* fix grammar in changelog checker

* add backport checker

Support automatic ACL bootstrapping with the Vault secrets backend

With the Vault secrets backend, server-acl-init now:
* Runs the Vault agent as a sidecar
* Bootstraps ACLs if the Vault bootstrap token is empty or not found,
  and writes the bootstrap token back to Vault via the Vault agent

The Kubernetes backend will write the bootstrap token to the
user-provided secret if that secret is empty. The Vault behavior is
the same.

The Vault backend writes to a default secret name if the secretName
and secretKey are not set in the helm chart values.

server-acl-init reads the secret directly from k8s or Vault.
* Remove -bootstrap-token-file flag from server-acl-init and remove the
* Remove the volume/mount for bootstrap token

---------

Co-authored-by: Chris Thain <32781396+cthain@users.noreply.github.com>

* update charts to point to 1.15.1

* updated consul libraries to the latest

…roller

Add SNI skip for client node configuration

…`null` to increase service registration times (#2008)

* Update values.yaml

Clients are not required for ingress/terminating gateways.

Website has linting that errors when links have the
developer.hashicorp.com prefix.

…shicorp/consul-k8s into bug/gateway-controller-incomplete-acl

…ed the bug

[COMPLIANCE] add copyright headers to files

…lete-acl

Update ACLs, add namespace.write permission

…xy-default

add failover policy to service resolver and proxy default

This reverts commit 2fb7944.

* Terraform: increase node sizes
* update GKE to use already created subnets
* Dispatch: dispatch to consul-k8s-workflows

* Update status on PRs
* Split pr and push into 2 different files so that context can be passed through

* Add a cleanup cron job

* draft of adding sameness group CRD

* move sameness group tests to ent test file

* update tests

* fix lint issues

* generate yaml and update helm charts

* update field descriptions and validation and its test

* remove unwanted files, add license comments back

* rename samenessgroups to samenessgroup

* fix resource names

* update failing unit test

* Fix Sync Catalog ACL Token Environment Var Name
* Update ACL variable name in tests

* add sameness group to exported services

* update CRDs

* update deep copy

* re add license line

* check if sameness group is wildcard

* remove experimental tag on peering fields

* update error message case

* update error message case in webhook test

…figured as secrets backend (#2083)

* Adjust mount based on whether Vault is enabled as secrets backend

* Add changelog entry

* Improve wording of changelog entry

* Use Vault serverca for CONSUL_CACERT when secrets backend enabled

* Add comment to Helm template explaining logic

* Add unit test for CONSUL_CACERT with Vault secret path

* Add unit tests for removing mounts when Vault is secrets backend

Co-authored-by: hashicorp-tsccr[bot] <hashicorp-tsccr[bot]@users.noreply.github.com>

* add sameness group to service resolver, update manifests

* get the latest api and update acceptance tests

* get the latest api in acceptanc tests

* update validation code, remove dynamic validations, update tests

* check nil pointer

* go get latest api

* revert acceptance changes

* add sameness group to source intention

* add more test coverage

* add comment on metaValueMaxLength variable

* fix comment lint issue

* Add MaxEjectionPercent and BaseEjectionTime to servicedefaults

* test with sister branch in consul repo

* missed one

* fix tag names

* fix json tags and duration type

* update test

* generate yaml files and fix imports

---------

Co-authored-by: Semir Patel <semir.patel@hashicorp.com>

* Customizing Vault Version for WanFed Test

* Modified

* Changed according to the review comments

* Removed the commented line

* Vault server version type changed to String

* changed back to VaultServerVersion type

* Changing "VaultServerVersion" to type "String"

* add config read command

* add tests

* lint

* update docs

* add changelog

* fix linting errors

* PR feedback

* Add mutualTLSMode to service-defaults and proxy-defaults
* Add allowEnablingPermisiveMutualTLS to mesh config entry

