diff --git a/.changelog/3873.txt b/.changelog/3873.txt new file mode 100644 index 0000000000..e4c36d5e58 --- /dev/null +++ b/.changelog/3873.txt @@ -0,0 +1,3 @@ +```release-note:improvement +ConfigEntries controller: Only error for config entries from different datacenters when the config entries are different +``` \ No newline at end of file diff --git a/CHANGELOG.md b/CHANGELOG.md index a8fc92156d..54058ce9d9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,150 @@ +## 1.4.1 (March 28, 2024) + +SECURITY: + +* Update `google.golang.org/protobuf` to v1.33.0 to address [CVE-2024-24786](https://nvd.nist.gov/vuln/detail/CVE-2024-24786). [[GH-3719](https://github.com/hashicorp/consul-k8s/issues/3719)] +* Update the Consul Build Go base image to `alpine3.19`. This resolves CVEs +[CVE-2023-52425](https://nvd.nist.gov/vuln/detail/CVE-2023-52425) +[CVE-2023-52426⁠](https://nvd.nist.gov/vuln/detail/CVE-2023-52426) [[GH-3741](https://github.com/hashicorp/consul-k8s/issues/3741)] +* Upgrade to use Go `1.21.8`. This resolves CVEs +[CVE-2024-24783](https://nvd.nist.gov/vuln/detail/CVE-2024-24783) (`crypto/x509`). +[CVE-2023-45290](https://nvd.nist.gov/vuln/detail/CVE-2023-45290) (`net/http`). +[CVE-2023-45289](https://nvd.nist.gov/vuln/detail/CVE-2023-45289) (`net/http`, `net/http/cookiejar`). +[CVE-2024-24785](https://nvd.nist.gov/vuln/detail/CVE-2024-24785) (`html/template`). +[CVE-2024-24784](https://nvd.nist.gov/vuln/detail/CVE-2024-24784) (`net/mail`). [[GH-3741](https://github.com/hashicorp/consul-k8s/issues/3741)] + +IMPROVEMENTS: + +* api-gateway: Expose prometheus scrape metrics on api-gateway pods. [[GH-3811](https://github.com/hashicorp/consul-k8s/issues/3811)] +* catalog: Topology zone and region information is now read from the Kubernetes endpoints and associated node and added to registered consul services under Metadata. [[GH-3693](https://github.com/hashicorp/consul-k8s/issues/3693)] + +BUG FIXES: + +* api-gateway: Fix order of initialization for creating ACL role/policy to avoid error logs in consul. [[GH-3779](https://github.com/hashicorp/consul-k8s/issues/3779)] +* control-plane: fix an issue where ACL token cleanup did not respect a pod's GracefulShutdownPeriodSeconds and +tokens were invalidated immediately on pod entering Terminating state. [[GH-3736](https://github.com/hashicorp/consul-k8s/issues/3736)] +* control-plane: fix an issue where ACL tokens would prematurely be deleted and services would be deregistered if there +was a K8s API error fetching the pod. [[GH-3758](https://github.com/hashicorp/consul-k8s/issues/3758)] + +## 1.3.4 (March 28, 2024) + +SECURITY: + +* Update `google.golang.org/protobuf` to v1.33.0 to address [CVE-2024-24786](https://nvd.nist.gov/vuln/detail/CVE-2024-24786). [[GH-3719](https://github.com/hashicorp/consul-k8s/issues/3719)] +* Update the Consul Build Go base image to `alpine3.19`. This resolves CVEs +[CVE-2023-52425](https://nvd.nist.gov/vuln/detail/CVE-2023-52425) +[CVE-2023-52426⁠](https://nvd.nist.gov/vuln/detail/CVE-2023-52426) [[GH-3741](https://github.com/hashicorp/consul-k8s/issues/3741)] +* Upgrade `helm/v3` to 3.11.3. This resolves the following security vulnerabilities: +[CVE-2023-25165](https://osv.dev/vulnerability/CVE-2023-25165) +[CVE-2022-23524](https://osv.dev/vulnerability/CVE-2022-23524) +[CVE-2022-23526](https://osv.dev/vulnerability/CVE-2022-23526) +[CVE-2022-23525](https://osv.dev/vulnerability/CVE-2022-23525) [[GH-3625](https://github.com/hashicorp/consul-k8s/issues/3625)] +* Upgrade docker/distribution to 2.8.3+incompatible (latest) to resolve [CVE-2023-2253](https://osv.dev/vulnerability/CVE-2023-2253). [[GH-3625](https://github.com/hashicorp/consul-k8s/issues/3625)] +* Upgrade