From 5290ba3cc51ec81d8e030f3d993e5bb74a188aae Mon Sep 17 00:00:00 2001 From: hc-github-team-consul-core Date: Wed, 6 Sep 2023 21:49:09 -0500 Subject: [PATCH] Backport of Reformat proxy docs refresh into release/1.16.x (#18696) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Update Consul K8s Upgrade Doc Updates (#17921) Updating upgrade procedures to encompass expected errors during upgrade process from v1.13.x to v1.14.x. * Update sameness-group.mdx (#17915) * Update create-sameness-groups.mdx (#17927) * deps: coredns v1.10.1 (#17912) * Ensure RSA keys are at least 2048 bits in length (#17911) * Ensure RSA keys are at least 2048 bits in length * Add changelog * update key length check for FIPS compliance * Fix no new variables error and failing to return when error exists from validating * clean up code for better readability * actually return value * tlsutil: Fix check TLS configuration (#17481) * tlsutil: Fix check TLS configuration * Rewording docs. * Update website/content/docs/services/configuration/checks-configuration-reference.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * Fix typos and add changelog entry. --------- Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * docs: Deprecations for connect-native SDK and specific connect native APIs (#17937) * Update v1_16_x.mdx * Update connect native golang page --------- Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * Revert "Add workflow to verify linux release packages (#17904)" (#17942) This reverts commit 3368f14fab500ebe9f6aeab5631dd1d5f5a453e5. * Fixes Secondary ConnectCA update (#17846) This fixes a bug that was identified which resulted in subsequent ConnectCA configuration update not to persist in the cluster. * fixing typo in link to jwt-validations-with-intentions doc (#17955) * Fix streaming backend link (#17958) * Fix streaming backend link * Update health.mdx * Dynamically create jwks clusters for jwt-providers (#17944) * website: remove deprecated agent rpc docs (#17962) * Fix missing BalanceOutboundConnections in v2 catalog. (#17964) * feature - [NET - 4005] - [Supportability] Reloadable Configuration - enable_debug (#17565) * # This is a combination of 9 commits. # This is the 1st commit message: init without tests # This is the commit message #2: change log # This is the commit message #3: fix tests # This is the commit message #4: fix tests # This is the commit message #5: added tests # This is the commit message #6: change log breaking change # This is the commit message #7: removed breaking change # This is the commit message #8: fix test # This is the commit message #9: keeping the test behaviour same * # This is a combination of 12 commits. # This is the 1st commit message: init without tests # This is the commit message #2: change log # This is the commit message #3: fix tests # This is the commit message #4: fix tests # This is the commit message #5: added tests # This is the commit message #6: change log breaking change # This is the commit message #7: removed breaking change # This is the commit message #8: fix test # This is the commit message #9: keeping the test behaviour same # This is the commit message #10: made enable debug atomic bool # This is the commit message #11: fix lint # This is the commit message #12: fix test true enable debug * parent 10f500e895d92cc3691ade7b74a33db755d22039 author absolutelightning 1687352587 +0530 committer absolutelightning 1687352592 +0530 init without tests change log fix tests fix tests added tests change log breaking change removed breaking change fix test keeping the test behaviour same made enable debug atomic bool fix lint fix test true enable debug using enable debug in agent as atomic bool test fixes fix tests fix tests added update on correct locaiton fix tests fix reloadable config enable debug fix tests fix init and acl 403 * revert commit * Fix formatting codeblocks on APIgw docs (#17970) * fix formatting codeblocks * remove unnecessary indents * Remove POC code (#17974) * update doc (#17910) * update doc * update link * Remove duplicate and unused newDecodeConfigEntry func (#17979) * docs: samenessGroup YAML examples (#17984) * configuration entry syntax * Example config * Add changelog entry for 1.16.0 (#17987) * Fix typo (#17198) servcies => services * Expose JWKS cluster config through JWTProviderConfigEntry (#17978) * Expose JWKS cluster config through JWTProviderConfigEntry * fix typos, rename trustedCa to trustedCA * Integration test for ext-authz Envoy extension (#17980) * Fix incorrect protocol for transparent proxy upstreams. (#17894) This PR fixes a bug that was introduced in: https://github.com/hashicorp/consul/pull/16021 A user setting a protocol in proxy-defaults would cause tproxy implicit upstreams to not honor the upstream service's protocol set in its `ServiceDefaults.Protocol` field, and would instead always use the proxy-defaults value. Due to the fact that upstreams configured with "tcp" can successfully contact upstream "http" services, this issue was not recognized until recently (a proxy-defaults with "tcp" and a listening service with "http" would make successful requests, but not the opposite). As a temporary work-around, users experiencing this issue can explicitly set the protocol on the `ServiceDefaults.UpstreamConfig.Overrides`, which should take precedence. The fix in this PR removes the proxy-defaults protocol from the wildcard upstream that tproxy uses to configure implicit upstreams. When the protocol was included, it would always overwrite the value during discovery chain compilation, which was not correct. The discovery chain compiler also consumes proxy defaults to determine the protocol, so simply excluding it from the wildcard upstream config map resolves the issue. * feat: include nodes count in operator usage endpoint and cli command (#17939) * feat: update operator usage api endpoint to include nodes count * feat: update operator usange cli command to includes nodes count * [OSS] Improve Gateway Test Coverage of Catalog Health (#18011) * fix(cli): remove failing check from 'connect envoy' registration for api gateway * test(integration): add tests to check catalog statsus of gateways on startup * remove extra sleep comment * Update test/integration/consul-container/libs/assert/service.go * changelog * Fixes Traffic rate limitting docs (#17997) * Fix removed service-to-service peering links (#17221) * docs: fix removed service-to-service peering links * docs: extend peering-via-mesh-gateways intro (thanks @trujillo-adam) --------- Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * docs: Sameness "beta" warning (#18017) * Warning updates * .x * updated typo in tab heading (#18022) * updated typo in tab heading * updated tab group typo, too * Document that DNS lookups can target cluster peers (#17990) Static DNS lookups, in addition to explicitly targeting a datacenter, can target a cluster peer. This was added in 95dc0c7b301b70a6b955a8b7c9737c9b86f03df6 but didn't make the documentation. The driving function for the change is `parseLocality` here: https://github.com/hashicorp/consul/blob/0b1299c28d8127129d61310ee4280055298438e0/agent/dns_oss.go#L25 The biggest change in this is to adjust the standard lookup syntax to tie `.` to `.dc` as required-together, and to append in the similar `..peer` optional argument, both to A record and SRV record lookups. Co-authored-by: David Yu * Add first integration test for jwt auth with intention (#18005) * fix stand-in text for name field (#18030) * removed sameness conf entry from failover nav (#18033) * docs - add service sync annotations and k8s service weight annotation (#18032) * Docs for https://github.com/hashicorp/consul-k8s/pull/2293 * remove versions for enterprise features since they are old --------- Co-authored-by: Tu Nguyen * docs - add jobs use case for service mesh k8s (#18037) * docs - add jobs use case for service mesh k8s * add code blocks * address feedback (#18045) * Add verify server hostname to tls default (#17155) * [OSS] Fix initial_fetch_timeout to wait for all xDS resources (#18024) * fix(connect): set initial_fetch_time to wait indefinitely * changelog * PR feedback 1 * ui: fix typos for peer service imports (#17999) * test: fix FIPS inline cert test message (#18076) * Fix a couple typos in Agent Telemetry Metrics docs (#18080) * Fix metrics docs * Add changelog Signed-off-by: josh --------- Signed-off-by: josh * docs updates - cluster peering and virtual services (#18069) * Update route-to-virtual-services.mdx * Update establish-peering.mdx * Update service-mesh-compare.mdx (#17279) grammar change * Update helm docs on main (#18085) * ci: use gotestsum v1.10.1 [NET-4042] (#18088) * Docs: Update proxy lifecycle annotations and consul-dataplane flags (#18075) * Update proxy lifecycle annotations and consul-dataplane flags * Pass configured role name to Vault for AWS auth in Connect CA (#17885) * Docs for dataplane upgrade on k8s (#18051) * Docs for dataplane upgrade on k8s --------- Co-authored-by: David Yu Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * docs - update upgrade index page to not recommend consul leave. (#18100) * Displays Consul version of each nodes in UI nodes section (#17754) * update UINodes and UINodeInfo response with consul-version info added as NodeMeta, fetched from serf members * update test cases TestUINodes, TestUINodeInfo * added nil check for map * add consul-version in local agent node metadata * get consul version from serf member and add this as node meta in catalog register request * updated ui mock response to include consul versions as node meta * updated ui trans and added version as query param to node list route * updates in ui templates to display consul version with filter and sorts * updates in ui - model class, serializers,comparators,predicates for consul version feature * added change log for Consul Version Feature * updated to get version from consul service, if for some reason not available from serf * updated changelog text * updated dependent testcases * multiselection version filter * Update agent/consul/state/catalog.go comments updated Co-authored-by: Jared Kirschner <85913323+jkirschner-hashicorp@users.noreply.github.com> --------- Co-authored-by: Jared Kirschner <85913323+jkirschner-hashicorp@users.noreply.github.com> * api gw 1.16 updates (#18081) * api gw 1.16 updates * Apply suggestions from code review Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com> * update CodeBlockConfig filename * Apply suggestions from code review Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com> * remove non-standard intentions page * Update website/content/docs/api-gateway/configuration/index.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> --------- Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com> Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * [NET-4103] ci: build s390x (#18067) * ci: build s390x * ci: test s390x * ci: dev build s390x * no GOOS * ent only * build: publish s390x * fix syntax error * fix syntax error again * fix syntax error again x2 * test branch * Move s390x conditionals to step level * remove test branch --------- Co-authored-by: emilymianeil * :ermahgerd "Sevice Mesh" -> "Service Mesh" (#18116) Just a typo in the docs. * Split pbmesh.UpstreamsConfiguration as a resource out of pbmesh.Upstreams (#17991) Configuration that previously was inlined into the Upstreams resource applies to both explicit and implicit upstreams and so it makes sense to split it out into its own resource. It also has other minor changes: - Renames `proxy.proto` proxy_configuration.proto` - Changes the type of `Upstream.destination_ref` from `pbresource.ID` to `pbresource.Reference` - Adds comments to fields that didn't have them * [NET-4895] ci - api tests and consul container tests error because of dependency bugs with go 1.20.6. Pin go to 1.20.5. (#18124) ### Description The following jobs started failing when go 1.20.6 was released: - `go-test-api-1-19` - `go-test-api-1-20` - `compatibility-integration-tests` - `upgrade-integration-tests` `compatibility-integration-tests` and `compatibility-integration-tests` to this testcontainers issue: https://github.com/testcontainers/testcontainers-go/issues/1359. This issue calls for testcontainers to release a new version when one of their dependencies is fixed. When that is done, we will unpin the go versions in `compatibility-integration-tests` and `compatibility-integration-tests`. ### Testing & Reproduction steps See these jobs broken in CI and then see them work with this PR. --------- Co-authored-by: Chris Thain <32781396+cthain@users.noreply.github.com> * Add ingress gateway deprecation notices to docs (#18102) ### Description This adds notices, that ingress gateway is deprecated, to several places in the product docs where ingress gateway is the topic. ### Testing & Reproduction steps Tested with a local copy of the website. ### Links Deprecation of ingress gateway was announced in the Release Notes for Consul 1.16 and Consul-K8s 1.2. See: [https://developer.hashicorp.com/consul/docs/release-notes/consul/v1_16_x#what-s-deprecated](https://developer.hashicorp.com/consul/docs/release-notes/consul/v1_16_x#what-s-deprecated ) [https://developer.hashicorp.com/consul/docs/release-notes/consul-k8s/v1_2_x#what-s-deprecated](https://developer.hashicorp.com/consul/docs/release-notes/consul-k8s/v1_2_x#what-s-deprecated) ### PR Checklist * [N/A] updated test coverage * [X] external facing docs updated * [X] appropriate backport labels added * [X] not a security concern --------- Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * Add docs for jwt cluster configuration (#18004) ### Description - Add jwt-provider docs for jwks cluster configuration. The configuration was added here: https://github.com/hashicorp/consul/pull/17978 * Docs: fix unmatched bracket for health checks page (#18134) * NET-4657/add resource service client (#18053) ### Description Dan had already started on this [task](https://github.com/hashicorp/consul/pull/17849) which is needed to start building the HTTP APIs. This just needed some cleanup to get it ready for review. Overview: - Rename `internalResourceServiceClient` to `insecureResourceServiceClient` for name consistency - Configure a `secureResourceServiceClient` with auth enabled ### PR Checklist * [ ] ~updated test coverage~ * [ ] ~external facing docs updated~ * [x] appropriate backport labels added * [ ] ~not a security concern~ * Fix bug with Vault CA provider (#18112) Updating RootPKIPath but not IntermediatePKIPath would not update leaf signing certs with the new root. Unsure if this happens in practice but manual testing showed it is a bug that would break mesh and agent connections once the old root is pruned. * [NET-4897] net/http host header is now verified and request.host that contains socked now error (#18129) ### Description This is related to https://github.com/hashicorp/consul/pull/18124 where we pinned the go versions in CI to 1.20.5 and 1.19.10. go 1.20.6 and 1.19.11 now validate request host headers for validity, including the hostname cannot be prefixed with slashes. For local communications (npipe://, unix://), the hostname is not used, but we need valid and meaningful hostname. Prior versions go Go would clean the host header, and strip slashes in the process, but go1.20.6 and go1.19.11 no longer do, and reject the host header. Around the community we are seeing that others are intercepting the req.host and if it starts with a slash or ends with .sock, they changing the host to localhost or another dummy value. [client: define a "dummy" hostname to use for local connections by thaJeztah · Pull Request #45942 · moby/moby](https://github.com/moby/moby/pull/45942) ### Testing & Reproduction steps Check CI tests. ### Links * [ ] updated test coverage * [ ] external facing docs updated * [ ] appropriate backport labels added * [ ] not a security concern * add a conditional around setting LANFilter.AllSegments to make sure it is valid (#18139) ### Description This is to correct a code problem because this assumes all segments, but when you get to Enterprise, you can be in partition that is not the default partition, in which case specifying all segments does not validate and fails. This is to correct the setting of this filter with `AllSegments` to `true` to only occur when in the the `default` partition. ### Testing & Reproduction steps ### Links ### PR Checklist * [ ] updated test coverage * [ ] external facing docs updated * [ ] appropriate backport labels added * [ ] not a security concern * chore: bump upgrade integrations tests to 1.15, 116 [NET-4743] (#18130) * re org resource type registry (#18133) * fix: update delegateMock used in ENT (#18149) ### Description The mock is used in `http_ent_test` file which caused lint failures. For OSS->ENT parity adding the same change here. ### Links Identified in OSS->ENT [merge PR](https://github.com/hashicorp/consul-enterprise/pull/6328) ### PR Checklist * [ ] ~updated test coverage~ * [ ] ~external facing docs updated~ * [x] appropriate backport labels added * [ ] ~not a security concern~ * Use JWT-auth filter in metadata mode & Delegate validation to RBAC filter (#18062) ### Description - Currently the jwt-auth filter doesn't take into account the service identity when validating jwt-auth, it only takes into account the path and jwt provider during validation. This causes issues when multiple source intentions restrict access to an endpoint with different JWT providers. - To fix these issues, rather than use the JWT auth filter for validation, we use it in metadata mode and allow it to forward the successful validated JWT token payload to the RBAC filter which will make the decisions. This PR ensures requests with and without JWT tokens successfully go through the jwt-authn filter. The filter however only forwards the data for successful/valid tokens. On the RBAC filter level, we check the payload for claims and token issuer + existing rbac rules. ### Testing & Reproduction steps - This test covers a multi level jwt requirements (requirements at top level and permissions level). It also assumes you have envoy running, you have a redis and a sidecar proxy service registered, and have a way to generate jwks with jwt. I mostly use: https://www.scottbrady91.com/tools/jwt for this. - first write your proxy defaults ``` Kind = "proxy-defaults" name = "global" config { protocol = "http" } ``` - Create two providers ``` Kind = "jwt-provider" Name = "auth0" Issuer = "https://ronald.local" JSONWebKeySet = { Local = { JWKS = "eyJrZXlzIjog....." } } ``` ``` Kind = "jwt-provider" Name = "okta" Issuer = "https://ronald.local" JSONWebKeySet = { Local = { JWKS = "eyJrZXlzIjogW3...." } } ``` - add a service intention ``` Kind = "service-intentions" Name = "redis" JWT = { Providers = [ { Name = "okta" }, ] } Sources = [ { Name = "*" Permissions = [{ Action = "allow" HTTP = { PathPrefix = "/workspace" } JWT = { Providers = [ { Name = "okta" VerifyClaims = [ { Path = ["aud"] Value = "my_client_app" }, { Path = ["sub"] Value = "5be86359073c434bad2da3932222dabe" } ] }, ] } }, { Action = "allow" HTTP = { PathPrefix = "/" } JWT = { Providers = [ { Name = "auth0" }, ] } }] } ] ``` - generate 3 jwt tokens: 1 from auth0 jwks, 1 from okta jwks with different claims than `/workspace` expects and 1 with correct claims - connect to your envoy (change service and address as needed) to view logs and potential errors. You can add: `-- --log-level debug` to see what data is being forwarded ``` consul connect envoy -sidecar-for redis1 -grpc-addr 127.0.0.1:8502 ``` - Make the following requests: ``` curl -s -H "Authorization: Bearer $Auth0_TOKEN" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v RBAC filter denied curl -s -H "Authorization: Bearer $Okta_TOKEN_with_wrong_claims" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v RBAC filter denied curl -s -H "Authorization: Bearer $Okta_TOKEN_with_correct_claims" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v Successful request ``` ### TODO * [x] Update test coverage * [ ] update integration tests (follow-up PR) * [x] appropriate backport labels added * Support Consul Connect Envoy Command on Windows (#17694) ### Description Add support for consul connect envoy command on windows. This PR fixes the comments of PR - https://github.com/hashicorp/consul/pull/15114 ### Testing * Built consul.exe from this branch on windows and hosted here - [AWS S3](https://asheshvidyut-bucket.s3.ap-southeast-2.amazonaws.com/consul.zip) * Updated the [tutorial](https://developer.hashicorp.com/consul/tutorials/developer-mesh/consul-windows-workloads) and changed the `consul_url.default` value to [AWS S3](https://asheshvidyut-bucket.s3.ap-southeast-2.amazonaws.com/consul.zip) * Followed the steps in the tutorial and verified that everything is working as described. ### PR Checklist * [x] updated test coverage * [ ] external facing docs updated * [x] appropriate backport labels added * [x] not a security concern --------- Co-authored-by: Franco Bruno Lavayen Co-authored-by: Jose Ignacio Lorenzo <74208929+joselo85@users.noreply.github.com> Co-authored-by: Jose Ignacio Lorenzo Co-authored-by: Dhia Ayachi * Change docs to say 168h instead of 7d for server_rejoin_age_max (#18154) ### Description Addresses https://github.com/hashicorp/consul/pull/17171#issuecomment-1636930705 * [OSS] test: improve xDS listener code coverage (#18138) test: improve xDS listener code coverage * Re-order expected/actual for assertContainerState in consul container tests (#18157) Re-order expected/actual, consul container tests * group and document make file (#17943) * group and document make file * Add `testing/deployer` (neé `consul-topology`) [NET-4610] (#17823) Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> Co-authored-by: R.B. Boyer Co-authored-by: Freddy * [NET-4792] Add integrations tests for jwt-auth (#18169) * Add FIPS reference to consul enterprise docs (#18028) * Add FIPS reference to consul enterprise docs * Update website/content/docs/enterprise/index.mdx Co-authored-by: David Yu * remove support for ecs client (fips) --------- Co-authored-by: David Yu * add peering_commontopo tests [NET-3700] (#17951) Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> Co-authored-by: R.B. Boyer Co-authored-by: Freddy Co-authored-by: NiniOak * docs - remove Sentinel from enterprise features list (#18176) * Update index.mdx * Update kv.mdx * Update docs-nav-data.json * delete sentinel.mdx * Update redirects.js --------- Co-authored-by: Tu Nguyen * [NET-4865] Bump golang.org/x/net to 0.12.0 (#18186) Bump golang.org/x/net to 0.12.0 While not necessary to directly address CVE-2023-29406 (which should be handled by using a patched version of Go when building), an accompanying change to HTTP/2 error handling does impact agent code. See https://go-review.googlesource.com/c/net/+/506995 for the HTTP/2 change. Bump this dependency across our submodules as well for the sake of potential indirect consumers of `x/net/http`. * Call resource mutate hook before validate hook (NET-4907) (#18178) * [NET-4865] security: Update Go version to 1.20.6 (#18190) Update Go version to 1.20.6 This resolves [CVE-2023-29406] (https://nvd.nist.gov/vuln/detail/CVE-2023-29406) for uses of the `net/http` standard library. Note that until the follow-up to #18124 is done, the version of Go used in those impacted tests will need to remain on 1.20.5. * Improve XDS test coverage: JWT auth edition (#18183) * Improve XDS test coverage: JWT auth edition more tests * test: xds coverage for jwt listeners --------- Co-authored-by: DanStough * update readme.md (#18191) u[date readme.md * Update submodules to latest following 1.16.0 (#18197) Align all our internal use of submodules on the latest versions. * SEC-090: Automated trusted workflow pinning (2023-07-18) (#18174) Result of tsccr-helper -log-level=info -pin-all-workflows . Co-authored-by: hashicorp-tsccr[bot] * Fix Backport Assistant PR commenting (#18200) * Fix Backport Assistant failure PR commenting For general comments on a PR, it looks like you have to use the `/issue` endpoint rather than `/pulls`, which requires commit/other review-specific target details. This matches the endpoint used in `backport-reminder.yml`. * Remove Backport Reminder workflow This is noisy (even when adding multiple labels, individual comments per label are generated), and likely no longer needed: we haven't had this work in a long time due to an expired GH token, and we now have better automation for backport PR assignment. * resource: Pass resource to Write ACL hook instead of just resource Id [NET-4908] (#18192) * Explicitly enable WebSocket upgrades (#18150) This PR explicitly enables WebSocket upgrades in Envoy's UpgradeConfig for all proxy types. (API Gateway, Ingress, and Sidecar.) Fixes #8283 * docs: fix the description of client rpc (#18206) * NET-4804: Add dashboard for monitoring consul-k8s (#18208) * [OSS] Improve xDS Code Coverage - Clusters (#18165) test: improve xDS cluster code coverage * NET-4222 take config file consul container (#18218) Net 4222 take config file consul container * Envoy Integration Test Windows (#18007) * [CONSUL-395] Update check_hostport and Usage (#40) * [CONSUL-397] Copy envoy binary from Image (#41) * [CONSUL-382] Support openssl in unique test dockerfile (#43) * [CONSUL-405] Add bats to single container (#44) * [CONSUL-414] Run Prometheus Test Cases and Validate Changes (#46) * [CONSUL-410] Run Jaeger in Single container (#45) * [CONSUL-412] Run test-sds-server in single container (#48) * [CONSUL-408] Clean containers (#47) * [CONSUL-384] Rebase and sync fork (#50) * [CONSUL-415] Create Scenarios Troubleshooting Docs (#49) * [CONSUL-417] Update Docs Single Container (#51) * [CONSUL-428] Add Socat to single container (#54) * [CONSUL-424] Replace pkill in kill_envoy function (#52) * [CONSUL-434] Modify Docker run functions in Helper script (#53) * [CONSUL-435] Replace docker run in set_ttl_check_state & wait_for_agent_service_register functions (#55) * [CONSUL-438] Add netcat (nc) in the Single container Dockerfile (#56) * [CONSUL-429] Replace Docker run with Docker exec (#57) * [CONSUL-436] Curl timeout and run tests (#58) * [CONSUL-443] Create dogstatsd Function (#59) * [CONSUL-431] Update Docs Netcat (#60) * [CONSUL-439] Parse nc Command in function (#61) * [CONSUL-463] Review curl Exec and get_ca_root Func (#63) * [CONSUL-453] Docker hostname in Helper functions (#64) * [CONSUL-461] Test wipe volumes without extra cont (#66) * [CONSUL-454] Check ports in the Server and Agent containers (#65) * [CONSUL-441] Update windows dockerfile with version (#62) * [CONSUL-466] Review case-grpc Failing Test (#67) * [CONSUL-494] Review case-cfg-resolver-svc-failover (#68) * [CONSUL-496] Replace docker_wget & docker_curl (#69) * [CONSUL-499] Cleanup Scripts - Remove nanoserver (#70) * [CONSUL-500] Update Troubleshooting Docs (#72) * [CONSUL-502] Pull & Tag Envoy Windows Image (#73) * [CONSUL-504] Replace docker run in docker_consul (#76) * [CONSUL-505] Change admin_bind * [CONSUL-399] Update envoy to 1.23.1 (#78) * [CONSUL-510] Support case-wanfed-gw on Windows (#79) * [CONSUL-506] Update troubleshooting Documentation (#80) * [CONSUL-512] Review debug_dump_volumes Function (#81) * [CONSUL-514] Add zipkin to