

remove pwd in favor of relative path

more debugging

Build wasm in compatability tests as well

Build wasm directly in ci rather than in container

Debug tinygo and llvm version

Change wasm file extension

Remove tinygo debugging

Remove extra comments

* Add compiled wasm and build instructions

* [HCP Telemetry] Periodic Refresh for Dynamic Telemetry Configuration (#18168)

* OTElExporter now uses an EndpointProvider to discover the endpoint

* OTELSink uses a ConfigProvider to obtain filters and labels configuration

* improve tests for otel_sink

* Regex logic is moved into client for a method on the TelemetryConfig object

* Create a telemetry_config_provider and update deps to use it

* Fix conversion

* fix import newline

* Add logger to hcp client and move telemetry_config out of the client.go file

* Add a telemetry_config.go to refactor client.go

* Update deps

* update hcp deps test

* Modify telemetry_config_providers

* Check for nil filters

* PR review updates

* Fix comments and move around pieces

* Fix comments

* Remove context from client struct

* Moved ctx out of sink struct and fixed filters, added a test

* Remove named imports, use errors.New if not fformatting

* Remove HCP dependencies in telemetry package

* Add success metric and move lock only to grab the t.cfgHahs

* Update hash

* fix nits

* Create an equals method and add tests

* Improve telemetry_config_provider.go tests

* Add race test

* Add missing godoc

* Remove mock for MetricsClient

* Avoid goroutine test panics

* trying to kick CI lint issues by upgrading mod

* imprve test code and add hasher for testing

* Use structure logging for filters, fix error constants, and default to allow all regex

* removed hashin and modify logic to simplify

* Improve race test and fix PR feedback by removing hash equals and avoid testing the timer.Ticker logic, and instead unit test

* Ran make go-mod-tidy

* Use errtypes in the test

* Add changelog

* add safety check for exporter endpoint

* remove require.Contains by using error types, fix structure logging, and fix success metric typo in exporter

* Fixed race test to have changing config values

* Send success metric before modifying config

* Avoid the defer and move the success metric under

* NET-4240 - Snapshots are failing on Windows  (#18302)

* fix go mod

* fix go sum

* added change log

* ran make go mod tidy

* Register ProxyStateTemplate Resource (#18316)

  Also, change the ProxyState.id to identity. This is because we already have the id of this proxy
  from the resource, and this id should be name-aligned with the workload it represents. It should
  also have the owner ref set to the workload ID if we need that. And so the id field seems unnecessary.
  We do, however, need a reference to workload identity so that we can authorize the proxy when it initially
  connects to the xDS server.

* [NET-5146] security: Update Go version to 1.20.7 and `x/net` to 0.13.0 (#18358)

* Update Go version to 1.20.7

This resolves [CVE-2023-29409]
(https://nvd.nist.gov/vuln/detail/CVE-2023-29409)(`crypto/tls`).

* Bump golang.org/x/net to 0.13.0

Addresses [CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978)
for security scans (non-impacting).

* mesh: adding the protobuf types and resources backing mesh config v2 (#18351)

* [OSS] test: xds coverage for routes (#18369)

test: xds coverage for routes

* Fix policy lookup to allow for slashes (#18347)

* Fix policy lookup to allow for slashes

* Fix suggestions

* Fix other test

* Revert some lines

* add some initial CODEOWNERS (#18346)

* Add redirects for mesh-gateway docs (#18377)

* expose grpc as http endpoint (#18221)

expose resource grpc endpoints as http endpoints

* bimapper: fix a bug and add some more test coverage (#18387)

* [docs] Fix ServiceDefaults example in distributed tracing (#17212)

Fix ServiceDefaults example in distributed tracing.

* Fix #17730 - Dev mode has new line (#18367)

* adding new line only in case of pretty in url not in dev mode

* change log added

* chore: make go-mod-tidy (#18388)

* resource: Make resource read tenancy aware (#18397)

* Not using chmod - fixed integration test for Enterprise (#18401)

* Not using chmod

* checking icacls

* Removed push

* replaced ordered list of rate limit ops with flow diagram (#18398)

* replaced ordered list of rate limit ops with flow diagram

* made diagram font bigger

* updated colors for dark mode img

* fixed typo

* recentered dark mode image

* Apply suggestions from code review

Co-authored-by: Jeff Boruszak <[email protected]>

---------

Co-authored-by: Jeff Boruszak <[email protected]>

* Upgrade test: remove outdated test and disable log due to verbosity (#18403)

* remove outdated test

* disable log since we have too many parallel tests

* bump testcontainers-go from 0.22.0 and remove pinned go version in in… (#18395)

* bump testcontainers-go from 0.22.0 and remove pinned go version in integ test

* go mod tidy

* Replace deprecated target.Authority with target.URL.Host

* Add ServiceEndpoints Mutation hook tests (#18404)

* Add ServiceEndpoints Mutation hook tests

* Move endpoint owner validation into the validation hook

Also there were some minor changes to error validation to account for go-cmp not liking to peer through an errors.errorstring type that get created by errors.New

* catalog: add FailoverPolicy mutation and validation hooks (#18390)

Add most of the validation and mutation hooks for the FailoverPolicy resource.

* NET-5115 Add retry + timeout filters for api-gateway (#18324)

* squash, implement retry/timeout in consul core

* update tests

* catalog: adding a controller to reconcile FailoverPolicy resources (#18399)

Add most of the semantic cross-resource validation for FailoverPolicy resources using a new controller.

* fix the error in ent repo (#18421)

fix the error in ent repo

* build: updates for 1.16.1 release (#18415)

* build: updates for 1.16.1 release

* build: fix missing replace directive for envoyextensions

* build: go mod tidy testing/deployer

* update ECS links (#18419)

* docs: fix incorrect proxy-defaults config in Lua Envoy extension (#18418)

fix incorrect proxy-defaults config

* resource: Make resource write tenancy aware (#18423)

* [NET-5217] [OSS] Derive sidecar proxy locality from parent service (#18437)

* Add logging to locality policy application

In OSS, this is currently a no-op.

* Inherit locality when registering sidecars

When sidecar locality is not explicitly configured, inherit locality
from the proxied service.

* NET-4984: Update APIGW Config Entries for JWT Auth (#18366)

* Added oss config entries for Policy and JWT on APIGW

* Updated structs for config entry

* Updated comments, ran deep-copy

* Move JWT configuration into OSS file

* Add in the config entry OSS file for jwts

* Added changelog

* fixing proto spacing

* Moved to using manually written deep copy method

* Use pointers for override/default fields in apigw config entries

* Run gen scripts for changed types

* k8s compat - Openshift versions (#18307)

* Update compatibility.mdx

Co-authored-by: trujillo-adam <[email protected]>

* APIGW: Update HTTPRouteConfigEntry for JWT Auth (#18422)

* Updated httproute config entry for JWT Filters

* Added manual deepcopy method for httproute jwt filter

* Fix test

* Update JWTFilter to be in oss file

* Add changelog

* Add build tags for deepcopy oss file

* [COMPLIANCE] License changes (#18443)

* Adding explicit MPL license for sub-package

This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository.

* Adding explicit MPL license for sub-package

This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository.

* Updating the license from MPL to Business Source License

Going forward, this project will be licensed under the Business Source License v1.1. Please see our blog post for more details at <Blog URL>, FAQ at www.hashicorp.com/licensing-faq, and details of the license at www.hashicorp.com/bsl.

* add missing license headers

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

---------

Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com>

* Net-2708/delete resource endpoint (#18420)

* feat: add http delete endpoint for resource service

* refactor: clean up

* Disable deep-copy codegen verification for now. (#18446)

Once we figure out what to do with license headers for these files we should re-enable this check.

* build: upgrade to latest buf v1.26.0 (#18426)

* NET-4952 Add docs for export command (#18425)

* Init file for services export command docs

* Add link for export command to nav

* Add export to list of subcommands for services

* Add usage and basic command options

* Add API options using includes

* Add section for enterprise options

* Include argument value in flag format

* Add examples

* Apply suggestions from code review

Co-authored-by: Jeff Boruszak <[email protected]>

---------

Co-authored-by: Jeff Boruszak <[email protected]>

* Net-2712/resource hcl parsing (#18250)

* Initial protohcl implementation

Co-authored-by: Matt Keeler <[email protected]>
Co-authored-by: Daniel Upton <[email protected]>

* resourcehcl: implement resource decoding on top of protohcl

Co-authored-by: Daniel Upton <[email protected]>

* fix: resolve ci failures

* test: add additional unmarshalling tests

* refactor: update function test to clean protohcl package imports

---------

Co-authored-by: Matt Keeler <[email protected]>
Co-authored-by: Daniel Upton <[email protected]>

* read endpoint (#18268)

implement http read endpoint to expose resource grpc service read method

* Net-2707/list resource endpoint (#18444)

feat: list resources endpoint

* Fix incorrect yaml in examples (#18463)

* NET-5187: Upgrade test timeout due to log producer errors (#18461)

Stop log producer before restarting container

* [NET-4799] [OSS] xdsv2: listeners L4 support for connect proxies (#18436)

* refactor to avoid future import cycles

* resource: Make resource list tenancy aware (#18475)

* [COMPLIANCE] License update (#18479)

Update BUSL LICENSE to include licensed product and version.

Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com>

* docs…
trujillo-adam added a commit that referenced this pull request Sep 7, 2023
@trujillo-adam @beautifulentropy
@jmurret @Ranjandas @jm96441n @roncodingenthusiast @loshz @hashi-derek @absolutelightning @im2nguyen @xwa153 @cthain @boruszak @nathancoleman @evanphx @JadhavPoonam @DanStough @karras @jcjones @fulviodenza @krastin @david3a @curtbushko @nfi-hashicorp @t-davies @lkysow @vijayraghav-io @jkirschner-hashicorp @eddie-rowe @emilymianeil @nv-hashi @ishustava @Jeff-Apple @huikang @cocolavayen @joselo85 @dhiaayachi @rboyer @freddygv @NiniOak @zalimeni @analogue @hashicorp-tsccr @blake @iberlot @ezfepo @ndhanushkodi @jjacobson93 @lornasong @judithpatudith @gautambaghel @apollo13 @cuishuang @johnlanda @Achooo @ilpianista @mkeeler @sarahalsmiller @nvanthao @hashicorp-copywrite @boxofrad @natmegs @hc-github-team-consul-core @hdkshingala
Backport/docs/proxy defaults reformat other improvements/quietly join…
b68274d 
…t monitor (#18699)

* tlsutil: Fix check TLS configuration (#17481)

* tlsutil: Fix check TLS configuration
* Rewording docs.
* Update website/content/docs/services/configuration/checks-configuration-reference.mdx
Co-authored-by: trujillo-adam <[email protected]>
* Fix typos and add changelog entry.
---------

Co-authored-by: trujillo-adam <[email protected]>

* docs: Deprecations for connect-native SDK and specific connect native APIs (#17937)

* Update v1_16_x.mdx
* Update connect native golang page

---------

Co-authored-by: trujillo-adam <[email protected]>

* Revert "Add workflow to verify linux release packages (#17904)" (#17942)

This reverts commit 3368f14fab500ebe9f6aeab5631dd1d5f5a453e5.

* Fixes Secondary ConnectCA update (#17846)

This fixes a bug that was identified which resulted in subsequent
ConnectCA configuration update not to persist in the cluster.

* fixing typo in link to jwt-validations-with-intentions doc (#17955)

* Fix streaming backend link (#17958)

* Fix streaming backend link
* Update health.mdx

* Dynamically create jwks clusters for jwt-providers (#17944)

* website: remove deprecated agent rpc docs (#17962)

* Fix missing BalanceOutboundConnections in v2 catalog. (#17964)

* feature - [NET - 4005]  - [Supportability] Reloadable Configuration - enable_debug (#17565)

* # This is a combination of 9 commits.
# This is the 1st commit message:

init without tests

# This is the commit message #2:

change log

# This is the commit message #3:

fix tests

# This is the commit message #4:

fix tests

# This is the commit message #5:

added tests

# This is the commit message #6:

change log breaking change

# This is the commit message #7:

removed breaking change

# This is the commit message #8:

fix test

# This is the commit message #9:

keeping the test behaviour same

* # This is a combination of 12 commits.
# This is the 1st commit message:

init without tests

# This is the commit message #2:

change log

# This is the commit message #3:

fix tests

# This is the commit message #4:

fix tests

# This is the commit message #5:

added tests

# This is the commit message #6:

change log breaking change

# This is the commit message #7:

removed breaking change

# This is the commit message #8:

fix test

# This is the commit message #9:

keeping the test behaviour same

# This is the commit message #10:

made enable debug atomic bool

# This is the commit message #11:

fix lint

# This is the commit message #12:

fix test true enable debug

* parent 10f500e895d92cc3691ade7b74a33db755d22039
author absolutelightning <[email protected]> 1687352587 +0530
committer absolutelightning <[email protected]> 1687352592 +0530

init without tests

change log

fix tests

fix tests

added tests

change log breaking change

removed breaking change

fix test

keeping the test behaviour same

made enable debug atomic bool

fix lint

fix test true enable debug

using enable debug in agent as atomic bool

test fixes

fix tests

fix tests

added update on correct locaiton

fix tests

fix reloadable config enable debug

fix tests

fix init and acl 403

* revert commit

* Fix formatting codeblocks on APIgw docs (#17970)

* fix formatting codeblocks

* remove unnecessary indents

* Remove POC code (#17974)

* update doc (#17910)

* update doc

* update link

* Remove duplicate and unused newDecodeConfigEntry func (#17979)

* docs: samenessGroup YAML examples (#17984)

* configuration entry syntax

* Example config

* Add changelog entry for 1.16.0 (#17987)

* Fix typo (#17198)

servcies => services

* Expose JWKS cluster config through JWTProviderConfigEntry (#17978)

* Expose JWKS cluster config through JWTProviderConfigEntry

* fix typos, rename trustedCa to trustedCA

* Integration test for ext-authz Envoy extension (#17980)

* Fix incorrect protocol for transparent proxy upstreams. (#17894)

This PR fixes a bug that was introduced in:
https://github.com/hashicorp/consul/pull/16021

A user setting a protocol in proxy-defaults would cause tproxy implicit
upstreams to not honor the upstream service's protocol set in its
`ServiceDefaults.Protocol` field, and would instead always use the
proxy-defaults value.

Due to the fact that upstreams configured with "tcp" can successfully contact
upstream "http" services, this issue was not recognized until recently (a
proxy-defaults with "tcp" and a listening service with "http" would make
successful requests, but not the opposite).

As a temporary work-around, users experiencing this issue can explicitly set
the protocol on the `ServiceDefaults.UpstreamConfig.Overrides`, which should
take precedence.

The fix in this PR removes the proxy-defaults protocol from the wildcard
upstream that tproxy uses to configure implicit upstreams. When the protocol
was included, it would always overwrite the value during discovery chain
compilation, which was not correct. The discovery chain compiler also consumes
proxy defaults to determine the protocol, so simply excluding it from the
wildcard upstream config map resolves the issue.

* feat: include nodes count in operator usage endpoint and cli command (#17939)

* feat: update operator usage api endpoint to include nodes count

* feat: update operator usange cli command to includes nodes count

* [OSS] Improve Gateway Test Coverage of Catalog Health (#18011)

* fix(cli): remove failing check from 'connect envoy' registration for api gateway

* test(integration): add tests to check catalog statsus of gateways on startup

* remove extra sleep comment

* Update test/integration/consul-container/libs/assert/service.go

* changelog

* Fixes Traffic rate limitting docs (#17997)

* Fix removed service-to-service peering links (#17221)

* docs: fix removed service-to-service peering links

* docs: extend peering-via-mesh-gateways intro (thanks @trujillo-adam)

---------

Co-authored-by: trujillo-adam <[email protected]>

* docs: Sameness "beta" warning (#18017)

* Warning updates

* .x

* updated typo in tab heading (#18022)

* updated typo in tab heading

* updated tab group typo, too

* Document that DNS lookups can target cluster peers (#17990)

Static DNS lookups, in addition to explicitly targeting a datacenter,
can target a cluster peer. This was added in 95dc0c7b301b70a6b955a8b7c9737c9b86f03df6 but didn't make the documentation.

The driving function for the change is `parseLocality` here: https://github.com/hashicorp/consul/blob/0b1299c28d8127129d61310ee4280055298438e0/agent/dns_oss.go#L25

The biggest change in this is to adjust the standard lookup syntax to tie
`.<datacenter>` to `.dc` as required-together, and to append in the similar `.<cluster-peer>.peer` optional argument, both to A record and SRV record lookups.