docker/docker to 25.0.3+incompatible (latest) to resolve [GHSA-jq35-85cj-fj4p](https://osv.dev/vulnerability/GHSA-jq35-85cj-fj4p). [[GH-3625](https://github.com/hashicorp/consul-k8s/issues/3625)] +* Upgrade filepath-securejoin to 0.2.4 (latest) to resolve [GO-2023-2048](https://osv.dev/vulnerability/GO-2023-2048). [[GH-3625](https://github.com/hashicorp/consul-k8s/issues/3625)] +* Upgrade to use Go `1.21.8`. This resolves CVEs +[CVE-2024-24783](https://nvd.nist.gov/vuln/detail/CVE-2024-24783) (`crypto/x509`). +[CVE-2023-45290](https://nvd.nist.gov/vuln/detail/CVE-2023-45290) (`net/http`). +[CVE-2023-45289](https://nvd.nist.gov/vuln/detail/CVE-2023-45289) (`net/http`, `net/http/cookiejar`). +[CVE-2024-24785](https://nvd.nist.gov/vuln/detail/CVE-2024-24785) (`html/template`). +[CVE-2024-24784](https://nvd.nist.gov/vuln/detail/CVE-2024-24784) (`net/mail`). [[GH-3741](https://github.com/hashicorp/consul-k8s/issues/3741)] +* security: upgrade containerd to 1.7.13 (latest) to resolve [GHSA-7ww5-4wqc-m92c](https://osv.dev/vulnerability/GO-2023-2412). [[GH-3625](https://github.com/hashicorp/consul-k8s/issues/3625)] + +IMPROVEMENTS: + +* catalog: Topology zone and region information is now read from the Kubernetes endpoints and associated node and added to registered consul services under Metadata. [[GH-3693](https://github.com/hashicorp/consul-k8s/issues/3693)] +* control-plane: publish `consul-k8s-control-plane` and `consul-k8s-control-plane-fips` images to official HashiCorp AWS ECR. [[GH-3668](https://github.com/hashicorp/consul-k8s/issues/3668)] + +BUG FIXES: + +* api-gateway: Fix order of initialization for creating ACL role/policy to avoid error logs in consul. [[GH-3779](https://github.com/hashicorp/consul-k8s/issues/3779)] +* control-plane: fix an issue where ACL token cleanup did not respect a pod's GracefulShutdownPeriodSeconds and +tokens were invalidated immediately on pod entering Terminating state. [[GH-3736](https://github.com/hashicorp/consul-k8s/issues/3736)] +* control-plane: fix an issue where ACL tokens would prematurely be deleted and services would be deregistered if there +was a K8s API error fetching the pod. [[GH-3758](https://github.com/hashicorp/consul-k8s/issues/3758)] + +NOTES: + +* build: Releases will now also be available as Debian and RPM packages for the arm64 architecture, refer to the +[Official Packaging Guide](https://www.hashicorp.com/official-packaging-guide) for more information. [[GH-3428](https://github.com/hashicorp/consul-k8s/issues/3428)] + +## 1.2.7 (March 28, 2024) + +SECURITY: + +* Update `google.golang.org/protobuf` to v1.33.0 to address [CVE-2024-24786](https://nvd.nist.gov/vuln/detail/CVE-2024-24786). [[GH-3719](https://github.com/hashicorp/consul-k8s/issues/3719)] +* Update the Consul Build Go base image to `alpine3.19`. This resolves CVEs +[CVE-2023-52425](https://nvd.nist.gov/vuln/detail/CVE-2023-52425) +[CVE-2023-52426⁠](https://nvd.nist.gov/vuln/detail/CVE-2023-52426) [[GH-3741](https://github.com/hashicorp/consul-k8s/issues/3741)] +* Upgrade `helm/v3` to 3.11.3. This resolves the following security vulnerabilities: +[CVE-2023-25165](https://osv.dev/vulnerability/CVE-2023-25165) +[CVE-2022-23524](https://osv.dev/vulnerability/CVE-2022-23524) +[CVE-2022-23526](https://osv.dev/vulnerability/CVE-2022-23526) +[CVE-2022-23525](https://osv.dev/vulnerability/CVE-2022-23525) [[GH-3625](https://github.com/hashicorp/consul-k8s/issues/3625)] +* Upgrade docker/distribution to 2.8.3+incompatible (latest) to resolve [CVE-2023-2253](https://osv.dev/vulnerability/CVE-2023-2253). [[GH-3625](https://github.com/hashicorp/consul-k8s/issues/3625)] +* Upgrade