Docker Image (#82) * [CONSUL-515] Update Documentation (#83) * [CONSUL-529] Support case-consul-exec (#86) * [CONSUL-530] Update Documentation (#87) * [CONSUL-530] Update default consul version 1.13.3 * [CONSUL-539] Cleanup (#91) * [CONSUL-546] Scripts Clean-up (#92) * [CONSUL-491] Support admin_access_log_path value for Windows (#71) * [CONSUL-519] Implement mkfifo Alternative (#84) * [CONSUL-542] Create OS Specific Files for Envoy Package (#88) * [CONSUL-543] Create exec_supported.go (#89) * [CONSUL-544] Test and Build Changes (#90) * Implement os.DevNull * using mmap instead of disk files * fix import in exec-unix * fix nmap open too many arguemtn * go fmt on file * changelog file * fix go mod * Update .changelog/17694.txt Co-authored-by: Dhia Ayachi * different mmap library * fix bootstrap json * some fixes * chocolatey version fix and image fix * using different library * fix Map funciton call * fix mmap call * fix tcp dump * fix tcp dump * windows tcp dump * Fix docker run * fix tests * fix go mod * fix version 16.0 * fix version * fix version dev * sleep to debug * fix sleep * fix permission issue * fix permission issue * fix permission issue * fix command * fix command * fix funciton * fix assert config entry status command not found * fix command not found assert_cert_has_cn * fix command not found assert_upstream_missing * fix command not found assert_upstream_missing_once * fix command not found get_upstream_endpoint * fix command not found get_envoy_public_listener_once * fix command not found * fix test cases * windows integration test workflow github * made code similar to unix using npipe * fix go.mod * fix dialing of npipe * dont wait * check size of written json * fix undefined n * running * fix dep * fix syntax error * fix workflow file * windows runner * fix runner * fix from json * fix runs on * merge connect envoy * fix cin path * build * fix file name * fix file name * fix dev build * remove unwanted code * fix upload * fix bin name * fix path * checkout current branch * fix path * fix tests * fix shell bash for windows sh files * fix permission of run-test.sh * removed docker dev * added shell bash for tests * fix tag * fix win=true * fix cd * added dev * fix variable undefined * removed failing tests * fix tcp dump image * fix curl * fix curl * tcp dump path * fix tcpdump path * fix curl * fix curl install * stop removing intermediate containers * fix tcpdump docker image * revert -rm * --rm=false * makeing docker image before * fix tcpdump * removed case consul exec * removed terminating gateway simple * comment case wasm * removed data dog * comment out upload coverage * uncomment case-consul-exec * comment case consul exec * if always * logs * using consul 1.17.0 * fix quotes * revert quotes * redirect to dev null * Revert version * revert consul connect * fix version * removed envoy connect * not using function * change log * docker logs * fix logs * restructure bad authz * rmeoved dev null * output * fix file descriptor * fix cacert * fix cacert * fix ca cert * cacert does not work in windows curl * fix func * removed docker logs * added sleep * fix tls * commented case-consul-exec * removed echo * retry docker consul * fix upload bin * uncomment consul exec * copying consul.exe to docker image * copy fix * fix paths * fix path * github workspace path * latest version * Revert "latest version" This reverts commit 5a7d7b82d9e7553bcb01b02557ec8969f9deba1d. * commented consul exec * added ssl revoke best effort * revert best effort * removed unused files * rename var name and change dir * windows runner * permission * needs setup fix * swtich to github runner * fix file path * fix path * fix path * fix path * fix path * fix path * fix build paths * fix tag * nightly runs * added matrix in github workflow, renamed files * fix job * fix matrix * removed brackes * from json * without using job matrix * fix quotes * revert job matrix * fix workflow * fix comment * added comment * nightly runs * removed datadog ci as it is already measured in linux one * running test * Revert "running test" This reverts commit 7013d15a23732179d18ec5d17336e16b26fab5d4. * pr comment fixes * running test now * running subset of test * running subset of test * job matrix * shell bash * removed bash shell * linux machine for job matrix * fix output * added cat to debug * using ubuntu latest * fix job matrix * fix win true * fix go test * revert job matrix --------- Co-authored-by: Jose Ignacio Lorenzo <74208929+joselo85@users.noreply.github.com> Co-authored-by: Franco Bruno Lavayen Co-authored-by: Ivan K Berlot Co-authored-by: Ezequiel Fernández Ponce <20102608+ezfepo@users.noreply.github.com> Co-authored-by: joselo85 Co-authored-by: Ezequiel Fernández Ponce Co-authored-by: Dhia Ayachi * fix typos and update ecs compat table (#18215) * fix typos and update ecs compat table * real info for the ecs compat matrix table * Update website/content/docs/ecs/compatibility.mdx Co-authored-by: Chris Thain <32781396+cthain@users.noreply.github.com> --------- Co-authored-by: Chris Thain <32781396+cthain@users.noreply.github.com> * [OSS] proxystate: add proxystate protos (#18216) * proxystate: add proxystate protos to pbmesh and resolve imports and conflicts between message names * ci: don't verify s390x (#18224) * [CC-5718] Remove HCP token requirement during bootstrap (#18140) * [CC-5718] Remove HCP token requirement during bootstrap * Re-add error for loading HCP management token * Remove old comment * Add changelog entry * Remove extra validation line * Apply suggestions from code review Co-authored-by: lornasong --------- Co-authored-by: lornasong * [NET-4122] Doc guidance for federation with externalServers (#18207) Doc guidance for federation with externalServers Add guidance for proper configuration when joining to a secondary cluster using WAN fed with external servers also enabled. Also clarify federation requirements and fix formatting for an unrelated value. Update both the Helm chart reference (synced from `consul-k8s`, see hashicorp/consul-k8s#2583) and the docs on using `externalServers`. * [OSS] Improve xDS Code Coverage - Endpoints and Misc (#18222) test: improve xDS endpoints code coverage * Clarify license reporting timing and GDPR compliance (#18237) Add Alicia's edits to clarify log timing and other details * Fix Github Workflow File (#18241) * [CONSUL-382] Support openssl in unique test dockerfile (#43) * [CONSUL-405] Add bats to single container (#44) * [CONSUL-414] Run Prometheus Test Cases and Validate Changes (#46) * [CONSUL-410] Run Jaeger in Single container (#45) * [CONSUL-412] Run test-sds-server in single container (#48) * [CONSUL-408] Clean containers (#47) * [CONSUL-384] Rebase and sync fork (#50) * [CONSUL-415] Create Scenarios Troubleshooting Docs (#49) * [CONSUL-417] Update Docs Single Container (#51) * [CONSUL-428] Add Socat to single container (#54) * [CONSUL-424] Replace pkill in kill_envoy function (#52) * [CONSUL-434] Modify Docker run functions in Helper script (#53) * [CONSUL-435] Replace docker run in set_ttl_check_state & wait_for_agent_service_register functions (#55) * [CONSUL-438] Add netcat (nc) in the Single container Dockerfile (#56) * [CONSUL-429] Replace Docker run with Docker exec (#57) * [CONSUL-436] Curl timeout and run tests (#58) * [CONSUL-443] Create dogstatsd Function (#59) * [CONSUL-431] Update Docs Netcat (#60) * [CONSUL-439] Parse nc Command in function (#61) * [CONSUL-463] Review curl Exec and get_ca_root Func (#63) * [CONSUL-453] Docker hostname in Helper functions (#64) * [CONSUL-461] Test wipe volumes without extra cont (#66) * [CONSUL-454] Check ports in the Server and Agent containers (#65) * [CONSUL-441] Update windows dockerfile with version (#62) * [CONSUL-466] Review case-grpc Failing Test (#67) * [CONSUL-494] Review case-cfg-resolver-svc-failover (#68) * [CONSUL-496] Replace docker_wget & docker_curl (#69) * [CONSUL-499] Cleanup Scripts - Remove nanoserver (#70) * [CONSUL-500] Update Troubleshooting Docs (#72) * [CONSUL-502] Pull & Tag Envoy Windows Image (#73) * [CONSUL-504] Replace docker run in docker_consul (#76) * [CONSUL-505] Change admin_bind * [CONSUL-399] Update envoy to 1.23.1 (#78) * [CONSUL-510] Support case-wanfed-gw on Windows (#79) * [CONSUL-506] Update troubleshooting Documentation (#80) * [CONSUL-512] Review debug_dump_volumes Function (#81) * [CONSUL-514] Add zipkin to Docker Image (#82) * [CONSUL-515] Update Documentation (#83) * [CONSUL-529] Support case-consul-exec (#86) * [CONSUL-530] Update Documentation (#87) * [CONSUL-530] Update default consul version 1.13.3 * [CONSUL-539] Cleanup (#91) * [CONSUL-546] Scripts Clean-up (#92) * [CONSUL-491] Support admin_access_log_path value for Windows (#71) * [CONSUL-519] Implement mkfifo Alternative (#84) * [CONSUL-542] Create OS Specific Files for Envoy Package (#88) * [CONSUL-543] Create exec_supported.go (#89) * [CONSUL-544] Test and Build Changes (#90) * Implement os.DevNull * using mmap instead of disk files * fix import in exec-unix * fix nmap open too many arguemtn * go fmt on file * changelog file * fix go mod * Update .changelog/17694.txt Co-authored-by: Dhia Ayachi * different mmap library * fix bootstrap json * some fixes * chocolatey version fix and image fix * using different library * fix Map funciton call * fix mmap call * fix tcp dump * fix tcp dump * windows tcp dump * Fix docker run * fix tests * fix go mod * fix version 16.0 * fix version * fix version dev * sleep to debug * fix sleep * fix permission issue * fix permission issue * fix permission issue * fix command * fix command * fix funciton * fix assert config entry status command not found * fix command not found assert_cert_has_cn * fix command not found assert_upstream_missing * fix command not found assert_upstream_missing_once * fix command not found get_upstream_endpoint * fix command not found get_envoy_public_listener_once * fix command not found * fix test cases * windows integration test workflow github * made code similar to unix using npipe * fix go.mod * fix dialing of npipe * dont wait * check size of written json * fix undefined n * running * fix dep * fix syntax error * fix workflow file * windows runner * fix runner * fix from json * fix runs on * merge connect envoy * fix cin path * build * fix file name * fix file name * fix dev build * remove unwanted code * fix upload * fix bin name * fix path * checkout current branch * fix path * fix tests * fix shell bash for windows sh files * fix permission of run-test.sh * removed docker dev * added shell bash for tests * fix tag * fix win=true * fix cd * added dev * fix variable undefined * removed failing tests * fix tcp dump image * fix curl * fix curl * tcp dump path * fix tcpdump path * fix curl * fix curl install * stop removing intermediate containers * fix tcpdump docker image * revert -rm * --rm=false * makeing docker image before * fix tcpdump * removed case consul exec * removed terminating gateway simple * comment case wasm * removed data dog * comment out upload coverage * uncomment case-consul-exec * comment case consul exec * if always * logs * using consul 1.17.0 * fix quotes * revert quotes * redirect to dev null * Revert version * revert consul connect * fix version * removed envoy connect * not using function * change log * docker logs * fix logs * restructure bad authz * rmeoved dev null * output * fix file descriptor * fix cacert * fix cacert * fix ca cert * cacert does not work in windows curl * fix func * removed docker logs * added sleep * fix tls * commented case-consul-exec * removed echo * retry docker consul * fix upload bin * uncomment consul exec * copying consul.exe to docker image * copy fix * fix paths * fix path * github workspace path * latest version * Revert "latest version" This reverts commit 5a7d7b82d9e7553bcb01b02557ec8969f9deba1d. * commented consul exec * added ssl revoke best effort * revert best effort * removed unused files * rename var name and change dir * windows runner * permission * needs setup fix * swtich to github runner * fix file path * fix path * fix path * fix path * fix path * fix path * fix build paths * fix tag * nightly runs * added matrix in github workflow, renamed files * fix job * fix matrix * removed brackes * from json * without using job matrix * fix quotes * revert job matrix * fix workflow * fix comment * added comment * nightly runs * removed datadog ci as it is already measured in linux one * running test * Revert "running test" This reverts commit 7013d15a23732179d18ec5d17336e16b26fab5d4. * pr comment fixes * running test now * running subset of test * running subset of test * job matrix * shell bash * removed bash shell * linux machine for job matrix * fix output * added cat to debug * using ubuntu latest * fix job matrix * fix win true * fix go test * revert job matrix * Fix tests --------- Co-authored-by: Ivan K Berlot Co-authored-by: Jose Ignacio Lorenzo <74208929+joselo85@users.noreply.github.com> Co-authored-by: Franco Bruno Lavayen Co-authored-by: Ezequiel Fernández Ponce <20102608+ezfepo@users.noreply.github.com> Co-authored-by: joselo85 Co-authored-by: Ezequiel Fernández Ponce Co-authored-by: Dhia Ayachi * NET-4996 - filter go-tests and test-integration workflows from running on docs only and ui only changes (#18236) * Align build arch matrix with enterprise (#18235) Ensure that OSS remains in sync w/ Enterprise by aligning the format of arch matrix args for various build jobs. * Revert "NET-4996 - filter go-tests and test-integration workflows from running on docs only and ui only changes" (#18248) Revert "NET-4996 - filter go-tests and test-integration workflows from running on docs only and ui only changes (#18236)" This reverts commit a11dba710e6ce6f172c0fa6c9b61567cc1efffc8. * resource: Add scope to resource type registration [NET-4976] (#18214) Enables querying a resource type's registration to determine if a resource is cluster, partition, or partition and namespace scoped. * Fix some inconsistencies in jwt docs (#18234) * NET-1825: More new ACL token creation docs (#18063) Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * grafana: add the panel resource usage of connect injector (#18247) * [NET-3700] Backfill changelog entry for c2bbe67 and 7402d06 (#18259) Backfill changelog entry for c2bbe67 and 7402d06 Add a changelog entry for the follow-up PR since it was specific to the fix and references the original change. * NET-4897 - update comment to include the current issue url from the go team. (#18263) * fix typos, style, and improper links (#18269) * member cli: add -filter expression to flags (#18223) * member cli: add -filter expression to flags * changelog * update doc * Add test cases * use quote * go-tests: disable s390x (#18273) * docs: Update ext-authz documentation for kubernetes (#18281) Update ext-authz documentation for kubernetes * docs: Consul on Kubernetes specific upgrade info (#18230) * Compatibility page - dataplanes mention * Upgrading higher-level dataplane mention * `exec=` string callout * More visible for upgrade page * Apply suggestions from code review Co-authored-by: Tu Nguyen --------- Co-authored-by: Tu Nguyen Co-authored-by: John Murret * Fix typo in Envoy extensions doc (#18284) * docs: K8s secondary DC requirements (#18280) * Requested edit * Apply suggestions from code review Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> --------- Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * api-gateway: subscribe to bound-api-gateway only after receiving api-gateway (#18291) * api-gateway: subscribe to bound-api-gateway only after receiving api-gateway This fixes a race condition due to our dependency on having the listener(s) from the api-gateway config entry in order to fully and properly process the resources on the bound-api-gateway config entry. * Apply suggestions from code review * Add changelog entry * Update K8s changelog to address cloud auto-join change in 1.0.0 (#18293) * Update list of Envoy versions (#18300) Update supported envoy versions to 1.24.10, 1.25.9, 1.26.4, 1.27.0. * [NET-4904] Update list of Envoy versions in docs (#18306) Update list of Envoy versions in docs Update supported Envoy versions across Consul release versions. * Update actions for TSCCR (#18317) Update action versions before deadline * Fix topology view when displaying mixed connect-native/normal services. (#13023) * Fix topoloy intention with mixed connect-native/normal services. If a service is registered twice, once with connect-native and once without, the topology views would prune the existing intentions. This change brings the code more in line with the transparent proxy behavior. * Dedupe nodes in the ServiceTopology ui endpoint (like done with tags). * Consider a service connect-native as soon as one instance is. * Stop JWT provider from being written in non default namespace (#18325) * docs: Fix some comments (#17118) Signed-off-by: cui fliter * [NET-4703] Prevent partial application of Envoy extensions (#18068) Prevent partial application of Envoy extensions Ensure that non-required extensions do not change xDS resources before exiting on failure by cloning proto messages prior to applying each extension. To support this change, also move `CanApply` checks up a layer and make them prior to attempting extension application, s.t. we avoid unnecessary copies where extensions can't be applied. Last, ensure that we do not allow panics from `CanApply` or `Extend` checks to escape the attempted extension application. * docs: Simplify example jq commands by removing pipes (#18327) Simplify jq command examples by removing pipes to other commands. * fix typo in create a mesh token docs (#18337) * [CC-5719] Add support for builtin global-read-only policy (#18319) * [CC-5719] Add support for builtin global-read-only policy * Add changelog * Add read-only to docs * Fix some minor issues. * Change from ReplaceAll to Sprintf * Change IsValidPolicy name to return an error instead of bool * Fix PolicyList test * Fix other tests * Apply suggestions from code review Co-authored-by: Paul Glass * Fix state store test for policy list. * Fix naming issues * Update acl/validation.go Co-authored-by: Chris Thain <32781396+cthain@users.noreply.github.com> * Update agent/consul/acl_endpoint.go --------- Co-authored-by: Paul Glass Co-authored-by: Chris Thain <32781396+cthain@users.noreply.github.com> * [NET-5121] proxystate: move protos to subdirectory to avoid conflicts (#18335) * also makes a few protos updates * resource: adding various helpers for working with resources (#18342) This is a bit of a grab bag of helpers that I found useful for working with them when authoring substantial Controllers. Subsequent PRs will make use of them. * Wasm integration tests for local and remote wasm files (#17756) * wasm integration tests for local and remote wasm files refactoring and cleanup for wasm testing remove wasm debug logging PR feedback, wasm build lock correct path pattern for wasm build files Add new helper function to minimize changes to existing test code Remove extra param mod tidy add custom service setup to test lib add wait until static server sidecar can reach nginx sidecar Doc comments PR feedback Update workflows to compile wasm for integration tests Fix docker build path Fix package name for linter Update makefile, fix redeclared function Update expected wasm filename Debug test ls in workflow remove pwd in favor of relative path more debugging Build wasm in compatability tests as well Build wasm directly in ci rather than in container Debug tinygo and llvm version Change wasm file extension Remove tinygo debugging Remove extra comments * Add compiled wasm and build instructions * [HCP Telemetry] Periodic Refresh for Dynamic Telemetry Configuration (#18168) * OTElExporter now uses an EndpointProvider to discover the endpoint * OTELSink uses a ConfigProvider to obtain filters and labels configuration * improve tests for otel_sink * Regex logic is moved into client for a method on the TelemetryConfig object * Create a telemetry_config_provider and update deps to use it * Fix conversion * fix import newline * Add logger to hcp client and move telemetry_config out of the client.go file * Add a telemetry_config.go to refactor client.go * Update deps * update hcp deps test * Modify telemetry_config_providers * Check for nil filters * PR review updates * Fix comments and move around pieces * Fix comments * Remove context from client struct * Moved ctx out of sink struct and fixed filters, added a test * Remove named imports, use errors.New if not fformatting * Remove HCP dependencies in telemetry package * Add success metric and move lock only to grab the t.cfgHahs * Update hash * fix nits * Create an equals method and add tests * Improve telemetry_config_provider.go tests * Add race test * Add missing godoc * Remove mock for MetricsClient * Avoid goroutine test panics * trying to kick CI lint issues by upgrading mod * imprve test code and add hasher for testing * Use structure logging for filters, fix error constants, and default to allow all regex * removed hashin and modify logic to simplify * Improve race test and fix PR feedback by removing hash equals and avoid testing the timer.Ticker logic, and instead unit test * Ran make go-mod-tidy * Use errtypes in the test * Add changelog * add safety check for exporter endpoint * remove require.Contains by using error types, fix structure logging, and fix success metric typo in exporter * Fixed race test to have changing config values * Send success metric before modifying config * Avoid the defer and move the success metric under * NET-4240 - Snapshots are failing on Windows (#18302) * fix go mod * fix go sum * added change log * ran make go mod tidy * Register ProxyStateTemplate Resource (#18316) Also, change the ProxyState.id to identity. This is because we already have the id of this proxy from the resource, and this id should be name-aligned with the workload it represents. It should also have the owner ref set to the workload ID if we need that. And so the id field seems unnecessary. We do, however, need a reference to workload identity so that we can authorize the proxy when it initially connects to the xDS server. * [NET-5146] security: Update Go version to 1.20.7 and `x/net` to 0.13.0 (#18358) * Update Go version to 1.20.7 This resolves [CVE-2023-29409] (https://nvd.nist.gov/vuln/detail/CVE-2023-29409)(`crypto/tls`). * Bump golang.org/x/net to 0.13.0 Addresses [CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978) for security scans (non-impacting). * mesh: adding the protobuf types and resources backing mesh config v2 (#18351) * [OSS] test: xds coverage for routes (#18369) test: xds coverage for routes * Fix policy lookup to allow for slashes (#18347) * Fix policy lookup to allow for slashes * Fix suggestions * Fix other test * Revert some lines * add some initial CODEOWNERS (#18346) * Add redirects for mesh-gateway docs (#18377) * expose grpc as http endpoint (#18221) expose resource grpc endpoints as http endpoints * bimapper: fix a bug and add some more test coverage (#18387) * [docs] Fix ServiceDefaults example in distributed tracing (#17212) Fix ServiceDefaults example in distributed tracing. * Fix #17730 - Dev mode has new line (#18367) * adding new line only in case of pretty in url not in dev mode * change log added * chore: make go-mod-tidy (#18388) * resource: Make resource read tenancy aware (#18397) * Not using chmod - fixed integration test for Enterprise (#18401) * Not using chmod * checking icacls * Removed push * replaced ordered list of rate limit ops with flow diagram (#18398) * replaced ordered list of rate limit ops with flow diagram * made diagram font bigger * updated colors for dark mode img * fixed typo * recentered dark mode image * Apply suggestions from code review Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com> --------- Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com> * Upgrade test: remove outdated test and disable log due to verbosity (#18403) * remove outdated test * disable log since we have too many parallel tests * bump testcontainers-go from 0.22.0 and remove pinned go version in in… (#18395) * bump testcontainers-go from 0.22.0 and remove pinned go version in integ test * go mod tidy * Replace deprecated target.Authority with target.URL.Host * Add ServiceEndpoints Mutation hook tests (#18404) * Add ServiceEndpoints Mutation hook tests * Move endpoint owner validation into the validation hook Also there were some minor changes to error validation to account for go-cmp not liking to peer through an errors.errorstring type that get created by errors.New * catalog: add FailoverPolicy mutation and validation hooks (#18390) Add most of the validation and mutation hooks for the FailoverPolicy resource. * NET-5115 Add retry + timeout filters for api-gateway (#18324) * squash, implement retry/timeout in consul core * update tests * catalog: adding a controller to reconcile FailoverPolicy resources (#18399) Add most of the semantic cross-resource validation for FailoverPolicy resources using a new controller. * fix the error in ent repo (#18421) fix the error in ent repo * build: updates for 1.16.1 release (#18415) * build: updates for 1.16.1 release * build: fix missing replace directive for envoyextensions * build: go mod tidy testing/deployer * update ECS links (#18419) * docs: fix incorrect proxy-defaults config in Lua Envoy extension (#18418) fix incorrect proxy-defaults config * resource: Make resource write tenancy aware (#18423) * [NET-5217] [OSS] Derive sidecar proxy locality from parent service (#18437) * Add logging to locality policy application In OSS, this is currently a no-op. * Inherit locality when registering sidecars When sidecar locality is not explicitly configured, inherit locality from the proxied service. * NET-4984: Update APIGW Config Entries for JWT Auth (#18366) * Added oss config entries for Policy and JWT on APIGW * Updated structs for config entry * Updated comments, ran deep-copy * Move JWT configuration into OSS file * Add in the config entry OSS file for jwts * Added changelog * fixing proto spacing * Moved to using manually written deep copy method * Use pointers for override/default fields in apigw config entries * Run gen scripts for changed types * k8s compat - Openshift versions (#18307) * Update compatibility.