Co-authored-by: David Yu <[email protected]>

* Add first integration test for jwt auth with intention (#18005)

* fix stand-in text for name field (#18030)

* removed sameness conf entry from failover nav (#18033)

* docs - add service sync annotations and k8s service weight annotation (#18032)

* Docs for https://github.com/hashicorp/consul-k8s/pull/2293
* remove versions for enterprise features since they are old

---------

Co-authored-by: Tu Nguyen <[email protected]>

* docs - add jobs use case for service mesh k8s (#18037)

* docs - add jobs use case for service mesh k8s
* add code blocks

* address feedback (#18045)

* Add verify server hostname to tls default (#17155)

* [OSS] Fix initial_fetch_timeout to wait for all xDS resources (#18024)

* fix(connect): set initial_fetch_time to wait indefinitely

* changelog

* PR feedback 1

* ui: fix typos for peer service imports (#17999)

* test: fix FIPS inline cert test message (#18076)

* Fix a couple typos in Agent Telemetry Metrics docs (#18080)

* Fix metrics docs

* Add changelog

Signed-off-by: josh <[email protected]>

---------

Signed-off-by: josh <[email protected]>

* docs updates - cluster peering and virtual services (#18069)

* Update route-to-virtual-services.mdx
* Update establish-peering.mdx

* Update service-mesh-compare.mdx (#17279)

grammar change

* Update helm docs on main (#18085)

* ci: use gotestsum v1.10.1 [NET-4042] (#18088)

* Docs: Update proxy lifecycle annotations and consul-dataplane flags (#18075)

* Update proxy lifecycle annotations and consul-dataplane flags

* Pass configured role name to Vault for AWS auth in Connect CA (#17885)

* Docs for dataplane upgrade on k8s (#18051)

* Docs for dataplane upgrade on k8s

---------

Co-authored-by: David Yu <[email protected]>
Co-authored-by: trujillo-adam <[email protected]>

* docs - update upgrade index page to not recommend consul leave. (#18100)

* Displays Consul version of each nodes in UI nodes section (#17754)

* update UINodes and UINodeInfo response with consul-version info added as NodeMeta, fetched from serf members

* update test cases TestUINodes, TestUINodeInfo

* added nil check for map

* add consul-version in local agent node metadata

* get consul version from serf member and add this as node meta in catalog register request

* updated ui mock response to include consul versions as node meta

* updated ui trans and added version as query param to node list route

* updates in ui templates to display consul version with filter and sorts

* updates in ui - model class, serializers,comparators,predicates for consul version feature

* added change log for Consul Version Feature

* updated to get version from consul service, if for some reason not available from serf

* updated changelog text

* updated dependent testcases

* multiselection version filter

* Update agent/consul/state/catalog.go

comments updated

Co-authored-by: Jared Kirschner <[email protected]>

---------

Co-authored-by: Jared Kirschner <[email protected]>

* api gw 1.16 updates (#18081)

* api gw 1.16 updates

* Apply suggestions from code review

Co-authored-by: Jeff Boruszak <[email protected]>

* update CodeBlockConfig filename

* Apply suggestions from code review

Co-authored-by: trujillo-adam <[email protected]>
Co-authored-by: Jeff Boruszak <[email protected]>

* remove non-standard intentions page

* Update website/content/docs/api-gateway/configuration/index.mdx

Co-authored-by: trujillo-adam <[email protected]>

---------

Co-authored-by: Jeff Boruszak <[email protected]>
Co-authored-by: trujillo-adam <[email protected]>

* [NET-4103] ci: build s390x (#18067)

* ci: build s390x

* ci: test s390x

* ci: dev build s390x

* no GOOS

* ent only

* build: publish s390x

* fix syntax error

* fix syntax error again

* fix syntax error again x2

* test branch

* Move s390x conditionals to step level

* remove test branch

---------

Co-authored-by: emilymianeil <[email protected]>

* :ermahgerd "Sevice Mesh" -> "Service Mesh" (#18116)

Just a typo in the docs.

* Split pbmesh.UpstreamsConfiguration as a resource out of pbmesh.Upstreams (#17991)

Configuration that previously was inlined into the Upstreams resource
applies to both explicit and implicit upstreams and so it makes sense to
split it out into its own resource.

It also has other minor changes:
- Renames `proxy.proto` proxy_configuration.proto`
- Changes the type of `Upstream.destination_ref` from `pbresource.ID` to
`pbresource.Reference`
- Adds comments to fields that didn't have them

* [NET-4895] ci - api tests and consul container tests error because of dependency bugs with go 1.20.6.  Pin go to 1.20.5. (#18124)

### Description
The following jobs started failing when go 1.20.6 was released:
- `go-test-api-1-19`
- `go-test-api-1-20`
- `compatibility-integration-tests`
- `upgrade-integration-tests`

`compatibility-integration-tests` and `compatibility-integration-tests`
to this testcontainers issue:
https://github.com/testcontainers/testcontainers-go/issues/1359. This
issue calls for testcontainers to release a new version when one of
their dependencies is fixed. When that is done, we will unpin the go
versions in `compatibility-integration-tests` and
`compatibility-integration-tests`.

### Testing & Reproduction steps

See these jobs broken in CI and then see them work with this PR.

---------

Co-authored-by: Chris Thain <[email protected]>

* Add ingress gateway deprecation notices to docs (#18102)

### Description

This adds notices, that ingress gateway is deprecated, to several places
in the product docs where ingress gateway is the topic.

### Testing & Reproduction steps

Tested with a local copy of the website.

### Links

Deprecation of ingress gateway was announced in the Release Notes for
Consul 1.16 and Consul-K8s 1.2. See:

[https://developer.hashicorp.com/consul/docs/release-notes/consul/v1_16_x#what-s-deprecated](https://developer.hashicorp.com/consul/docs/release-notes/consul/v1_16_x#what-s-deprecated
)

[https://developer.hashicorp.com/consul/docs/release-notes/consul-k8s/v1_2_x#what-s-deprecated](https://developer.hashicorp.com/consul/docs/release-notes/consul-k8s/v1_2_x#what-s-deprecated)

### PR Checklist

* [N/A] updated test coverage
* [X] external facing docs updated
* [X] appropriate backport labels added
* [X] not a security concern

---------

Co-authored-by: trujillo-adam <[email protected]>

* Add docs for jwt cluster configuration (#18004)

### Description

<!-- Please describe why you're making this change, in plain English.
-->

- Add jwt-provider docs for jwks cluster configuration. The
configuration was added here:
https://github.com/hashicorp/consul/pull/17978

* Docs: fix unmatched bracket for health checks page (#18134)

* NET-4657/add resource service client (#18053)

### Description

<!-- Please describe why you're making this change, in plain English.
-->
Dan had already started on this
[task](https://github.com/hashicorp/consul/pull/17849) which is needed
to start building the HTTP APIs. This just needed some cleanup to get it
ready for review.

Overview:

- Rename `internalResourceServiceClient` to
`insecureResourceServiceClient` for name consistency
- Configure a `secureResourceServiceClient` with auth enabled

### PR Checklist

* [ ] ~updated test coverage~
* [ ] ~external facing docs updated~
* [x] appropriate backport labels added
* [ ] ~not a security concern~

* Fix bug with Vault CA provider (#18112)

Updating RootPKIPath but not IntermediatePKIPath would not update 
leaf signing certs with the new root. Unsure if this happens in practice 
but manual testing showed it is a bug that would break mesh and agent 
connections once the old root is pruned.

* [NET-4897] net/http host header is now verified and request.host that contains socked now error (#18129)

### Description

This is related to https://github.com/hashicorp/consul/pull/18124 where
we pinned the go versions in CI to 1.20.5 and 1.19.10.

go 1.20.6 and 1.19.11 now validate request host headers for validity,
including the hostname cannot be prefixed with slashes.

For local communications (npipe://, unix://), the hostname is not used,
but we need valid and meaningful hostname. Prior versions go Go would
clean the host header, and strip slashes in the process, but go1.20.6
and go1.19.11 no longer do, and reject the host header. Around the
community we are seeing that others are intercepting the req.host and if
it starts with a slash or ends with .sock, they changing the host to
localhost or another dummy value.

[client: define a "dummy" hostname to use for local connections by
thaJeztah · Pull Request #45942 ·
moby/moby](https://github.com/moby/moby/pull/45942)

### Testing & Reproduction steps

Check CI tests.

### Links
* [ ] updated test coverage
* [ ] external facing docs updated
* [ ] appropriate backport labels added
* [ ] not a security concern

* add a conditional around setting LANFilter.AllSegments to make sure it is valid (#18139)

### Description

This is to correct a code problem because this assumes all segments, but
when you get to Enterprise, you can be in partition that is not the
default partition, in which case specifying all segments does not
validate and fails. This is to correct the setting of this filter with
`AllSegments` to `true` to only occur when in the the `default`
partition.

### Testing & Reproduction steps

<!--

* In the case of bugs, describe how to replicate
* If any manual tests were done, document the steps and the conditions
to replicate
* Call out any important/ relevant unit tests, e2e tests or integration
tests you have added or are adding

-->

### Links

<!--

Include any links here that might be helpful for people reviewing your
PR (Tickets, GH issues, API docs, external benchmarks, tools docs, etc).
If there are none, feel free to delete this section.

