Backport of values.yaml - set default connect inject init cpu resource limits to null to increase service registration times into release/0.1.0.x

.changelog/1770.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+control-plane: server ACL Init always appends both, the secrets from the serviceAccount's secretRefs and the one created by the Helm chart, to support Openshift secret handling.
+```

.changelog/1934.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+control-plane: update alpine to 3.17 in the Docker image.
+```

.changelog/1953.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+helm: update `imageConsulDataplane` value to `hashicorp/consul-dataplane:1.1.0`.
+```

.changelog/1976.txt

@@ -0,0 +1,3 @@
+```release-note:security
+upgrade to use Go 1.19.6. This resolves vulnerabilities CVE-2022-41724 in crypto/tls and CVE-2022-41723 in net/http.
+```

.changelog/2008.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+helm: Set default `limits.cpu` resource setting to `null` for `consul-connect-inject-init` container to speed up registration times when onboarding services onto the mesh during the init container lifecycle. 
+```

.changelog/2013.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+api-gateway: fix issue where specifying an external server SNI name while using client nodes resulted in a TLS verification error.
+```

.changelog/changelog.tmpl

@@ -0,0 +1,57 @@
+{{- if index .NotesByType "breaking-change" -}}
+BREAKING CHANGES:
+
+{{range index .NotesByType "breaking-change" -}}
+* {{ template "note" . }}
+{{ end -}}
+{{- end -}}
+
+{{- if .NotesByType.security }}
+SECURITY:
+
+{{range .NotesByType.security -}}
+* {{ template "note" . }}
+{{ end -}}
+{{- end -}}
+
+{{- if .NotesByType.feature }}
+FEATURES:
+
+{{range .NotesByType.feature -}}
+* {{ template "note" . }}
+{{ end -}}
+{{- end -}}
+
+{{- $improvements := combineTypes .NotesByType.improvement .NotesByType.enhancement -}}
+{{- if $improvements }}
+IMPROVEMENTS:
+
+{{range $improvements | sort -}}
+* {{ template "note" . }}
+{{ end -}}
+{{- end -}}
+
+{{- if .NotesByType.deprecation }}
+DEPRECATIONS:
+
+{{range .NotesByType.deprecation -}}
+* {{ template "note" . }}
+{{ end -}}
+{{- end -}}
+
+{{- if .NotesByType.bug }}
+BUG FIXES:
+
+{{range .NotesByType.bug -}}
+* {{ template "note" . }}
+{{ end -}}
+{{- end -}}
+
+{{- if .NotesByType.note }}
+NOTES:
+
+{{range .NotesByType.note -}}
+* {{ template "note" . }}
+{{ end -}}
+{{- end -}}
+

.changelog/note.tmpl

@@ -0,0 +1,3 @@
+{{- define "note" -}}
+{{.Body}}{{if not (stringHasPrefix .Issue "_")}} [[GH-{{- .Issue -}}](https://github.com/hashicorp/consul-k8s/issues/{{- .Issue -}})]{{end}}
+{{- end -}}

.circleci/config.yml

@@ -6,7 +6,7 @@ orbs:
 executors:
   go:
     docker:
-      - image: docker.mirror.hashicorp.services/cimg/go:1.19.2
+      - image: docker.mirror.hashicorp.services/cimg/go:1.19.6
     environment:
       TEST_RESULTS: /tmp/test-results # path to where test results are saved
 
@@ -34,9 +34,9 @@ commands:
       - run:
           name: Install go, gotestsum, kind, kubectl, and helm
           command: |
-            wget https://golang.org/dl/go1.19.2.linux-amd64.tar.gz
-            sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf go1.19.2.linux-amd64.tar.gz
-            rm go1.19.2.linux-amd64.tar.gz
+            wget https://golang.org/dl/go1.19.6.linux-amd64.tar.gz
+            sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf go1.19.6.linux-amd64.tar.gz
+            rm go1.19.6.linux-amd64.tar.gz
             echo 'export PATH=$PATH:/usr/local/go/bin' >> $BASH_ENV
 
             wget https://github.com/gotestyourself/gotestsum/releases/download/v1.8.2/gotestsum_1.8.2_linux_amd64.tar.gz
@@ -573,7 +573,7 @@ jobs:
       - checkout
       - install-prereqs
       - create-kind-clusters:
-          version: "v1.25.3"
+          version: "v1.26.0"
       - restore_cache:
           keys:
             - consul-helm-modcache-v2-{{ checksum "acceptance/go.mod" }}
@@ -606,7 +606,7 @@ jobs:
       - checkout
       - install-prereqs
       - create-kind-clusters:
-          version: "v1.25.3"
+          version: "v1.26.0"
       - restore_cache:
           keys:
             - consul-helm-modcache-v2-{{ checksum "acceptance/go.mod" }}
@@ -723,7 +723,7 @@ jobs:
   #############################
   # CLOUD ACCEPTANCE TEST JOBS
   #############################
-  acceptance-gke-1-23:
+  acceptance-gke-1-25:
     parallelism: 2
     environment:
       - TEST_RESULTS: /tmp/test-results
@@ -773,7 +773,7 @@ jobs:
       - run: mkdir -p $TEST_RESULTS
 