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> * APIGW: Update HTTPRouteConfigEntry for JWT Auth (#18422) * Updated httproute config entry for JWT Filters * Added manual deepcopy method for httproute jwt filter * Fix test * Update JWTFilter to be in oss file * Add changelog * Add build tags for deepcopy oss file * [COMPLIANCE] License changes (#18443) * Adding explicit MPL license for sub-package This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository. * Adding explicit MPL license for sub-package This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository. * Updating the license from MPL to Business Source License Going forward, this project will be licensed under the Business Source License v1.1. Please see our blog post for more details at , FAQ at www.hashicorp.com/licensing-faq, and details of the license at www.hashicorp.com/bsl. * add missing license headers * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 --------- Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com> * Net-2708/delete resource endpoint (#18420) * feat: add http delete endpoint for resource service * refactor: clean up * Disable deep-copy codegen verification for now. (#18446) Once we figure out what to do with license headers for these files we should re-enable this check. * build: upgrade to latest buf v1.26.0 (#18426) * NET-4952 Add docs for export command (#18425) * Init file for services export command docs * Add link for export command to nav * Add export to list of subcommands for services * Add usage and basic command options * Add API options using includes * Add section for enterprise options * Include argument value in flag format * Add examples * Apply suggestions from code review Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com> --------- Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com> * Net-2712/resource hcl parsing (#18250) * Initial protohcl implementation Co-authored-by: Matt Keeler Co-authored-by: Daniel Upton * resourcehcl: implement resource decoding on top of protohcl Co-authored-by: Daniel Upton * fix: resolve ci failures * test: add additional unmarshalling tests * refactor: update function test to clean protohcl package imports --------- Co-authored-by: Matt Keeler Co-authored-by: Daniel Upton * read endpoint (#18268) implement http read endpoint to expose resource grpc service read method * Net-2707/list resource endpoint (#18444) feat: list resources endpoint * Fix incorrect yaml in examples (#18463) * NET-5187: Upgrade test timeout due to log producer errors (#18461) Stop log producer before restarting container * [NET-4799] [OSS] xdsv2: listeners L4 support for connect proxies (#18436) * refactor to avoid future import cycles * resource: Make resource list tenancy aware (#18475) * [COMPLIANCE] License update (#18479) Update BUSL LICENSE to include licensed product and version. Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com> * docs: specify manual server metadata intervention (#18477) * docs: Update OpenShift compatibility (#18478) Update compatibility.mdx * resource: Make resource delete tenancy aware (#18476) resource: Make resource delete tenancy awarae * Add license-checker action that fails when any backported file contains BUSL header (#18485) * Add license-checker action that fails when any backported file contains BUSL header * Quote echoed variable to retain line breaks * Add ticket to reference for more details * docs: Update K8s TGW tutorial to reliably obtain role ID (#18474) The `grep` command used to obtain the ID for the terminating gateway role is not reliable in all scenarios. For example, if there is a similarly named role, the command may return the wrong role ID for the active terminating gateway instance. This commit updates the command to use jq to obtain the role ID. If multiple roles are found, jq will raise an error informing the user that it cannot reliably determine the role ID. * NET-5371 License checker pt2 (#18491) * Update grep command to work on ubuntu * Run license checker when new commits are pushed to PR * README - Update KV use case to Dynamic App Configuration (#18301) * Update README.md * Update kv.mdx * Add BUSL badge * README - re-order badges and update hub link (#18498) Update README.md * [NET-5163] Support locality testing in consul-container (#18484) * Support locality testing in consul-container Support including locality in client sidecar config. Also align test config structs with Ent to avoid future conflicts. * Refactor consul-container fortio helpers Refactor fortio test helpers to separate HTTP retries from waiting on fortio result changes due to e.g. service startup and failovers. * NET-4853 - xds v2 - implement base connect proxy functionality for clusters (#18499) * Fix HCL (#18513) * Fix HCL * Update create-sameness-groups.mdx * NET-4932 - xds v2 - implement base connect proxy functionality for endpoints (#18500) * NET-4853 - xds v2 - implement base connect proxy functionality for clusters * NET-4853 - xds v2 - implement base connect proxy functionality for clusters * NET-4932 - xds v2 - implement base connect proxy functionality for endpoints * Update endpoints_test.go * gofmt * Update naming.go * Support custom watches on controller (#18439) * Support custom watches on controller * refactor mapper methods * NET-4858 - xds v2 - implement base connect proxy functionality for routes (#18501) * NET-4853 - xds v2 - implement base connect proxy functionality for clusters * NET-4853 - xds v2 - implement base connect proxy functionality for clusters * NET-4932 - xds v2 - implement base connect proxy functionality for endpoints * Update endpoints_test.go * gofmt * NET-4858 - Make connect proxy route tests pass using xds v2 * Update endpoints_test.go * Update naming.go * use alsoRunTestForV2 * remove unused makeAddress * gofmt * fixing clusters * bimapper: allow to untrack links and support reference or id (#18451) * bimapper: fix data race (#18519) * CI Split integration tests to run nightly and every PR (#18518) * CI Split integration tests to run nightly and every PR * Checkout release branch for nightly test * Fix broken links caught in weekly report (#18522) * fix broken link caught in weekly report * Apply suggestions from code review Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com> --------- Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com> * Create nightly test-integration for consul release branch (#18530) * Create nightly test-integration for consul release branch * test * fix * docs: Fix spelling errors across various pages on the site (#18533) This commit fixes numerous spelling errors across the site and also removes unnecessary whitespace that was present in the edited files. * Make proto-public license MPL (#18531) * Make proto-public license MPL * Add proto-public dir to exclusion list in .copywrite.hcl * NET-4943 - Implement ProxyTracker (#18535) * resource: Make resource watchlist tenancy aware (#18539) * Reduce required type arguments for DecodedResource (#18540) * OSS -> CE (community edition) changes (#18517) * CI: fix envoy versions in CI of release branch (#18538) * CI: fix envoy versions in CI of release branch * - remove steps sds for 1.15 nightly run - checkout the release branch * add default name * fix * Update go-tests.yml * fix checkout code * add comments and revert schedule * catalog: add failover mode enum validation (#18545) * mesh: add validation for the new pbmesh resources (#18410) Adds validation for HTTPRoute, GRPCRoute, TCPRoute, DestinationPolicy, and ComputedRoutes. * xds controller: resolve ServiceEndpoints references in ProxyStateTemp… (#18544) xds controller: resolve ServiceEndpoints references in ProxyStateTemplate * mesh: adding type aliases for mesh resource usage (#18448) Introduces some simple type aliases for DecodedResource[*X] wrappers for each type which cut down on the verbosity * Update trust bundle into proxy-state-template (#18550) * catalog: validating Protocol and Health enums on Service, Workload, and ServiceEndpoints (#18554) * chore: fix missing/incorrect license headers (#18555) * fix for , non presence of consul-version meta (#18464) * fix for #18406 , non presence of consul-version meta * removed redundant checks * updated mock-api to mimic api response for synthetic nodes * added test to test getDistinctConsulVersions method with synthetic-node case * updated typo in comments * added change log * feat: add experiments flag to testserver sdk (#18541) * bug: prevent go routine leakage due to existing DeferCheck (#18558) * bug: prevent go routine leakage due to existing DeferCheck * add changelog * NET-5382 & PLAT-1159: Do not trigger workflow if only doc files are in commit history (#18528) NET-5382: Do not run workflow runs if at least one path matches * UI: community verbiage (#18560) * chore: update community verbiage * chore: add changelog entry * Fix Windows FIPS Build (#18357) * Fix Windows FIPS Build * create new file for windows arm * removed build tag * fix buidl tags * fix multiple go build * CE port of enterprise extension (#18572) CE commit * resource: Make resource listbyowner tenancy aware (#18566) * NET-5147: Added placeholder structs for JWT functionality (#18575) * Added placeholder structs for JWT functionality * Added watches for CE vs ENT * Add license header * Undo plumbing work * Add context arg * resource: Make resource writestatus tenancy aware (#18577) * NET-5338 - NET-5338 - Run a v2 mode xds server (#18579) * NET-5338 - NET-5338 - Run a v2 mode xds server * fix linting * CI: send slack notification on failed nightly job (#18578) * CE commit (#18583) * Fix broken link on sameness group page (#18511) fix broken link * Fix typo in permissive mTLS docs (#18551) Update onboarding-tproxy-mode.mdx * Set concurrency for workflows (#18567) * Set concurrency for workflows * test: run automated tests against Vault 1.11 - 1.14 (#18590) Begin to test against Vault 1.14. Drop tests against Vault 1.10. * Reduce the frequency of metric exports to minutely (#18584) * NET-4944 - wire up controllers with proxy tracker (#18603) Co-authored-by: github-team-consul-core * Watch the ProxyTracker from xDS controller (#18611) * Distinguish v2 catalog Protocol unset from default (#18612) Even though we intend to default to TCP when this field is not explicitly provided, uncluding an `UNSPECIFIED` default enum value allows us to create inheritance chains, e.g. service to workload. * Added OpenTelemetry Access Logging Envoy extension (#18336) * [HCP Telemetry] Move first TelemetryConfig Fetch into the TelemetryConfigProvider (#18318) * Add Enabler interface to turn sink on/off * Use h for hcpProviderImpl vars, fix PR feeback and fix errors * Keep nil check in exporter and fix tests * Clarify comment and fix function name * Use disable instead of enable * Fix errors nit in otlp_transform * Add test for refreshInterval of updateConfig * Add disabled field in MetricsConfig struct * Fix PR feedback: improve comment and remove double colons * Fix deps test which requires a maybe * Update hcp-sdk-go to v0.61.0 * use disabled flag in telemetry_config.go * Handle 4XX errors in telemetry_provider * Fix deps test * Check 4XX instead * Run make go-mod-tidy * update comments and docs about running envoy integration tests with the ENVOY_VERSION set. (#18614) update ENVOY_VERSION and documentation of it used in the bats envoy tests. Co-authored-by: github-team-consul-core * first commit; reformat PD conf entry * updated proxies overview page * added Deploy SM proxy usage and removed reg index * moved sidecar proxy usage to main proxy folder * recast sidecar reg page as Deploy sidecar services * backport of commit 1ab22a78f305097b469573e51c8a161e0d46449b * backport of commit 8903c8ce936b1a46ee1a0a43d55b6de3612d85cf * backport of commit 67e332826daa44cf736f711ac83af1cc38ab84e5 * backport of commit 3345473c10ea65d7925fcd3bce04384b18ecfd59 * backport of commit d838e5de9eb7a87ef961a4f7a447e7bbd92def6c * backport of commit a1c35174cccd0f24e1c8f3c5563cc28f5e5d8bff * backport of commit 066079064991055d890354e89aeb8276ef4c57c8 * backport of commit baae1ed358f5b79acc30ed9890d5ecd2ab6d4b43 * backport of commit ef186faf8978035e0e60c6fd68a274c969c73d49 --------- Signed-off-by: josh Signed-off-by: cui fliter Co-authored-by: natemollica-dev <57850649+natemollica-nm@users.noreply.github.com> Co-authored-by: David Yu Co-authored-by: Dan Bond Co-authored-by: John Maguire Co-authored-by: Samantha Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> Co-authored-by: John Murret Co-authored-by: Ranjandas Co-authored-by: Ronald Co-authored-by: Derek Menteer <105233703+hashi-derek@users.noreply.github.com> Co-authored-by: Ashesh Vidyut <134911583+absolutelightning@users.noreply.github.com> Co-authored-by: Tu Nguyen Co-authored-by: Chris S. Kim Co-authored-by: wangxinyi7 <121973291+wangxinyi7@users.noreply.github.com> Co-authored-by: Chris Thain <32781396+cthain@users.noreply.github.com> Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com> Co-authored-by: Nathan Coleman Co-authored-by: Evan Phoenix Co-authored-by: Poonam Jadhav Co-authored-by: Dan Stough Co-authored-by: Michael Hofer Co-authored-by: J.C. Jones Co-authored-by: Fulvio Co-authored-by: Krastin Krastev Co-authored-by: Joshua Timmons Co-authored-by: david3a <49253132+david3a@users.noreply.github.com> Co-authored-by: Curt Bushko Co-authored-by: Nick Irvine <115657443+nfi-hashicorp@users.noreply.github.com> Co-authored-by: Tom Davies Co-authored-by: Luke Kysow <1034429+lkysow@users.noreply.github.com> Co-authored-by: Vijay Co-authored-by: Jared Kirschner <85913323+jkirschner-hashicorp@users.noreply.github.com> Co-authored-by: Eddie Rowe <74205376+eddie-rowe@users.noreply.github.com> Co-authored-by: emilymianeil Co-authored-by: nv-hashi <80716011+nv-hashi@users.noreply.github.com> Co-authored-by: Iryna Shustava Co-authored-by: Jeff Apple <79924108+Jeff-Apple@users.noreply.github.com> Co-authored-by: cskh Co-authored-by: Franco Bruno Lavayen Co-authored-by: Jose Ignacio Lorenzo <74208929+joselo85@users.noreply.github.com> Co-authored-by: Jose Ignacio Lorenzo Co-authored-by: Dhia Ayachi Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> Co-authored-by: R.B. Boyer Co-authored-by: Freddy Co-authored-by: NiniOak Co-authored-by: Michael Zalimeni Co-authored-by: Semir Patel Co-authored-by: hashicorp-tsccr[bot] <129506189+hashicorp-tsccr[bot]@users.noreply.github.com> Co-authored-by: hashicorp-tsccr[bot] Co-authored-by: Blake Covarrubias Co-authored-by: Ivan K Berlot Co-authored-by: Ezequiel Fernández Ponce <20102608+ezfepo@users.noreply.github.com> Co-authored-by: Ezequiel Fernández Ponce Co-authored-by: Nitya Dhanushkodi Co-authored-by: Jeremy Jacobson Co-authored-by: lornasong Co-authored-by: Judith Malnick Co-authored-by: Paul Glass Co-authored-by: Gautam Co-authored-by: Florian Apolloner Co-authored-by: cui fliter Co-authored-by: John Landa Co-authored-by: Ashvitha Co-authored-by: Andrea Scarpino Co-authored-by: Matt Keeler Co-authored-by: sarahalsmiller <100602640+sarahalsmiller@users.noreply.github.com> Co-authored-by: Gerard Nguyen Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com> Co-authored-by: Daniel Upton Co-authored-by: Ashwin Venkatesh Co-authored-by: Natalie Smith Co-authored-by: Hardik Shingala <34568645+hdkshingala@users.noreply.github.com> Co-authored-by: trujillo-adam --- .../connect/config-entries/proxy-defaults.mdx | 1129 ++++++++++------- .../proxies/deploy-service-mesh-proxies.mdx | 77 ++ .../proxies/deploy-sidecar-services.mdx | 286 +++++ .../content/docs/connect/proxies/index.mdx | 80 +- .../proxy-config-reference.mdx} | 59 +- .../docs/connect/registration/index.mdx | 22 - .../connect/registration/sidecar-service.mdx | 175 --- website/data/docs-nav-data.json | 37 +- website/redirects.js | 20 +- 9 files changed, 1159 insertions(+), 726 deletions(-) create mode 100644 website/content/docs/connect/proxies/deploy-service-mesh-proxies.mdx create mode 100644 website/content/docs/connect/proxies/deploy-sidecar-services.mdx rename website/content/docs/connect/{registration/service-registration.mdx => proxies/proxy-config-reference.mdx} (93%) delete mode 100644 website/content/docs/connect/registration/index.mdx delete mode 100644 website/content/docs/connect/registration/sidecar-service.mdx diff --git a/website/content/docs/connect/config-entries/proxy-defaults.mdx b/website/content/docs/connect/config-entries/proxy-defaults.mdx index 1d94a79389b6..05e5de30f7e8 100644 --- a/website/content/docs/connect/config-entries/proxy-defaults.mdx +++ b/website/content/docs/connect/config-entries/proxy-defaults.mdx @@ -1,178 +1,135 @@ --- layout: docs -page_title: Proxy Defaults - Configuration Entry Reference +page_title: Proxy defaults configuration entry reference description: >- The proxy defaults configuration entry kind defines default behaviors for proxies in the service mesh. Use the reference guide to learn about `""proxy-defaults""` config entry parameters. --- -# Proxy Defaults Configuration Entry +# Proxy defaults configuration reference -The `proxy-defaults` configuration entry (`ProxyDefaults` on Kubernetes) allows you to globally configure passthrough Envoy settings for proxies in the service mesh, including both sidecars and gateways. -It is different from the [`mesh` configuration entry](/consul/docs/connect/config-entries/mesh), which sets Consul features for cluster peering, transparent proxy, and TLS behavior that also affect Consul servers. - -Only one global entry is supported. -For Consul Enterprise, only the global entry in the `default` partition is recognized. +This topic provides reference information for proxy defaults configuration entries. Refer to [Service mesh proxy overview](/consul/docs/connect/proxies) for information about using proxies in Consul. ## Introduction -You can customize some service registration settings for service mesh proxies centrally using the `proxy-defaults` configuration entry in the `kind` field. - -You can still override this centralized configuration for specific services -with the [`service-defaults`](/consul/docs/connect/config-entries/service-defaults) -configuration entry `kind` or for individual proxy instances in their [sidecar -service definitions](/consul/docs/connect/registration/sidecar-service). +Proxy defaults configuration entries set global passthrough Envoy settings for proxies in the service mesh, including sidecars and gateways. Proxy defaults configuration entries do not control features for peered clusters, transparent proxy, or TLS behavior. For information about configuring Consul settings that affect service mesh behavior, refer to the [mesh configuration entry reference](/consul/docs/connect/config-entries/mesh). -## Usage +Consul only supports one global proxy defaults configuration entry at a time. If multiple configuration entries are defined in Consul Enterprise, Consul implements the configuration entry in the `default` partition. -1. Verify that your datacenter meets the conditions specified in the [Requirements](#requirements). -1. Determine the settings you want to implement (see [Configuration](#configuration)). You can create a file containing the configuration or pass them to the state store directly to apply the configuration. -1. Apply the configuration using one of the following methods: - - Kubernetes CRD: Refer to the [Custom Resource Definitions](/consul/docs/k8s/crds) documentation for details. - - Issue the `consul config write` command: Refer to the [Consul Config Write](/consul/commands/config/write) documentation for details. +## Configuration model -## Configuration - -Configure the following parameters to define a `proxy-defaults` configuration entry: +The following list outlines field hierarchy, language-specific data types, and requirements in proxy defaults configuration entries. Click on a property name to view additional details, including default values. - - - -```hcl -Kind = "proxy-defaults" -Name = "global" -Meta { - = "" -} -Config { - = -} -Mode = "" -TransparentProxy { - OutboundListenerPort = - DialedDirectly = -} -MutualTLSMode = "" -MeshGateway { - Mode = "" -} -Expose { - Checks = + + +- [`Kind`](#kind): string | required | must be set to `proxy-defaults` +- [`Name`](#name): string | must be set to `global` +- [`Namespace`](#namespace): string | `default` | +- [`Partition`](#partition): string | `default` | +- [`Meta`](#meta): map +- [`Config`](#meta): map +- [`EnvoyExtensions`](#envoyextensions): list of maps + - [`Name`](#envoyextensions): string + - [`Required`](#envoyextensions): string + - [`Arguments`](#envoyextensions): string + - [`ConsulVersion`](#envoyextensions): string + - [`EnvoyVersion`](#envoyextensions): string +- [`Mode`](#mode): string +- [`TransparentProxy`](#transparentproxy): map + - [`OutboundListenerPort`](#transparentproxy): number | `15001` + - [`DialedDirectly`](#transparentproxy): boolean | `false` +- [`MutualTLSMode`](#mutualtlsmode): string +- [`MeshGateway`](#meshgateway): map + - [`Mode`](#meshgateway): string +- [`Expose`](#expose): map + - [`Checks`](#expose-checks): boolean | `false` + - [`Paths`](#expose-paths): list of maps + - [`Path`](#expose-paths-path): string | must begin with `/` + - [`LocalPathPort`](#expose-paths): number | `0` + - [`ListenerPort`](#expose-paths): number | `0` + - [`Protocol`](#expose-paths): string | `http` +- [`FailoverPolicy`](#failoverpolicy): map + - [`Mode`](#failoverpolicy-mode): string +- [`AccessLogs`](#accesslogs): map + - [`Enabled`](#accesslogs): boolean | `false` + - [`DisableListenerLogs`](#accesslogs): boolean | `false` + - [`Type`](#accesslogs): string | `stdout` + - [`Path`](#accesslogs): string + - [`JSONFormat`](#accesslogs): string + - [`TextFormat`](#accesslogs): string - Paths = [ - { - Path = "" - LocalPathPort = - ListenerPort = - Protocol = "" - } - ] -} -AccessLogs { - Enabled = < true | false > - DisableListenerLogs = < true | false , disables listener access logs for unrecognized traffic> - Type = "< file | stdout | stdout, the destination for access logs >" - Path = "< set the output path for 'file' based access logs >" - JSONFormat = "< json representation of access log format >" - TextFormat = "< text representation of access log format >" -} -``` + + + +- [`apiVersion`](#apiversion): string | required | must be set to `consul.hashicorp.com/v1alpha1` +- [`kind`](#kind): string | required | must be set to `ProxyDefaults` +- [`metadata`](#metadata): map | required + - [`name`](#metadata-name): string | required | must be set to `global` + - [`namespace`](#metadata-namespace): string | `default` | +- [`spec`](#spec): map | required + - [`config`](#spec-config): map + - [`EnvoyExtensions`](#spec-EnvoyExtensions): list of maps + - [`name`](#spec-EnvoyExtensions): string + - [`required`](#spec-EnvoyExtensions): string + - [`arguments`](#spec-EnvoyExtensions): string + - [`consulVersion`](#spec-EnvoyExtensions): string + - [`envoyVersion`](#spec-EnvoyExtensions): string + - [`mode`](#spec-mode): string + - [`transparentProxy`](#spec-transparentproxy): map + - [`outboundListenerPort`](#spec-transparentproxy): number | `15001` + - [`dialedDirectly`](#spec-transparentproxy): boolean | `false` + - [`mutualTLSMode`](#spec-mutualtlsmode): string + - [`meshGateway`](#spec-meshgateway): map + - [`mode`](#spec-meshgateway): string + - [`expose`](#spec-expose): map + - [`checks`](#spec-expose-checks): boolean | `false` + - [`paths`](#spec-expose-paths): list + - [`path`](#spec-expose-paths): string | must begin with `/` + - [`localPathPort`](#spec-expose-paths): number | `0` + - [`listenerPort`](#spec-expose-paths): number | `0` + - [`protocol`](#spec-expose-paths): string | `http` + - [`failoverPolicy`](#spec-failoverpolicy): map + - [`mode`](#spec-failoverpolicy-mode): string + - [`accessLogs`](#spec-accesslogs): map + - [`enabled`](#spec-accesslogs): boolean | `false` + - [`disableListenerLogs`](#spec-accesslogs): boolean | `false` + - [`type`](#spec-accesslogs): string | `stdout` + - [`path`](#spec-accesslogs): string + - [`jsonFormat`](#spec-accesslogs): string + - [`textFormat`](#spec-accesslogs): string -```yaml -apiVersion: consul.hashicorp.com/v1alpha1 -kind: ProxyDefaults -metadata: - name: global -spec: - meta: - : - config: - : - mode: - transparentProxy: - outboundListenerPort: - dialedDirectly: - mutualTLSMode: - meshGateway: - mode: - expose: - checks: - paths: - - path: - localPathPort: - listenerPort: - protocol:= - accessLogs: - enabled: < true | false > - disableListenerLogs: < true | false , disables listener access logs for unrecognized traffic> - type: < file | stdout | stdout, the destination for access logs > - path: < set the output path for 'file' based access logs > - jsonFormat: < json representation of access log format > - textFormat: < text representation of access log format > -``` + -```json -{ - "Kind": "proxy-defaults", - "Name": "global", - "Meta": { - "": "" - }, - "Config": { - "": - }, - "MutualTLSMode": "", - "Mode": "", - "TransparentProxy": { - "OutboundListenerPort": , - "DialedDirectly": - }, - "MeshGateway": { - "Mode": = "" - }, - "Expose": { - "Checks": , - "Paths": [ - { - "Path": "", - "LocalPathPort": , - "ListenerPort": , - "Protocol": "" - } - ] - }, - "AccessLogs": { - "Enabled": < true | false >, - "DisableListenerLogs": < true | false , disables listener access logs for unrecognized traffic>, - "Type": "< file | stdout | stdout, the destination for access logs >", - "Path": "< set the output path for 'file' based access logs >", - "JSONFormat": "< json representation of access log format >", - "TextFormat": "< text representation of access log format >" - } -} -``` + - +## Complete configuration - - +When every field is defined, a proxy defaults configuration entry has the following form: --> **NOTE:** The `proxy-defaults` config entry can only be created in the `default` -namespace and it will configure proxies in **all** namespaces. + - + ```hcl Kind = "proxy-defaults" Name = "global" -Namespace = "default" # Can only be set to "default". +Namespace = "default" Meta { = "" } Config { = } +EnvoyExtensions = [ + { + Name= "" + Required = "required" + Arguments = "" + ConsulVersion = "" + EnvoyVersion = "" + } +] Mode = "" TransparentProxy { OutboundListenerPort = @@ -203,6 +160,9 @@ AccessLogs { TextFormat = "< text representation of access log format >" } ``` + + + ```yaml apiVersion: consul.hashicorp.com/v1alpha1 @@ -215,6 +175,12 @@ spec: : config: : + EnvoyExtensions: + - name: + required: required + arguments: + consulVersion: + envoyVersion: mode: transparentProxy: outboundListenerPort: @@ -238,6 +204,10 @@ spec: textFormat: < text representation of access log format > ``` + + + + ```json { "Kind": "proxy-defaults", @@ -249,6 +219,15 @@ spec: "Config": { "": }, + "EnvoyExtensions": [ + { + "Name": "", + "Required": "required", + "Arguments": "", + "ConsulVersion": "", + "EnvoyVersion": "" + } + ], "Mode": "", "TransparentProxy": { "OutboundListenerPort": , @@ -280,288 +259,486 @@ spec: } ``` - - + -### Configuration Parameters +## Specification -: nil', - description: - 'Specifies arbitrary KV metadata pairs. Added in Consul 1.8.4.', - yaml: false, - }, - { - name: 'metadata', - children: [ - { - name: 'name', - description: 'Must be set to `global`', - }, - { - name: 'namespace', - enterprise: true, - description: - 'If running Consul Open Source, the namespace is ignored (see [Kubernetes Namespaces in Consul OSS](/consul/docs/k8s/crds#consul-oss)). If running Consul Enterprise see [Kubernetes Namespaces in Consul Enterprise](/consul/docs/k8s/crds#consul-enterprise) for more details.', - }, - ], - hcl: false, - }, - { - name: 'Config', - type: 'map[string]arbitrary', - description: `An arbitrary map of configuration values used by service mesh proxies. - The available configurations depend on the mesh proxy you use. - Any values that your proxy allows can be configured globally here. To explore these options please see the documentation for your chosen proxy. -
  • [Envoy](/consul/docs/connect/proxies/envoy#proxy-config-options)
    • -
  • [Consul's built-in proxy](/consul/docs/connect/proxies/built-in#proxy-config-key-reference)
`, - }, - { - name: 'EnvoyExtensions', - type: 'array: []', - description: `A list of extensions to modify Envoy proxy configuration.