Please be mindful not to leak any customer or confidential information.
HashiCorp employees may want to use our internal URL shortener to
obfuscate links.

-->

### PR Checklist

* [ ] updated test coverage
* [ ] external facing docs updated
* [ ] appropriate backport labels added
* [ ] not a security concern

* chore: bump upgrade integrations tests to 1.15, 116 [NET-4743] (#18130)

* re org resource type registry (#18133)

* fix: update delegateMock used in ENT (#18149)

### Description

<!-- Please describe why you're making this change, in plain English.
-->
The mock is used in `http_ent_test` file which caused lint failures. For
OSS->ENT parity adding the same change here.

### Links

<!--

Include any links here that might be helpful for people reviewing your
PR (Tickets, GH issues, API docs, external benchmarks, tools docs, etc).
If there are none, feel free to delete this section.

Please be mindful not to leak any customer or confidential information.
HashiCorp employees may want to use our internal URL shortener to
obfuscate links.

-->

Identified in OSS->ENT [merge
PR](https://github.com/hashicorp/consul-enterprise/pull/6328)

### PR Checklist

* [ ] ~updated test coverage~
* [ ] ~external facing docs updated~
* [x] appropriate backport labels added
* [ ] ~not a security concern~

* Use JWT-auth filter in metadata mode & Delegate validation to RBAC filter (#18062)

### Description

<!-- Please describe why you're making this change, in plain English.
-->

- Currently the jwt-auth filter doesn't take into account the service
identity when validating jwt-auth, it only takes into account the path
and jwt provider during validation. This causes issues when multiple
source intentions restrict access to an endpoint with different JWT
providers.
- To fix these issues, rather than use the JWT auth filter for
validation, we use it in metadata mode and allow it to forward the
successful validated JWT token payload to the RBAC filter which will
make the decisions.

This PR ensures requests with and without JWT tokens successfully go
through the jwt-authn filter. The filter however only forwards the data
for successful/valid tokens. On the RBAC filter level, we check the
payload for claims and token issuer + existing rbac rules.

### Testing & Reproduction steps

<!--

* In the case of bugs, describe how to replicate
* If any manual tests were done, document the steps and the conditions
to replicate
* Call out any important/ relevant unit tests, e2e tests or integration
tests you have added or are adding

-->

- This test covers a multi level jwt requirements (requirements at top
level and permissions level). It also assumes you have envoy running,
you have a redis and a sidecar proxy service registered, and have a way
to generate jwks with jwt. I mostly use:
https://www.scottbrady91.com/tools/jwt for this.

- first write your proxy defaults
```
Kind = "proxy-defaults"
name = "global"
config {
  protocol = "http"
}
```
- Create two providers 
```
Kind = "jwt-provider"
Name = "auth0"
Issuer = "https://ronald.local"

JSONWebKeySet = {
    Local = {
     JWKS = "eyJrZXlzIjog....."
    }
}
```

```
Kind = "jwt-provider"
Name = "okta"
Issuer = "https://ronald.local"

JSONWebKeySet = {
   Local = {
     JWKS = "eyJrZXlzIjogW3...."
    }
}
```

- add a service intention
```
Kind = "service-intentions"
Name = "redis"

JWT = {
  Providers = [
    {
      Name = "okta"
    },
  ]
}

Sources = [
  {
    Name = "*"
    Permissions = [{
      Action = "allow"
      HTTP = {
        PathPrefix = "/workspace"
      }
      JWT = {
        Providers = [
          {
            Name = "okta"
            VerifyClaims = [
              {
                  Path = ["aud"]
                  Value = "my_client_app"
              },
              {
                Path = ["sub"]
                Value = "5be86359073c434bad2da3932222dabe"
              }
            ]
          },
        ]
      }

    },
    {
      Action = "allow"
      HTTP = {
        PathPrefix = "/"
      }
      JWT = {
        Providers = [
          {
            Name = "auth0"
          },
        ]
      }

    }]
  }
]
```
- generate 3 jwt tokens: 1 from auth0 jwks, 1 from okta jwks with
different claims than `/workspace` expects and 1 with correct claims
- connect to your envoy (change service and address as needed) to view
logs and potential errors. You can add: `-- --log-level debug` to see
what data is being forwarded
```
consul connect envoy -sidecar-for redis1 -grpc-addr 127.0.0.1:8502
```
- Make the following requests: 
```
curl -s -H "Authorization: Bearer $Auth0_TOKEN" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v

RBAC filter denied

curl -s -H "Authorization: Bearer $Okta_TOKEN_with_wrong_claims" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v

RBAC filter denied

curl -s -H "Authorization: Bearer $Okta_TOKEN_with_correct_claims" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v

Successful request
```


### TODO

* [x] Update test coverage
* [ ] update integration tests (follow-up PR)
* [x] appropriate backport labels added

* Support Consul Connect Envoy Command on Windows (#17694)

### Description

Add support for consul connect envoy command on windows. This PR fixes
the comments of PR - https://github.com/hashicorp/consul/pull/15114

### Testing
* Built consul.exe from this branch on windows and hosted here - [AWS
S3](https://asheshvidyut-bucket.s3.ap-southeast-2.amazonaws.com/consul.zip)
* Updated the
[tutorial](https://developer.hashicorp.com/consul/tutorials/developer-mesh/consul-windows-workloads)
and changed the `consul_url.default` value to [AWS
S3](https://asheshvidyut-bucket.s3.ap-southeast-2.amazonaws.com/consul.zip)
* Followed the steps in the tutorial and verified that everything is
working as described.

### PR Checklist

* [x] updated test coverage
* [ ] external facing docs updated
* [x] appropriate backport labels added
* [x] not a security concern

---------

Co-authored-by: Franco Bruno Lavayen <[email protected]>
Co-authored-by: Jose Ignacio Lorenzo <[email protected]>
Co-authored-by: Jose Ignacio Lorenzo <[email protected]>
Co-authored-by: Dhia Ayachi <[email protected]>

* Change docs to say 168h instead of 7d for server_rejoin_age_max (#18154)

### Description

Addresses
https://github.com/hashicorp/consul/pull/17171#issuecomment-1636930705

* [OSS] test: improve xDS listener code coverage (#18138)

test: improve xDS listener code coverage

* Re-order expected/actual for assertContainerState in consul container tests (#18157)

Re-order expected/actual, consul container tests

* group and document make file (#17943)

* group and document make file

* Add `testing/deployer` (neé `consul-topology`) [NET-4610] (#17823)

Co-authored-by: R.B. Boyer <[email protected]>
Co-authored-by: R.B. Boyer <[email protected]>
Co-authored-by: Freddy <[email protected]>

* [NET-4792] Add integrations tests for jwt-auth (#18169)

* Add FIPS reference to consul enterprise docs (#18028)

* Add FIPS reference to consul enterprise docs

* Update website/content/docs/enterprise/index.mdx

Co-authored-by: David Yu <[email protected]>

* remove support for ecs client (fips)

---------

Co-authored-by: David Yu <[email protected]>

* add peering_commontopo tests [NET-3700] (#17951)

Co-authored-by: R.B. Boyer <[email protected]>
Co-authored-by: R.B. Boyer <[email protected]>
Co-authored-by: Freddy <[email protected]>
Co-authored-by: NiniOak <[email protected]>

* docs - remove Sentinel from enterprise features list (#18176)

* Update index.mdx
* Update kv.mdx
* Update docs-nav-data.json
* delete sentinel.mdx
* Update redirects.js

---------

Co-authored-by: Tu Nguyen <[email protected]>

* [NET-4865] Bump golang.org/x/net to 0.12.0 (#18186)

Bump golang.org/x/net to 0.12.0

While not necessary to directly address CVE-2023-29406 (which should be
handled by using a patched version of Go when building), an
accompanying change to HTTP/2 error handling does impact agent code.

See https://go-review.googlesource.com/c/net/+/506995 for the HTTP/2
change.

Bump this dependency across our submodules as well for the sake of
potential indirect consumers of `x/net/http`.

* Call resource mutate hook before validate hook (NET-4907) (#18178)

* [NET-4865] security: Update Go version to 1.20.6 (#18190)

Update Go version to 1.20.6

This resolves [CVE-2023-29406]
(https://nvd.nist.gov/vuln/detail/CVE-2023-29406) for uses of the
`net/http` standard library.

Note that until the follow-up to #18124 is done, the version of Go used
in those impacted tests will need to remain on 1.20.5.

