Skip to content

Backport of Fix audit log parse error into release/1.2.x#2918

Closed
hc-github-team-consul-core wants to merge 158 commits intorelease/1.2.xfrom
backport/net-5513/fix-integer/recently-bursting-crow
Closed

Backport of Fix audit log parse error into release/1.2.x#2918
hc-github-team-consul-core wants to merge 158 commits intorelease/1.2.xfrom
backport/net-5513/fix-integer/recently-bursting-crow

Conversation

@hc-github-team-consul-core
Copy link
Copy Markdown
Collaborator

Backport

This PR is auto-generated from #2905 to be assessed for backporting due to the inclusion of the label backport/1.2.x.

The below text is copied from the body of the original PR.


Changes proposed in this PR:

  • Fixes a bug in parsing the following audit log helm configuration
server:
  auditLogs:
      enabled: true
      sinks:
        - name: My Sink
          type: file
          format: json
          path: /tmp/audit.json
          delivery_guarantee: best-effort
          rotate_duration: 24h
          rotate_max_files: 15
          rotate_bytes: 25165824

where rotate_max_files and rotate_bytes get passed as string inputs to the server configuration file. This PR makes sure to perform special handling for rotate_max_files and rotate_bytes where they don't get passed with quotes.

Generated config (Before the fix)

    {
      "audit": {
        "enabled": true,
        "sink": {
          "MySink": {
              "delivery_guarantee": "best-effort",
              "format": "json",
              "path": "/tmp/audit.json",
              "rotate_bytes": "12455355", // note the presence of braces here
              "rotate_duration": "24h",
              "rotate_max_files": "20",
              "type": "file"
          }
        }
      }
    }

Generated config (After the fix)

    {
      "audit": {
        "enabled": true,
        "sink": {
          "MySink": {
              "delivery_guarantee": "best-effort",
              "format": "json",
              "path": "/tmp/audit.json",
              "rotate_bytes": 12455355, // note the absence of braces here
              "rotate_duration": "24h",
              "rotate_max_files": 20,
              "type": "file"
          }
        }
      }
    }

How I've tested this PR:

  1. CI
  2. Verified manually that the server no longer crashes with this issue.

How I expect reviewers to test this PR:

👀

Checklist:


Overview of commits

curtbushko and others added 30 commits June 7, 2023 19:51
* Add FIPS builds for linux amd64

* add version check

* fix CI labels and add local dev commands

* fix ci version tagging

* switch to ubuntu 20.04

* add CLI version tag

* add gcompat for alpine glibc cgo compatibility

* remove FIPS version check from connect-init

* address comments
- making this trigger nightly until after 1.2.0 GA
- leaving 0.49.x active until after 1.2.0 GA
* first run through, needs help

* still need to make secure pass

* left something uncommented

* it works and also cleanup

* fix acceptance tests
* [API Gateway] Add acceptance test for cluster peering

* Fix linter

* Fix random unrelated linter errors to get CI to run: revert later?

* one more linter fix to later probably revert

* more linter fixes

* Revert "more linter fixes"

This reverts commit 6210dff.

* Revert "one more linter fix to later probably revert"

This reverts commit 030c563.

* Revert "Fix random unrelated linter errors to get CI to run: revert later?"

This reverts commit fdeccab.
…ersion of kind and k8s 1.27 (#2304)

* update cloud tests to use 1.24, 1.25 and 1.26 version of kubernetes for more coverage

* updated readme for supported kubernetes versions

* added changelog
* [API Gateway] WAN Federation test and fixes

* Fix unit tests
* Fix when gateways are deleted before we get services populated into cache

* a bit of cleanup
…assConfig are obeyed (#2272)

* Add unit tests verifying that scaling parameters on GatewayClassConfig are obeyed

* Add test case for scaling w/ no min or max configured
* Rename GatewayClassController to prevent name collision

* Use gateway instead of gatewayclass in name

* Use the constant in ownership checks

* Change GatewayClass name to "consul"

* Change GatewayClass name in cases

* Change ApiGatewayClass back
* Fix SupportedKinds array to be what Conformance test expects

* Fix cert validation status condition for listeners

* Add programmed condition for listeners

* Fix unit test

---------

Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com>
* first pass at halting: got httproute and api-gateway done

* clean up test

* Handle all set for infinite reconcile check

* Add table tests for minimal setup

* Added some odd field names to test normalization is handled correctly

* Use funky casing http routes
* Added helm inputs for managing audit logs
* Remove unwanted changes from values
* fix: use correct flag when translating namespaces

* Use non-normalized namespace when deregistering services

* Guard against namespace queries when namespaces not enabled in cache
* added imagePullPolicy for images in values.yaml

* fix: renamed pullPolicy key according to image

* fixed dafault always in tmpl

* changed structure of image in yaml

* revert changes

* added global imagePullPolicy

* fixed typo

* added changelog file
This brings consul-k8s in line with consul.
Most importantly, the backport assistant was updated to automatically assign created PRs to the author of the PR that is being backported.
* update changelog based on changes made to 1.2.x

