Skip to content

Commit

Permalink
Merge branch 'main' into main
Browse files Browse the repository at this point in the history
  • Loading branch information
v-kamerdinerov authored Nov 27, 2024
2 parents c2c8e3d + cf16128 commit 51a5bae
Show file tree
Hide file tree
Showing 16 changed files with 562 additions and 74 deletions.
3 changes: 3 additions & 0 deletions .changelog/4426.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
```release-note:bug
cli: fix issue where the `consul-k8s proxy list` command does not include API gateways.
```
79 changes: 79 additions & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
@@ -1,3 +1,21 @@
## 1.6.1 (November 4, 2023)

SECURITY:

* crd: Add `contains` and `ignoreCase` to the Intentions CRD to support configuring L7 Header intentions resilient to variable casing and multiple header values. [[GH-4385](https://github.com/hashicorp/consul-k8s/issues/4385)]
* crd: Add `http.incoming.requestNormalization` to the Mesh CRD to support configuring service traffic request normalization. [[GH-4385](https://github.com/hashicorp/consul-k8s/issues/4385)]

IMPROVEMENTS:

* catalog-sync: Added field to helm chart to purge all services registered with catalog-sync from consul on disabling of catalog-sync. [[GH-4378](https://github.com/hashicorp/consul-k8s/issues/4378)]

BUG FIXES:

* api-gateway: `global.imagePullSecrets` are now configured on the `ServiceAccount` for `Gateways`.

Note: the referenced image pull Secret(s) must be present in the same namespace the `Gateway` is deployed to. [[GH-4316](https://github.com/hashicorp/consul-k8s/issues/4316)]
* helm: fix issue where the API Gateway GatewayClassConfig tolerations can not be parsed by the Helm chart. [[GH-4315](https://github.com/hashicorp/consul-k8s/issues/4315)]

## 1.6.0 (October 16, 2024)

> NOTE: Consul K8s 1.6.x is compatible with Consul 1.20.x and Consul Dataplane 1.6.x. Refer to our [compatibility matrix](https://developer.hashicorp.com/consul/docs/k8s/compatibility) for more info.
Expand All @@ -21,6 +39,28 @@ BUG FIXES:
* helm: Fix ArgoCD hooks related annotations on server-acl-init Job, they must be added at Job definition and not template level. [[GH-3989](https://github.com/hashicorp/consul-k8s/issues/3989)]
* sync-catalog: Enable the user to purge the registered services by passing parent node and necessary filters. [[GH-4255](https://github.com/hashicorp/consul-k8s/issues/4255)]

## 1.5.4 (November 4, 2023)

SECURITY:

* Upgrade Go to use 1.22.7. This addresses CVE
[CVE-2024-34155](https://nvd.nist.gov/vuln/detail/CVE-2024-34155) [[GH-4313](https://github.com/hashicorp/consul-k8s/issues/4313)]
* crd: Add `contains` and `ignoreCase` to the Intentions CRD to support configuring L7 Header intentions resilient to variable casing and multiple header values. [[GH-4385](https://github.com/hashicorp/consul-k8s/issues/4385)]
* crd: Add `http.incoming.requestNormalization` to the Mesh CRD to support configuring service traffic request normalization. [[GH-4385](https://github.com/hashicorp/consul-k8s/issues/4385)]

IMPROVEMENTS:

* connect-inject: remove unnecessary resource permissions from connect-inject ClusterRole [[GH-4307](https://github.com/hashicorp/consul-k8s/issues/4307)]
* helm: Exclude gke namespaces from being connect-injected when the connect-inject: default: true value is set. [[GH-4333](https://github.com/hashicorp/consul-k8s/issues/4333)]

BUG FIXES:

* api-gateway: `global.imagePullSecrets` are now configured on the `ServiceAccount` for `Gateways`.

Note: the referenced image pull Secret(s) must be present in the same namespace the `Gateway` is deployed to. [[GH-4316](https://github.com/hashicorp/consul-k8s/issues/4316)]
* helm: fix issue where the API Gateway GatewayClassConfig tolerations can not be parsed by the Helm chart. [[GH-4315](https://github.com/hashicorp/consul-k8s/issues/4315)]
* sync-catalog: Enable the user to purge the registered services by passing parent node and necessary filters. [[GH-4255](https://github.com/hashicorp/consul-k8s/issues/4255)]

## 1.5.3 (August 30, 2024)

SECURITY:
Expand Down Expand Up @@ -52,6 +92,28 @@ This ensures that diff detection tools like ArgoCD consider the source and recon

Release redacted, use `1.5.3`

## 1.4.7 (November 4, 2023)

SECURITY:

