Connect transparent proxy support #20175
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
tgross
added a commit
that referenced
this pull request
Mar 27, 2024
tgross
added a commit
that referenced
this pull request
Mar 28, 2024
Update the service mesh integration docs to explain how Consul needs to be configured for transparent proxy. Update the walkthrough to assume that `transparent_proxy` mode is the best approach, and move the manually-configured `upstreams` to a separate section for users who don't want to use Consul DNS. Ref: #20175 Ref: #20241
tgross
added a commit
that referenced
this pull request
Apr 3, 2024
Migrate our E2E tests for Connect off the old framework in preparation for writing E2E tests for transparent proxy and the updated workload identity workflow. Mark the tests that cover the legacy Consul token submitted workflow. Ref: #20175
Add a constraint on job submission that requires the `consul-cni` plugin fingerprint whenever transparent proxy is used. Add a validation that the `network.dns` cannot be set when transparent proxy is used, unless the `no_dns` flag is set.
tgross
added a commit
that referenced
this pull request
Apr 5, 2024
Add the `consul-cni` plugin to the Linux AMI for E2E, and add a test case that covers the transparent proxy feature. Ref: #20175
Add the `consul-cni` plugin to the Linux AMI for E2E, and add a test case that covers the transparent proxy feature. Add test assertions to the Connect tests for upstream reachability Ref: #20175
shoenig
reviewed
Apr 9, 2024
shoenig
approved these changes
Apr 9, 2024
The `getPortMapping` method forces callers to handle two different data structures, but only one caller cares about it. We don't want to return a single map or slice because the `cni.PortMapping` object doesn't include a label field that we need for tproxy. Return a new datastructure that closes over both a slice of `cni.PortMapping` and a map of label to index in that slice.
philrenaud
pushed a commit
that referenced
this pull request
Apr 18, 2024
Migrate our E2E tests for Connect off the old framework in preparation for writing E2E tests for transparent proxy and the updated workload identity workflow. Mark the tests that cover the legacy Consul token submitted workflow. Ref: #20175
philrenaud
pushed a commit
that referenced
this pull request
Apr 18, 2024
) Update the service mesh integration docs to explain how Consul needs to be configured for transparent proxy. Update the walkthrough to assume that `transparent_proxy` mode is the best approach, and move the manually-configured `upstreams` to a separate section for users who don't want to use Consul DNS. Ref: #20175 Ref: #20241
philrenaud
pushed a commit
that referenced
this pull request
Apr 18, 2024
philrenaud
pushed a commit
that referenced
this pull request
Apr 18, 2024
Add the `consul-cni` plugin to the Linux AMI for E2E, and add a test case that covers the transparent proxy feature. Add test assertions to the Connect tests for upstream reachability Ref: #20175
|
@tgross Would it be possible to also update the Terraform Nomad provider to utilize the new transparent proxy block? |
|
We typically update the TF provider on GA. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is a feature branch PR for adding support for Consul transparent proxy.
Component PRs, all of which have been previously reviewed:
CNI_ARGSgeneration) tproxy: networking hook changes #20183plugins.cni.version.consul-cniversion tproxy: job submission hooks #20244consul-cniupdates Add support for Nomad transparent proxy consul-k8s#3795consul-cniversion string bug fix fix version output forconsul-cniconsul-k8s#3829 (needed for job endpoint hook PR)transparent_proxyreference docs #20241Fixes: #10628