Caleb Doxsey
7c98e0ae76
xdsmgr: update resource versions on NACK ( #2093 )
2021-04-16 08:23:40 -06:00
Caleb Doxsey
116805acb3
config: rename headers to set_response_headers ( #2081 )
...
* config: rename headers to set_response_headers
* Update config/options.go
Co-authored-by: bobby <1544881+desimone@users.noreply.github.com>
Co-authored-by: bobby <1544881+desimone@users.noreply.github.com>
2021-04-14 11:22:21 -07:00
Caleb Doxsey
f760cdece5
envoyconfig: move most bootstrap config to shared package ( #2088 )
2021-04-14 12:07:49 -06:00
wasaga
c12c0aab49
metrics_address should be optional parameter ( #2087 )
2021-04-13 15:56:35 -04:00
Caleb Doxsey
1dcccf2b56
envoy: refactor controlplane xds to new envoyconfig package ( #2086 )
2021-04-13 13:51:44 -06:00
Caleb Doxsey
6d1d2bec54
crypto: use actual bytes of shared secret, not the base64 encoded representation ( #2075 )
...
* crypto: use actual bytes of shared secret, not the base64 encoded representation
* return errors
* return errors
2021-04-08 20:04:01 -06:00
Caleb Doxsey
aeb8aaf9cd
directory: remove provider from user id ( #2068 )
2021-04-07 15:06:08 -06:00
Caleb Doxsey
a51c7140ea
cryptutil: use bytes for hmac ( #2067 )
2021-04-07 14:57:24 -06:00
wasaga
a935c1ba30
config related metrics ( #2065 )
2021-04-07 12:29:36 -07:00
Caleb Doxsey
294addd857
databroker: remove unused installation id, close streams when backend is closed ( #2062 )
2021-04-06 13:41:19 -06:00
Caleb Doxsey
d8f11dcb91
proxy: support re-proxying request through control plane for kubernetes ( #2051 )
...
* proxy: support re-proxying request from envoy for kubernetes
* encrypt policy id for reproxy, implement tls options
* add comment, use hmac
* use httputil handler and error
* remove reproxy headers on all incoming request
* only allow re-proxying for kubernetes, strip headers
* fix tests
2021-04-06 12:08:09 -06:00
Travis Groth
c7d243d742
proxy: restrict programmatic URLs to localhost ( #2049 )
...
Co-authored-by: Caleb Doxsey <cdoxsey@pomerium.com>
2021-04-01 10:04:49 -04:00
Travis Groth
0635c838c9
authenticate: validate signature on /.pomerium, /.pomerium/sign_in and /.pomerium/sign_out ( #2048 )
...
Co-authored-by: Caleb Doxsey <cdoxsey@pomerium.com>
2021-04-01 10:04:16 -04:00
contrun
c96ff595e5
fix not obtaining correct gitlab url because of empty string ( #2044 )
2021-03-31 11:21:16 -06:00
Caleb Doxsey
d7ab817de7
authorize: add databroker server and record version to result, force sync via polling ( #2024 )
...
* authorize: add databroker server and record version to result, force sync via polling
* wrap inmem store to take read lock when grabbing databroker versions
* address code review comments
* reset max to 0
2021-03-31 10:09:06 -06:00
wasaga
c27cd9030d
support host:port in metrics_address ( #2042 )
2021-03-30 18:54:33 -04:00
Caleb Doxsey
76bc7a7e9a
proxy: add nil check for fix-misdirected ( #2040 )
...
* proxy: add nil check for fix-misdirected
* fix test
2021-03-30 08:22:38 -06:00
wasaga
80c55dd50c
databroker: return server version in Get ( #2039 )
2021-03-29 13:18:38 -04:00
Caleb Doxsey
4cc697ace4
autocert: add metrics for renewal count, total and next expiration ( #2019 )
2021-03-25 08:03:04 -06:00
Caleb Doxsey
e2ebef44ef
telemetry: add installation id ( #2017 )
...
* telemetry: add installation id
* set installation id globally
* remove unneeded changes
2021-03-24 07:22:54 -06:00
Caleb Doxsey
853d2dd478
config: use getters for certificates ( #2001 )
...
* config: use getters for certificates
* update log message
2021-03-23 08:02:50 -06:00
ntoofu
fee4979246
Add xff_num_trusted_hops config option ( #2003 )
...
* Add `xff_num_trusted_hops` config option
* Fix code formatting with gofmt
* Update docs for `xff_num_trusted_hops`
2021-03-22 10:30:20 -06:00
Caleb Doxsey
3690a32855
config: use getters for authenticate, signout and forward auth urls ( #2000 )
2021-03-19 14:49:25 -06:00
Caleb Doxsey
1febaa82ff
envoy: restrict permissions on embedded envoy binary ( #1999 )
2021-03-19 09:51:14 -06:00
Caleb Doxsey
23bc3f979f
config: add headers to config proto ( #1996 )
2021-03-19 08:06:01 -06:00
Caleb Doxsey
21d87f8fdc
xds: use ALPN Auto config for upstream protocol when possible ( #1995 )
2021-03-18 14:25:00 -06:00
Caleb Doxsey
eddabc46c7
envoy: upgrade to v1.17.1 ( #1993 )
2021-03-17 19:32:58 -06:00
Caleb Doxsey
77fe37c8c0
redis: add redis cluster support ( #1992 )
...
