Skip to content

Commit 4692019

Browse files
asheshvidyutasheshvidyut
authored
Merge branch 'main' into doc-update-for-log-file-changes
2 parents 05d5d24 + 0a11499 commit 4692019

File tree

184 files changed

+6174
-2511
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

184 files changed

+6174
-2511
lines changed

‎.changelog/17936.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:feature
2+
acl: Add new `acl.tokens.dns` config field which specifies the token used implicitly during dns checks.
3+
```

‎.github/scripts/filter_changed_files_go_test.sh‎

Lines changed: 31 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -2,36 +2,41 @@
22
# Copyright (c) HashiCorp, Inc.
33
# SPDX-License-Identifier: BUSL-1.1
44

5+
set -euo pipefail
56

67
# Get the list of changed files
7-
files_to_check=$(git diff --name-only origin/$GITHUB_BASE_REF)
8+
# Using `git merge-base` ensures that we're always comparing against the correct branch point.
9+
#For example, given the commits:
10+
#
11+
# A---B---C---D---W---X---Y---Z # origin/main
12+
# \---E---F # feature/branch
13+
#
14+
# ... `git merge-base origin/$SKIP_CHECK_BRANCH HEAD` would return commit `D`
15+
# `...HEAD` specifies from the common ancestor to the latest commit on the current branch (HEAD)..
16+
files_to_check=$(git diff --name-only "$(git merge-base origin/$SKIP_CHECK_BRANCH HEAD~)"...HEAD)
817

918
# Define the directories to check
1019
skipped_directories=("docs/" "ui/" "website/" "grafana/")
1120

12-
# Initialize a variable to track directories outside the skipped ones
13-
other_directories=""
14-
trigger_ci=true
21+
# Loop through the changed files and find directories/files outside the skipped ones
22+
for file_to_check in "${files_to_check[@]}"; do
23+
file_is_skipped=false
24+
for dir in "${skipped_directories[@]}"; do
25+
if [[ "$file_to_check" == "$dir"* ]] || [[ "$file_to_check" == *.md && "$dir" == *"/" ]]; then
26+
file_is_skipped=true
27+
break
28+
fi
29+
done
30+
if [ "$file_is_skipped" != "true" ]; then
31+
echo -e $file_to_check
32+
SKIP_CI=false
33+
echo "Changes detected in non-documentation files - skip-ci: $SKIP_CI"
34+
echo "skip-ci=$SKIP_CI" >> "$GITHUB_OUTPUT"
35+
exit 0 ## if file is outside of the skipped_directory exit script
36+
fi
37+
done
1538

16-
# # Loop through the changed files and find directories/files outside the skipped ones
17-
# for file_to_check in $files_to_check; do
18-
# file_is_skipped=false
19-
# for dir in "${skipped_directories[@]}"; do
20-
# if [[ "$file_to_check" == "$dir"* ]] || [[ "$file_to_check" == *.md && "$dir" == *"/" ]]; then
21-
# file_is_skipped=true
22-
# break
23-
# fi
24-
# done
25-
# if [ "$file_is_skipped" = "false" ]; then
26-
# other_directories+="$(dirname "$file_to_check")\n"
27-
# trigger_ci=true
28-
# echo "Non doc file(s) changed - triggered ci: $trigger_ci"
29-
# echo -e $other_directories
30-
# echo "trigger-ci=$trigger_ci" >>"$GITHUB_OUTPUT"
31-
# exit 0 ## if file is outside of the skipped_directory exit script
32-
# fi
33-
# done
34-
35-
# echo "Only doc file(s) changed - triggered ci: $trigger_ci"
36-
echo "Doc file(s) change detection is currently disabled - triggering ci"
37-
echo "trigger-ci=$trigger_ci" >>"$GITHUB_OUTPUT"
39+
echo -e "$files_to_check"
40+
SKIP_CI=true
41+
echo "Changes detected in only documentation files - skip-ci: $SKIP_CI"
42+
echo "skip-ci=$SKIP_CI" >> "$GITHUB_OUTPUT"

‎.github/workflows/go-tests.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ permissions:
2222
env:
2323
TEST_RESULTS: /tmp/test-results
2424