* Improve XDS test coverage: JWT auth edition (#18183)

* Improve XDS test coverage: JWT auth edition

more tests

* test: xds coverage for jwt listeners

---------

Co-authored-by: DanStough <[email protected]>

* update readme.md (#18191)

u[date readme.md

* Update submodules to latest following 1.16.0 (#18197)

Align all our internal use of submodules on the latest versions.

* SEC-090: Automated trusted workflow pinning (2023-07-18) (#18174)

Result of tsccr-helper -log-level=info -pin-all-workflows .

Co-authored-by: hashicorp-tsccr[bot] <hashicorp-tsccr[bot]@users.noreply.github.com>

* Fix Backport Assistant PR commenting (#18200)

* Fix Backport Assistant failure PR commenting

For general comments on a PR, it looks like you have to use the `/issue`
endpoint rather than `/pulls`, which requires commit/other
review-specific target details.

This matches the endpoint used in `backport-reminder.yml`.

* Remove Backport Reminder workflow

This is noisy (even when adding multiple labels, individual comments per
label are generated), and likely no longer needed: we haven't had this
work in a long time due to an expired GH token, and we now have better
automation for backport PR assignment.

* resource: Pass resource to Write ACL hook instead of just resource Id [NET-4908] (#18192)

* Explicitly enable WebSocket upgrades (#18150)

This PR explicitly enables WebSocket upgrades in Envoy's UpgradeConfig for all
proxy types. (API Gateway, Ingress, and Sidecar.)

Fixes #8283

* docs: fix the description of client rpc (#18206)

* NET-4804: Add dashboard for monitoring consul-k8s (#18208)

* [OSS] Improve xDS Code Coverage - Clusters  (#18165)

test: improve xDS cluster code coverage

* NET-4222 take config file consul container (#18218)

Net 4222 take config file consul container

* Envoy Integration Test Windows (#18007)

* [CONSUL-395] Update check_hostport and Usage (#40)

* [CONSUL-397] Copy envoy binary from Image (#41)

* [CONSUL-382] Support openssl in unique test dockerfile (#43)

* [CONSUL-405] Add bats to single container (#44)

* [CONSUL-414] Run Prometheus Test Cases and Validate Changes (#46)

* [CONSUL-410] Run Jaeger in Single container (#45)

* [CONSUL-412] Run test-sds-server in single container (#48)

* [CONSUL-408] Clean containers (#47)

* [CONSUL-384] Rebase and sync fork (#50)

* [CONSUL-415] Create Scenarios Troubleshooting Docs (#49)

* [CONSUL-417] Update Docs Single Container (#51)

* [CONSUL-428] Add Socat to single container (#54)

* [CONSUL-424] Replace pkill in kill_envoy function (#52)

* [CONSUL-434] Modify Docker run functions in Helper script (#53)

* [CONSUL-435] Replace docker run in set_ttl_check_state & wait_for_agent_service_register functions (#55)

* [CONSUL-438] Add netcat (nc) in the Single container Dockerfile (#56)

* [CONSUL-429] Replace Docker run with Docker exec (#57)

* [CONSUL-436] Curl timeout and run tests (#58)

* [CONSUL-443] Create dogstatsd Function (#59)

* [CONSUL-431] Update Docs Netcat (#60)

* [CONSUL-439] Parse nc Command in function (#61)

* [CONSUL-463] Review curl Exec and get_ca_root Func (#63)

* [CONSUL-453] Docker hostname in Helper functions (#64)

* [CONSUL-461] Test wipe volumes without extra cont (#66)

* [CONSUL-454] Check ports in the Server and Agent containers (#65)

* [CONSUL-441] Update windows dockerfile with version (#62)

* [CONSUL-466] Review case-grpc Failing Test (#67)

* [CONSUL-494] Review case-cfg-resolver-svc-failover (#68)

* [CONSUL-496] Replace docker_wget & docker_curl (#69)

* [CONSUL-499] Cleanup Scripts - Remove nanoserver (#70)

* [CONSUL-500] Update Troubleshooting Docs (#72)

* [CONSUL-502] Pull & Tag Envoy Windows Image (#73)

* [CONSUL-504] Replace docker run in docker_consul (#76)

* [CONSUL-505] Change admin_bind

* [CONSUL-399] Update envoy to 1.23.1 (#78)

* [CONSUL-510] Support case-wanfed-gw on Windows (#79)

* [CONSUL-506] Update troubleshooting Documentation (#80)

* [CONSUL-512] Review debug_dump_volumes Function (#81)

* [CONSUL-514] Add zipkin to Docker Image (#82)

* [CONSUL-515] Update Documentation (#83)

* [CONSUL-529] Support case-consul-exec (#86)

* [CONSUL-530] Update Documentation (#87)

* [CONSUL-530] Update default consul version 1.13.3

* [CONSUL-539] Cleanup (#91)

* [CONSUL-546] Scripts Clean-up (#92)

* [CONSUL-491] Support admin_access_log_path value for Windows (#71)

* [CONSUL-519] Implement mkfifo Alternative (#84)

* [CONSUL-542] Create OS Specific Files for Envoy Package (#88)

* [CONSUL-543] Create exec_supported.go (#89)

* [CONSUL-544] Test and Build Changes (#90)

* Implement os.DevNull

* using mmap instead of disk files

* fix import in exec-unix

* fix nmap open too many arguemtn

* go fmt on file

* changelog file

* fix go mod

* Update .changelog/17694.txt

Co-authored-by: Dhia Ayachi <[email protected]>

* different mmap library

* fix bootstrap json

* some fixes

* chocolatey version fix and image fix

* using different library

* fix Map funciton call

* fix mmap call

* fix tcp dump

* fix tcp dump

* windows tcp dump

* Fix docker run

* fix tests

* fix go mod

* fix version 16.0

* fix version

* fix version dev

* sleep to debug

* fix sleep

* fix permission issue

* fix permission issue

* fix permission issue

* fix command

* fix command

* fix funciton

* fix assert config entry status command not found

* fix command not found assert_cert_has_cn

* fix command not found assert_upstream_missing

* fix command not found assert_upstream_missing_once

* fix command not found get_upstream_endpoint

* fix command not found get_envoy_public_listener_once

* fix command not found

* fix test cases

* windows integration test workflow github

* made code similar to unix using npipe

* fix go.mod

* fix dialing of npipe

* dont wait

* check size of written json

* fix undefined n

* running

* fix dep

* fix syntax error

* fix workflow file

* windows runner

* fix runner

* fix from json

* fix runs on

* merge connect envoy

* fix cin path

* build

* fix file name

* fix file name

* fix dev build

* remove unwanted code

* fix upload

* fix bin name

* fix path

* checkout current branch

* fix path

* fix tests

* fix shell bash for windows sh files

* fix permission of run-test.sh

* removed docker dev

* added shell bash for tests

* fix tag

* fix win=true

* fix cd

* added dev

* fix variable undefined

* removed failing tests

* fix tcp dump image

* fix curl

* fix curl

* tcp dump path

* fix tcpdump path

* fix curl

* fix curl install

* stop removing intermediate containers

* fix tcpdump docker image

* revert -rm

* --rm=false

* makeing docker image before

* fix tcpdump

* removed case consul exec

* removed terminating gateway simple

* comment case wasm

* removed data dog

* comment out upload coverage

* uncomment case-consul-exec

* comment case consul exec

* if always

* logs

* using consul 1.17.0

* fix quotes

* revert quotes

* redirect to dev null

* Revert version

* revert consul connect

* fix version

* removed envoy connect

* not using function

* change log

* docker logs

* fix logs

* restructure bad authz

* rmeoved dev null

* output

* fix file descriptor

* fix cacert

* fix cacert

* fix ca cert

* cacert does not work in windows curl

* fix func

* removed docker logs

* added sleep

* fix tls

* commented case-consul-exec

* removed echo

* retry docker consul

* fix upload bin

* uncomment consul exec

* copying consul.exe to docker image

* copy fix

* fix paths

* fix path

* github workspace path

* latest version

* Revert "latest version"

This reverts commit 5a7d7b82d9e7553bcb01b02557ec8969f9deba1d.

* commented consul exec

* added ssl revoke best effort

* revert best effort

* removed unused files

* rename var name and change dir

* windows runner

* permission

* needs setup fix

* swtich to github runner

* fix file path

* fix path

* fix path

* fix path

* fix path

* fix path

* fix build paths

* fix tag

* nightly runs

* added matrix in github workflow, renamed files

* fix job

* fix matrix

* removed brackes

* from json

* without using job matrix

* fix quotes

* revert job matrix

* fix workflow

* fix comment

* added comment

* nightly runs

* removed datadog ci as it is already measured in linux one

* running test

* Revert "running test"

This reverts commit 7013d15a23732179d18ec5d17336e16b26fab5d4.

