Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Backport of Expose JWKS cluster config through JWTProviderConfigEntry into release/1.16.x #18001

Closed
wants to merge 129 commits into from
Closed

Backport of Expose JWKS cluster config through JWTProviderConfigEntry into release/1.16.x #18001

wants to merge 129 commits into from

Conversation

hc-github-team-consul-core
Copy link
Collaborator

Backport

This PR is auto-generated from #17978 to be assessed for backporting due to the inclusion of the label backport/1.16.

🚨

Warning automatic cherry-pick of commits failed. If the first commit failed,
you will see a blank no-op commit below. If at least one commit succeeded, you
will see the cherry-picked commits up to, not including, the commit where
the merge conflict occurred.

The person who merged in the original PR is:
@roncodingenthusiast
This person should manually cherry-pick the original PR into a new backport PR,
and close this one when the manual backport PR is merged in.

merge conflict error: unable to process merge commit: "2fbfac35f7d1e9aab3dcfc635bcf48a5302c3d64", automatic backport requires rebase workflow

The below text is copied from the body of the original PR.

Description

  • Expose remote jwks cluster configuration through jwt-provider config entry to allow users to configure how remote jwks uri s are obtained.
  • We are starting with certs and connect timeout as we deem those are the most important ones currently. We will be adding more fields as we find the demand for this

Testing & Reproduction steps

  • write a jwt provider with jwks cluster
  • get the envoy config dump to ensure the cluster being configured has the right values

TODO

  • follow up this PR with docs
Overview of commits

zalimeni and others added 30 commits June 7, 2023 21:46
@zalimeni
[OSS] Post Consul 1.16 updates (#17606)
1e920a7 
* chore: update dev build to 1.17

* chore(ci): add nightly 1.16 test

Drop the oldest and add the newest running release branch to nightly
builds.
@roncodingenthusiast
Add writeAuditRPCEvent to agent_oss (#17607)
8118aae 
* Add writeAuditRPCEvent to agent_oss

* fix the other diffs

* backport change log
@erichaberkorn
Add Envoy and Consul version constraints to Envoy extensions (#17612)
779647b
[API Gateway] Fix trust domain for external peered services in synthe…
9a4f503 
…sis code (#17609)

* [API Gateway] Fix trust domain for external peered services in synthesis code

* Add changelog
@roncodingenthusiast @zalimeni
backport ent changes to oss (#17614)
17f4689 
* backport ent changes to oss

* Update .changelog/_5669.txt

Co-authored-by: Michael Zalimeni <[email protected]>

---------

Co-authored-by: Michael Zalimeni <[email protected]>
@lkysow
Update intentions.mdx (#17619)
8598288 
Make behaviour of L7 intentions clearer
@roncodingenthusiast
enterprise changelog update for audit (#17625)
7ae457c
@zalimeni
Update list of Envoy versions (#17546)
30e0c23
[API Gateway] Fix rate limiting for API gateways (#17631)
3cb7056 
* [API Gateway] Fix rate limiting for API gateways

* Add changelog

* Fix failing unit tests

* Fix operator usage tests for api package
@rboyer
sort some imports that are wonky between oss and ent (#17637)
ec347ef
@trujillo-adam @boruszak
PmTLS and tproxy improvements with failover and L7 traffic mgmt for k…
5e84674 
…8s (#17624)

* porting over changes from enterprise repo to oss

* applied feedback on service mesh for k8s overview

* fixed typo

* removed ent-only build script file

* Apply suggestions from code review

Co-authored-by: Jeff Boruszak <[email protected]>

* Apply suggestions from code review

Co-authored-by: David Yu <[email protected]>
Co-authored-by: Jeff Boruszak <[email protected]>

---------

Co-authored-by: Jeff Boruszak <[email protected]>
Co-authored-by: David Yu <[email protected]>
Delete check-legacy-links-format.yml (#17647)
b1d3ec0
@trujillo-adam
docs: Reference doc updates for permissive mTLS settings (#17371)
809c188 
* Reference doc updates for permissive mTLS settings
* Document config entry filtering
* Fix minor doc errors (double slashes in link url paths)