GOPRIVATE: github.com/hashicorp # Required for enterprise deps
25+
SKIP_CHECK_BRANCH: ${{ github.head_ref || github.ref_name }}
2526

2627
# concurrency
2728
concurrency:
@@ -33,7 +34,7 @@ jobs:
3334
runs-on: ubuntu-latest
3435
name: Get files changed and conditionally skip CI
3536
outputs:
36-
trigger-ci: ${{ steps.read-files.outputs.trigger-ci }}
37+
skip-ci: ${{ steps.read-files.outputs.skip-ci }}
3738
steps:
3839
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
3940
with:
@@ -45,7 +46,7 @@ jobs:
4546
setup:
4647
needs: [conditional-skip]
4748
name: Setup
48-
if: needs.conditional-skip.outputs.trigger-ci == 'true'
49+
if: needs.conditional-skip.outputs.skip-ci != 'true'
4950
runs-on: ubuntu-latest
5051
outputs:
5152
compute-small: ${{ steps.setup-outputs.outputs.compute-small }}
@@ -506,7 +507,7 @@ jobs:
506507
- go-test-32bit
507508
# - go-test-s390x
508509
runs-on: ${{ fromJSON(needs.setup.outputs.compute-small) }}
509-
if: always() && needs.conditional-skip.outputs.trigger-ci == 'true'
510+
if: always() && needs.conditional-skip.outputs.skip-ci != 'true'
510511
steps:
511512
- name: evaluate upstream job results
512513
run: |

‎.github/workflows/test-integrations.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ env:
2424
# strip the hashicorp/ off the front of github.repository for consul
2525
CONSUL_LATEST_IMAGE_NAME: ${{ endsWith(github.repository, '-enterprise') && github.repository || 'hashicorp/consul' }}
2626
GOPRIVATE: github.com/hashicorp # Required for enterprise deps
27+
SKIP_CHECK_BRANCH: ${{ github.head_ref || github.ref_name }}
2728

2829
concurrency:
2930
group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
@@ -34,7 +35,7 @@ jobs:
3435
runs-on: ubuntu-latest
3536
name: Get files changed and conditionally skip CI
3637
outputs:
37-
trigger-ci: ${{ steps.read-files.outputs.trigger-ci }}
38+
skip-ci: ${{ steps.read-files.outputs.skip-ci }}
3839
steps:
3940
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
4041
with:
@@ -47,7 +48,7 @@ jobs:
4748
needs: [conditional-skip]
4849
runs-on: ubuntu-latest
4950
name: Setup
50-
if: needs.conditional-skip.outputs.trigger-ci == 'true'
51+
if: needs.conditional-skip.outputs.skip-ci != 'true'
5152
outputs:
5253
compute-small: ${{ steps.runners.outputs.compute-small }}
5354
compute-medium: ${{ steps.runners.outputs.compute-medium }}
@@ -495,7 +496,7 @@ jobs:
495496
- envoy-integration-test
496497
- compatibility-integration-test
497498
runs-on: ${{ fromJSON(needs.setup.outputs.compute-small) }}
498-
if: always() && needs.conditional-skip.outputs.trigger-ci == 'true'
499+
if: always() && needs.conditional-skip.outputs.skip-ci != 'true'
499500
steps:
500501
- name: evaluate upstream job results
501502
run: |

‎CHANGELOG.md‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,98 @@
1+
## 1.16.2 (September 19, 2023)
2+
3+
SECURITY:
4+
5+
* Upgrade to use Go 1.20.8. This resolves CVEs
6+
[CVE-2023-39320](https://github.com/advisories/GHSA-rxv8-v965-v333) (`cmd/go`),
7+
[CVE-2023-39318](https://github.com/advisories/GHSA-vq7j-gx56-rxjh) (`html/template`),
8+
[CVE-2023-39319](https://github.com/advisories/GHSA-vv9m-32rr-3g55) (`html/template`),
9+
[CVE-2023-39321](https://github.com/advisories/GHSA-9v7r-x7cv-v437) (`crypto/tls`), and
10+
[CVE-2023-39322](https://github.com/advisories/GHSA-892h-r6cr-53g4) (`crypto/tls`) [[GH-18742](https://github.com/hashicorp/consul/issues/18742)]
11+
12+
IMPROVEMENTS:
13+
14+
* Adds flag -append-filename (which works on values version, dc, node and status) to consul snapshot save command.