* pr comment fixes

* running test now

* running subset of test

* running subset of test

* job matrix

* shell bash

* removed bash shell

* linux machine for job matrix

* fix output

* added cat to debug

* using ubuntu latest

* fix job matrix

* fix win true

* fix go test

* revert job matrix

---------

Co-authored-by: Jose Ignacio Lorenzo <[email protected]>
Co-authored-by: Franco Bruno Lavayen <[email protected]>
Co-authored-by: Ivan K Berlot <[email protected]>
Co-authored-by: Ezequiel Fernández Ponce <[email protected]>
Co-authored-by: joselo85 <[email protected]>
Co-authored-by: Ezequiel Fernández Ponce <[email protected]>
Co-authored-by: Dhia Ayachi <[email protected]>

* fix typos and update ecs compat table (#18215)

* fix typos and update ecs compat table

* real info for the ecs compat matrix table

* Update website/content/docs/ecs/compatibility.mdx

Co-authored-by: Chris Thain <[email protected]>

---------

Co-authored-by: Chris Thain <[email protected]>

* [OSS] proxystate: add proxystate protos (#18216)

* proxystate: add proxystate protos to pbmesh and resolve imports and conflicts between message names

* ci: don't verify s390x (#18224)

* [CC-5718] Remove HCP token requirement during bootstrap (#18140)

* [CC-5718] Remove HCP token requirement during bootstrap

* Re-add error for loading HCP management token

* Remove old comment

* Add changelog entry

* Remove extra validation line

* Apply suggestions from code review

Co-authored-by: lornasong <[email protected]>

---------

Co-authored-by: lornasong <[email protected]>

* [NET-4122] Doc guidance for federation with externalServers (#18207)

Doc guidance for federation with externalServers

Add guidance for proper configuration when joining to a secondary
cluster using WAN fed with external servers also enabled.

Also clarify federation requirements and fix formatting for an
unrelated value.

Update both the Helm chart reference (synced from `consul-k8s`, see
hashicorp/consul-k8s#2583) and the docs on using `externalServers`.

* [OSS] Improve xDS Code Coverage - Endpoints and Misc (#18222)

test: improve xDS endpoints code coverage

* Clarify license reporting timing and GDPR compliance (#18237)

Add Alicia's edits to clarify log timing and other details

* Fix Github Workflow File (#18241)

* [CONSUL-382] Support openssl in unique test dockerfile (#43)

* [CONSUL-405] Add bats to single container (#44)

* [CONSUL-414] Run Prometheus Test Cases and Validate Changes (#46)

* [CONSUL-410] Run Jaeger in Single container (#45)

* [CONSUL-412] Run test-sds-server in single container (#48)

* [CONSUL-408] Clean containers (#47)

* [CONSUL-384] Rebase and sync fork (#50)

* [CONSUL-415] Create Scenarios Troubleshooting Docs (#49)

* [CONSUL-417] Update Docs Single Container (#51)

* [CONSUL-428] Add Socat to single container (#54)

* [CONSUL-424] Replace pkill in kill_envoy function (#52)

* [CONSUL-434] Modify Docker run functions in Helper script (#53)

* [CONSUL-435] Replace docker run in set_ttl_check_state & wait_for_agent_service_register functions (#55)

* [CONSUL-438] Add netcat (nc) in the Single container Dockerfile (#56)

* [CONSUL-429] Replace Docker run with Docker exec (#57)

* [CONSUL-436] Curl timeout and run tests (#58)

* [CONSUL-443] Create dogstatsd Function (#59)

* [CONSUL-431] Update Docs Netcat (#60)

* [CONSUL-439] Parse nc Command in function (#61)

* [CONSUL-463] Review curl Exec and get_ca_root Func (#63)

* [CONSUL-453] Docker hostname in Helper functions (#64)

* [CONSUL-461] Test wipe volumes without extra cont (#66)

* [CONSUL-454] Check ports in the Server and Agent containers (#65)

* [CONSUL-441] Update windows dockerfile with version (#62)

* [CONSUL-466] Review case-grpc Failing Test (#67)

* [CONSUL-494] Review case-cfg-resolver-svc-failover (#68)

* [CONSUL-496] Replace docker_wget & docker_curl (#69)

* [CONSUL-499] Cleanup Scripts - Remove nanoserver (#70)

* [CONSUL-500] Update Troubleshooting Docs (#72)

* [CONSUL-502] Pull & Tag Envoy Windows Image (#73)

* [CONSUL-504] Replace docker run in docker_consul (#76)

* [CONSUL-505] Change admin_bind

* [CONSUL-399] Update envoy to 1.23.1 (#78)

* [CONSUL-510] Support case-wanfed-gw on Windows (#79)

* [CONSUL-506] Update troubleshooting Documentation (#80)

* [CONSUL-512] Review debug_dump_volumes Function (#81)

* [CONSUL-514] Add zipkin to Docker Image (#82)

* [CONSUL-515] Update Documentation (#83)

* [CONSUL-529] Support case-consul-exec (#86)

* [CONSUL-530] Update Documentation (#87)

* [CONSUL-530] Update default consul version 1.13.3

* [CONSUL-539] Cleanup (#91)

* [CONSUL-546] Scripts Clean-up (#92)

* [CONSUL-491] Support admin_access_log_path value for Windows (#71)

* [CONSUL-519] Implement mkfifo Alternative (#84)

* [CONSUL-542] Create OS Specific Files for Envoy Package (#88)

* [CONSUL-543] Create exec_supported.go (#89)

* [CONSUL-544] Test and Build Changes (#90)

* Implement os.DevNull

* using mmap instead of disk files

* fix import in exec-unix

* fix nmap open too many arguemtn

* go fmt on file

* changelog file

* fix go mod

* Update .changelog/17694.txt

Co-authored-by: Dhia Ayachi <[email protected]>

* different mmap library

* fix bootstrap json

* some fixes

* chocolatey version fix and image fix

* using different library

* fix Map funciton call

* fix mmap call

* fix tcp dump

* fix tcp dump

* windows tcp dump

* Fix docker run

* fix tests

* fix go mod

* fix version 16.0

* fix version

* fix version dev

* sleep to debug

* fix sleep

* fix permission issue

* fix permission issue

* fix permission issue

* fix command

* fix command

* fix funciton

* fix assert config entry status command not found

* fix command not found assert_cert_has_cn

* fix command not found assert_upstream_missing

* fix command not found assert_upstream_missing_once

* fix command not found get_upstream_endpoint

* fix command not found get_envoy_public_listener_once

* fix command not found

* fix test cases

* windows integration test workflow github

* made code similar to unix using npipe

* fix go.mod

* fix dialing of npipe

* dont wait

* check size of written json

* fix undefined n

* running

* fix dep

* fix syntax error

* fix workflow file

* windows runner

* fix runner

* fix from json

* fix runs on

* merge connect envoy

* fix cin path

* build

* fix file name

* fix file name

* fix dev build

* remove unwanted code

* fix upload

* fix bin name

* fix path

* checkout current branch

* fix path

* fix tests

* fix shell bash for windows sh files

* fix permission of run-test.sh

* removed docker dev

* added shell bash for tests

* fix tag

* fix win=true

* fix cd

* added dev

* fix variable undefined

* removed failing tests

* fix tcp dump image

* fix curl

* fix curl

* tcp dump path

* fix tcpdump path

* fix curl

* fix curl install

* stop removing intermediate containers

* fix tcpdump docker image

* revert -rm

* --rm=false

* makeing docker image before

* fix tcpdump

* removed case consul exec

* removed terminating gateway simple

* comment case wasm

* removed data dog

* comment out upload coverage

* uncomment case-consul-exec

* comment case consul exec

* if always

* logs

* using consul 1.17.0

* fix quotes

* revert quotes

* redirect to dev null

* Revert version

* revert consul connect

* fix version

* removed envoy connect

* not using function

* change log

* docker logs

* fix logs

* restructure bad authz

* rmeoved dev null

* output

* fix file descriptor

* fix cacert

* fix cacert

* fix ca cert

* cacert does not work in windows curl

* fix func

* removed docker logs

* added sleep

* fix tls

* commented case-consul-exec

* removed echo

* retry docker consul

* fix upload bin

* uncomment consul exec

* copying consul.exe to docker image

* copy fix

* fix paths

* fix path

* github workspace path

* latest version

* Revert "latest version"

This reverts commit 5a7d7b82d9e7553bcb01b02557ec8969f9deba1d.