* redis: add redis cluster support
* redis: update docs
2021-03-17 13:48:41 -06:00
renovate[bot]
0b1e89925a
fix(deps): update module github.com/prometheus/procfs to v0.6.0 ( #1969 )
2021-03-16 22:03:01 -04:00
Caleb Doxsey
975b56d2d2
redis: add support for redis-sentinel ( #1991 )
...
* redis: add support for redis-sentinel
* try setting hostname
* try using container ips
* try the default network
* use container ip address
2021-03-16 16:45:08 -06:00
wasaga
816fb60b7c
procStat.CPUTime() is already a sum ( #1979 )
2021-03-15 11:43:56 -04:00
Caleb Doxsey
a5731f7d92
identity: infer email from mail claim ( #1977 )
2021-03-12 09:01:21 -07:00
Caleb Doxsey
fd97561ab1
ping: identity and directory providers ( #1975 )
...
* ping: add identity provider
* ping: implement directory provider
* ping, not onelogin
* ping, not onelogin
* escape path params
2021-03-10 16:25:49 -07:00
Caleb Doxsey
7f6107051f
config: add rewrite_response_headers option ( #1961 )
...
* add lua script to rewrite response headers
* add policy config
* update docs
2021-03-05 09:40:17 -07:00
Caleb Doxsey
b6ec01f377
assets: use embed instead of statik ( #1960 )
...
* assets: use embed instead of statik
* remove empty line
* maybe fix precommit
2021-03-03 18:56:55 -07:00
Caleb Doxsey
92c3a4a56c
telemetry: add process collector for envoy ( #1948 )
...
* telemetry: add process collector for envoy
* add test
* maybe fix macos
* address comments
2021-03-03 16:05:35 -07:00
Caleb Doxsey
f396c2a0f7
config: log config source changes ( #1959 )
...
* config: log config source changes
* use internal log import
2021-03-03 09:54:08 -07:00
Caleb Doxsey
664358dfad
config: multiple endpoints for authorize and databroker ( #1957 )
...
* wip
* update docs
* remove dead code
2021-03-03 09:53:19 -07:00
Caleb Doxsey
a825b06014
metrics: add TLS options ( #1939 )
...
* move metrics listener to envoy
* add metrics tls options
* add test
* update docs
* update config proto
* add function to validate metric addr
* fix validation
2021-02-24 09:42:53 -07:00
wasaga
de55199a70
use build_info as liveness gauge metric ( #1940 )
2021-02-24 10:57:31 -05:00
bobby
cdcb65b77c
ci: go 1.16.x, cached tests ( #1937 )
...
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2021-02-23 11:39:52 -08:00
Caleb Doxsey
138df5ae24
identity: record metric for last refresh ( #1936 )
2021-02-23 10:08:01 -07:00
Caleb Doxsey
218acc001b
autocert: remove non-determinism ( #1932 )
...
* autocert: remove non-determinism
* try sorting coverage
2021-02-23 08:56:11 -08:00
bobby
9c7958b66f
middleware: equalize lengths of input ( #1934 )
...
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2021-02-23 08:31:17 -08:00
Caleb Doxsey
8b42eb5ebd
config: add metrics_basic_auth option ( #1917 )
...
* config: add metrics_basic_auth option
* remove println
* use constant time compare
2021-02-22 13:37:18 -07:00
Caleb Doxsey
03d8ffaee2
google: fix default provider URL ( #1928 )
2021-02-22 11:21:16 -07:00
Caleb Doxsey
5d60cff21e
databroker: refactor databroker to sync all changes ( #1879 )
...
* refactor backend, implement encrypted store
* refactor in-memory store
* wip
* wip
* wip
* add syncer test
* fix redis expiry
* fix linting issues
* fix test by skipping non-config records
* fix backoff import
* fix init issues
* fix query
* wait for initial sync before starting directory sync
* add type to SyncLatest
* add more log messages, fix deadlock in in-memory store, always return server version from SyncLatest
* update sync types and tests
* add redis tests
* skip macos in github actions
* add comments to proto
* split getBackend into separate methods
* handle errors in initVersion
* return different error for not found vs other errors in get
* use exponential backoff for redis transaction retry
* rename raw to result
* use context instead of close channel
* store type urls as constants in databroker
* use timestampb instead of ptypes
* fix group merging not waiting
* change locked names
* update GetAll to return latest record version
* add method to grpcutil to get the type url for a protobuf type
2021-02-18 15:24:33 -07:00
Caleb Doxsey
b1871b0f2e
envoy: validate binary checksum ( #1908 )
...
* envoy: validate binary checksum
* address comments
* change to info
* fix order
2021-02-18 15:22:46 -07:00
wasaga
c02223a8f0
fix flaky registry test ( #1911 )
2021-02-17 20:17:42 -05:00
wasaga
d04416a5fd
in-memory service registry ( #1892 )
2021-02-17 14:28:54 -05:00