15+
Adding the flag -append-filename version,dc,node,status will add consul version, consul datacenter, node name and leader/follower
16+
(status) in the file name given in the snapshot save command before the file extension. [[GH-18625](https://github.com/hashicorp/consul/issues/18625)]
17+
* Reduce the frequency of metric exports from Consul to HCP from every 10s to every 1m [[GH-18584](https://github.com/hashicorp/consul/issues/18584)]
18+
* api: Add support for listing ACL tokens by service name. [[GH-18667](https://github.com/hashicorp/consul/issues/18667)]
19+
* checks: It is now possible to configure agent TCP checks to use TLS with
20+
optional server SNI and mutual authentication. To use TLS with a TCP check, the
21+
check must enable the `tcp_use_tls` boolean. By default the agent will use the
22+
TLS configuration in the `tls.default` stanza. [[GH-18381](https://github.com/hashicorp/consul/issues/18381)]
23+
* command: Adds -since flag in consul debug command which internally calls hcdiag for debug information in the past. [[GH-18797](https://github.com/hashicorp/consul/issues/18797)]
24+
* log: Currently consul logs files like this consul-{timestamp}.log. This change makes sure that there is always
25+
consul.log file with the latest logs in it. [[GH-18617](https://github.com/hashicorp/consul/issues/18617)]
26+
27+
BUG FIXES:
28+
29+
* Inherit locality from services when registering sidecar proxies. [[GH-18437](https://github.com/hashicorp/consul/issues/18437)]
30+
* UI : Nodes list view was breaking for synthetic-nodes. Fix handles non existence of consul-version meta for node. [[GH-18464](https://github.com/hashicorp/consul/issues/18464)]
31+
* api: Fix `/v1/agent/self` not returning latest configuration [[GH-18681](https://github.com/hashicorp/consul/issues/18681)]
32+
* ca: Vault provider now cleans up the previous Vault issuer and key when generating a new leaf signing certificate [[GH-18779](https://github.com/hashicorp/consul/issues/18779)] [[GH-18773](https://github.com/hashicorp/consul/issues/18773)]
33+
* check: prevent go routine leakage when existing Defercheck of same check id is not nil [[GH-18558](https://github.com/hashicorp/consul/issues/18558)]
34+
* connect: Fix issue where Envoy endpoints would not populate correctly after a snapshot restore. [[GH-18636](https://github.com/hashicorp/consul/issues/18636)]
35+
* gateways: Fix a bug where gateway to service mappings weren't being cleaned up properly when externally registered proxies were being deregistered. [[GH-18831](https://github.com/hashicorp/consul/issues/18831)]
36+
* telemetry: emit consul version metric on a regular interval. [[GH-18724](https://github.com/hashicorp/consul/issues/18724)]
37+
38+
## 1.15.6 (September 19, 2023)
39+
40+
SECURITY:
41+
42+
* Upgrade to use Go 1.20.8. This resolves CVEs
43+
[CVE-2023-39320](https://github.com/advisories/GHSA-rxv8-v965-v333) (`cmd/go`),
44+
[CVE-2023-39318](https://github.com/advisories/GHSA-vq7j-gx56-rxjh) (`html/template`),
45+
[CVE-2023-39319](https://github.com/advisories/GHSA-vv9m-32rr-3g55) (`html/template`),
46+
[CVE-2023-39321](https://github.com/advisories/GHSA-9v7r-x7cv-v437) (`crypto/tls`), and
47+
[CVE-2023-39322](https://github.com/advisories/GHSA-892h-r6cr-53g4) (`crypto/tls`) [[GH-18742](https://github.com/hashicorp/consul/issues/18742)]
48+
49+
IMPROVEMENTS:
50+
51+
* Adds flag -append-filename (which works on values version, dc, node and status) to consul snapshot save command.