* add HOST_IP to mesh-gateway

* Add support for syncing Ingress hostname to the Consul Catalog
* fix changelog-checker syntax error

* Create values.yaml section for telemetry-collector

* Initial telemetry-collector validation and bats test

* Add nodeSelector

* Add connect-init initContainer

* Add consul-dataplane container

* Conditionally add ca-cert volume

* Include vault annotations

* Prune tests to pertinent test cases

* Move consul server env vars

* Check ca mount for dataplane container

* Check correct env var

* Set default resources

* Set initContainer and tolerations

* Support priorityClassName

* Support setting initContainer resources

* Fix replicas unit test

* Turn off tproxy and remove unneeded security context

* Set -tls-disabled if global.tls.enabled=false

* Set -ca-certs correct if tls is enabled

* Set external server args

* Set partition flag tests

* Label bats tests, remove duplicate flags

* Bats tests for service, add metricsserver port

* Support annotations and imagePullSecret on serviceAccount

* Create configmap for custom configuration

* Add configmap to deployment

* Fix test names

* Remove unneeded cloud validation. fixup comment

* Comment values.yaml changes

* Switch from sidecar auth method to component auth method

* changelog

* Add PodSecurityPolicy for consul-telemetry-collector

* Rename init container + add comment

* Remove logLevel bats tests as it is unsupported right now

* Remove auth-method special cases

* Replace LOGIN_DATACENTER login with LOGIN_NAMESPACE

* Remove unneeded LOGIN_DATACENTER test

Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com>

* update go-discove so we're not pulling in a version of tencent cloud
that no longer exists

* Update go discover to latest

…2170)

* add helm chart values to configure global server side rate limiting

* add changelog.

* update server checksum for configmap

* fix the other 2 checksums

* Disable DNS redirection when tproxy is disabled

DNS redirection and the various settings that make that possible (like
the dataplane binding to a port for DNS) is only useful if tproxy is
enabled. Most of the code checked if tproxy was enabled but there
was one location where we didn't check. This resulted in a bug
with our multiport support where even though tproxy is disabled,
we tried to setup the dataplane to proxy DNS. This meant each dataplane
tried to bind to 8600 but because there are >1 dataplanes with
multiport, there was a port conflict.

This PR fixes the location where we didn't check if tproxy was enabled
and as a result fixes the multiport issue.

* Add API Gateway subcommand to Control Plane.
Co-authored-by: Thomas Eckert <teckert@hashicorp.com>

* Add GatewayClassConfig CRD (#2036)

* Update dependencies so that CRDs can be added

* Generate CRD for GatewayClassConfig

* Return empty logger instead of nil due to dependency update

* Update sidecar webhook to use ProbeHandler instead of Handler

* Update controller sub resources to use sub resource update options

* Re-add copyright header that got removed on generation

* Use NewTestLogger and ProbeHandler in tests

* Add api_gateway_types_test

* Remove boilerplate from ctrl-generate as it is no longer required

* Add app-copyright-header to Makefile

* Clarify GatewayClassConfig description

* Remove unneeded fields from GatewayClassConfig

* Fix lint issues

* Fix TestLogger in enterprise tests

* Add Changelog

* Fix TestLogger in enterprise test in one more place

* Remove the helpers

* Remove unused consts

* Adds API Gateway Class Config controller

* Add Hack for Generating CRDs from external sources (#2060)

* Add generate-external-crds to Makefile

* Add contributing docs

* Add comment about Helm ignoring kustomization.yaml

* Update Makefile

Co-authored-by: Luke Kysow <1034429+lkysow@users.noreply.github.com>

* Update CONTRIBUTING.md

Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com>

---------

Co-authored-by: Luke Kysow <1034429+lkysow@users.noreply.github.com>
Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com>

* Remove the api-gateway subcommand we decided not to use (#2062)

* APIGW Resource Translation (#2070)