- Applying \`EnvoyExtensions\` to \`ProxyDefaults\` may produce unintended consequences. We recommend enabling \`EnvoyExtensions\` with [\`ServiceDefaults\`](/consul/docs/connect/config-entries/service-defaults#envoyextensions) in most cases.`, - children: [ - { - name: 'Name', - type: `string: ""`, - description: `Name of the extension.`, - }, - { - name: 'Required', - type: `string: ""`, - description: `When \`Required\` is true and the extension does not update any Envoy resources, an error is - returned. Use this parameter to ensure that extensions required for secure communication are not unintentionally - bypassed.`, - }, - { - name: 'Arguments', - type: 'map: nil', - description: `Arguments to pass to the extension executable.`, - }, - ], - }, - { - name: 'Mode', - type: `string: ""`, - description: `One of \`direct\` or \`transparent\`. - \`transparent\` represents that inbound and outbound application traffic is being - captured and redirected through the proxy. This mode does not enable the traffic redirection - itself. Instead it signals Consul to configure Envoy as if traffic is already being redirected. - \`direct\` represents that the proxy's listeners must be dialed directly by the local - application and other proxies. - Added in v1.10.0.`, - }, - { - name: 'TransparentProxy', - type: 'TransparentProxyConfig: ', - description: `Controls configuration specific to proxies in transparent mode. Added in v1.10.0.`, - children: [ - { - name: 'OutboundListenerPort', - type: 'int: "15001"', - description: `The port the proxy should listen on for outbound traffic. This must be the port where - outbound application traffic is captured and redirected to.`, - }, - { - name: 'DialedDirectly', - type: 'bool: false', - description: `Determines whether this proxy instance's IP address can be dialed directly by transparent proxies. - Typically transparent proxies dial upstreams using the "virtual" tagged address, which load balances - across instances. Dialing individual instances can be helpful in cases like stateful services such - as a database cluster with a leader. `, - }, - ], - }, - { - name: 'MutualTLSMode', - type: 'string: ""', - description: `Controls the default mutual TLS mode for all proxies. This setting is only - supported for services with transparent proxy enabled. One of \`""\`, \`strict\`, or \`permissive\`. - When unset or \`""\`, the mode defaults to \`strict\`. When set to \`strict\`, the sidecar proxy - requires mutual TLS for incoming traffic. When set to \`permissive\`, the sidecar proxy accepts - mutual TLS traffic on the sidecar proxy service port and accepts any traffic on the destination - service port. We recommend only using \`permissive\` mode if necessary while onboarding services to - the service mesh. `, - }, - { - name: 'MeshGateway', - type: 'MeshGatewayConfig: ', - description: `Controls the default - [mesh gateway configuration](/consul/docs/connect/gateways/mesh-gateway#service-mesh-proxy-configuration) - for all proxies. Added in v1.6.0.`, - children: [ - { - name: 'Mode', - type: 'string: ""', - description: 'One of `none`, `local`, or `remote`.', - }, - ], - }, - { - name: 'Expose', - type: 'ExposeConfig: ', - description: `Controls the default - [expose path configuration](/consul/docs/connect/registration/service-registration#expose-paths-configuration-reference) - for Envoy. Added in v1.6.2.