---------

Co-authored-by: trujillo-adam <[email protected]>
@mkeeler
Add generic experiments configuration and use it to enable catalog v2…
baaf6d8 
… resources (#17604)

* Add generic experiments configuration and use it to enable catalog v2 resources

* Run formatting with -s as CI will validate that this has been done
@nathancoleman
api-gateway: stop adding all header filters to virtual host when gene…
1074252 
…rating xDS (#17644)

* Add header filter to api-gateway xDS golden test

* Stop adding all header filters to virtual host when generating xDS for api-gateway

* Regenerate xDS golden file for api-gateway w/ header filter
@JadhavPoonam
fix: add agent info reporting log (#17654)
f8d3721
@im2nguyen @trujillo-adam
Add new Consul 1.16 docs (#17651)
862e78f 
* Merge pull request #5773 from hashicorp/docs/rate-limiting-from-ip-addresses-1.16

updated docs for rate limiting for IP addresses - 1.16

* Merge pull request #5609 from hashicorp/docs/enterprise-utilization-reporting

Add docs for enterprise utilization reporting

* Merge pull request #5734 from hashicorp/docs/envoy-ext-1.16

Docs/envoy ext 1.16

* Merge pull request #5773 from hashicorp/docs/rate-limiting-from-ip-addresses-1.16

updated docs for rate limiting for IP addresses - 1.16

* Merge pull request #5609 from hashicorp/docs/enterprise-utilization-reporting

Add docs for enterprise utilization reporting

* Merge pull request #5734 from hashicorp/docs/envoy-ext-1.16

Docs/envoy ext 1.16

* fix build errors

---------

Co-authored-by: trujillo-adam <[email protected]>
@cthain
Default ProxyType for builtin extensions (#17657)
c04c122
@zalimeni
Post 1.16.0-rc1 updates (#17663)
446a640 
- Update changelog to include new entries from release
- Update submodule versions to latest published
@ramramhariram
Update service-defaults.mdx (#17656)
290ba0e
@boruszak @sfarkas-hashicorp @trujillo-adam
docs: Sameness Groups (#17628)
ef77f9a 
* port from enterprise branch

* Apply suggestions from code review

Co-authored-by: shanafarkas <[email protected]>

* Update website/content/docs/connect/cluster-peering/usage/create-sameness-groups.mdx

* next steps

* Update website/content/docs/connect/cluster-peering/usage/create-sameness-groups.mdx

Co-authored-by: trujillo-adam <[email protected]>

* Update website/content/docs/k8s/connect/cluster-peering/usage/create-sameness-groups.mdx

Co-authored-by: trujillo-adam <[email protected]>

---------

Co-authored-by: shanafarkas <[email protected]>
Co-authored-by: trujillo-adam <[email protected]>
Remove "BETA" marker from config entries (#17670)
c384f24
@trujillo-adam @boruszak @Jeff-Apple
CAPIgw for K8s installation updates for 1.16 (#17627)
27206d9 
* trimmed CRD step and reqs from installation

* updated tech specs

* Apply suggestions from code review

Co-authored-by: Jeff Boruszak <[email protected]>
Co-authored-by: Jeff Apple <[email protected]>

* added upgrade instruction

* removed tcp port req

* described downtime and DT-less upgrades

* applied additional review feedback

---------

Co-authored-by: Jeff Boruszak <[email protected]>
Co-authored-by: Jeff Apple <[email protected]>
@trujillo-adam @Jeff-Apple
additional feedback on API gateway upgrades (#17677)
b678742 
* additional feedback

* Update website/content/docs/api-gateway/upgrades.mdx

Co-authored-by: Jeff Apple <[email protected]>

---------

Co-authored-by: Jeff Apple <[email protected]>
@boruszak @trujillo-adam
docs: JWT Authorization for intentions (#17643)
66704e5 
* Initial page/nav creation