* commented consul exec

* added ssl revoke best effort

* revert best effort

* removed unused files

* rename var name and change dir

* windows runner

* permission

* needs setup fix

* swtich to github runner

* fix file path

* fix path

* fix path

* fix path

* fix path

* fix path

* fix build paths

* fix tag

* nightly runs

* added matrix in github workflow, renamed files

* fix job

* fix matrix

* removed brackes

* from json

* without using job matrix

* fix quotes

* revert job matrix

* fix workflow

* fix comment

* added comment

* nightly runs

* removed datadog ci as it is already measured in linux one

* running test

* Revert "running test"

This reverts commit 7013d15a23732179d18ec5d17336e16b26fab5d4.

* pr comment fixes

* running test now

* running subset of test

* running subset of test

* job matrix

* shell bash

* removed bash shell

* linux machine for job matrix

* fix output

* added cat to debug

* using ubuntu latest

* fix job matrix

* fix win true

* fix go test

* revert job matrix

* Fix tests

---------

Co-authored-by: Ivan K Berlot <[email protected]>
Co-authored-by: Jose Ignacio Lorenzo <[email protected]>
Co-authored-by: Franco Bruno Lavayen <[email protected]>
Co-authored-by: Ezequiel Fernández Ponce <[email protected]>
Co-authored-by: joselo85 <[email protected]>
Co-authored-by: Ezequiel Fernández Ponce <[email protected]>
Co-authored-by: Dhia Ayachi <[email protected]>

* NET-4996 - filter go-tests and test-integration workflows from running on docs only and ui only changes (#18236)

* Align build arch matrix with enterprise (#18235)

Ensure that OSS remains in sync w/ Enterprise by aligning the format of
arch matrix args for various build jobs.

* Revert "NET-4996 - filter go-tests and test-integration workflows from running on docs only and ui only changes" (#18248)

Revert "NET-4996 - filter go-tests and test-integration workflows from running on docs only and ui only changes (#18236)"

This reverts commit a11dba710e6ce6f172c0fa6c9b61567cc1efffc8.

* resource: Add scope to resource type registration [NET-4976] (#18214)

Enables querying a resource type's registration to determine if a resource is cluster, partition, or partition and namespace scoped.

* Fix some inconsistencies in jwt docs (#18234)

* NET-1825: More new ACL token creation docs (#18063)

Co-authored-by: trujillo-adam <[email protected]>

* grafana: add the panel resource usage of connect injector (#18247)

* [NET-3700] Backfill changelog entry for c2bbe67 and 7402d06 (#18259)

Backfill changelog entry for c2bbe67 and 7402d06

Add a changelog entry for the follow-up PR since it was specific to the
fix and references the original change.

* NET-4897 - update comment to include the current issue url from the go team. (#18263)

* fix typos, style, and improper links (#18269)

* member cli: add -filter expression to flags (#18223)

* member cli: add -filter expression to flags

* changelog

* update doc

* Add test cases

* use quote

* go-tests: disable s390x (#18273)

* docs: Update ext-authz documentation for kubernetes (#18281)

Update ext-authz documentation for kubernetes

* docs: Consul on Kubernetes specific upgrade info (#18230)

* Compatibility page - dataplanes mention

* Upgrading higher-level dataplane mention

* `exec=` string callout

* More visible for upgrade page

* Apply suggestions from code review

Co-authored-by: Tu Nguyen <[email protected]>

---------

Co-authored-by: Tu Nguyen <[email protected]>
Co-authored-by: John Murret <[email protected]>

* Fix typo in Envoy extensions doc (#18284)

* docs: K8s secondary DC requirements (#18280)

* Requested edit

* Apply suggestions from code review

Co-authored-by: trujillo-adam <[email protected]>

---------

Co-authored-by: trujillo-adam <[email protected]>

* api-gateway: subscribe to bound-api-gateway only after receiving api-gateway (#18291)

* api-gateway: subscribe to bound-api-gateway only after receiving api-gateway

This fixes a race condition due to our dependency on having the listener(s) from the api-gateway config entry in order to fully and properly process the resources on the bound-api-gateway config entry.

* Apply suggestions from code review

* Add changelog entry

* Update K8s changelog to address cloud auto-join change in 1.0.0 (#18293)

* Update list of Envoy versions (#18300)

Update supported envoy versions to 1.24.10, 1.25.9, 1.26.4, 1.27.0.

* [NET-4904] Update list of Envoy versions in docs (#18306)

Update list of Envoy versions in docs

Update supported Envoy versions across Consul release versions.

* Update actions for TSCCR (#18317)

Update action versions before deadline

* Fix topology view when displaying mixed connect-native/normal services. (#13023)

* Fix topoloy intention with mixed connect-native/normal services.

If a service is registered twice, once with connect-native and once
without, the topology views would prune the existing intentions. This
change brings the code more in line with the transparent proxy behavior.

* Dedupe nodes in the ServiceTopology ui endpoint (like done with tags).

* Consider a service connect-native as soon as one instance is.

* Stop JWT provider from being written in non default namespace (#18325)

* docs: Fix some comments (#17118)

Signed-off-by: cui fliter <[email protected]>

* [NET-4703] Prevent partial application of Envoy extensions (#18068)

Prevent partial application of Envoy extensions

Ensure that non-required extensions do not change xDS resources before
exiting on failure by cloning proto messages prior to applying each
extension.

To support this change, also move `CanApply` checks up a layer and make
them prior to attempting extension application, s.t. we avoid
unnecessary copies where extensions can't be applied.

Last, ensure that we do not allow panics from `CanApply` or `Extend`
checks to escape the attempted extension application.

* docs: Simplify example jq commands by removing pipes (#18327)

Simplify jq command examples by removing pipes to other commands.

* fix typo in create a mesh token docs (#18337)

* [CC-5719] Add support for builtin global-read-only policy (#18319)

* [CC-5719] Add support for builtin global-read-only policy

* Add changelog

* Add read-only to docs

* Fix some minor issues.

* Change from ReplaceAll to Sprintf

* Change IsValidPolicy name to return an error instead of bool

* Fix PolicyList test

* Fix other tests

* Apply suggestions from code review

Co-authored-by: Paul Glass <[email protected]>

* Fix state store test for policy list.

* Fix naming issues

* Update acl/validation.go

Co-authored-by: Chris Thain <[email protected]>

* Update agent/consul/acl_endpoint.go

---------

Co-authored-by: Paul Glass <[email protected]>
Co-authored-by: Chris Thain <[email protected]>

* [NET-5121] proxystate: move protos to subdirectory to avoid conflicts (#18335)

* also makes a few protos updates

* resource: adding various helpers for working with resources (#18342)

This is a bit of a grab bag of helpers that I found useful for working with them when authoring substantial Controllers. Subsequent PRs will make use of them.

* Wasm integration tests for local and remote wasm files (#17756)

* wasm integration tests for local and remote wasm files

refactoring and cleanup for wasm testing

remove wasm debug logging

PR feedback, wasm build lock

correct path pattern for wasm build files

Add new helper function to minimize changes to existing test code

Remove extra param

mod tidy

add custom service setup to test lib

add wait until static server sidecar can reach nginx sidecar

Doc comments

PR feedback

Update workflows to compile wasm for integration tests

Fix docker build path

Fix package name for linter

Update makefile, fix redeclared function

Update expected wasm filename

Debug test ls in workflow

remove pwd in favor of relative path

more debugging

Build wasm in compatability tests as well

Build wasm directly in ci rather than in container

Debug tinygo and llvm version

Change wasm file extension

Remove tinygo debugging

Remove extra comments

* Add compiled wasm and build instructions

* [HCP Telemetry] Periodic Refresh for Dynamic Telemetry Configuration (#18168)

* OTElExporter now uses an EndpointProvider to discover the endpoint

* OTELSink uses a ConfigProvider to obtain filters and labels configuration

* improve tests for otel_sink

* Regex logic is moved into client for a method on the TelemetryConfig object

* Create a telemetry_config_provider and update deps to use it

* Fix conversion

* fix import newline

* Add logger to hcp client and move telemetry_config out of the client.go file

* Add a telemetry_config.go to refactor client.go

* Update deps

* update hcp deps test

* Modify telemetry_config_providers

* Check for nil filters

* PR review updates

* Fix comments and move around pieces

* Fix comments

* Remove context from client struct

* Moved ctx out of sink struct and fixed filters, added a test

* Remove named imports, use errors.New if not fformatting

* Remove HCP dependencies in telemetry package

* Add success metric and move lock only to grab the t.cfgHahs

* Update hash

* fix nits

* Create an equals method and add tests

* Improve telemetry_config_provider.go tests

* Add race test

* Add missing godoc

* Remove mock for MetricsClient

* Avoid goroutine test panics

* trying to kick CI lint issues by upgrading mod

* imprve test code and add hasher for testing

* Use structure logging for filters, fix error constants, and default to allow all regex

* removed hashin and modify logic to simplify

* Improve race test and fix PR feedback by removing hash equals and avoid testing the timer.Ticker logic, and instead unit test

* Ran make go-mod-tidy

* Use errtypes in the test

* Add changelog

* add safety check for exporter endpoint

* remove require.Contains by using error types, fix structure logging, and fix success metric typo in exporter

* Fixed race test to have changing config values

* Send success metric before modifying config

* Avoid the defer and move the success metric under

* NET-4240 - Snapshots are failing on Windows  (#18302)

* fix go mod

* fix go sum

* added change log

* ran make go mod tidy

* Register ProxyStateTemplate Resource (#18316)

  Also, change the ProxyState.id to identity. This is because we already have the id of this proxy
  from the resource, and this id should be name-aligned with the workload it represents. It should
  also have the owner ref set to the workload ID if we need that. And so the id field seems unnecessary.
  We do, however, need a reference to workload identity so that we can authorize the proxy when it initially
  connects to the xDS server.