- Exposing paths through Envoy enables a service to protect itself by only listening on localhost, while still allowing - non-mesh-enabled applications to contact an HTTP endpoint. - Some examples include: exposing a \`/metrics\` path for Prometheus or \`/healthz\` for kubelet liveness checks.`, - children: [ - { - name: 'Checks', - type: 'bool: false', - description: `If enabled, all HTTP and gRPC checks registered with the agent are exposed through Envoy. - Envoy will expose listeners for these checks and will only accept connections originating from localhost or Consul's - [advertise address](/consul/docs/agent/config/config-files#advertise). The port for these listeners are dynamically allocated from - [expose_min_port](/consul/docs/agent/config/config-files#expose_min_port) to [expose_max_port](/consul/docs/agent/config/config-files#expose_max_port). - This flag is useful when a Consul client cannot reach registered services over localhost.`, - }, - { - name: 'Paths', - type: 'array: []', - description: 'A list of paths to expose through Envoy.', - children: [ - { - name: 'Path', - type: 'string: ""', - description: - 'The HTTP path to expose. The path must be prefixed by a slash. ie: `/metrics`.', - }, - { - name: 'LocalPathPort', - type: 'int: 0', - description: - 'The port where the local service is listening for connections to the path.', - }, - { - name: 'ListenerPort', - type: 'int: 0', - description: `The port where the proxy will listen for connections. This port must be available - for the listener to be set up. If the port is not free then Envoy will not expose a listener for the path, - but the proxy registration will not fail.`, - }, - { - name: 'Protocol', - type: 'string: "http"', - description: - 'Sets the protocol of the listener. One of `http` or `http2`. For gRPC use `http2`.', - }, - ], - }, - ], - }, - { - name: 'FailoverPolicy', - type: 'ServiceResolverFailoverPolicy: ', - description: `Policy specifies the exact mechanism used for failover. - Added in v1.16.0.`, - children: [ - { - name: 'Mode', - type: 'string: ""', - description: 'One of `""`, `default`, or `order-by-locality`.', - }, - ], - }, - { - name: 'AccessLogs', - type: 'AccessLogsConfig: ', - description: `Controls the configuration of [Envoy's access logging](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/observability/access_logging.html?highlight=access%20logs) - for all proxies in the mesh, including gateways. It also configures access logs on [Envoy's administration interface](https://www.envoyproxy.io/docs/envoy/latest/operations/admin.html?highlight=administration%20logs).`, - children: [ - { - name: 'Enabled', - type: 'bool: false', - description: 'When enabled, access logs are emitted for all proxies in the mesh, including gateways.', - }, - { - name: 'DisableListenerLogs', - type: 'bool: false', - description: `When enabled, access logs for traffic rejected at the listener-level are not emitted. - This traffic includes connections that do not match any of Envoy's configured filters, such as Consul upstream services. - Set this option to \`true\` if you do not want to log unknown requests that Envoy is not forwarding`, - }, - { - name: 'Type', - type: 'string: "stdout"', - description: 'The destination for access logs. One of \`stdout\`, \`stderr\`, or \`file\`.', - }, - { - name: 'Path', - type: 'string: ""', - description: 'The destination file for access logs. Only valid with \`Type\` set to \`file\`.', - }, - { - name: 'JSONFormat', - type: 'string: (default as follows)', - description: `A JSON-formatted string that represents the format of each emitted access log. - By default, it is set to the [default access log format](/consul/docs/connect/observability/access-logs#default-log-format). - You can use Envoy [command operators](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#command-operators) to customize the emitted data. - Nesting is supported. - Invalid if a custom format is specified with TextFormat.`, - }, - { - name: 'TextFormat', - type: 'string: ""', - description: `A formatted string that represents the format of each emitted access log. - Envoy [command operators](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#command-operators) can be used to customize the data emitted. - A new line is added to the string automatically. - Invalid when a custom JSONFormat is already specified.`, - } - ], - }, - ]} -/> +This section provides details about the fields you can configure in the proxy defaults configuration entry. + + + + + +### `Kind` + +Specifies the type of configuration entry to implement. Must be set to `proxy-defaults`. + +#### Values + +- Default: None +- This field is required. +- Data type: String value that must be set to `proxy-defaults`. + +### `Name` + +Specifies a name for the configuration entry that is used to identify the configuration entry. Must be set to `global`. + +#### Values + +- Default: None +- This field is required. +- Data type: String that must be set to `global`. + +### `Namespace` + +Specifies the namespace that the proxy defaults apply to. You can only specify the `default` namespace. + +#### Values + +- Default: `default` +- Data type: String + +### `Partition` + +Specifies the local admin partition that the proxy defaults apply to. Refer to [admin partitions](/consul/docs/enterprise/admin-partitions) for more information. + +#### Values + +- Default: `default` +- Data type: String + +### `Meta` + +Specifies a set of custom key-value pairs to add the [Consul KV](#/consul/docs/dynamic-app-config/kv) store. + +#### Values + +- Default: None +- Data type: Map of one or more key-value pairs. + - Keys: String + - Values: String, integer, or float + +### `Config` + +Specifies an arbitrary map of configuration values used by service mesh proxies. The available configurations depend on the mesh proxy you use. You can configure any global values that your proxy allows in this field. Refer to the following topics for additional information: + +- [Envoy proxy configuration option](/consul/docs/connect/proxies/envoy#proxy-config-options) +- [Built-in proxy configuration options](/consul/docs/connect/proxies/built-in#proxy-config-key-reference) + +#### Values + +- Default: None +- Data type: Map of + +### `EnvoyExtensions` + +Specifies a list of extensions that modify Envoy proxy configurations. Refer to [Envoy extensions](/consul/docs/connect/proxies/envoy-extensions) for additional information. + +#### Values + +- Default: None +- Data type: Map of containing the following fields: + - `Name` + - `Required` + - `Arguments` + - `ConsulVersion` + - `EnvoyVersion` + +The following table describes how to configure values in the `EnvoyExtensions` map: + +| Parameter | Description | Data type | Default | +| --- | --- | --- | --- | +| `Name` | Specifies the name of the extension. | String | None | +| `Required` | Specify `true` to require Consul to implement the extension.