       - run-acceptance-tests:
-          additional-flags: -kubeconfig="$primary_kubeconfig" -secondary-kubeconfig="$secondary_kubeconfig" -enable-pod-security-policies -enable-transparent-proxy -consul-image=hashicorppreview/consul-enterprise:1.14-dev
+          additional-flags: -kubeconfig="$primary_kubeconfig" -secondary-kubeconfig="$secondary_kubeconfig" -enable-transparent-proxy -consul-image=hashicorppreview/consul-enterprise:1.14-dev
 
       - store_test_results:
           path: /tmp/test-results
@@ -792,7 +792,7 @@ jobs:
           fail_only: true
           failure_message: "GKE acceptance tests failed. Check the logs at: ${CIRCLE_BUILD_URL}"
 
-  acceptance-gke-cni-1-23:
+  acceptance-gke-cni-1-25:
     parallelism: 2
     environment:
       - TEST_RESULTS: /tmp/test-results
@@ -842,7 +842,7 @@ jobs:
       - run: mkdir -p $TEST_RESULTS
 
       - run-acceptance-tests:
-          additional-flags: -use-gke -kubeconfig="$primary_kubeconfig" -secondary-kubeconfig="$secondary_kubeconfig" -enable-pod-security-policies -enable-transparent-proxy -enable-cni -consul-image=hashicorppreview/consul-enterprise:1.14-dev
+          additional-flags: -use-gke -kubeconfig="$primary_kubeconfig" -secondary-kubeconfig="$secondary_kubeconfig" -enable-transparent-proxy -enable-cni -consul-image=hashicorppreview/consul-enterprise:1.14-dev
 
       - store_test_results:
           path: /tmp/test-results
@@ -861,7 +861,7 @@ jobs:
           fail_only: true
           failure_message: "GKE CNI acceptance tests failed. Check the logs at: ${CIRCLE_BUILD_URL}"
 
-  acceptance-aks-1-22:
+  acceptance-aks-1-24:
     parallelism: 3
     environment:
       - TEST_RESULTS: /tmp/test-results
@@ -918,7 +918,7 @@ jobs:
           fail_only: true
           failure_message: "AKS acceptance tests failed. Check the logs at: ${CIRCLE_BUILD_URL}"
 
-  acceptance-aks-cni-1-22:
+  acceptance-aks-cni-1-24:
     parallelism: 3
     environment:
       - TEST_RESULTS: /tmp/test-results
@@ -974,7 +974,7 @@ jobs:
           fail_only: true
           failure_message: "AKS CNI acceptance tests failed. Check the logs at: ${CIRCLE_BUILD_URL}"
 
-  acceptance-eks-1-21:
+  acceptance-eks-1-23:
     parallelism: 3
     environment:
       - TEST_RESULTS: /tmp/test-results
@@ -1037,7 +1037,7 @@ jobs:
           fail_only: true
           failure_message: "EKS acceptance tests failed. Check the logs at: ${CIRCLE_BUILD_URL}"
 
-  acceptance-eks-cni-1-21:
+  acceptance-eks-cni-1-23:
     parallelism: 3
     environment:
       - TEST_RESULTS: /tmp/test-results
@@ -1193,7 +1193,7 @@ jobs:
       - slack/status:
           channel: *slack-channel
           fail_only: true
-          failure_message: "Acceptance tests against Kind with Kubernetes v1.23 with Consul 1.12 nightly failed. Check the logs at: ${CIRCLE_BUILD_URL}"
+          failure_message: "Acceptance tests against Kind with Kubernetes v1.25 with Consul 1.12 nightly failed. Check the logs at: ${CIRCLE_BUILD_URL}"
 
   acceptance-kind-1-23-consul-compat-nightly-1-13:
     environment:
@@ -1234,7 +1234,7 @@ jobs:
       - slack/status:
           channel: *slack-channel
           fail_only: true
-          failure_message: "Acceptance tests against Kind with Kubernetes v1.23 with Consul 1.13 nightly failed. Check the logs at: ${CIRCLE_BUILD_URL}"
+          failure_message: "Acceptance tests against Kind with Kubernetes v1.25 with Consul 1.13 nightly failed. Check the logs at: ${CIRCLE_BUILD_URL}"
 
 ########################
 # WORKFLOWS
@@ -1264,16 +1264,17 @@ workflows:
       - acceptance:
           context: consul-ci
           requires:
-            - dev-upload-docker
+          - dev-upload-docker
       - acceptance-tproxy-cni:
           context: consul-ci
           requires:
-            - dev-upload-docker
+          - dev-upload-docker
       - acceptance-tproxy:
           context: consul-ci
           requires:
           - dev-upload-docker
 