52+
Adding the flag -append-filename version,dc,node,status will add consul version, consul datacenter, node name and leader/follower
53+
(status) in the file name given in the snapshot save command before the file extension. [[GH-18625](https://github.com/hashicorp/consul/issues/18625)]
54+
* Reduce the frequency of metric exports from Consul to HCP from every 10s to every 1m [[GH-18584](https://github.com/hashicorp/consul/issues/18584)]
55+
* api: Add support for listing ACL tokens by service name. [[GH-18667](https://github.com/hashicorp/consul/issues/18667)]
56+
* command: Adds -since flag in consul debug command which internally calls hcdiag for debug information in the past. [[GH-18797](https://github.com/hashicorp/consul/issues/18797)]
57+
* log: Currently consul logs files like this consul-{timestamp}.log. This change makes sure that there is always
58+
consul.log file with the latest logs in it. [[GH-18617](https://github.com/hashicorp/consul/issues/18617)]
59+
60+
BUG FIXES:
61+
62+
* api: Fix `/v1/agent/self` not returning latest configuration [[GH-18681](https://github.com/hashicorp/consul/issues/18681)]
63+
* ca: Vault provider now cleans up the previous Vault issuer and key when generating a new leaf signing certificate [[GH-18779](https://github.com/hashicorp/consul/issues/18779)] [[GH-18773](https://github.com/hashicorp/consul/issues/18773)]
64+
* check: prevent go routine leakage when existing Defercheck of same check id is not nil [[GH-18558](https://github.com/hashicorp/consul/issues/18558)]
65+
* gateways: Fix a bug where gateway to service mappings weren't being cleaned up properly when externally registered proxies were being deregistered. [[GH-18831](https://github.com/hashicorp/consul/issues/18831)]
66+
* telemetry: emit consul version metric on a regular interval. [[GH-18724](https://github.com/hashicorp/consul/issues/18724)]
67+
68+
## 1.14.10 (September 19, 2023)
69+
70+
SECURITY:
71+
72+
* Upgrade to use Go 1.20.8. This resolves CVEs
73+
[CVE-2023-39320](https://github.com/advisories/GHSA-rxv8-v965-v333) (`cmd/go`),
74+
[CVE-2023-39318](https://github.com/advisories/GHSA-vq7j-gx56-rxjh) (`html/template`),
75+
[CVE-2023-39319](https://github.com/advisories/GHSA-vv9m-32rr-3g55) (`html/template`),
76+
[CVE-2023-39321](https://github.com/advisories/GHSA-9v7r-x7cv-v437) (`crypto/tls`), and
77+
[CVE-2023-39322](https://github.com/advisories/GHSA-892h-r6cr-53g4) (`crypto/tls`) [[GH-18742](https://github.com/hashicorp/consul/issues/18742)]
78+
79+
IMPROVEMENTS:
80+
81+
* Adds flag -append-filename (which works on values version, dc, node and status) to consul snapshot save command.