Use this parameter to ensure that extensions required for secure communication are not unintentionally bypassed.

Consul returns an error when `Required` is set to `true` and the extension does not update Envoy resources.

| String | None | +| `Arguments` | Specifies the arguments to pass to the extension executable. Refer to the documentation for the extension you want to implement for additional information. | Map | None | +| `ConsulVersion` | Specifies the version of Consul that the extension is allowed to work with. Consul validates the version during xDS updates. If a different version is in use, Consul skips the extension and writes the event to the log.

The `ConsulVersion` and `EnvoyVersion` must both validate for Consul to implement the extension.

| String | None | +| `EnvoyVersion` | Specifies the version of Envoy that the extension is allowed to work with. Consul validates the version during xDS updates. If a different version is in use, Consul skips the extension and writes the event to the log.

The `ConsulVersion` and `EnvoyVersion` must both validate for Consul to implement the extension.

| String | None | + +### `Mode` + +Specifies a mode for how proxies direct inbound and outbound traffic. You can specify one of the following values: + +- `transparent`: In transparent mode, proxies capture and redirect inbound and outbound traffic. The mode does not enable traffic redirection, but directs Consul to configure Envoy as if traffic is already being redirected. + +- `direct`: In this mode, the local application and other proxies must directly dial proxy listeners. + +#### Values + +- Default: None +- Data type: String + +### `TransparentProxy` + +Contains configurations for proxies that are running in transparent proxy mode. Refer to [Transparent proxy mode](/consul/docs/k8s/connect/transparent-proxy) for additional information. + +#### Values + +- Default: None +- Data type: Map of containing the following fields: + - `OutboundListenerPort` + - `DialedDirectly` + +The following table describes how to configure values in the `TransparentProxy` map: + +| Parameter | Description | Data type | Default | +| --- | --- | --- | --- | +| `OutboundListenerPort` | Specifies the port that the proxy listens on for outbound traffic. Outbound application traffic must be captured and redirected to this port. | Integer | `15001` | +| `DialedDirectly` | Determines whether other proxies in transparent mode can directly dial this proxy instance's IP address. Proxies in transparent mode commonly dial upstreams at the [`virtual`](/consul/docs/services/configuration/services-configuration-reference#tagged_addresses-virtual) tagged address, which load balances across instances. Dialing individual instances can be helpful when sending requests to stateful services, such as database clusters with a leader. | Boolean | `false` | + +### `MutualTLSMode` + +Controls the default mutual TLS (mTLS) mode for all proxies. You can only set mutual TLS mode for services in transparent proxy mode. + +You can specify one of the following modes: + +`strict`: The sidecar proxy requires mTLS for incoming traffic. +`permissive`: The sidecar proxy accepts mTLS traffic on the sidecar proxy service port and accepts any traffic on the destination service port. We recommend only using permissive mode if necessary while onboarding services to the service mesh. + +#### Values + +- Default: `strict` +- Data type: One of the following string values: + - `strict` + - `permissive` + +### `MeshGateway` + +Sets the default mesh gateway `mode` field for all proxies. You can specify the following string values for the `mode` field: + +- `none`: The proxy does not make outbound connections through a mesh gateway. Instead, it makes outbound connections directly to the destination services. +- `local`: The proxy makes an outbound connection to a gateway running in the same datacenter. +- `remote`: The proxy makes an outbound connection to a gateway running in the destination datacenter. + +#### Values + +- Default: None +- Data type: Map containing the `mode` field + +### `Expose` + +Specifies default configurations for exposing HTTP paths through Envoy. Exposing paths through Envoy enables services to protect themselves by only listening on `localhost`. Applications that are not Consul service mesh-enabled are still able to contact an HTTP endpoint. + +Example use-cases include exposing the `/metrics` endpoint to a monitoring system, such as Prometheus, and exposing the `/healthz` endpoint to the kubelet for liveness checks. Refer to [Expose Paths Configuration Reference](/consul/docs/connect/proxy-config-reference#expose-paths-configuration-reference) for additional information. + +#### Values + +- Default: None +- Data type: Map containing the following parameters: + - [`Checks`](#expose-checks) + - [`Paths`](#expose-paths) + +### `Expose{}.Checks` + +Exposes all HTTP and gRPC checks registered with the agent when set to `true`. Envoy exposes listeners for the checks and only accepts connections originating from localhost or Consul's [`advertise_addr`](/consul/docs/agent/config/config-files#advertise). The ports for the listeners are dynamically allocated from the agent's [`expose_min_port`](/consul/docs/agent/config/config-files#expose_min_port) and [`expose_max_port`](/consul/docs/agent/config/config-files#expose_max_port) configurations. + +We recommend enabling the `Checks` configuration when a Consul client cannot reach registered services over localhost, such as when Consul agents run in their own pods in Kubernetes. + +#### Values + +- Default: `false` +- Data type: boolean + +### `Expose{}.Paths[]` + +Specifies a list of configuration maps that define paths to expose through Envoy when `Expose.Checks` is set to `true`. + +#### Values + +- Default: None +- Data type: List of maps. + +The following table describes the parameters for each map you can define in the list: + +| Parameter | Description | Data type | Default | +| --- | --- | --- | --- | +| `Path` | Specifies the HTTP path to expose. You must prepend the path with a forward slash (`/`). | String | None | +| `LocalPathPort` | Specifies the port where the local service listens for connections to the path. | Integer | `0` | +| `ListenPort` | Specifies the port where the proxy listens for connections. The port must be available. If the port is unavailable, Envoy does not expose a listener for the path and the proxy registration still succeeds. | Integer | `0` | +| `Protocol` | Specifies the protocol of the listener. You can configure one of the following values:
  • `http`
  • `http2`: Use with gRPC traffic
    • | String | `http` | + +### `FailoverPolicy` + +Sets the failover policy `mode` field for all proxies. The failover policy mode defines how Consul directs traffic to failover service instances if the primary instance becomes unreachable. For example, you can direct Consul to send failover traffic to local service instances. Refer to [Failover overview](/consul/docs/connect/failover) for additional information. + +You can specify the following string values for the `mode` field: + +- `default`: Envoy sends failover traffic to the first failover target with healthy instances. +- `order-by-locality`: Envoy prioritizes failover targets that are closer to the downstream service. Envoy deterministically orders failover targets that are the same distance from the local proxy. + +#### Values + +- Default: None +- Data type: Map containing the `mode` field + +### `AccessLogs` + +Specifies [Envoy access logger](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/observability/access_logging.html?highlight=access%20logs) configurations for all proxies in the service mesh, including gateways. This field also configures access logs on [Envoy's administration interface](https://www.envoyproxy.io/docs/envoy/latest/operations/admin.html?highlight=administration%20logs). + +#### Values + +- Default: None +- Data type: Map + +The following table describes the parameters you can define in the `AccessLogs` map: + +| Parameter | Description | Data type | Default | +| --- | --- | --- | --- | +| `Enabled` | Enables Envoy to emit access logs for all proxies in the service mesh. | Boolean | `false` | +| `DisabledListenerLogs` | Disables access logs for traffic rejected at the listener level. Rejected traffic includes connections that do not match any of Envoy's configured filters, such as Consul upstream services. Set this option to `true` if you do not want to log unknown requests that Envoy is not forwarding. | Boolean | `false` | +| `Type` | Specifies the destination for access logs. You can specify one of the following types:
  • `stdout`
  • `stderr`
  • `file`
    • | String | None | +| `Path` | Specifies the destination for writing access logs to file when `Type` is set to `file`. | String | None | +| `JSONFormat` | Specifies a JSON-formatted string that represents the format for each emitted access log. You can use [Envoy command operators](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#command-operators) to customize the emitted data. You can also nest data. You cannot set this field and the `TextFormat` field concurrently. | String | [Default log format](/consul/docs/connect/observability/access-logs#default-log-format) | +| `TextFormat` | Specifies a text-formatted string that represents the format for each emitted access log. You can use [Envoy command operators](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#command-operators) to customize the emitted data. You can also nest data. You cannot set this field and the `JSONFormat` field concurrently. | String | None | + +     + + + +### apiVersion + +Specifies the verion of the Consul API to use to apply the configuration entry. This must be set to `consul.hashicorp.com/v1alpha1`. + +#### Values + +- Default: None +- This field is required. +- Data type: String value that must be set to `consul.hashicorp.com/v1alpha1`. + +### `kind` + +Specifies the type of configuration entry to implement. Must be set to `ProxyDefaults`. + +#### Values + +- Default: None +- This field is required. +- Data type: String value that must be set to `ProxyDefaults`. + + +### `metadata` + +Map that contains the service name, namespace, and admin partition that the configuration entry applies to. + +#### Values + +- Default: none +- Map containing the following strings: + - `name` + - `namespace` + + +### `metadata.name` + +Specifies a name for the configuration entry that is used to identify the configuration entry. Must be set to `global`. + +#### Values + +- Default: None +- This field is required. +- Data type: String that must be set to `global`. + +### `metadata.namespace` + +Specifies the namespace that the proxy defaults apply to. If you are on the community version, Consul ignores the `namespace` field. Refer to [Kubernetes namespaces in Consul](/consul/docs/k8s/crds#consul-oss) for additional information. If you are on Consul Enterprise, refer to [Kubernetes namespaces in Consul Enterprise](/consul/docs/k8s/crds#consul-enterprise) for additional information. + +#### Values + +- Default: `default` +- Data type: String + +### `spec` + +Map that contains the details about the ProxyDefaults configuration entry. The `apiVersion`, `kind``, and `metadata` fields are siblings of the `spec` field. All other configurations are children. + +### `spec.config` + +Specifies an arbitrary map of configuration values used by service mesh proxies. The available configurations depend on the mesh proxy you use. You can configure any global values that your proxy allows in this field. Refer to the following topics for additional information: + +- [Envoy proxy configuration option](/consul/docs/connect/proxies/envoy#proxy-config-options) +- [Built-in proxy configuration options](/consul/docs/connect/proxies/built-in#proxy-config-key-reference) + +#### Values + +- Default: None +- Data type: Map + +### `spec.envoyExtensions` + +Specifies a list of extensions that modify Envoy proxy configurations. Refer to [Envoy extensions](/consul/docs/connect/proxies/envoy-extensions) for additional information. + +#### Values + +- Default: None +- Data type: Map of containing the following fields: + - `name` + - `required` + - `arguments` + - `consulVersion` + - `envoyVersion` + +The following table describes how to configure values in the `EnvoyExtensions` map: + +| Parameter | Description | Data type | Default | +| --- | --- | --- | --- | +| `name` | Specifies the name of the extension. | String | None | +| `required` | Specify `true` to require Consul to implement the extension.

    Use this parameter to ensure that extensions required for secure communication are not unintentionally bypassed.

    Consul returns an error when `Required` is set to `true` and the extension does not update Envoy resources.

    | String | None | +| `arguments` | Specifies the arguments to pass to the extension executable. Refer to the documentation for the extension you want to implement for additional information. | Map | None | +| `consulVersion` | Specifies the version of Consul that the extension is allowed to work with. Consul validates the version during xDS updates. If a different version is in use, Consul skips the extension and writes the event to the log.

    The `consulVersion` and `envoyVersion` must both validate for Consul to implement the extension.

    | String | None | +| `envoyVersion` | Specifies the version of Envoy that the extension is allowed to work with. Consul validates the version during xDS updates. If a different version is in use, Consul skips the extension and writes the event to the log.

    The `consulVersion` and `envoyVersion` must both validate for Consul to implement the extension.

