Commit graph

17 commits

Author SHA1 Message Date
Kenneth Jenkins
c7c2087483
envoy: enable TCP keepalive for internal clusters (#4902)
In split service mode, and during periods of inactivity, the gRPC
connections to the databroker may fall idle. Some network firewalls may
eventually time out an idle TCP connection and even start dropping
subsequent packets once connection traffic resumes. Combined with Linux
default TCP retransmission settings, this could cause a broken
connection to persist for over 15 minutes.

In an attempt to avoid this scenario, enable TCP keepalive for outbound
gRPC connections, matching the Go standard library default settings for
time & interval: 15 seconds for both. (The probe count does not appear
to be set, so it will remain at the OS default.)

Add a test case exercising the BuildClusters() method with the default
configuration options, comparing the results with a reference "golden"
file in the testdata directory. Also add an '-update' flag to make it
easier to update the reference golden when needed:

  go test ./config/envoyconfig -update
2024-01-11 09:12:45 -08:00
Caleb Doxsey
fd8cb18c44
core/filemgr: use xxhash instead of sha512 for filenames (#4697) 2023-11-01 13:52:32 -06:00
Caleb Doxsey
b50d5f3203
config: add additional dns lookup families, default to V4_PREFERRED (#3957) 2023-02-10 16:29:23 -07:00
Denis Mishin
488bcd6f72
auto tls (#3856) 2023-01-05 16:35:58 -05:00
Caleb Doxsey
cef6b355ae
config: add option for tls renegotiation (#3773)
config: add option for tls renogotiation
2022-11-28 14:34:06 -07:00
Caleb Doxsey
4d38da94dd
envoy: upgrade to 1.23.0 (#3560)
* envoy: upgrade to 1.23.0

* only set ipv4_compat if :: or an ipv4in6 address

* fix tests
2022-08-22 15:03:29 -06:00
Caleb Doxsey
b79f1e379f
config: add support for downstream TLS server name (#3243)
* config: add support for downstream TLS server name

* fix whitespace

* fix whitespace

* add docs

* add tls_upstream_server_name and tls_downstream_server_name to config

* Update docs/reference/settings.yaml

Co-authored-by: Alex Fornuto <afornuto@pomerium.com>

* Update docs/reference/readme.md

Co-authored-by: Alex Fornuto <afornuto@pomerium.com>

* add deprecation notice

Co-authored-by: Alex Fornuto <afornuto@pomerium.com>
2022-04-06 06:48:45 -07:00
Caleb Doxsey
b435f73e2b
authenticate: fix debug and metrics endpoints (#3212) 2022-03-30 09:37:37 -06:00
Caleb Doxsey
d6bd2d06ef
envoy: upgrade to 1.21.1 (#3186)
* envoy: upgrade to 1.21.1

* envoy: upgrade to 1.21.1
2022-03-24 10:16:07 -06:00
Caleb Doxsey
bd0a5389bf
envoy: add support for bind_config bootstrap options (#2772)
* envoy: add support for bind_config bootstrap options

* only add upstream bind config options to individual policy clusters

* update docs for new Envoy keys

Co-authored-by: alexfornuto <alex@fornuto.com>
2021-12-01 13:02:49 -07:00
Caleb Doxsey
3026efb5af
envoyconfig: improvements (#2402)
* add alpn function

* add comment

* address PR feedback
2021-07-27 16:44:15 -06:00
Caleb Doxsey
1c627e5724
disable http/2 for websockets (#2399) 2021-07-26 20:09:18 -06:00
Caleb Doxsey
9b61d04dd8
envoyconfig: fallback to global custom ca when no policy ca is defined (#2235)
* envoyconfig: fallback to global custom ca when no policy ca is defined

* update upgrading

* combine custom ca with root cas
2021-05-28 09:36:15 -06:00
bobby
27c8cd9bd8
proxy / controplane: use old upstream cipher suite (#2196) 2021-05-12 15:37:20 -07:00
Caleb Doxsey
22f6a2207b
envoy: re-implement recommended defaults (#2123) 2021-04-23 14:54:13 -06:00
wasaga
e0c09a0998
log context (#2107) 2021-04-22 10:58:13 -04:00
Caleb Doxsey
1dcccf2b56
envoy: refactor controlplane xds to new envoyconfig package (#2086) 2021-04-13 13:51:44 -06:00
Renamed from internal/controlplane/xds_cluster_test.go (Browse further)