* fixed test cases
- enterprise cases were in the OSS test cases
* trigger conformance tests nightly, squash

* remove extra line

* Update nightly-api-gateway-conformance.yml
making scripts more robust and removing changing helm chart
* Fix cache and service deletion issue

* Add comments

* add in acceptance test

* Fix indentation

* Fix unit test for deleting gateway w/ consul services

* Remove redundant service deregistration code

* Exit loop early once registration is found for service

* Fix import blocking

* Set status on pods added to test

* Apply suggestions from code review

* Reduce count of test gateways to 10 from 100

---------

Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com>
Co-authored-by: Sarah Alsmiller <sarah.alsmiller@hashicorp.com>
* Adding support for weighted k8s service

* Adding changelog

* if per-app weight is 0 then pull the weight to 1

* Addressing review comments

* Addressing review comments

* Addressing review comments

* Comment update

* Comment update

* Parameterized table test

* Parameterized table test

* fixing linting issue

* fixing linting issue

---------

Co-authored-by: srahul3 <rahulsharma@hashicorp.com>
* Bumping go-discover to the lastest version
DanStough and others added 21 commits August 25, 2023 17:49
Revert "Add readOnlyRootFilesystem to security context (#2771) (#2789)"

This reverts commit b75d803.
* Update comments on Deployment

* Move resources into managedGatewayClass

* Add resource configuration to GatewayClassConfig

* Regenerate CRDs

* Pass resource configuration into the gateway-resources-job

* Pull in resources from GatewayClassConfig

* Add flag for resources in `gateway-resources` subcommand

* Clean up some comments in existing code

* Add gateway-resources configmap

* Load configmap into gateway-resources job

* Load resources from json

* Update CRDs

* Read resources in from the configmap

* Add BATs for Gateway Resources Configmap

* Add Changelog

* Fix unquoted value in BATs

* Fix how resources.json is read

* Fix BATs errors for real

* Fix seg fault bug

* Fix reading of resources file

* Quote "$actual"

* Fix zsh/sh differences in BATs

* Update control-plane/api-gateway/common/helm_config.go

Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com>

* Move resources into DeploymentSpec

* Remove extra split in crds

---------

Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com>
* correct prometheus port and scheme annotations if tls is enabled
…iceDefault CRDs (#2796)

Co-authored-by: Andrew Stucki <andrew.stucki@hashicorp.com>
* added check if anonymous token policy exists

* changed checkIfAnonymousTokenPolicyExists impl

* made consts private

* added test for configureAnonymousPolicy

* fixed unit test

* fixed test and minor refactoring

* fix typo

* changed some var names

* added changelog
* enable argocd

* adds bats test and setting argo annotations if global.argocd.enabled = true

* update comment

* added change log

* Update charts/consul/templates/gateway-cleanup-job.yaml

Co-authored-by: Ganesh S <ganesh.seetharaman@hashicorp.com>

* comments fixes

* fix line diff

* change log fix

* fix comment

* Update .changelog/2785.txt

Co-authored-by: Luke Kysow <1034429+lkysow@users.noreply.github.com>

---------

Co-authored-by: Ganesh S <ganesh.seetharaman@hashicorp.com>
Co-authored-by: Luke Kysow <1034429+lkysow@users.noreply.github.com>
* Update values.yaml

Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>
… from Gateway Resources Jobs (#2869)

* Remove  and  from Gateway Resources Jobs

* changelog

* Remove acl annotations from gateway resources unit tests
…nnect (#2880)

* Reduce api-gateway logging
* add changelog
* removed deprecated `patchesStrategicMerge`

* fixed some extra whitespace
…eployments (#2890)

Add NET_BIND_SERVICE to built-in PSPs for consul-dataplane deployments
* feat: add v2 pod controller w/ workload lifecycle
@hashicorp-cla
Copy link
Copy Markdown

hashicorp-cla commented Sep 7, 2023

CLA assistant check

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes


19 out of 20 committers have signed the CLA.

  • hc-github-team-consul-core
  • curtbushko
  • nathancoleman
  • zalimeni
  • t-eckert
  • missylbytes
  • hashi-derek
  • rigalGit
  • wilkermichael
  • sarahalsmiller
  • jm96441n
  • aahel
  • DanStough
  • Ganeshrockz
  • david-yu
  • trevorLeonHC
  • kisunji
  • sophie-gairo
  • absolutelightning
  • Paul Glass

Paul Glass seems not to be a GitHub user.
You need a GitHub account to be able to sign the CLA. If you already have a GitHub account, please add the email address used for this commit to your account.

Have you signed the CLA already but the status is still pending? Recheck it.

@david-yu
Copy link
Copy Markdown
Contributor

david-yu commented Sep 7, 2023

Looks like this failed, and needs a manual backport.

@Ganeshrockz Ganeshrockz closed this Sep 8, 2023
auto-merge was automatically disabled September 8, 2023 06:02

Pull request was closed

@github-actions github-actions bot deleted the backport/net-5513/fix-integer/recently-bursting-crow branch September 1, 2025 06:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.