    | String | None | + +### `spec.mode` + +Specifies a mode for how proxies direct inbound and outbound traffic. You can specify one of the following values: + +- `transparent`: In transparent mode, proxies capture and redirect inbound and outbound traffic. The mode does not enable traffic redirection, but directs Consul to configure Envoy as if traffic is already being redirected. +- `direct`: In this mode, the local application and other proxies must directly dial proxy listeners. + +#### Values + +- Default: None +- Data type: String + +### `spec.transparentProxy` + +Contains configurations for proxies that are running in transparent proxy mode. Refer to [Transparent proxy mode](/consul/docs/k8s/connect/transparent-proxy) for additional information. + +#### Values + +- Default: None +- Data type: Map of containing the following fields: + - `outboundListenerPort` + - `dialedDirectly` + +The following table describes how to configure values in the `TransparentProxy` map: + +| Parameter | Description | Data type | Default | +| --- | --- | --- | --- | +| `outboundListenerPort` | Specifies the port that the proxy listens on for outbound traffic. Outbound application traffic must be captured and redirected to this port. | Integer | `15001` | +| `dialedDirectly` | Determines whether other proxies in transparent mode can directly dial this proxy instance's IP address. Proxies in transparent mode commonly dial upstreams at the [`virtual`](/consul/docs/services/configuration/services-configuration-reference#tagged_addresses-virtual) tagged address, which load balances across instances. Dialing individual instances can be helpful when sending requests to stateful services, such as database clusters with a leader. | Boolean | `false` | + +### `spec.mutualTLSMode` + +Controls the default mutual TLS (mTLS) mode for all proxies. You can only set mutual TLS mode for services in transparent proxy mode. + +You can specify one of the following modes: + +`strict`: The sidecar proxy requires mTLS for incoming traffic. +`permissive`: The sidecar proxy accepts mTLS traffic on the sidecar proxy service port and accepts any traffic on the destination service port. We recommend only using permissive mode if necessary while onboarding services to the service mesh. + +#### Values + +- Default: `strict` +- Data type: One of the following string values: + - `strict` + - `permissive` + +### `spec.meshGateway` + +Sets the default mesh gateway `mode` field for all proxies. You can specify the following string values for the `mode` field: + +- `none`: The proxy does not make outbound connections through a mesh gateway. Instead, it makes outbound connections directly to the destination services. +- `local`: The proxy makes an outbound connection to a gateway running in the same datacenter. +- `remote`: The proxy makes an outbound connection to a gateway running in the destination datacenter. + +#### Values + +- Default: None +- Data type: Map containing the `mode` field + +### `spec.expose` + +Specifies default configurations for exposing HTTP paths through Envoy. Exposing paths through Envoy enables services to protect themselves by only listening on `localhost`. Applications that are not Consul service mesh-enabled are still able to contact an HTTP endpoint. + +Example use-cases include exposing the `/metrics` endpoint to a monitoring system, such as Prometheus, and exposing the `/healthz` endpoint to the kubelet for liveness checks. Refer to [Expose Paths Configuration Reference](/consul/docs/connect/proxy-config-reference#expose-paths-configuration-reference) for additional information. + +#### Values + +- Default: None +- Data type: Map containing the following parameters: + - [`checks`](#expose-checks) + - [`aths`](#expose-paths) + +### `spec.expose{}.checks` + +Exposes all HTTP and gRPC checks registered with the agent when set to `true`. Envoy exposes listeners for the checks and only accepts connections originating from localhost or Consul's [`advertise_addr`](/consul/docs/agent/config/config-files#advertise). The ports for the listeners are dynamically allocated from the agent's [`expose_min_port`](/consul/docs/agent/config/config-files#expose_min_port) and [`expose_max_port`](/consul/docs/agent/config/config-files#expose_max_port) configurations. + +We recommend enabling the `Checks` configuration when a Consul client cannot reach registered services over localhost, such as when Consul agents run in their own pods in Kubernetes. + +#### Values + +- Default: `false` +- Data type: boolean + +### `spec.expose{}.paths[]` + +Specifies a list of configuration maps that define paths to expose through Envoy when `spec.expose.checks` is set to `true`. + +#### Values + +- Default: None +- Data type: List of maps. + +The following table describes the parameters for each map you can define in the list: + +| Parameter | Description | Data type | Default | +| --- | --- | --- | --- | +| `path` | Specifies the HTTP path to expose. You must prepend the path with a forward slash (`/`). | String | None | +| `localPathPort` | Specifies the port where the local service listens for connections to the path. | Integer | `0` | +| `listenPort` | Specifies the port where the proxy listens for connections. The port must be available. If the port is unavailable, Envoy does not expose a listener for the path and the proxy registration still succeeds. | Integer | `0` | +| `protocol` | Specifies the protocol of the listener. You can configure one of the following values:
  • `http`
  • `http2`: Use with gRPC traffic
    • | String | `http` | + +### `spec.failoverPolicy` + +Sets the failover policy `mode` field for all proxies. The failover policy mode defines how Consul directs traffic to failover service instances if the primary instance becomes unreachable. For example, you can direct Consul to send failover traffic to local service instances. Refer to [Failover overview](/consul/docs/connect/failover) for additional information. + +You can specify the following string values for the `mode` field: + +- `default`: Envoy sends failover traffic to the first failover target with healthy instances. +- `order-by-locality`: Envoy prioritizes failover targets that are closer to the downstream service. Envoy deterministically orders failover targets that are the same distance from the local proxy. + +#### Values + +- Default: None +- Data type: Map containing the `mode` field + +### `spec.accessLogs` + +Specifies [Envoy access logger](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/observability/access_logging.html?highlight=access%20logs) configurations for all proxies in the service mesh, including gateways. This field also configures access logs on [Envoy's administration interface](https://www.envoyproxy.io/docs/envoy/latest/operations/admin.html?highlight=administration%20logs). + +#### Values + +- Default: None +- Data type: Map + +The following table describes the parameters you can define in the `accessLogs` map: + +| Parameter | Description | Data type | Default | +| --- | --- | --- | --- | +| `enabled` | Enables Envoy to emit access logs for all proxies in the service mesh. | Boolean | `false` | +| `disabledListenerLogs` | Disables access logs for traffic rejected at the listener level. Rejected traffic includes connections that do not match any of Envoy's configured filters, such as Consul upstream services. Set this option to `true` if you do not want to log unknown requests that Envoy is not forwarding. | Boolean | `false` | +| `type` | Specifies the destination for access logs. You can specify one of the following types:
  • `stdout`
  • `stderr`
  • `file`
    • | String | None | +| `path` | Specifies the destination for writing access logs to file when `type` is set to `file`. | String | None | +| `jsonFormat` | Specifies a JSON-formatted string that represents the format for each emitted access log. You can use [Envoy command operators](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#command-operators) to customize the emitted data. You can also nest data. You cannot set this field and the `textFormat` field concurrently. | String | [Default log format](/consul/docs/connect/observability/access-logs#default-log-format) | +| `textFormat` | Specifies a text-formatted string that represents the format for each emitted access log. You can use [Envoy command operators](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#command-operators) to customize the emitted data. You can also nest data. You cannot set this field and the `jsonFormat` field concurrently. | String | None | + +     + +     ## Examples +The following examples demonstrate common patterns for configuring proxy defaults configuration entries. + ### Default protocol -The following example configures the default protocol for all proxies. +The following example sets the default protocol for all proxies to `http`. - + - +#### Community edition ```hcl Kind = "proxy-defaults" @@ -571,6 +748,24 @@ Config { } ``` +#### Consul Enterprise + +For Consul Enterprise, you can only create the configuration entry in the `default` namespace. The namepace configuration applies to proxies in all namespaces. + +```hcl +Kind = "proxy-defaults" +Name = "global" +Namespace = "default" # Can only be set to "default". +Config { + protocol = "http" +} +``` + + + + +#### Community edition + ```yaml apiVersion: consul.hashicorp.com/v1alpha1 kind: ProxyDefaults @@ -581,34 +776,9 @@ spec: protocol: http ``` -```json -{ - "Kind": "proxy-defaults", - "Name": "global", - "Config": { - "protocol": "http" - } -} -``` +#### Consul Enterprise - - - - - --> **NOTE:** The `proxy-defaults` config entry can only be created in the `default` -namespace and it will configure proxies in **all** namespaces. - - - -```hcl -Kind = "proxy-defaults" -Name = "global" -Namespace = "default" # Can only be set to "default". -Config { - protocol = "http" -} -``` +For Consul Enterprise, you can only create the configuration entry in the `default` namespace. The namepace configuration applies to proxies in all namespaces. ```yaml apiVersion: consul.hashicorp.com/v1alpha1 @@ -621,27 +791,46 @@ spec: protocol: http ``` + + + + +#### Community edition + ```json { "Kind": "proxy-defaults", "Name": "global", - "Namespace": "default", "Config": { "protocol": "http" } } ``` +#### Consul Enterprise + +For Consul Enterprise, you can only create the configuration entry in the `default` namespace. The namepace configuration applies to proxies in all namespaces. - +```json +{ + "Kind": "proxy-defaults", + "Name": "global", + "Namespace": "default", + "Config": { + "protocol": "http" + } +} +``` + ### Prometheus The following example configures all proxies to expose Prometheus metrics. - + + ```hcl Kind = "proxy-defaults" @@ -651,6 +840,11 @@ Config { } ``` + + + + + ```yaml apiVersion: consul.hashicorp.com/v1alpha1 kind: ProxyDefaults @@ -661,6 +855,10 @@ spec: envoy_prometheus_bind_addr: '0.0.0.0:9102' ``` + + + + ```json { "Kind": "proxy-defaults", @@ -671,14 +869,17 @@ spec: } ``` - + + + ### Access Logs -The following example is a minimal configuration for enabling access logs for all proxies. -Refer to [access logs](/consul/docs/connect/observability/access-logs) for advanced configurations. +The following example enables access logs for all proxies. efer to [access logs](/consul/docs/connect/observability/access-logs) for more detailed examples. + + + - ```hcl Kind = "proxy-defaults" @@ -688,6 +889,10 @@ AccessLogs { } ``` + + + + ```yaml apiVersion: consul.hashicorp.com/v1alpha1 kind: ProxyDefaults @@ -698,6 +903,10 @@ spec: enabled: true ``` + + + + ```json { "Kind": "proxy-defaults", @@ -708,13 +917,16 @@ spec: } ``` - + + + ### Proxy-specific defaults -The following example configures some custom default values for all proxies. +The following example configures custom default values for all proxies. - + + ```hcl Kind = "proxy-defaults" @@ -725,6 +937,10 @@ Config { } ``` + + + + ```yaml apiVersion: consul.hashicorp.com/v1alpha1 kind: ProxyDefaults @@ -736,6 +952,10 @@ spec: handshake_timeout_ms: 10000 ``` + + + + ```json { "Kind": "proxy-defaults", @@ -747,13 +967,6 @@ spec: } ``` - - -## ACLs - -Configuration entries may be protected by [ACLs](/consul/docs/security/acl). - -Reading a `proxy-defaults` config entry requires no specific privileges. + -Creating, updating, or deleting a `proxy-defaults` config entry requires -`operator:write`. + \ No newline at end of file diff --git a/website/content/docs/connect/proxies/deploy-service-mesh-proxies.mdx b/website/content/docs/connect/proxies/deploy-service-mesh-proxies.mdx new file mode 100644 index 000000000000..60d9cc5ab745 --- /dev/null +++ b/website/content/docs/connect/proxies/deploy-service-mesh-proxies.mdx @@ -0,0 +1,77 @@ +--- +layout: docs +page_title: Deploy service mesh proxies +description: >- + Envoy and other proxies in Consul service mesh enable service-to-service communication across your network. Learn how to deploy service mesh proxies in this topic. +--- + +# Deploy service mesh proxies services + +This topic describes how to create, register, and start service mesh proxies in Consul. Refer to [Service mesh proxies overview](/consul/docs/connect/proxies) for additional information about how proxies enable Consul functionalities. For information about deployed sidecar proxies, refer to [Deploy sidecar proxy services](/consul/docs/connect/proxies/deploy-sidecar-services). + +## Overview + +Complete the following steps to deploy a service mesh proxy: + +1. It is not required, but you can create a proxy defaults configuration entry that contains global passthrough settings for all Envoy proxies. +1. Create a service definition file and specify the proxy configurations in the `proxy` block. +1. Register the service using the API or CLI. +1. Start the proxy service. + +## Requirements + +If [ACLs](/consul/docs/security/acl) are enabled and you want to configure global Envoy settings in the [proxy defaults configuration entry](/consul/docs/connect/config-entries/proxy-defaults), you must present a token with `operator:write` permissions. Refer to [Create a service token](/consul/docs/security/acl/tokens/create/create-a-service-token) for additional information. + +## Configure global Envoy passthrough settings + +If you want to define global passthrough settings for all Envoy proxies, create a proxy defaults configuration entry and specify default settings, such as access log configuration. [Service defaults configuration entries](/consul/docs/connect/config-entries/service-defaults) override proxy defaults and individual service configurations override both configuration entries. + +1. Create a proxy defaults configuration entry and specify the following parameters: + - `Kind`: Must be set to `proxy-defaults` + - `Name`: Must be set to `global` +1. Configure any additional settings you want to apply to all proxies. Refer to [Proxy defaults configuration entry reference](/consul/docs/connect/config-entries/proxy-defaults) for details about all settings available in the configuraiton entry. +1. Apply the configuration by either calling the [`/config` API endpoint](/consul/api-docs/config) or running the [`consul config write` CLI command](/consul/commands/config/write). The following example writes a proxy defaults configuration entry from a local HCL file using the CLI: + +```shell-session +$ consul config write proxy-defaults.hcl +``` + +## Define service mesh proxy + +Create a service definition file and configure the following fields to define a service mesh proxy: + +1. Set the `kind` field to `connect-proxy`. Refer to the [services configuration reference](/consul/docs/services/configuration/services-configuration-reference#kind) for information about other kinds of proxies you can declare. +1. Specify a name for the proxy service in the `name` field. Consul applies the configurations to any proxies you bootstrap with the same name. +1. In the `proxy.destination_service_name` field, specify the name of the service that the proxy represents. +1. Configure any additional proxy behaviors that you want to implement in the `proxy` block. Refer to the [Service mesh proxy configuration reference](/consul/docs/connect/proxies/proxy-config-reference) for information about all parameters. +1. Specify a port number where other services registered with Consul can discover and connect to the proxies service in the `port` field. To ensure that services only allow external connections established through the service mesh protocol, you should configure all services to only accept connections on a loopback address. + +Refer to the [Service mesh proxy configuration reference](/consul/docs/connect/proxies/proxy-config-reference) for example configurations. + + ## Register the service + +Provide the service definition to the Consul agent to register your proxy service. You can use the same methods for registering proxy services as you do for registering application services: + +- Place the service definition in a Consul agent's configuration directory and start, restart, or reload the agent. Use this method when implementing changes to an existing proxy service. +- Use the `consul services register` command to register the proxy service with a running Consul agent. +- Call the `/agent/service/register` HTTP API endpoint to register the proxy service with a running Consul agent. + +Refer to [Register services and health checks](/consul/docs/services/usage/register-services-checks) for instructions. + +In the following example, the `consul services register` command registers a proxy service stored in `proxy.hcl`: + +```shell-session +$ consul services register proxy.hcl +``` + +## Start the proxy + +Envoy requires a bootstrap configuration file before it can start. Use the [`consul connect envoy` command](/consul/commands/connect/envoy) to create the Envoy bootstrap configuration and start the proxy service. Specify the ID of the proxy you want to start with the `-proxy-id` option. + +The following example command starts an Envoy proxy for the `web-proxy` service: + +```shell-session +$ consul connect envoy -proxy-id=web-proxy +``` + +For details about operating an Envoy proxy in Consul, refer to the [Envoy proxy reference](/consul/docs/connect/proxies/envoy). diff --git a/website/content/docs/connect/proxies/deploy-sidecar-services.mdx b/website/content/docs/connect/proxies/deploy-sidecar-services.mdx new file mode 100644 index 000000000000..23e7a6238aa1 --- /dev/null +++ b/website/content/docs/connect/proxies/deploy-sidecar-services.mdx @@ -0,0 +1,286 @@ +--- +layout: docs +page_title: Deploy proxies as sidecar services +description: >- + You can register a service instance and its sidecar proxy at the same time. Learn about default settings, customizable parameters, limitations, and lifecycle behaviors of the sidecar proxy. +--- + +# Deploy sidecar services + +This topic describes how to create, register, and start sidecar proxy services in Consul. Refer to [Service mesh proxies overview](/consul/docs/connect/proxies) for additional information about how proxies enable Consul functionalities. For information about deploying service mesh proxies, refer to [Deploy service mesh proxies](/consul/docs/connect/proxies/deploy-service-mesh-proxies). + +## Overview + +Sidecar proxies run on the same node as the single service instance that they handle traffic for. +They may be on the same VM or running as a separate container in the same network namespace. + +You can attach a sidecar proxy to a service you want to deploy to your mesh: + +1. It is not required, but you can create a proxy defaults configuration entry that contains global passthrough settings for all Envoy proxies. +1. Create the service definition and include the `connect` block. The `connect` block contains the sidecar proxy configurations that allow the service to interact with other services in the mesh. +1. Register the service using either the API or CLI. +1. Start the sidecar proxy service. + +## Requirements + +If [ACLs](/consul/docs/security/acl) are enabled and you want to configure global Envoy settings in the [proxy defaults configuration entry](/consul/docs/connect/config-entries/proxy-defaults), you must present a token with `operator:write` permissions. Refer to [Create a service token](/consul/docs/security/acl/tokens/create/create-a-service-token) for additional information. + +## Configure global Envoy passthrough settings + +If you want to define global passthrough settings for all Envoy proxies, create a proxy defaults configuration entry and specify default settings, such as access log configuration. [Service defaults configuration entries](/consul/docs/connect/config-entries/service-defaults) override proxy defaults and individual service configurations override both configuration entries. + +1. Create a proxy defaults configuration entry and specify the following parameters: + - `Kind`: Must be set to `proxy-defaults` + - `Name`: Must be set to `global` +1. Configure any additional settings you want to apply to all proxies. Refer to [Proxy defaults configuration entry reference](/consul/docs/connect/config-entries/proxy-defaults) for details about all settings available in the configuraiton entry. +1. Apply the configuration by either calling the [`/config` API endpoint](/consul/api-docs/config) or running the [`consul config write` CLI command](/consul/commands/config/write). The following example writes a proxy defaults configuration entry from a local HCL file using the CLI: + +```shell-session +$ consul config write proxy-defaults.hcl +``` + +## Define service mesh proxy + +Create a service definition and configure the following fields: + +1. Specify a name for the service you want to attach a sidecar proxy to in the `name` field. This field is required for all services you want to register in Consul. +1. Specify a port number where other services registered with Consul can discover and connect to the service in the `port` field. This field is required for all services you want to register in Consul. +1. Set the `connect` field to `{ sidecar_service: {} }`. The `{ sidecar_service: {} }` value is a macro that applies a set of default configurations that enable you to quickly implement a sidecar. Refer to [Sidecar service defaults](#sidecar-service-defaults) for additional information. +1. Configure any additional options for your service. Refer to [Services configuration reference](/consul/docs/services/configuration/services-configuration-reference) for details. + +In the following example, a service named `web` is configured with a sidecar proxy: + + + + + +```hcl +service = { + name = "web" + port = 8080 + connect = { sidecar_service = {} } +} +``` + + + + + +```json + +{ + "service": { + "name": "web", + "port": 8080, + "connect": { "sidecar_service": {} } + } +} + +``` + + + + + +When Consul processes the service definition, it generates the following configuration in place of the `sidecar_service` macro. Note that sidecar proxies services are based on the `connect-proxy` type: + + + + + +```hcl +services = [ + { + name = "web" + port = 8080 + } + checks = { + Interval = "10s" + Name = "Connect Sidecar Listening" + TCP = "127.0.0.1:20000" + } + checks = { + alias_service = "web" + name = "Connect Sidecar Aliasing web" + } + kind = "connect-proxy" + name = "web-sidecar-proxy" + port = 20000 + proxy = { + destination_service_id = "web" + destination_service_name = "web" + local_service_address = "127.0.0.1" + local_service_port = 8080 + } +] + +``` + + + + + +```json +{ + "services": [ + { + "name": "web", + "port": 8080 + }, + { + "name": "web-sidecar-proxy", + "port": 20000, + "kind": "connect-proxy", + "checks": [ + { + "Name": "Connect Sidecar Listening", + "TCP": "127.0.0.1:20000", + "Interval": "10s" + }, + { + "name": "Connect Sidecar Aliasing web", + "alias_service": "web" + } + ], + "proxy": { + "destination_service_name": "web", + "destination_service_id": "web", + "local_service_address": "127.0.0.1", + "local_service_port": 8080 + } + } + ] +} + +``` + + + + + +## Register the service + +Provide the service definition to the Consul agent to register your proxy service. You can use the same methods for registering proxy services as you do for registering application services: + +- Place the service definition in a Consul agent's configuration directory and start, restart, or reload the agent. Use this method when implementing changes to an existing proxy service. +- Use the `consul services register` command to register the proxy service with a running Consul agent. +- Call the `/agent/service/register` HTTP API endpoint to register the proxy service with a running Consul agent. + +Refer to [Register services and health checks](/consul/docs/services/usage/register-services-checks) for instructions. + +In the following example, the `consul services register` command registers a proxy service stored in `proxy.hcl`: + +```shell-session +$ consul services register proxy.hcl +``` + +## Start the proxy + +Envoy requires a bootstrap configuration file before it can start. Use the [`consul connect envoy` command](/consul/commands/connect/envoy) to create the Envoy bootstrap configuration and start the proxy service. Specify the name of the service with the attached proxy with the `-sidecar-for` option. + +The following example command starts an Envoy sidecar proxy for the `web` service: + +```shell-session +$ consul connect envoy -sidecar-for=web +``` + +For details about operating an Envoy proxy in Consul, refer to [](/consul/docs/connect/proxies/envoy) + +## Configuration reference + +The `sidecar_service` block is a service definition that can contain most regular service definition fields. Refer to [Limitations](#limitations) for information about unsupported service definition fields for sidecar proxies. + +Consul treats sidecar proxy service definitions as a root-level service definition. All fields are optional in nested definitions, which default to opinionated settings that are intended to reduce burden of setting up a sidecar proxy. + +## Sidecar service defaults + +The following fields are set by default on a sidecar service registration. With +[the exceptions noted](#limitations) any field may be overridden explicitly in +the `connect.sidecar_service` definition to customize the proxy registration. +The "parent" service refers to the service definition that embeds the sidecar +proxy. + +- `id` - ID defaults to being `-sidecar-proxy`. This can't + be overridden as it is used to [manage the lifecycle](#lifecycle) of the + registration. +- `name` - Defaults to being `-sidecar-proxy`. +- `tags` - Defaults to the tags of the parent service. +- `meta` - Defaults to the service metadata of the parent service. +- `port` - Defaults to being auto-assigned from a configurable + range specified by [`sidecar_min_port`](/consul/docs/agent/config/config-files#sidecar_min_port) + and [`sidecar_max_port`](/consul/docs/agent/config/config-files#sidecar_max_port). +- `kind` - Defaults to `connect-proxy`. This can't be overridden currently. +- `check`, `checks` - By default we add a TCP check on the local address and + port for the proxy, and a [service alias + check](/consul/docs/services/usage/checks#alias-checks) for the parent service. If either + `check` or `checks` fields are set, only the provided checks are registered. +- `proxy.destination_service_name` - Defaults to the parent service name. +- `proxy.destination_service_id` - Defaults to the parent service ID. +- `proxy.local_service_address` - Defaults to `127.0.0.1`. +- `proxy.local_service_port` - Defaults to the parent service port. + +### Example with overwritten configurations + +In the following example, but the `sidecar_service` macro sets baselines configurations for the proxy, but the [proxy +upstreams](/consul/docs/connect/proxies/proxy-config-reference#upstream-configuration-reference) +and [built-in proxy +configuration](/consul/docs/connect/proxies/built-in) fields contain custom values: + +```json +{ + "name": "web", + "port": 8080, + "connect": { + "sidecar_service": { + "proxy": { + "upstreams": [ + { + "destination_name": "db", + "local_bind_port": 9191 + } + ], + "config": { + "handshake_timeout_ms": 1000 + } + } + } + } +} +``` + +## Limitations + +The following fields are not supported in the `connect.sidecar_service` block: + +- `id` - Sidecar services get an ID assigned and it is an error to override + this. This ensures the agent can correctly