+
   nightly-cleanup:
     triggers:
       - schedule:
@@ -1310,15 +1311,15 @@ workflows:
             - build-distros-linux
       # Disable until we can use UBI images.
       # - acceptance-openshift
-      - acceptance-gke-1-23:
+      - acceptance-gke-1-25:
           requires:
-            - dev-upload-docker
-      - acceptance-gke-cni-1-23:
+          - dev-upload-docker
+      - acceptance-gke-cni-1-25:
           requires:
-            - acceptance-gke-1-23
+          - acceptance-gke-1-25
       - acceptance-tproxy:
           requires:
-            - dev-upload-docker
+          - dev-upload-docker
 
   nightly-acceptance-tests-main:
     description: |
@@ -1342,24 +1343,24 @@ workflows:
             - build-distros-linux
       # Disable until we can use UBI images.
       # - acceptance-openshift
-      - acceptance-gke-1-23:
+      - acceptance-gke-1-25:
           requires:
             - dev-upload-docker
-      - acceptance-gke-cni-1-23:
+      - acceptance-gke-cni-1-25:
           requires:
-            - acceptance-gke-1-23
-      - acceptance-eks-1-21:
+            - acceptance-gke-1-25
+      - acceptance-eks-1-23:
           requires:
             - dev-upload-docker
-      - acceptance-eks-cni-1-21:
+      - acceptance-eks-cni-1-23:
           requires:
-            - acceptance-eks-1-21
-      - acceptance-aks-1-22:
+            - acceptance-eks-1-23
+      - acceptance-aks-1-24:
           requires:
             - dev-upload-docker
-      - acceptance-aks-cni-1-22:
+      - acceptance-aks-cni-1-24:
           requires:
-            - acceptance-aks-1-22
+            - acceptance-aks-1-24
       - acceptance-tproxy:
           requires:
             - dev-upload-docker

.github/workflows/backport-checker.yml

@@ -0,0 +1,32 @@
+# This workflow checks that there is either a 'pr/no-backport' label applied to a PR
+# or there is a backport/<pr number>.txt file associated with a PR for a backport label
+
+name: Backport Checker
+
+on:
+  pull_request:
+    types: [opened, synchronize, labeled]
+    # Runs on PRs to main and all release branches
+    branches:
+      - main
+      - release/*
+
+jobs:
+  # checks that a backport label is present for a PR
+  backport-check:
+    # If there's a `pr/no-backport` label we ignore this check. Also, we ignore PRs created by the bot assigned to `backport-assistant`
+    if: "! ( contains(github.event.pull_request.labels.*.name, 'pr/no-backport') || github.event.pull_request.user.login == 'hc-github-team-consul-core' )"
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check for Backport Label
+        run: |
+          labels="${{join(github.event.pull_request.labels.*.name, ', ') }}"
+          if [[ "$labels" =~ .*"backport/".* ]]; then
+            echo "Found backport label!"
+            exit 0
+          fi
+          # Fail status check when no backport label was found on the PR
+          echo "Did not find a backport label matching the pattern 'backport/*' and the 'pr/no-backport' label was not applied. Reference - https://github.com/hashicorp/consul-k8s/pull/1982"
+          exit 1
+

.github/workflows/changelog-checker.yml

@@ -0,0 +1,46 @@
+# This workflow checks that there is either a 'pr/no-changelog' label applied to a PR
+# or there is a .changelog/<pr number>.txt file associated with a PR for a changelog entry
+
+name: Changelog Checker
+
+on:
+  pull_request:
+    types: [opened, synchronize, labeled]
+    # Runs on PRs to main and all release branches
+    branches:
+      - main
+      - release/*
+
+jobs:
+  # checks that a .changelog entry is present for a PR
+  changelog-check:
+    # If there's a `pr/no-changelog` label we ignore this check. Also, we ignore PRs created by the bot assigned to `backport-assistant`
+    if: "! ( contains(github.event.pull_request.labels.*.name, 'pr/no-changelog') || github.event.pull_request.user.login == 'hc-github-team-consul-core' )" 
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0 # by default the checkout action doesn't checkout all branches
+      - name: Check for changelog entry in diff
+        run: |
+          # check if there is a diff in the .changelog directory
+          # for PRs against the main branch, the changelog file name should match the PR number
+          if [ "${{ github.event.pull_request.base.ref }}" = "${{ github.event.repository.default_branch }}" ]; then
+            enforce_matching_pull_request_number="matching this PR number "
+            changelog_file_path=".changelog/(_)?${{ github.event.pull_request.number }}.txt"
+          else
+            changelog_file_path=".changelog/[_0-9]*.txt"
+          fi
+
+          changelog_files=$(git --no-pager diff --name-only HEAD "$(git merge-base HEAD "origin/main")" | egrep ${changelog_file_path})
+
+          # If we do not find a file in .changelog/, we fail the check
+          if [ -z "$changelog_files" ]; then
+            # Fail status check when no .changelog entry was found on the PR
+            echo "Did not find a .changelog entry ${enforce_matching_pull_request_number}and the 'pr/no-changelog' label was not applied. Reference - https://github.com/hashicorp/consul-k8s/pull/1947"
+            exit 1
+          else
+            echo "Found .changelog entry in PR!"
+          fi