* WIP: api-gateway resource conversion

* convert meta for apigw from k8s

* Added tests and updated config entry translation for APIGW

* Fix linting issue, move translation code to correct location

* Updates from PR comments

* Update config entry translation to use k8s type NamedNamespace, updated
tests

* switch to standard import rename for consul api

* Add GatewayClass Controller (#2055)

* Add permissions to connect-inject clusterrole

* Add gateway api crd deps

* Stub out the gatewayclass controller

* Add finalizer functions

* Use finalizer functions

* Add tests for GatewayClass Controller

* Change the controller name

* Only register gwv1beta1

* Run tests in parallel

* Remove RBAC comments

* Remove perms from resources not yet implemented

* shouldUpdate -> expectedDidUpdate

* Don't requeue if in use

* Address PR feedback

* Apply suggestions from code review

Co-authored-by: Andrew Stucki <andrew.stucki@hashicorp.com>

* Make gatewayClassFinalizer private

* Separate out indexers

* Move validation of parametersRef to a helper func

* Add reason to ensureStatus

* Rename GatewayClassReconciler -> GatewayClassController

* Add perms to list gateways

* Clean up status conditions

* Clean up indexes

* Set conditions properly and test them

* Test incorrect parametersRef

* Fix comments on indexer funcs

* Fix lint issues

* Set conditions without unnecessary updates

* Set ObservedGeneration from parent object

* Fix infinite loop issue with invalid config

* Fix update issue

* Return error if the GatewayClass cannot be reached

---------

Co-authored-by: Andrew Stucki <andrew.stucki@hashicorp.com>

* Updates GatewayClassConfig Controller to use common finalizer methods

* APIGW4CONK8S: HTTP Route/TCPRoute/Secrets Translation (#2088)

* Add http route translation

* Added copywrite headers

* Add namespace translation for service

* handle potential nil pointer on section name, check if parent ref if an
api gateway, fix comment from PR Review

* Added TCPRoute Translation

* Fix potential nil pointer deref in tcp service namespace, update
tcproute tests

* Add inline certs translation, clean up some potential nil pointer
derefs

* Clean up comments

* Linting

* Switch out env var usage for field on translator

* rename api-gateway/consul package to api-gateway/translation

* Adds stub for Gateway Controller

* Use the non-deprecated logr test (#2125)

* APIGW4CONK8s: Add Consul Cache (#2118)

* Added basic cache functionality with most tests, todo: add get method
for cache and expand tests

* Updated tests for Cache.Run function, removed tests of unexported
methods called by Run function

* Moved translation function def to translation package, added translate
apigw config entry

* Add translation for consul config entries to k8s namespaced name meta

* Added Get method to cache

* Add watch for contoller and setup in inject command

* Updated comments, renamed TranslateConsulInlineSecret method to
TranslateConsulInlineCertificate

* Updates from PR review

* Parallelize tests

* Bump consul api version

* Set api timeout for cache calls

* Revert "Bump consul api version"

This reverts commit c074b0f.

* Linting fun

* Add Gatekeeper for managing gateway deployment resources (#2117)

* Stub out the gatewayclass controller

* Change the controller name

* Only register gwv1beta1

* Address PR feedback

* Adds stub of Gateway Controller

* cannot understand why the indexes are not working

* some updates, want to do cleanup

* rebase and cleanup

* Start adding deployer

* Flesh out tests

* Refactor into a "gatekeeper"

* Integrate the gatekeeper into the gateway controller

* Simplify the api

* Remove the creation of helm config until later

* Remove use and rename package to gatekeeper

* Add labels to apigateway

* Manage ServiceAccount

* Manage Deployment

* Add more to deployment

* Update Helm Values

* WIP fleshing out the gateway deployment upsert behavior

* Update role and service

* Fix merge conflicts

* Round out tests

* Add test for respecting replicas

* Change the Gatekeeper New API and add comments for Upsert and Delete

* implement joinResources

* accept suggestions from @jm96441n

* Use pointer receivers

* Separate out mutator

* Update deployment correctly

* Update Role and ServiceAccount

* Fix that silly linting error

* Comments on HelmConfig

* Add Image to deployment

* Merge api-gateway into branch

---------

Co-authored-by: Melisa Griffin <melisa.griffin@hashicorp.com>

* Net 3490/reference grants (#2122)