docker/docker to 25.0.3+incompatible (latest) to resolve [GHSA-jq35-85cj-fj4p](https://osv.dev/vulnerability/GHSA-jq35-85cj-fj4p). [[GH-3625](https://github.com/hashicorp/consul-k8s/issues/3625)] +* Upgrade filepath-securejoin to 0.2.4 (latest) to resolve [GO-2023-2048](https://osv.dev/vulnerability/GO-2023-2048). [[GH-3625](https://github.com/hashicorp/consul-k8s/issues/3625)] +* Upgrade to use Go `1.21.8`. This resolves CVEs +[CVE-2024-24783](https://nvd.nist.gov/vuln/detail/CVE-2024-24783) (`crypto/x509`). +[CVE-2023-45290](https://nvd.nist.gov/vuln/detail/CVE-2023-45290) (`net/http`). +[CVE-2023-45289](https://nvd.nist.gov/vuln/detail/CVE-2023-45289) (`net/http`, `net/http/cookiejar`). +[CVE-2024-24785](https://nvd.nist.gov/vuln/detail/CVE-2024-24785) (`html/template`). +[CVE-2024-24784](https://nvd.nist.gov/vuln/detail/CVE-2024-24784) (`net/mail`). [[GH-3741](https://github.com/hashicorp/consul-k8s/issues/3741)] +* security: upgrade containerd to 1.7.13 (latest) to resolve [GHSA-7ww5-4wqc-m92c](https://osv.dev/vulnerability/GO-2023-2412). [[GH-3625](https://github.com/hashicorp/consul-k8s/issues/3625)] + +IMPROVEMENTS: + +* catalog: Topology zone and region information is now read from the Kubernetes endpoints and associated node and added to registered consul services under Metadata. [[GH-3693](https://github.com/hashicorp/consul-k8s/issues/3693)] +* control-plane: publish `consul-k8s-control-plane` and `consul-k8s-control-plane-fips` images to official HashiCorp AWS ECR. [[GH-3668](https://github.com/hashicorp/consul-k8s/issues/3668)] + +BUG FIXES: + +* api-gateway: Fix order of initialization for creating ACL role/policy to avoid error logs in consul. [[GH-3779](https://github.com/hashicorp/consul-k8s/issues/3779)] +* control-plane: fix an issue where ACL token cleanup did not respect a pod's GracefulShutdownPeriodSeconds and +tokens were invalidated immediately on pod entering Terminating state. [[GH-3736](https://github.com/hashicorp/consul-k8s/issues/3736)] +* control-plane: fix an issue where ACL tokens would prematurely be deleted and services would be deregistered if there +was a K8s API error fetching the pod. [[GH-3758](https://github.com/hashicorp/consul-k8s/issues/3758)] + +NOTES: + +* build: Releases will now also be available as Debian and RPM packages for the arm64 architecture, refer to the +[Official Packaging Guide](https://www.hashicorp.com/official-packaging-guide) for more information. [[GH-3428](https://github.com/hashicorp/consul-k8s/issues/3428)] + +## 1.1.11 (March 28, 2024) + +SECURITY: + +* Update `google.golang.org/protobuf` to v1.33.0 to address [CVE-2024-24786](https://nvd.nist.gov/vuln/detail/CVE-2024-24786). [[GH-3719](https://github.com/hashicorp/consul-k8s/issues/3719)] +* Update the Consul Build Go base image to `alpine3.19`. This resolves CVEs +[CVE-2023-52425](https://nvd.nist.gov/vuln/detail/CVE-2023-52425) +[CVE-2023-52426⁠](https://nvd.nist.gov/vuln/detail/CVE-2023-52426) [[GH-3741](https://github.com/hashicorp/consul-k8s/issues/3741)] +* Upgrade `helm/v3` to 3.11.3. This resolves the following security vulnerabilities: +[CVE-2023-25165](https://osv.dev/vulnerability/CVE-2023-25165) +[CVE-2022-23524](https://osv.dev/vulnerability/CVE-2022-23524) +[CVE-2022-23526](https://osv.dev/vulnerability/CVE-2022-23526) +[CVE-2022-23525](https://osv.dev/vulnerability/CVE-2022-23525) [[GH-3625](https://github.com/hashicorp/consul-k8s/issues/3625)] +* Upgrade docker/distribution to 2.8.3+incompatible (latest) to resolve [CVE-2023-2253](https://osv.dev/vulnerability/CVE-2023-2253). [[GH-3625](https://github.com/hashicorp/consul-k8s/issues/3625)] +* Upgrade