* configuration entry reference page

* Usage + fixes

* service intentions page

* usage

* description

* config entry updates

* formatting fixes

* Update website/content/docs/connect/config-entries/service-intentions.mdx

Co-authored-by: Paul Glass <[email protected]>

* service intentions review fixes

* Overview page review fixes

* Apply suggestions from code review

Co-authored-by: trujillo-adam <[email protected]>

---------

Co-authored-by: Paul Glass <[email protected]>
Co-authored-by: trujillo-adam <[email protected]>
@boruszak
docs: minor fixes to JWT auth docs (#17680)
37a13dc 
* Fixes

* service intentions fixes
Fix two WAL metrics in docs/agent/telemetry.mdx (#17593)
28d81ec
@trujillo-adam
updated failover for k8s w-tproxy page title (#17683)
0ddafcf
@im2nguyen @trujillo-adam
@boruszak @Jeff-Apple
Add release notes 1.16 rc (#17665)
3a8fc61 
* Merge pull request #5773 from hashicorp/docs/rate-limiting-from-ip-addresses-1.16

updated docs for rate limiting for IP addresses - 1.16

* Merge pull request #5609 from hashicorp/docs/enterprise-utilization-reporting

Add docs for enterprise utilization reporting

* Merge pull request #5734 from hashicorp/docs/envoy-ext-1.16

Docs/envoy ext 1.16

* Add release notes for 1.16-rc

* Add consul-e license utlization reporting

* Update with rc absolute links

* Update with rc absolute links

* fix typo

* Apply suggestions from code review

Co-authored-by: trujillo-adam <[email protected]>

* Update to use callout component

* address typo

* docs: FIPS 140-2 Compliance (#17668)

* Page + nav + formatting

* link fix

* Update website/content/docs/enterprise/fips.mdx

Co-authored-by: trujillo-adam <[email protected]>

* Update website/content/docs/enterprise/fips.mdx

Co-authored-by: trujillo-adam <[email protected]>

* Update website/content/docs/enterprise/fips.mdx

Co-authored-by: trujillo-adam <[email protected]>

* Update website/content/docs/enterprise/fips.mdx

Co-authored-by: trujillo-adam <[email protected]>

* Update website/content/docs/enterprise/fips.mdx

Co-authored-by: trujillo-adam <[email protected]>

* Update website/content/docs/enterprise/fips.mdx

Co-authored-by: trujillo-adam <[email protected]>

* Update website/content/docs/enterprise/fips.mdx

Co-authored-by: trujillo-adam <[email protected]>

* Update website/content/docs/enterprise/fips.mdx

Co-authored-by: trujillo-adam <[email protected]>

* Update website/content/docs/enterprise/fips.mdx

Co-authored-by: trujillo-adam <[email protected]>

* Update website/content/docs/enterprise/fips.mdx

Co-authored-by: trujillo-adam <[email protected]>

* link fix

* Apply suggestions from code review

Co-authored-by: Jeff Apple <[email protected]>

* Update website/content/docs/enterprise/fips.mdx

---------

Co-authored-by: trujillo-adam <[email protected]>
Co-authored-by: Jeff Apple <[email protected]>

* fix apigw install values file

* fix typos in release notes

---------

Co-authored-by: trujillo-adam <[email protected]>
Co-authored-by: Jeff Boruszak <[email protected]>
Co-authored-by: Jeff Apple <[email protected]>
@im2nguyen
fix release notes links (#17687)
421e9d8
Ranjandas and others added 14 commits June 29, 2023 14:24
@Ranjandas
Fixes Secondary ConnectCA update (#17846)
1b1f33f 
This fixes a bug that was identified which resulted in subsequent
ConnectCA configuration update not to persist in the cluster.
@jm96441n
fixing typo in link to jwt-validations-with-intentions doc (#17955)
a60b363
Fix streaming backend link (#17958)
85b78fe 
* Fix streaming backend link
* Update health.mdx
@roncodingenthusiast
Dynamically create jwks clusters for jwt-providers (#17944)
1512ea3
@loshz
website: remove deprecated agent rpc docs (#17962)
f7305b2
@hashi-derek
Fix missing BalanceOutboundConnections in v2 catalog. (#17964)
2736e64
@absolutelightning
feature - [NET - 4005] - [Supportability] Reloadable Configuration - …
2af6bc4 
…enable_debug (#17565)