82+
Adding the flag -append-filename version,dc,node,status will add consul version, consul datacenter, node name and leader/follower
83+
(status) in the file name given in the snapshot save command before the file extension. [[GH-18625](https://github.com/hashicorp/consul/issues/18625)]
84+
* api: Add support for listing ACL tokens by service name. [[GH-18667](https://github.com/hashicorp/consul/issues/18667)]
85+
* command: Adds -since flag in consul debug command which internally calls hcdiag for debug information in the past. [[GH-18797](https://github.com/hashicorp/consul/issues/18797)]
86+
* log: Currently consul logs files like this consul-{timestamp}.log. This change makes sure that there is always
87+
consul.log file with the latest logs in it. [[GH-18617](https://github.com/hashicorp/consul/issues/18617)]
88+
89+
BUG FIXES:
90+
91+
* api: Fix `/v1/agent/self` not returning latest configuration [[GH-18681](https://github.com/hashicorp/consul/issues/18681)]
92+
* ca: Vault provider now cleans up the previous Vault issuer and key when generating a new leaf signing certificate [[GH-18779](https://github.com/hashicorp/consul/issues/18779)] [[GH-18773](https://github.com/hashicorp/consul/issues/18773)]
93+
* gateways: Fix a bug where gateway to service mappings weren't being cleaned up properly when externally registered proxies were being deregistered. [[GH-18831](https://github.com/hashicorp/consul/issues/18831)]
94+
* telemetry: emit consul version metric on a regular interval. [[GH-18724](https://github.com/hashicorp/consul/issues/18724)]
95+
196
## 1.16.1 (August 8, 2023)
297

398
KNOWN ISSUES:

‎agent/acl_endpoint_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1374,7 +1374,7 @@ func TestACL_HTTP(t *testing.T) {
13741374

13751375
var list map[string]api.ACLTemplatedPolicyResponse
13761376
require.NoError(t, json.NewDecoder(resp.Body).Decode(&list))
1377-
require.Len(t, list, 3)
1377+
require.Len(t, list, 4)
13781378

13791379
require.Equal(t, api.ACLTemplatedPolicyResponse{
13801380
TemplateName: api.ACLTemplatedPolicyServiceName,

‎agent/agent_endpoint.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1531,6 +1531,9 @@ func (s *HTTPHandlers) AgentToken(resp http.ResponseWriter, req *http.Request) (
15311531
case "config_file_service_registration":
15321532
s.agent.tokens.UpdateConfigFileRegistrationToken(args.Token, token_store.TokenSourceAPI)
15331533

1534+
case "dns_token", "dns":
1535+
s.agent.tokens.UpdateDNSToken(args.Token, token_store.TokenSourceAPI)
1536+
15341537
default:
15351538
return HTTPError{StatusCode: http.StatusNotFound, Reason: fmt.Sprintf("Token %q is unknown", target)}
15361539
}

‎agent/config/builder.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -882,6 +882,7 @@ func (b *builder) build() (rt RuntimeConfig, err error) {
882882
ACLAgentRecoveryToken: stringVal(c.ACL.Tokens.AgentRecovery),
883883
ACLReplicationToken: stringVal(c.ACL.Tokens.Replication),
884884
ACLConfigFileRegistrationToken: stringVal(c.ACL.Tokens.ConfigFileRegistration),
885+
ACLDNSToken: stringVal(c.ACL.Tokens.DNS),
885886
},
886887

887888
// Autopilot

‎agent/config/config.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -778,6 +778,7 @@ type Tokens struct {
778778
Default *string `mapstructure:"default"`
779779
Agent *string `mapstructure:"agent"`
780780
ConfigFileRegistration *string `mapstructure:"config_file_service_registration"`
781+
DNS *string `mapstructure:"dns"`
781782

782783
// Enterprise Only
783784
ManagedServiceProvider []ServiceProviderToken `mapstructure:"managed_service_provider"`

‎agent/config/testdata/TestRuntimeConfig_Sanitize.golden‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
"ACLAgentRecoveryToken": "hidden",
1818
"ACLAgentToken": "hidden",
1919
"ACLConfigFileRegistrationToken": "hidden",
20+
"ACLDNSToken": "hidden",
2021
"ACLDefaultToken": "hidden",
2122
"ACLReplicationToken": "hidden",
2223
"DataDir": "",

0 commit comments

Comments
 (0)