* Adds reference grant validation

* Adds all necessary methods and tests

* lint

* some cleanup, fix copypasta test errors

* lint

* more linting

* PR updates, fix capitalization

* Add a bunch of TODOs for teamwork

* Split out cleanup func and clear up todos

* APIGW4CONK8S: Serialize the GatewayClassConfig onto the Gateway for easier retrieval (#2126)

* Add serialization of gateway class config

* Parallelize tests

* Remove prints, fix cache tests

* Add outer managed check to ensure we don't fetch config if we don't need
to

* Stub out where the openshift role info will go (#2145)

* APIGW4CONK8S: Function to get all refs for a gateway (#2139)

* Added function to get all refs for a gateway

* Use k8s objects for references rather than consul objects

* Fix comment

* [API Gateway] API Gateway Binding Logic (#2142)

* initial commit

* Add additional TODO

* Add some basic lifecycle unit tests

* split up implementation

* Add more tests and fix some bugs

* remove one parallel call in a loop

* Fix binding

* Add resolvedRefs statuses for routes

* Fix issue with empty parent ref that k8s doesn't like

* Fix up updates/status ordering

* Add basic gateway status setting

* Finish up first pass on gateway statuses

* Re-organize and begin adding comments

* More comments

* More comments

* More comments

* More comments

* More comments

* Add file that wasn't saved

* Add utils unit tests

* Add more tests

* Final tests

* Fix tests

* Fix up gateway annotation with binding logic

* Update doc comments for linter

* Add forgotten file

* Fix block in tests due to buffered channel size and better handle context cancelation

* Add basic acceptance tests for route binding behavior (#2161)

* Configure Gateway Controller with Helm values (#2158)

* Stub out the gatewayclass controller

* Change the controller name

* Only register gwv1beta1

* Address PR feedback

* Adds stub of Gateway Controller

* cannot understand why the indexes are not working

* some updates, want to do cleanup

* rebase and cleanup

* Start adding deployer

* Flesh out tests

* Refactor into a "gatekeeper"

* Integrate the gatekeeper into the gateway controller

* Simplify the api

* Remove the creation of helm config until later

* Remove use and rename package to gatekeeper

* Add labels to apigateway

* Manage ServiceAccount

* Manage Deployment

* Add more to deployment

* Update Helm Values

* WIP fleshing out the gateway deployment upsert behavior

* Update role and service

* Fix merge conflicts

* Round out tests

* Add test for respecting replicas

* Change the Gatekeeper New API and add comments for Upsert and Delete

* implement joinResources

* accept suggestions from @jm96441n

* Use pointer receivers

* Separate out mutator

* Update deployment correctly

* Update Role and ServiceAccount

* Fix that silly linting error

* Comments on HelmConfig

* Add Image to deployment

* Add Gateway flags to inject-connect

* Pass through env vars

* Add environment variables to the deployment template

* Add conditional injection of environment variables

* Add env vars back in

* Fix up issues from merge

* Test default env vars

* Test all of the env vars

* Fix up more issues from merge

* Pass in values to HelmConfig then to Controller

* Just pass config in as a struct

* Add gateway-gatewayclass

* Add gateway-gatewayclassconfig

* Add DeploymentSpec to GatewayClassConfig

* Remove deployment configuration settings from HelmConfig

* Remove BATs on deployment configuration

* Expand gatewayclassconfig

* Set deployment replicas in test

* Place GatewayClassConfig in the crds/ dir

* Update control-plane/api-gateway/gatekeeper/gatekeeper_test.go

Co-authored-by: Andrew Stucki <andrew.stucki@hashicorp.com>

---------

Co-authored-by: Melisa Griffin <melisa.griffin@hashicorp.com>
Co-authored-by: Andrew Stucki <andrew.stucki@hashicorp.com>