* # This is a combination of 9 commits.
# This is the 1st commit message:

init without tests

# This is the commit message #2:

change log

# This is the commit message #3:

fix tests

# This is the commit message #4:

fix tests

# This is the commit message #5:

added tests

# This is the commit message #6:

change log breaking change

# This is the commit message #7:

removed breaking change

# This is the commit message #8:

fix test

# This is the commit message #9:

keeping the test behaviour same

* # This is a combination of 12 commits.
# This is the 1st commit message:

init without tests

# This is the commit message #2:

change log

# This is the commit message #3:

fix tests

# This is the commit message #4:

fix tests

# This is the commit message #5:

added tests

# This is the commit message #6:

change log breaking change

# This is the commit message #7:

removed breaking change

# This is the commit message #8:

fix test

# This is the commit message #9:

keeping the test behaviour same

# This is the commit message #10:

made enable debug atomic bool

# This is the commit message #11:

fix lint

# This is the commit message #12:

fix test true enable debug

* parent 10f500e
author absolutelightning <[email protected]> 1687352587 +0530
committer absolutelightning <[email protected]> 1687352592 +0530

init without tests

change log

fix tests

fix tests

added tests

change log breaking change

removed breaking change

fix test

keeping the test behaviour same

made enable debug atomic bool

fix lint

fix test true enable debug

using enable debug in agent as atomic bool

test fixes

fix tests

fix tests

added update on correct locaiton

fix tests

fix reloadable config enable debug

fix tests

fix init and acl 403

* revert commit
@im2nguyen
Fix formatting codeblocks on APIgw docs (#17970)
5b7f360 
* fix formatting codeblocks

* remove unnecessary indents
Remove POC code (#17974)
50a9d1b
@xwa153
update doc (#17910)
9ce89c4 
* update doc

* update link
@roncodingenthusiast
Expose JWKS cluster config through JWTProviderConfigEntry
34b3f87
@roncodingenthusiast
backport of commit 34b3f87
582c59c
@hc-github-team-consul-core
Merge 34b3f87 into backport/issue-17886-expose-certs/definitely-wise-…
b08589a 
…sturgeon
@roncodingenthusiast
backport of commit 84b6f80
2fdbaca
@hc-github-team-consul-core hc-github-team-consul-core force-pushed the backport/issue-17886-expose-certs/definitely-wise-sturgeon branch from eb2817b to 6efe3dc Compare July 4, 2023 13:12
@hc-github-team-consul-core hc-github-team-consul-core force-pushed the backport/issue-17886-expose-certs/definitely-wise-sturgeon branch from 4792d11 to 2fdbaca Compare July 4, 2023 13:12
github-team-consul-core-pr-approver
github-team-consul-core-pr-approver approved these changes Jul 4, 2023
View reviewed changes
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Auto approved Consul Bot automated PR

@github-actions github-actions bot added type/docs Documentation needs to be created/updated/clarified theme/api Relating to the HTTP API interface theme/cli Flags and documentation for the CLI interface theme/config Relating to Consul Agent configuration, including reloading type/ci Relating to continuous integration (CI) tooling for testing or releases pr/dependencies PR specifically updates dependencies of project theme/envoy/xds Related to Envoy support theme/contributing Additions and enhancements to community contributing materials labels Jul 4, 2023
@roncodingenthusiast roncodingenthusiast mentioned this pull request Jul 4, 2023
Merged
1 task
@roncodingenthusiast
Copy link
Contributor

Manually re-opened this so closing this backport

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@github-team-consul-core-pr-approver github-team-consul-core-pr-approver github-team-consul-core-pr-approver approved these changes

@roncodingenthusiast roncodingenthusiast Awaiting requested review from roncodingenthusiast

Assignees

@roncodingenthusiast roncodingenthusiast

Labels
pr/dependencies PR specifically updates dependencies of project theme/api Relating to the HTTP API interface theme/cli Flags and documentation for the CLI interface theme/config Relating to Consul Agent configuration, including reloading theme/contributing Additions and enhancements to community contributing materials theme/envoy/xds Related to Envoy support type/ci Relating to continuous integration (CI) tooling for testing or releases type/docs Documentation needs to be created/updated/clarified
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.