* Upgrade Go to use 1.22.7. This addresses CVE
[CVE-2024-34155](https://nvd.nist.gov/vuln/detail/CVE-2024-34155) [[GH-4313](https://github.com/hashicorp/consul-k8s/issues/4313)]
* crd: Add `contains` and `ignoreCase` to the Intentions CRD to support configuring L7 Header intentions resilient to variable casing and multiple header values. [[GH-4385](https://github.com/hashicorp/consul-k8s/issues/4385)]
* crd: Add `http.incoming.requestNormalization` to the Mesh CRD to support configuring service traffic request normalization. [[GH-4385](https://github.com/hashicorp/consul-k8s/issues/4385)]

IMPROVEMENTS:

* connect-inject: remove unnecessary resource permissions from connect-inject ClusterRole [[GH-4307](https://github.com/hashicorp/consul-k8s/issues/4307)]
* helm: Exclude gke namespaces from being connect-injected when the connect-inject: default: true value is set. [[GH-4333](https://github.com/hashicorp/consul-k8s/issues/4333)]

BUG FIXES:

* api-gateway: `global.imagePullSecrets` are now configured on the `ServiceAccount` for `Gateways`.

Note: the referenced image pull Secret(s) must be present in the same namespace the `Gateway` is deployed to. [[GH-4316](https://github.com/hashicorp/consul-k8s/issues/4316)]
* helm: fix issue where the API Gateway GatewayClassConfig tolerations can not be parsed by the Helm chart. [[GH-4315](https://github.com/hashicorp/consul-k8s/issues/4315)]
* sync-catalog: Enable the user to purge the registered services by passing parent node and necessary filters. [[GH-4255](https://github.com/hashicorp/consul-k8s/issues/4255)]

## 1.4.6 (August 30, 2024)

SECURITY:
Expand Down Expand Up @@ -112,6 +174,23 @@ This ensures that diff detection tools like ArgoCD consider the source and recon

Release redacted, use `1.3.9`

## 1.1.17 (November 4, 2023)

SECURITY:

* Upgrade Go to use 1.22.7. This addresses CVE
[CVE-2024-34155](https://nvd.nist.gov/vuln/detail/CVE-2024-34155) [[GH-4313](https://github.com/hashicorp/consul-k8s/issues/4313)]
* crd: Add `contains` and `ignoreCase` to the Intentions CRD to support configuring L7 Header intentions resilient to variable casing and multiple header values. [[GH-4385](https://github.com/hashicorp/consul-k8s/issues/4385)]
* crd: Add `http.incoming.requestNormalization` to the Mesh CRD to support configuring service traffic request normalization. [[GH-4385](https://github.com/hashicorp/consul-k8s/issues/4385)]

IMPROVEMENTS:

* helm: Exclude gke namespaces from being connect-injected when the connect-inject: default: true value is set. [[GH-4333](https://github.com/hashicorp/consul-k8s/issues/4333)]

BUG FIXES:

* sync-catalog: Enable the user to purge the registered services by passing parent node and necessary filters. [[GH-4255](https://github.com/hashicorp/consul-k8s/issues/4255)]

## 1.1.16 (August 30, 2024)

SECURITY:
Expand Down
5 changes: 5 additions & 0 deletions Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -334,6 +334,11 @@ eks-test-packages: ## eks test packages
aks-test-packages: ## aks test packages
@./control-plane/build-support/scripts/set_test_package_matrix.sh "acceptance/ci-inputs/aks_acceptance_test_packages.yaml"


.PHONY: openshift-test-packages
openshift-test-packages: ## openshift test packages
@./control-plane/build-support/scripts/set_test_package_matrix.sh "acceptance/ci-inputs/openshift_acceptance_test_packages.yaml"

.PHONY: go-mod-tidy
go-mod-tidy: ## Recursively run go mod tidy on all subdirectories
@./control-plane/build-support/scripts/mod_tidy.sh
Expand Down
5 changes: 5 additions & 0 deletions acceptance/ci-inputs/openshift_acceptance_test_packages.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
# Copyright (c) HashiCorp, Inc.
# SPDX-License-Identifier: MPL-2.0

# Cloud package is not included in test suite as it is triggered from a non consul-k8s repo and requires HCP credentials
- {runner: 0, test-packages: "openshift"}
1 change: 1 addition & 0 deletions acceptance/framework/config/config.go
Original file line number Diff line number Diff line change
Expand Up @@ -107,6 +107,7 @@ type TestConfig struct {
UseGKE bool
UseGKEAutopilot bool
UseKind bool
UseOpenshift bool

helmChartPath string
}
Expand Down
8 changes: 7 additions & 1 deletion acceptance/framework/flags/flags.go
Original file line number Diff line number Diff line change
Expand Up @@ -10,8 +10,9 @@ import (
"strings"
"sync"

"github.com/hashicorp/consul-k8s/acceptance/framework/config"
"github.com/hashicorp/go-version"

