Skip to content

Backport of added check if anonymous token policy exists into release/1.0.x#2862

Closed
hc-github-team-consul-core wants to merge 344 commits intorelease/1.0.xfrom
backport/NET-5174/anonymous-token-policy/legally-humble-fawn
Closed

Backport of added check if anonymous token policy exists into release/1.0.x#2862
hc-github-team-consul-core wants to merge 344 commits intorelease/1.0.xfrom
backport/NET-5174/anonymous-token-policy/legally-humble-fawn

Conversation

@hc-github-team-consul-core
Copy link
Copy Markdown
Collaborator

Backport

This PR is auto-generated from #2790 to be assessed for backporting due to the inclusion of the label backport/1.0.x.

🚨

Warning automatic cherry-pick of commits failed. If the first commit failed,
you will see a blank no-op commit below. If at least one commit succeeded, you
will see the cherry-picked commits up to, not including, the commit where
the merge conflict occurred.

The person who merged in the original PR is:
@aahel
This person should manually cherry-pick the original PR into a new backport PR,
and close this one when the manual backport PR is merged in.

merge conflict error: POST https://api.github.com/repos/hashicorp/consul-k8s/merges: 409 Merge conflict []

The below text is copied from the body of the original PR.


Changes proposed in this PR:

Prevent updating anonymous token if it already exists and is attached to the anonymous token policy

How I've tested this PR:

  • setup the deafault partiton and create a non-default partition called my-partition.
  • modified the anonymous token policy rule.
  • created helm deployment in my-partiton using acl bootstrap token with following policies.
acl = "read"
operator = "read"
agent_prefix "" {
  policy = "read"
}
partition "my-partition" {
  acl = "write"
  mesh = "write"
  peering = "write"
  namespace_prefix "" {
    policy = "write"
  }
  service_prefix "" {
    policy = "write"
  }
}
  • server-acl-acl init was successfull and anonymous token policy rule didn't get updated

How I expect reviewers to test this PR:

Checklist:


Overview of commits

wilkermichael and others added 30 commits March 2, 2023 12:02
* fix grammar in changelog checker

* add backport checker
Support automatic ACL bootstrapping with the Vault secrets backend

With the Vault secrets backend, server-acl-init now:
* Runs the Vault agent as a sidecar
* Bootstraps ACLs if the Vault bootstrap token is empty or not found,
  and writes the bootstrap token back to Vault via the Vault agent

The Kubernetes backend will write the bootstrap token to the
user-provided secret if that secret is empty. The Vault behavior is
the same.

The Vault backend writes to a default secret name if the secretName
and secretKey are not set in the helm chart values.

server-acl-init reads the secret directly from k8s or Vault.
* Remove -bootstrap-token-file flag from server-acl-init and remove the
* Remove the volume/mount for bootstrap token

---------

Co-authored-by: Chris Thain <32781396+cthain@users.noreply.github.com>
* update charts to point to 1.15.1

* updated consul libraries to the latest
…roller

Add SNI skip for client node configuration
…`null` to increase service registration times (#2008)

* Update values.yaml
Clients are not required for ingress/terminating gateways.
Website has linting that errors when links have the
developer.hashicorp.com prefix.
…shicorp/consul-k8s into bug/gateway-controller-incomplete-acl
[COMPLIANCE] add copyright headers to files
…lete-acl

Update ACLs, add namespace.write permission
Ashwin Venkatesh and others added 23 commits July 28, 2023 16:08
* Bump golang.org/x/net to 0.12.0 in cni

This was missed in 5b57e63 as part of a
general upgrade of that dependency.

* Bump server-connection-manager to v0.1.3

Tidying up following CVE dependency bumps, leading to a new release of
this library.
* Fix default Ent image tag in acceptance tests

Rather than hard-coding the Docker repository and parsing the non-Ent
image tag for a version, simply replace the image name and retain other
coordinates. This is consistent with our tagging scheme introduced in
hashicorp/consul#13541 and will allow for using
`hashicorppreview` images seamlessly regardless of whether OSS or Ent is
being tested.

* Add make target for loading images in kind

Complement other multi-cluster make targets by supporting image loading
across kind clusters.
increase timeout while waiting for server to be ready and fix require.Equal check
* Increase the retries and add config entry retries
…ing on OpenShift (#2184)

Co-authored-by: Melisa Griffin <melisa.griffin@hashicorp.com>
* Adds port mapping to Gateway Class Config to avoid running container on privileged ports

Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com>
* Implement validation of TLS options

* Use constants for annotation keys

* Add changelog entry

* Implement TLS options translation

* Update changelog entry

* Add unit test coverage for TLS option validation

* Code review feedback
* JWT auth basic acceptance test

* Update to run only in enterprise mode, update comment to be correct

* Remove usage of `testing.t` in retry block

* Fixed last `t` in retry block in tests

* Update acceptance/tests/api-gateway/api_gateway_test.go

Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com>

* Update acceptance/tests/api-gateway/api_gateway_test.go

Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com>

* Updating filenames for gw jwt cases and adding message about why this
test is skipped

---------

Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com>
Apply K8s node locality to services and sidecars

Locality-aware routing is based on proxy locality rather than the
proxied service. Ensure we propagate locality to both when registering
services.
* Set privileged to false unless on OpenShift without CNI
* added fixtures

* removed fixtures
- intentions only gets added now if acls are enabled
- payment-service-resolver is only for locality aware which isn't in scope for this PR

* updated sameness tests to include peering
- refactored with some helper functions for members (now TestClusters)
- made names more uniform, tend more towards the cluster-01-a/cluster-02-a/etc. nomenclature

* added 4 clusters to cni make target

* disable proxy lifecycle
* add additional tproxy static-client
- this doesn't specify an upstream so that tproxy will be able to handle routing

* add tproxy coverage
- add control-flow to handle using the virtual host name when tproxy is enabled
@hc-github-team-consul-core hc-github-team-consul-core force-pushed the backport/NET-5174/anonymous-token-policy/legally-humble-fawn branch from e1fa0a7 to 598be58 Compare August 30, 2023 05:24
@hc-github-team-consul-core hc-github-team-consul-core force-pushed the backport/NET-5174/anonymous-token-policy/legally-humble-fawn branch from 598be58 to e1fa0a7 Compare August 30, 2023 05:24
@hashicorp-cla
Copy link
Copy Markdown

hashicorp-cla commented Aug 30, 2023

CLA assistant check

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes


16 out of 17 committers have signed the CLA.

  • hashicorp-copywrite[bot]
  • hc-github-team-consul-core
  • thisisnotashwin
  • nathancoleman
  • chapmanc
  • DanStough
  • curtbushko
  • 20sr20
  • zalimeni
  • skpratt
  • aahel
  • wilkermichael
  • Ganeshrockz
  • jm96441n
  • markcampv
  • missylbytes
  • Paul Glass

Paul Glass seems not to be a GitHub user.
You need a GitHub account to be able to sign the CLA. If you already have a GitHub account, please add the email address used for this commit to your account.

Have you signed the CLA already but the status is still pending? Recheck it.

@aahel aahel closed this Aug 30, 2023
@aahel aahel deleted the backport/NET-5174/anonymous-token-policy/legally-humble-fawn branch August 30, 2023 07:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.