* Net 4124/handle syncing consul lifecycle events (#2173)

* with type switch

* latest changes

* remove debugging panic

* Updated error in test

* Fix bug with capacity v length in the cache list and type that is being
subscribed to

* Fix linting issues/naming from PR review

* Added tests for delete function

* Plumbing for gatekeeper with snapshot

* [API Gateway] Hooking up API Gateways End-to-End (#2175)

* updated gatekeeper, added update call, still needs work

* still has some print statements, seeing issues with updates

* some linting

* run ctrl-manifests and generate

* get the whole gamut finally working in a minimum configuration

* Fix up tests

* Add some tests

* Move cache package

* Fix up tests after other fixes

* Fix up test lifecycle

* Fix up linter issues

* Remove unnecessary test that panics

* Add MeshService CRD

* fix bats tests

* bats bats bats

* baaaatttss

* Fix up acceptance test cleanup by introducing uninstall hook to cleanup managed GatewayClass and GatewayClassConfig resources

* Add test for deletion failures due to finalizers

* reorder commands

---------

Co-authored-by: Melisa Griffin <melisa.griffin@hashicorp.com>

* Fix crd loading (#2179)

* Fix CRD loading for CLI

* Adds crds directory to install with consul-k8s cli

* fix tests

* testing

* fix bats tests

---------

Co-authored-by: Thomas Eckert <teckert@hashicorp.com>
Co-authored-by: Andrew Stucki <andrew.stucki@hashicorp.com>

* Add Changelog

* Fix up issues after merge back

* Fix wildcard usage on enterprise

* Don't subscribe to peerings when not enabled

* Remove additional changelog entries since we're only going to use 1

---------

Co-authored-by: Melisa Griffin <missylbytes@users.noreply.github.com>
Co-authored-by: Luke Kysow <1034429+lkysow@users.noreply.github.com>
Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com>
Co-authored-by: John Maguire <john.maguire@hashicorp.com>
Co-authored-by: Andrew Stucki <andrew.stucki@hashicorp.com>
Co-authored-by: Melisa Griffin <melisa.griffin@hashicorp.com>

Update consul image on prepare-dev and prepare-release

* Bump version of controller runtime

* Use SubResourceUpdateOption

* Fix test loggr

* Fix ProbeHandler

* Set runtime to 0.14.6

* Add Changelog

* Fix up a few more breaking change issues

* Adding support for idleTimeout in Service Router spec

* add changelog

…llector is enabled (#2143)

* inject envoy_telemetry_bind_socket_dir proxy config when telemetry collector is enabled

* use metrics.enableTelemetryCollector value to gate controller logic

* add changelog entry and unit test

…paces not to be compared. (#2194)

This bug means that swapping partitions and namespaces on sources wouldn't get
reflected in Consul.

* Add CRD for jwt-provider config entry
* Pin consul/api to versions containing the jwt-provider config entry
* Update Makefile to use v0.10.0 of sigs.k8s.io/controller-tools/cmd/controller-gen

* Initial scaffolding

* Fix up some infinite reconciliation issues and initial other bugs

* overhaul

* get basic e2e working again

* Add resource ref validation

* Fix up namespace/reference grants

* fix binding

* clean up logging

* cleanup

* Get some binder unit tests working again

* log guard

* Fix unit test

* Fix up more binder tests

* get more binder tests working

* finish binder tests

* fix setter test

* light touches and un-bak passing tests

* Remove controller test as the wiring of deployments is predominantly tests via acceptance tests

* Update reference grant tests

* fix linter issues

* fix acceptance test linters

* Fix validation tests

* Fix up consul cache tests

* fixing up a few more tests

* Finish up translation test work

* Fix last bit of tests