* [NET-5146] security: Update Go version to 1.20.7 and `x/net` to 0.13.0 (#18358)

* Update Go version to 1.20.7

This resolves [CVE-2023-29409]
(https://nvd.nist.gov/vuln/detail/CVE-2023-29409)(`crypto/tls`).

* Bump golang.org/x/net to 0.13.0

Addresses [CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978)
for security scans (non-impacting).

* mesh: adding the protobuf types and resources backing mesh config v2 (#18351)

* [OSS] test: xds coverage for routes (#18369)

test: xds coverage for routes

* Fix policy lookup to allow for slashes (#18347)

* Fix policy lookup to allow for slashes

* Fix suggestions

* Fix other test

* Revert some lines

* add some initial CODEOWNERS (#18346)

* Add redirects for mesh-gateway docs (#18377)

* expose grpc as http endpoint (#18221)

expose resource grpc endpoints as http endpoints

* bimapper: fix a bug and add some more test coverage (#18387)

* [docs] Fix ServiceDefaults example in distributed tracing (#17212)

Fix ServiceDefaults example in distributed tracing.

* Fix #17730 - Dev mode has new line (#18367)

* adding new line only in case of pretty in url not in dev mode

* change log added

* chore: make go-mod-tidy (#18388)

* resource: Make resource read tenancy aware (#18397)

* Not using chmod - fixed integration test for Enterprise (#18401)

* Not using chmod

* checking icacls

* Removed push

* replaced ordered list of rate limit ops with flow diagram (#18398)

* replaced ordered list of rate limit ops with flow diagram

* made diagram font bigger

* updated colors for dark mode img

* fixed typo

* recentered dark mode image

* Apply suggestions from code review

Co-authored-by: Jeff Boruszak <[email protected]>

---------

Co-authored-by: Jeff Boruszak <[email protected]>

* Upgrade test: remove outdated test and disable log due to verbosity (#18403)

* remove outdated test

* disable log since we have too many parallel tests

* bump testcontainers-go from 0.22.0 and remove pinned go version in in… (#18395)

* bump testcontainers-go from 0.22.0 and remove pinned go version in integ test

* go mod tidy

* Replace deprecated target.Authority with target.URL.Host

* Add ServiceEndpoints Mutation hook tests (#18404)

* Add ServiceEndpoints Mutation hook tests

* Move endpoint owner validation into the validation hook

Also there were some minor changes to error validation to account for go-cmp not liking to peer through an errors.errorstring type that get created by errors.New

* catalog: add FailoverPolicy mutation and validation hooks (#18390)

Add most of the validation and mutation hooks for the FailoverPolicy resource.

* NET-5115 Add retry + timeout filters for api-gateway (#18324)

* squash, implement retry/timeout in consul core

* update tests

* catalog: adding a controller to reconcile FailoverPolicy resources (#18399)

Add most of the semantic cross-resource validation for FailoverPolicy resources using a new controller.

* fix the error in ent repo (#18421)

fix the error in ent repo

* build: updates for 1.16.1 release (#18415)

* build: updates for 1.16.1 release

* build: fix missing replace directive for envoyextensions

* build: go mod tidy testing/deployer

* update ECS links (#18419)

* docs: fix incorrect proxy-defaults config in Lua Envoy extension (#18418)

fix incorrect proxy-defaults config

* resource: Make resource write tenancy aware (#18423)

* [NET-5217] [OSS] Derive sidecar proxy locality from parent service (#18437)

* Add logging to locality policy application

In OSS, this is currently a no-op.

* Inherit locality when registering sidecars

When sidecar locality is not explicitly configured, inherit locality
from the proxied service.

* NET-4984: Update APIGW Config Entries for JWT Auth (#18366)

* Added oss config entries for Policy and JWT on APIGW

* Updated structs for config entry

* Updated comments, ran deep-copy

* Move JWT configuration into OSS file

* Add in the config entry OSS file for jwts

* Added changelog

* fixing proto spacing

* Moved to using manually written deep copy method

* Use pointers for override/default fields in apigw config entries

* Run gen scripts for changed types

* k8s compat - Openshift versions (#18307)

* Update compatibility.mdx

Co-authored-by: trujillo-adam <[email protected]>

* APIGW: Update HTTPRouteConfigEntry for JWT Auth (#18422)

* Updated httproute config entry for JWT Filters

* Added manual deepcopy method for httproute jwt filter

* Fix test

* Update JWTFilter to be in oss file

* Add changelog

* Add build tags for deepcopy oss file

* [COMPLIANCE] License changes (#18443)

* Adding explicit MPL license for sub-package

This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository.

* Adding explicit MPL license for sub-package

This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository.

* Updating the license from MPL to Business Source License

Going forward, this project will be licensed under the Business Source License v1.1. Please see our blog post for more details at <Blog URL>, FAQ at www.hashicorp.com/licensing-faq, and details of the license at www.hashicorp.com/bsl.

* add missing license headers

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

* Update copyright file headers to BUSL-1.1

---------

Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com>

* Net-2708/delete resource endpoint (#18420)

* feat: add http delete endpoint for resource service

* refactor: clean up

* Disable deep-copy codegen verification for now. (#18446)

Once we figure out what to do with license headers for these files we should re-enable this check.

* build: upgrade to latest buf v1.26.0 (#18426)

* NET-4952 Add docs for export command (#18425)

* Init file for services export command docs

* Add link for export command to nav

* Add export to list of subcommands for services

* Add usage and basic command options

* Add API options using includes

* Add section for enterprise options

* Include argument value in flag format

* Add examples

* Apply suggestions from code review

Co-authored-by: Jeff Boruszak <[email protected]>

---------

Co-authored-by: Jeff Boruszak <[email protected]>

* Net-2712/resource hcl parsing (#18250)

* Initial protohcl implementation

Co-authored-by: Matt Keeler <[email protected]>
Co-authored-by: Daniel Upton <[email protected]>

* resourcehcl: implement resource decoding on top of protohcl

Co-authored-by: Daniel Upton <[email protected]>

* fix: resolve ci failures

* test: add additional unmarshalling tests

* refactor: update function test to clean protohcl package imports

---------

Co-authored-by: Matt Keeler <[email protected]>
Co-authored-by: Daniel Upton <[email protected]>

* read endpoint (#18268)

implement http read endpoint to expose resource grpc service read method

* Net-2707/list resource endpoint (#18444)

feat: list resources endpoint

* Fix incorrect yaml in examples (#18463)

* NET-5187: Upgrade test timeout due to log producer errors (#18461)

Stop log producer before restarting container

* [NET-4799] [OSS] xdsv2: listeners L4 support for connect proxies (#18436)

* refactor to avoid future import cycles

* resource: Make resource list tenancy aware (#18475)

* [COMPLIANCE] License update (#18479)

Update BUSL LICENSE to include licensed product and version.

Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com>

* docs: specify manual server metadata intervention (#18477)

* docs: Update OpenShift compatibility  (#18478)

Update compatibility.mdx

* resource: Make resource delete tenancy aware (#18476)

resource: Make resource delete tenancy awarae

* Add license-checker action that fails when any backported file contains BUSL header (#18485)

* Add license-checker action that fails when any backported file contains BUSL header

* Quote echoed variable to retain line breaks

* Add ticket to reference for more details

* docs: Update K8s TGW tutorial to reliably obtain role ID (#18474)

The `grep…
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@boxofrad boxofrad boxofrad approved these changes

@banks banks banks approved these changes

@jmurret jmurret jmurret approved these changes

Assignees
No one assigned
Labels
backport/1.15 This release series is no longer active on CE. Use backport/ent/1.15. theme/config Relating to Consul Agent configuration, including reloading
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
6 participants
@loshz @markusschuh @david-yu @banks @boxofrad @jmurret