"github.com/hashicorp/consul-k8s/acceptance/framework/config"
)

type TestFlags struct {
Expand Down Expand Up @@ -57,6 +58,7 @@ type TestFlags struct {
flagUseGKE bool
flagUseGKEAutopilot bool
flagUseKind bool
flagUseOpenshift bool

flagDisablePeering bool

Expand Down Expand Up @@ -154,6 +156,9 @@ func (t *TestFlags) init() {
flag.BoolVar(&t.flagUseKind, "use-kind", false,
"If true, the tests will assume they are running against a local kind cluster(s).")

flag.BoolVar(&t.flagUseOpenshift, "use-openshift", false,
"If true, the tests will assume they are running against an openshift cluster(s).")

flag.BoolVar(&t.flagDisablePeering, "disable-peering", false,
"If true, the peering tests will not run.")

Expand Down Expand Up @@ -246,6 +251,7 @@ func (t *TestFlags) TestConfigFromFlags() *config.TestConfig {
UseGKE: t.flagUseGKE,
UseGKEAutopilot: t.flagUseGKEAutopilot,
UseKind: t.flagUseKind,
UseOpenshift: t.flagUseOpenshift,
}

return c
Expand Down
59 changes: 59 additions & 0 deletions acceptance/tests/fixtures/cases/openshift/basic/backend.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,59 @@
apiVersion: v1
kind: Namespace
metadata:
name: backend
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: backend
namespace: backend
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: backend
namespace: backend
spec:
selector:
matchLabels:
app: backend
replicas: 1
template:
metadata:
labels:
app: backend
annotations:
consul.hashicorp.com/connect-inject: "true"
spec:
serviceAccountName: backend
containers:
- name: backend
image: nicholasjackson/fake-service:v0.26.0
ports:
- containerPort: 8080
env:
- name: LISTEN_ADDR
value: "0.0.0.0:8080"
- name: NAME
value: backend
---
apiVersion: v1
kind: Service
metadata:
name: backend
namespace: backend
spec:
type: ClusterIP
selector:
app: backend
ports:
- port: 8080
---
apiVersion: consul.hashicorp.com/v1alpha1
kind: ServiceDefaults
metadata:
name: backend
namespace: backend
spec:
protocol: http
62 changes: 62 additions & 0 deletions acceptance/tests/fixtures/cases/openshift/basic/frontend.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,62 @@
apiVersion: v1
kind: Namespace
metadata:
name: frontend
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: frontend
namespace: frontend
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: frontend
namespace: frontend
spec:
selector:
matchLabels:
app: frontend
replicas: 1
template:
metadata:
labels:
app: frontend
annotations:
consul.hashicorp.com/connect-inject: "true"
spec:
serviceAccountName: frontend
containers:
- name: frontend
image: nicholasjackson/fake-service:v0.26.0
ports:
- containerPort: 8080
env:
- name: LISTEN_ADDR
value: "0.0.0.0:8080"
- name: NAME
value: frontend
- name: UPSTREAM_URIS
value: 'http://backend.backend:8080'

---
apiVersion: v1
kind: Service
metadata:
name: frontend
namespace: frontend
spec:
type: ClusterIP
selector:
app: frontend
ports:
- port: 8080
---
apiVersion: consul.hashicorp.com/v1alpha1
kind: ServiceDefaults
metadata:
name: frontend
namespace: frontend
spec:
protocol: http
15 changes: 15 additions & 0 deletions acceptance/tests/fixtures/cases/openshift/basic/gateway.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
name: api-gateway
namespace: consul
spec:
gatewayClassName: consul
listeners:
- name: https
protocol: HTTPS
port: 443
tls:
certificateRefs:
- name: consul-server-cert
namespace: consul
23 changes: 23 additions & 0 deletions acceptance/tests/fixtures/cases/openshift/basic/intentions.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
apiVersion: consul.hashicorp.com/v1alpha1
kind: ServiceIntentions
metadata:
name: to-backend-default
namespace: default
spec:
destination:
name: backend
sources:
- name: frontend
action: allow
---
apiVersion: consul.hashicorp.com/v1alpha1
kind: ServiceIntentions
metadata:
name: to-frontend-default
namespace: default
spec:
destination:
name: frontend
sources:
- name: api-gateway
action: allow
30 changes: 30 additions & 0 deletions acceptance/tests/fixtures/cases/openshift/basic/route.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
name: frontend-route-default
namespace: consul
spec:
parentRefs:
- name: api-gateway
rules:
- backendRefs:
- kind: Service
name: frontend
namespace: frontend
port: 8080

---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: ReferenceGrant
metadata:
name: service-grant
namespace: frontend
spec:
from:
- group: gateway.networking.k8s.io
kind: HTTPRoute
namespace: consul
to:
- group: ""
kind: Service
name: frontend
Loading

0 comments on commit 51a5bae

Please sign in to comment.