deregister the sidecar service + later when the parent service is removed. +- `kind` - Kind defaults to `connect-proxy` and there is currently no way to + unset this to make the registration be for a regular non-connect-proxy + service. +- `connect.sidecar_service` - Service definitions can't be nested recursively. +- `connect.native` - Currently the `kind` is fixed to `connect-proxy` and it's + an error to register a `connect-proxy` that is also service mesh-native. + +## Lifecycle + +Sidecar service registration is mostly a configuration syntax helper to avoid +adding lots of boiler plate for basic sidecar options, however the agent does +have some specific behavior around their lifecycle that makes them easier to +work with. + +The agent fixes the ID of the sidecar service to be based on the parent +service's ID. This enables the following behavior. + +- A service instance can _only ever have one_ sidecar service registered. +- When re-registering via API or reloading from configuration file: + - If something changes in the nested sidecar service definition, the change + will _update_ the current sidecar registration instead of creating a new + one. + - If a service registration removes the nested `sidecar_service` then the + previously registered sidecar for that service will be deregistered + automatically. +- When reloading the configuration files, if a service definition changes its + ID, then a new service instance _and_ a new sidecar instance will be + registered. The old ones will be removed since they are no longer found in + the config files. \ No newline at end of file diff --git a/website/content/docs/connect/proxies/index.mdx b/website/content/docs/connect/proxies/index.mdx index ff344e56d2d2..eeea3305f214 100644 --- a/website/content/docs/connect/proxies/index.mdx +++ b/website/content/docs/connect/proxies/index.mdx @@ -1,29 +1,73 @@ --- layout: docs -page_title: Service Mesh Proxy Overview +page_title: Service mesh proxy overview description: >- In Consul service mesh, each service has a sidecar proxy that secures connections with other services in the mesh without modifying the underlying application code. You can use the built-in proxy, Envoy, or a custom proxy to handle communication and verify TLS connections. --- -# Service Mesh Proxy Overview +# Service mesh proxy overview -Proxies enable unmodified applications to connect to other services in the service mesh. A -per-service proxy sidecar transparently handles inbound and outbound service -connections, automatically wrapping and verifying TLS connections. Consul -ships with a built-in L4 proxy and has first class support for Envoy. You -can plug other proxies into your environment as well. This section describes how to -configure Envoy or the built-in proxy using Consul service mesh, and how to integrate the -proxy of your choice. +This topic provides an overview of how Consul uses proxies in your service mesh. A proxy is a type of service that enables unmodified applications to connect to other services in the service mesh. Consul ships with a built-in L4 proxy and has first class support for Envoy. You can plug other proxies into your environment, as well, and apply configurations in Consul to define proxy behavior. -To ensure that services only allow external connections established through -the service mesh protocol, you should configure all services to only accept connections on a loopback address. +## Proxy use cases -## Dynamic upstreams require native integration +_Proxies_ are services that you can configure to perform several different types of functions in Consul. -Service mesh proxies do not support dynamic upstreams. +### Sidecars -If an application requires dynamic dependencies that are only available -at runtime, you must [natively integrate](/consul/docs/connect/native) -the application with Consul service mesh. After natively integrating, the HTTP API or -[DNS interface](/consul/docs/services/discovery/dns-static-lookups#service-mesh-enabled-service-lookups) -can be used. \ No newline at end of file +You can configure proxies to operate as sidecar services transparently handles inbound and outbound service connections. Sidecars also automatically wrap and verify TLS connections. Each service in your mesh should have its own sidecar proxy. + +Refer to [Deploy sidecar services](/consul/docs/connect/proxies/deploy-sidecar-services) for additional information. + +### Gateways + +You can configure proxies to operate as gateway services, which allow service-to-service traffic across different network areas, including peered clusters, WAN-federated datacenters, and nodes outside the mesh. Consul ships with several types of gateway capabilities, but gateways deliver the underlying functionality. + +Refer to [Gateways overview](/consul/docs/connect/gateways) for additional information. + +## Supported proxies + +Consul has first-class support for Envoy proxies, which is a highly configurable open source edge service. Consul configures Envoy by optionally exposing a gRPC service on the local agent that serves Envoy's xDS configuration API. Refer to the following documentation for additional information: + +- [Envoy proxy reference](/consul/docs/connect/proxies/envoy) +- [Envoy API documentation](https://www.envoyproxy.io/docs/envoy/v1.17.2/api-docs/xds_protocol) + +You can use Consul's built-in proxy service that supports L4 network traffic, which is suitable for testing and development but not recommended for production environments. Refer to the [built-in proxy reference](/consul/docs/connect/proxies/built-in) for additional information. + +## Workflow + +The following procedure describes how to implement proxies: + +1. **Configure global proxy settings**. You can configure global passthrough settings for all proxies deployed to your service mesh in the proxy defaults configuration entry. This step is not required, but it enables you to define common behaviors in a central configuration. +1. **Deploy your service mesh proxy**. Configure proxy behavior in a service definition and register the proxy with Consul. +1. **Start the proxy service**. + +### Dynamic upstreams require native integration + +Service mesh proxies do not support dynamic upstreams. If an application requires dynamic dependencies that are only available at runtime, you must [natively integrate](/consul/docs/connect/native) the application with Consul service mesh. After integration, the application can use the HTTP API or [DNS interface](/consul/docs/services/discovery/dns-static-lookups#service-mesh-enabled-service-lookups) to connect to other services in the mesh. + +## Proxies in Kubernetes-orchestrated networks + +For Kubernetes-orchestrated environments, Consul deploys _dataplanes_ by default to manage proxies. Consul dataplanes are light-weight processes that leverage existing Kubernetes sidecar orchestration capabilities. Refer to the [dataplanes documentation](/consul/docs/connect/dataplane) for additional information. + +## Guidance + +Refer to the following resources for help using service mesh proxies: + +### Tutorial + +- [Using Envoy with Consul service mesh](/consul/tutorials/developer-mesh/service-mesh-with-envoy-proxy) + +### Usage documentation + +- [Deploy service mesh proxies](/consul/docs/connect/proxies/deploy-service-mesh-proxies) +- [Deploy sidecar proxies](/consul/docs/connect/proxies/deploy-sidecar-services) +- [Extend Envoy proxies](/consul/docs/connect/proxies/envoy-extensions) +- [Integrate custom proxies](/consul/docs/connect/proxies/integrate) + +### Reference documentation + +- [Proxy defaults configuration entry reference](/consul/docs/connect/config-entries/proxy-defaults) for additional information. +- [Envoy proxies reference](/consul/docs/connect/proxies/envoy) +- [Service mesh proxy configuration reference](/consul/docs/connect/proxies/proxy-config-reference) +- [`consul connect envoy` command](/consul/commands/connect/envoy) diff --git a/website/content/docs/connect/registration/service-registration.mdx b/website/content/docs/connect/proxies/proxy-config-reference.mdx similarity index 93% rename from website/content/docs/connect/registration/service-registration.mdx rename to website/content/docs/connect/proxies/proxy-config-reference.mdx index 57050476dcf4..dc3765b8cdb5 100644 --- a/website/content/docs/connect/registration/service-registration.mdx +++ b/website/content/docs/connect/proxies/proxy-config-reference.mdx @@ -1,15 +1,14 @@ --- layout: docs -page_title: Register a Service Mesh Proxy Outside of a Service Registration +page_title: Service mesh proxy configuration reference description: >- You can register a service mesh sidecar proxy separately from the registration of the service instance it fronts. Learn about proxy configuration options and how to format them with examples. --- -# Register a Service Mesh Proxy Outside of a Service Registration +# Service mesh proxy configuration This topic describes how to declare a service mesh proxy in a service definition. The `kind` must be declared and information about the service they represent must be provided to function as a Consul service mesh proxy. - ## Configuration Configure a service mesh proxy using the following syntax: @@ -79,7 +78,7 @@ proxy = { -### Sidecar Proxy Configuration +### Sidecar proxy configuration Many service mesh proxies are deployed as sidecars. Sidecar proxies are co-located with the single service instance they represent and proxy all inbound traffic to. @@ -92,7 +91,7 @@ Specify the following parameters in the `proxy` code block to configure a sideca See [Sidecar Service Registration](/consul/docs/connect/registration/sidecar-service) for additional information about configuring service mesh proxies as sidecars. -### Complete Configuration Example +### Complete configuration example The following example includes values for all available options when registering a proxy instance. @@ -140,7 +139,7 @@ proxy = { -### Proxy Parameters +### Proxy parameters The following table describes all parameters that can be defined in the `proxy` block. @@ -158,7 +157,7 @@ The following table describes all parameters that can be defined in the `proxy` | `mesh_gateway` | Object value that specifies the mesh gateway configuration for the proxy. Refer to [Mesh Gateway Configuration Reference](#mesh-gateway-configuration-reference) for details. | Optional | None | | `expose` | Object value that specifies a configuration for exposing HTTP paths through the proxy.
    This parameter is only compatible with Envoy proxies.
    Refer to [Expose Paths Configuration Reference](#expose-paths-configuration-reference) for details. | Optional | None | -### Upstream Configuration Reference +### Upstream configuration reference You can configure the service mesh proxy to create listeners for upstream services. The listeners enable the upstream service to accept requests. You can specify the following parameters to configure upstream service listeners. @@ -177,7 +176,7 @@ You can configure the service mesh proxy to create listeners for upstream servic | `config` | Object value that specifies opaque configuration options that will be provided to the proxy instance for the upstream.
    Valid JSON objects are also supported.
    The `config` parameter can specify timeouts, retries, and other proxy-specific features for the given upstream.
    See the [built-in proxy configuration reference](/consul/docs/connect/proxies/built-in#proxy-upstream-config-key-reference) for configuration options when using the built-in proxy.
    If using Envoy as a proxy, see [Envoy configuration reference](/consul/docs/connect/proxies/envoy#proxy-upstream-config-options) | Optional | None | | `mesh_gateway` | Object that defines the mesh gateway configuration for the proxy. Refer to the [Mesh Gateway Configuration Reference](#mesh-gateway-configuration-reference) for configuration details. | Optional | None | -### Upstream Configuration Examples +### Upstream configuration examples Upstreams support multiple destination types. The following examples include information about each implementation. Note that the examples in this topic use snake case, which is a convention that separates words with underscores, because the format is supported in configuration files and API registrations. @@ -280,7 +279,7 @@ local_bind_port = 9090 -## Proxy Modes +## Proxy modes You can configure which mode a proxy operates in by specifying `"direct"` or `"transparent"` in the `mode` parameter. The proxy mode determines the how proxies direct traffic. This feature was added in Consul 1.10.0. @@ -295,7 +294,7 @@ You can also specify an empty string (`""`), which configures the proxy to opera The proxy will default to `direct` mode if a mode cannot be determined from the parent parameters. -### Transparent Proxy Configuration Reference +### Transparent proxy configuration reference The following examples show additional configuration for transparent proxies. @@ -320,13 +319,13 @@ Note that the examples in this topic use snake case, which is a convention that ~> **Note:** Dynamic routing rules such as failovers and redirects do not apply to services dialed directly. Additionally, the connection is proxied using a TCP proxy with a connection timeout of 5 seconds. -### Mesh Gateway Configuration Reference +### Mesh gateway configuration reference The following examples show all possible mesh gateway configurations. Note that the examples in this topic use snake case, which is a convention that separates words with underscores, because the format is supported in configuration files and API registrations. -#### Using a Local/Egress Gateway in the Local Datacenter +#### Using local and egress gateways in the local datacenter ```json { @@ -334,7 +333,7 @@ The following examples show all possible mesh gateway configurations. } ``` -#### Direct to a Remote/Ingress in a Remote Datacenter +#### Direct to remote and ingress services in a remote datacenter ```json { @@ -342,7 +341,7 @@ The following examples show all possible mesh gateway configurations. } ``` -#### Prevent Using a Mesh Gateway +#### Disable a mesh gateway ```json { @@ -350,7 +349,7 @@ The following examples show all possible mesh gateway configurations. } ``` -#### Default Mesh Gateway Mode +#### Specify the default mesh gateway mode ```json { @@ -373,7 +372,7 @@ The following examples show all possible mesh gateway configurations. 3. The `service-defaults` configuration for the service. 4. The `global` `proxy-defaults`. -### Expose Paths Configuration Reference +### Expose paths configuration reference The following examples show possible configurations to expose HTTP paths through Envoy. @@ -383,7 +382,9 @@ Some examples include: exposing a `/metrics` path for Prometheus or `/healthz` f Note that the examples in this topic use snake case, which is a convention that separates words with underscores, because the format is supported in configuration files and API registrations. -#### Expose listeners in Envoy for HTTP and GRPC checks registered with the local Consul agent +#### Expose listeners in Envoy for health checks + +The following example exposes Envoy listeners to HTTP and GRPC checks registered with the local Consul agent: ```json { @@ -393,7 +394,9 @@ Note that the examples in this topic use snake case, which is a convention that } ``` -#### Expose an HTTP listener in Envoy at port 21500 that routes to an HTTP server listening at port 8080 +#### Expose an HTTP listener + +The following example exposes and HTTP listener in Envoy at port `21500` that routes to an HTTP server listening at port `8080`: ```json { @@ -409,7 +412,9 @@ Note that the examples in this topic use snake case, which is a convention that } ``` -#### Expose an HTTP2 listener in Envoy at port 21501 that routes to a gRPC server listening at port 9090 +#### Expose an HTTP2 listener + +The following example expose an HTTP2 listener in Envoy at port `21501` that routes to a gRPC server listening at port `9090`: ```json { @@ -440,15 +445,9 @@ Note that the examples in this topic use snake case, which is a convention that but the proxy registration will not fail. - `protocol` `(string: "http")` - Sets the protocol of the listener. One of `http` or `http2`. For gRPC use `http2`. -### Unix Domain Sockets - -The following examples show additional configuration for Unix domain sockets. - -Added in v1.10.0. +### Unix domain sockets -To connect to a service via local Unix Domain Socket instead of a -port, add `local_bind_socket_path` and optionally `local_bind_socket_mode` -to the upstream config for a service: +To connect to a service using a local Unix domain socket instead of a port, add `local_bind_socket_path` and optionally `local_bind_socket_mode` to the upstream config for a service. The following examples show additional configurations for Unix domain sockets: @@ -474,11 +473,9 @@ upstreams = [ -This will cause Envoy to create a socket with the path and mode -provided, and connect that to service-1. +Envoy creates a socket with the specified path and mode and connects to `service-1`. -The mode field is optional, and if omitted will use the default mode -for Envoy. This is not applicable for abstract sockets. See the +The `mode` field is optional. When omitted, Envoy uses the default mode. This is not applicable for abstract sockets. Refer to the [Envoy documentation](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/address.proto#envoy-v3-api-msg-config-core-v3-pipe) for details. diff --git a/website/content/docs/connect/registration/index.mdx b/website/content/docs/connect/registration/index.mdx deleted file mode 100644 index 96db32788776..000000000000 --- a/website/content/docs/connect/registration/index.mdx +++ /dev/null @@ -1,22 +0,0 @@ ---- -layout: docs -page_title: Service Mesh Proxy Registration Overview -description: >- - To make Consul aware of proxies in your service mesh, you must register them. Learn about methods for configuring and registering sidecar proxies. ---- - -# Service Mesh Proxy Overview - -To enable service mesh proxies, you must define and register them with Consul. Proxies are a type of service in Consul that facilitate highly secure communication between services in a service mesh. The topics in the section outline your options for registering service mesh proxies. You can register proxies independently or nested inside a sidecar service registration. - -## Proxy service registration - -To register proxies with independent proxy service registrations, you can define them in either in config files or via the API just like any other service. Learn more about all of the options you can define when registering your proxy service in the [proxy registration documentation](/consul/docs/connect/registration/service-registration). - -## Sidecar service registration - -To reduce the amount of boilerplate needed for a sidecar proxy, -application service definitions may define an inline sidecar service block. This is an opinionated -shorthand for a separate full proxy registration as described above. For a -description of how to configure the sidecar proxy as well as the opinionated defaults, see the [sidecar service registrations -documentation](/consul/docs/connect/registration/sidecar-service). diff --git a/website/content/docs/connect/registration/sidecar-service.mdx b/website/content/docs/connect/registration/sidecar-service.mdx deleted file mode 100644 index 46e14869c31e..000000000000 --- a/website/content/docs/connect/registration/sidecar-service.mdx +++ /dev/null @@ -1,175 +0,0 @@ ---- -layout: docs -page_title: Register a Service Mesh Proxy in a Service Registration -description: >- - You can register a service instance and its sidecar proxy at the same time. Learn about default settings, customizable parameters, limitations, and lifecycle behaviors of the sidecar proxy. ---- - -# Register a Service Mesh Proxy in a Service Registration - -This topic describes how to declare a proxy as a _sidecar_ proxy. -Sidecar proxies run on the same node as the single service instance that they handle traffic for. -They may be on the same VM or running as a separate container in the same network namespace. - -## Configuration - -Add the `connect.sidecar_service` block to your service definition file and specify the parameters to configure sidecar proxy behavior. The `sidecar_service` block is a service definition that can contain most regular service definition fields. Refer to [Limitations](#limitations) for information about unsupported service definition fields for sidecar proxies. - -Consul treats sidecar proxy service definitions as a root-level service definition. All fields are optional in nested -definitions, which default to opinionated settings that are intended to reduce burden of setting up a sidecar proxy. - -## Minimal Example - -To register a service instance with a sidecar, all that's needed is: - -```json -{ - "service": { - "name": "web", - "port": 8080, - "connect": { "sidecar_service": {} } - } -} -``` - -This will register the `web` service as normal, but will also register another -[proxy service](/consul/docs/connect/proxies) with defaults values used. - -The above expands out to be equivalent to the following explicit service -definitions: - -```json -{ - "services": [ - { - "name": "web", - "port": 8080 - }, - { - "name": "web-sidecar-proxy", - "port": 20000, - "kind": "connect-proxy", - "checks": [ - { - "Name": "Connect Sidecar Listening", - "TCP": "127.0.0.1:20000", - "Interval": "10s" - }, - { - "name": "Connect Sidecar Aliasing web", - "alias_service": "web" - } - ], - "proxy": { - "destination_service_name": "web", - "destination_service_id": "web", - "local_service_address": "127.0.0.1", - "local_service_port": 8080 - } - } - ] -} -``` - -Details on how the defaults are determined are [documented -below](#sidecar-service-defaults). - --> **Note:** Sidecar service registrations are only a shorthand for registering -multiple services. Consul will not start up or manage the actual proxy processes -for you. - -## Overridden Example - -The following example shows a service definition where some fields are -overridden to customize the proxy configuration. - -```json -{ - "name": "web", - "port": 8080, - "connect": { - "sidecar_service": { - "proxy": { - "upstreams": [ - { - "destination_name": "db", - "local_bind_port": 9191 - } - ], - "config": { - "handshake_timeout_ms": 1000 - } - } - } - } -} -``` - -This example customizes the [proxy -upstreams](/consul/docs/connect/registration/service-registration#upstream-configuration-reference) -and some [built-in proxy -configuration](/consul/docs/connect/proxies/built-in). - -## Sidecar Service Defaults - -The following fields are set by default on a sidecar service registration. With -[the exceptions noted](#limitations) any field may be overridden explicitly in -the `connect.sidecar_service` definition to customize the proxy registration. -The "parent" service refers to the service definition that embeds the sidecar -proxy. - -- `id` - ID defaults to being `-sidecar-proxy`. This can't - be overridden as it is used to [manage the lifecycle](#lifecycle) of the - registration. -- `name` - Defaults to being `-sidecar-proxy`. -- `tags` - Defaults to the tags of the parent service. -- `meta` - Defaults to the service metadata of the parent service. -- `port` - Defaults to being auto-assigned from a configurable - range specified by [`sidecar_min_port`](/consul/docs/agent/config/config-files#sidecar_min_port) - and [`sidecar_max_port`](/consul/docs/agent/config/config-files#sidecar_max_port). -- `kind` - Defaults to `connect-proxy`. This can't be overridden currently. -- `check`, `checks` - By default we add a TCP check on the local address and - port for the proxy, and a [service alias - check](/consul/docs/services/usage/checks#alias-checks) for the parent service. If either - `check` or `checks` fields are set, only the provided checks are registered. -- `proxy.destination_service_name` - Defaults to the parent service name. -- `proxy.destination_service_id` - Defaults to the parent service ID. -- `proxy.local_service_address` - Defaults to `127.0.0.1`. -- `proxy.local_service_port` - Defaults to the parent service port. - -## Limitations - -The following fields are not supported in the `connect.sidecar_service` block: - -- `id` - Sidecar services get an ID assigned and it is an error to override - this. This ensures the agent can correctly deregister the sidecar service - later when the parent service is removed. -- `kind` - Kind defaults to `connect-proxy` and there is currently no way to - unset this to make the registration be for a regular non-connect-proxy - service. -- `connect.sidecar_service` - Service definitions can't be nested recursively. -- `connect.native` - Currently the `kind` is fixed to `connect-proxy` and it's - an error to register a `connect-proxy` that is also service mesh-native. - -## Lifecycle - -Sidecar service registration is mostly a configuration syntax helper to avoid -adding lots of boiler plate for basic sidecar options, however the agent does -have some specific behavior around their lifecycle that makes them easier to -work with. - -The agent fixes the ID of the sidecar service to be based on the parent -service's ID. This enables the following behavior. - -- A service instance can _only ever have one_ sidecar service registered. -- When re-registering via API or reloading from configuration file: - - If something changes in the nested sidecar service definition, the change - will _update_ the current sidecar registration instead of creating a new - one. - - If a service registration removes the nested `sidecar_service` then the - previously registered sidecar for that service will be deregistered - automatically. -- When reloading the configuration files, if a service definition changes its - ID, then a new service instance _and_ a new sidecar instance will be - registered. The old ones will be removed since they are no longer found in - the config files. diff --git a/website/data/docs-nav-data.json b/website/data/docs-nav-data.json index 6d8926592c4e..5cd454d4f9e1 100644 --- a/website/data/docs-nav-data.json +++ b/website/data/docs-nav-data.json @@ -479,15 +479,19 @@ ] }, { - "title": "Supported Proxies", + "title": "Proxies", "routes": [ { "title": "Overview", "path": "connect/proxies" }, { - "title": "Envoy", - "path": "connect/proxies/envoy" + "title": "Deploy service mesh proxies", + "path": "connect/proxies/deploy-service-mesh-proxies" + }, + { + "title": "Deploy sidecar services", + "path": "connect/proxies/deploy-sidecar-services" }, { "title": "Envoy Extensions", @@ -541,29 +545,24 @@ ] }, { - "title": "Built-in Proxy", - "path": "connect/proxies/built-in" + "title": "Proxy integration", + "path": "connect/proxies/integrate" }, { - "title": "Proxy Integration", - "path": "connect/proxies/integrate" - } - ] - }, - { - "title": "Registering Proxies", - "routes": [ + "title": "Proxy defaults configuration reference", + "href": "/consul/docs/connect/config-entries/proxy-defaults" + }, { - "title": "Overview", - "path": "connect/registration" + "title": "Envoy proxies reference", + "path": "connect/proxies/envoy" }, { - "title": "Proxy Service Registration", - "path": "connect/registration/service-registration" + "title": "Built-in proxy reference", + "path": "connect/proxies/built-in" }, { - "title": "Sidecar Service Registration", - "path": "connect/registration/sidecar-service" + "title": "Service mesh proxy configuration reference", + "path": "connect/proxies/proxy-config-reference" } ] }, diff --git a/website/redirects.js b/website/redirects.js index 52712feeed5a..c6dde36160ea 100644 --- a/website/redirects.js +++ b/website/redirects.js @@ -69,8 +69,22 @@ module.exports = [ { source: '/consul/docs/connect/gateways/mesh-gateway/service-to-service-traffic-datacenters', - destination: - '/consul/docs/k8s/deployment-configurations/multi-cluster', + destination: '/consul/docs/k8s/deployment-configurations/multi-cluster', + permanent: true, + }, + { + source: '/consul/docs/connect/registration/service-registration', + destination: '/consul/docs/connect/proxies/proxy-config-reference', permanent: true, - } + }, + { + source: '/consul/docs/connect/registration', + destination: '/consul/docs/connect/proxies/', + permanent: true, + }, + { + source: '/consul/docs/connect/registration/sidecar-service', + destination: '/consul/docs/connect/proxies/deploy-sidecar-services', + permanent: true, + }, ]