docker/docker to 25.0.3+incompatible (latest) to resolve [GHSA-jq35-85cj-fj4p](https://osv.dev/vulnerability/GHSA-jq35-85cj-fj4p). [[GH-3625](https://github.com/hashicorp/consul-k8s/issues/3625)] +* Upgrade filepath-securejoin to 0.2.4 (latest) to resolve [GO-2023-2048](https://osv.dev/vulnerability/GO-2023-2048). [[GH-3625](https://github.com/hashicorp/consul-k8s/issues/3625)] +* Upgrade to use Go `1.21.8`. This resolves CVEs +[CVE-2024-24783](https://nvd.nist.gov/vuln/detail/CVE-2024-24783) (`crypto/x509`). +[CVE-2023-45290](https://nvd.nist.gov/vuln/detail/CVE-2023-45290) (`net/http`). +[CVE-2023-45289](https://nvd.nist.gov/vuln/detail/CVE-2023-45289) (`net/http`, `net/http/cookiejar`). +[CVE-2024-24785](https://nvd.nist.gov/vuln/detail/CVE-2024-24785) (`html/template`). +[CVE-2024-24784](https://nvd.nist.gov/vuln/detail/CVE-2024-24784) (`net/mail`). [[GH-3741](https://github.com/hashicorp/consul-k8s/issues/3741)] +* security: upgrade containerd to 1.7.13 (latest) to resolve [GHSA-7ww5-4wqc-m92c](https://osv.dev/vulnerability/GO-2023-2412). [[GH-3625](https://github.com/hashicorp/consul-k8s/issues/3625)] + +IMPROVEMENTS: + +* control-plane: publish `consul-k8s-control-plane` and `consul-k8s-control-plane-fips` images to official HashiCorp AWS ECR. [[GH-3668](https://github.com/hashicorp/consul-k8s/issues/3668)] + +BUG FIXES: + +* control-plane: fix an issue where ACL token cleanup did not respect a pod's GracefulShutdownPeriodSeconds and +tokens were invalidated immediately on pod entering Terminating state. [[GH-3736](https://github.com/hashicorp/consul-k8s/issues/3736)] +* control-plane: fix an issue where ACL tokens would prematurely be deleted and services would be deregistered if there +was a K8s API error fetching the pod. [[GH-3758](https://github.com/hashicorp/consul-k8s/issues/3758)] + ## 1.4.0 (February 29, 2024) > NOTE: Consul K8s 1.4.x is compatible with Consul 1.18.x and Consul Dataplane 1.4.x. Refer to our [compatibility matrix](https://developer.hashicorp.com/consul/docs/k8s/compatibility) for more info. diff --git a/control-plane/controllers/configentries/configentry_controller.go b/control-plane/controllers/configentries/configentry_controller.go index 9e9459308f..dc68aea619 100644 --- a/control-plane/controllers/configentries/configentry_controller.go +++ b/control-plane/controllers/configentries/configentry_controller.go @@ -183,7 +183,7 @@ func (r *ConfigEntryController) ReconcileEntry(ctx context.Context, crdCtrl Cont } // Check to see if consul has config entry with the same name - entry, _, err := consulClient.ConfigEntries().Get(configEntry.ConsulKind(), configEntry.ConsulName(), &capi.QueryOptions{ + entryFromConsul, _, err := consulClient.ConfigEntries().Get(configEntry.ConsulKind(), configEntry.ConsulName(), &capi.QueryOptions{ Namespace: r.consulNamespace(consulEntry, configEntry.ConsulMirroringNS(), configEntry.ConsulGlobalResource()), }) // If a config entry with this name does not exist @@ -223,37 +223,31 @@ func (r *ConfigEntryController) ReconcileEntry(ctx context.Context, crdCtrl Cont return r.syncFailed(ctx, logger, crdCtrl, configEntry, ConsulAgentError, err) } - requiresMigration := false - sourceDatacenter := entry.GetMeta()[common.DatacenterKey] - + sourceDatacenter := entryFromConsul.GetMeta()[common.DatacenterKey] + managedByThisDC := sourceDatacenter == r.DatacenterName // Check if the config entry is managed by our datacenter. // Do not process resource if the entry was not created within our datacenter // as it was created in a different cluster which will be managing that config entry. - if sourceDatacenter != r.DatacenterName { - - // Note that there is a special case where we will migrate a config entry - // that wasn't created by the controller if it has the migrate-entry annotation set to true. - // This functionality exists to help folks who are upgrading from older helm - // chart versions where they had previously created config entries themselves but - // now want to manage them through custom resources. - if configEntry.GetObjectMeta().Annotations[common.MigrateEntryKey] != common.MigrateEntryTrue { - return r.syncFailed(ctx, logger, crdCtrl, configEntry, ExternallyManagedConfigError, - sourceDatacenterMismatchErr(sourceDatacenter)) - } - - requiresMigration = true - } - - if !configEntry.MatchesConsul(entry) { - if requiresMigration { - // If we're migrating this config entry but the custom resource - // doesn't match what's in Consul currently we error out so that - // it doesn't overwrite something accidentally. - return r.syncFailed(ctx, logger, crdCtrl, configEntry, MigrationFailedError, - r.nonMatchingMigrationError(configEntry, entry)) - } - - logger.Info("config entry does not match consul", "modify-index", entry.GetModifyIndex()) + matchesConsul := configEntry.MatchesConsul(entryFromConsul) + // Note that there is a special case where we will migrate a config entry + // that wasn't created by the controller if it has the migrate-entry annotation set to true. + // This functionality exists to help folks who are upgrading from older helm + // chart versions where they had previously created config entries themselves but + // now want to manage them through custom resources. + hasMigrationKey := configEntry.GetObjectMeta().Annotations[common.MigrateEntryKey] == common.MigrateEntryTrue + + switch { + case !matchesConsul && !managedByThisDC && !hasMigrationKey: + return r.syncFailed(ctx, logger, crdCtrl, configEntry, ExternallyManagedConfigError, + sourceDatacenterMismatchErr(sourceDatacenter)) + case !matchesConsul && hasMigrationKey: + // If we're migrating this config entry but the custom resource + // doesn't match what's in Consul currently we error out so that + // it doesn't overwrite something accidentally. + return r.syncFailed(ctx, logger, crdCtrl, configEntry, MigrationFailedError, + r.nonMatchingMigrationError(configEntry, entryFromConsul)) + case !matchesConsul: + logger.Info("config entry does not match consul", "modify-index", entryFromConsul.GetModifyIndex()) _, writeMeta, err := consulClient.ConfigEntries().Set(consulEntry, &capi.WriteOptions{ Namespace: r.consulNamespace(consulEntry, configEntry.ConsulMirroringNS(), configEntry.ConsulGlobalResource()), }) @@ -263,7 +257,7 @@ func (r *ConfigEntryController) ReconcileEntry(ctx context.Context, crdCtrl Cont } logger.Info("config entry updated", "request-time", writeMeta.RequestTime) return r.syncSuccessful(ctx, crdCtrl, configEntry) - } else if requiresMigration && entry.GetMeta()[common.DatacenterKey] != r.DatacenterName { + case hasMigrationKey && !managedByThisDC: // If we get here then we're doing a migration and the entry in Consul // matches the entry in Kubernetes. We just need to update the metadata // of the entry in Consul to say that it's now managed by Kubernetes. @@ -277,7 +271,7 @@ func (r *ConfigEntryController) ReconcileEntry(ctx context.Context, crdCtrl Cont } logger.Info("config entry migrated", "request-time", writeMeta.RequestTime) return r.syncSuccessful(ctx, crdCtrl, configEntry) - } else if configEntry.SyncedConditionStatus() != corev1.ConditionTrue { + case configEntry.SyncedConditionStatus() != corev1.ConditionTrue: return r.syncSuccessful(ctx, crdCtrl, configEntry) } diff --git a/control-plane/controllers/configentries/configentry_controller_test.go b/control-plane/controllers/configentries/configentry_controller_test.go index faa153c323..bdfb1efa9e 100644 --- a/control-plane/controllers/configentries/configentry_controller_test.go +++ b/control-plane/controllers/configentries/configentry_controller_test.go @@ -5,6 +5,7 @@ package configentries import ( "context" + "errors" "fmt" "testing" "time" @@ -1683,16 +1684,37 @@ func TestConfigEntryControllers_doesNotCreateUnownedConfigEntry(t *testing.T) { kubeNS := "default" cases := []struct { - datacenterAnnotation string - expErr string + name string + datacenterAnnotation string + expErr error + expReason string + makeDifferentFromConsul bool }{ { - datacenterAnnotation: "", - expErr: "config entry already exists in Consul", + name: "when dc annotation is blank and the config entry does not match consul, then error is thrown, entry is not synced and reason is it is externally managed.", + datacenterAnnotation: "", + makeDifferentFromConsul: true, + expErr: errors.New("config entry already exists in Consul"), + expReason: "ExternallyManagedConfigError", }, { - datacenterAnnotation: "other-datacenter", - expErr: "config entry managed in different datacenter: \"other-datacenter\"", + name: "when dc annotation is not blank and the config entry matches consul, then error is not thrown and it is marked as synced", + datacenterAnnotation: "", + makeDifferentFromConsul: false, + expErr: nil, + }, + { + name: "when dc annotation is not blank and the config entry does not match consul, then error is thrown, entry is not synced and reason is it is externally managed.", + datacenterAnnotation: "other-datacenter", + makeDifferentFromConsul: true, + expErr: errors.New("config entry managed in different datacenter: \"other-datacenter\""), + expReason: "ExternallyManagedConfigError", + }, + { + name: "when dc annotation is not blank and the config entry matches consul, then error is not thrown and it is marked as synced", + datacenterAnnotation: "other-datacenter", + makeDifferentFromConsul: false, + expErr: nil, }, } @@ -1714,6 +1736,11 @@ func TestConfigEntryControllers_doesNotCreateUnownedConfigEntry(t *testing.T) { s.AddKnownTypes(v1alpha1.GroupVersion, svcDefaults) fakeClient := fake.NewClientBuilder().WithScheme(s).WithRuntimeObjects(svcDefaults).Build() + // Change the config entry so protocol is https instead of http if test case says to + if c.makeDifferentFromConsul { + svcDefaults.Spec.Protocol = "https" + } + testClient := test.TestServerWithMockConnMgrWatcher(t, nil) testClient.TestServer.WaitForServiceIntentions(t) consulClient := testClient.APIClient @@ -1749,7 +1776,7 @@ func TestConfigEntryControllers_doesNotCreateUnownedConfigEntry(t *testing.T) { resp, err := reconciler.Reconcile(ctx, ctrl.Request{ NamespacedName: namespacedName, }) - req.EqualError(err, c.expErr) + req.Equal(err, c.expErr) req.False(resp.Requeue) // Now check that the object in Consul is as expected. @@ -1761,9 +1788,17 @@ func TestConfigEntryControllers_doesNotCreateUnownedConfigEntry(t *testing.T) { err = fakeClient.Get(ctx, namespacedName, svcDefaults) req.NoError(err) status, reason, errMsg := svcDefaults.SyncedCondition() - req.Equal(corev1.ConditionFalse, status) - req.Equal("ExternallyManagedConfigError", reason) - req.Equal(errMsg, c.expErr) + expectedStatus := corev1.ConditionFalse + if !c.makeDifferentFromConsul { + expectedStatus = corev1.ConditionTrue + } + req.Equal(expectedStatus, status) + if !c.makeDifferentFromConsul { + req.Equal(c.expReason, reason) + } + if c.expErr != nil { + req.Equal(errMsg, c.expErr.Error()) + } } }) }