Merge branch 'main' into fix-bug-with-cross-namespace-routes

.changelog/16647.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+raft_logstore: Fixes a bug where restoring a snapshot when using the experimental WAL storage backend causes a panic.
+```

.changelog/16660.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: fix PUT token request with adding missed AccessorID property to requestBody
+```

.changelog/16661.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+gateways: Fixes a bug API gateways using HTTP listeners were taking upwards of 15 seconds to get configured over xDS.
+```

.github/workflows/jira-issues.yaml

@@ -57,7 +57,7 @@ jobs:
       - name: Search
         if: github.event.action != 'opened'
         id: search
-        uses: tomhjp/gh-action-jira-search@v0.2.1
+        uses: tomhjp/gh-action-jira-search@v0.2.2
         with:
           # cf[10089] is Issue Link (use JIRA API to retrieve)
           jql: 'issuetype = "${{ steps.set-ticket-type.outputs.TYPE }}" and cf[10089] = "${{ github.event.issue.html_url || github.event.pull_request.html_url }}"'
@@ -71,14 +71,14 @@ jobs:
 
       - name: Close ticket
         if: ( github.event.action == 'closed' || github.event.action == 'deleted' ) && steps.search.outputs.issue
-        uses: atlassian/gajira-transition@v2.0.1
+        uses: atlassian/gajira-transition@v3.0.1
         with:
           issue: ${{ steps.search.outputs.issue }}
           transition: "Closed"
 
       - name: Reopen ticket
         if: github.event.action == 'reopened' && steps.search.outputs.issue
-        uses: atlassian/gajira-transition@v2.0.1
+        uses: atlassian/gajira-transition@v3.0.1
         with:
           issue: ${{ steps.search.outputs.issue }}
           transition: "To Do"

.github/workflows/jira-pr.yaml

@@ -76,7 +76,7 @@ jobs:
       - name: Search
         if: github.event.action != 'opened'
         id: search
-        uses: tomhjp/gh-action-jira-search@v0.2.1
+        uses: tomhjp/gh-action-jira-search@v0.2.2
         with:
           # cf[10089] is Issue Link (use JIRA API to retrieve)
           jql: 'issuetype = "${{ steps.set-ticket-type.outputs.TYPE }}" and cf[10089] = "${{ github.event.issue.html_url || github.event.pull_request.html_url }}"'
@@ -90,14 +90,14 @@ jobs:
 
       - name: Close ticket
         if: ( github.event.action == 'closed' || github.event.action == 'deleted' ) && steps.search.outputs.issue
-        uses: atlassian/gajira-transition@v2.0.1
+        uses: atlassian/gajira-transition@v3.0.1
         with:
           issue: ${{ steps.search.outputs.issue }}
           transition: "Closed"
 
       - name: Reopen ticket
         if: github.event.action == 'reopened' && steps.search.outputs.issue
-        uses: atlassian/gajira-transition@v2.0.1
+        uses: atlassian/gajira-transition@v3.0.1
         with:
           issue: ${{ steps.search.outputs.issue }}
           transition: "To Do"

agent/configentry/discoverychain.go

@@ -10,22 +10,24 @@ import (
 //
 // None of these are defaulted.
 type DiscoveryChainSet struct {
-	Routers       map[structs.ServiceID]*structs.ServiceRouterConfigEntry
-	Splitters     map[structs.ServiceID]*structs.ServiceSplitterConfigEntry
-	Resolvers     map[structs.ServiceID]*structs.ServiceResolverConfigEntry
-	Services      map[structs.ServiceID]*structs.ServiceConfigEntry
-	Peers         map[string]*pbpeering.Peering
-	ProxyDefaults map[string]*structs.ProxyConfigEntry
+	Routers        map[structs.ServiceID]*structs.ServiceRouterConfigEntry
+	Splitters      map[structs.ServiceID]*structs.ServiceSplitterConfigEntry
+	Resolvers      map[structs.ServiceID]*structs.ServiceResolverConfigEntry
+	Services       map[structs.ServiceID]*structs.ServiceConfigEntry
+	Peers          map[string]*pbpeering.Peering
+	SamenessGroups map[string]*structs.SamenessGroupConfigEntry
+	ProxyDefaults  map[string]*structs.ProxyConfigEntry
 }
 
 func NewDiscoveryChainSet() *DiscoveryChainSet {
 	return &DiscoveryChainSet{
-		Routers:       make(map[structs.ServiceID]*structs.ServiceRouterConfigEntry),
-		Splitters:     make(map[structs.ServiceID]*structs.ServiceSplitterConfigEntry),
-		Resolvers:     make(map[structs.ServiceID]*structs.ServiceResolverConfigEntry),
-		Services:      make(map[structs.ServiceID]*structs.ServiceConfigEntry),
-		Peers:         make(map[string]*pbpeering.Peering),
-		ProxyDefaults: make(map[string]*structs.ProxyConfigEntry),
+		Routers:        make(map[structs.ServiceID]*structs.ServiceRouterConfigEntry),
+		Splitters:      make(map[structs.ServiceID]*structs.ServiceSplitterConfigEntry),
+		Resolvers:      make(map[structs.ServiceID]*structs.ServiceResolverConfigEntry),
+		Services:       make(map[structs.ServiceID]*structs.ServiceConfigEntry),
+		Peers:          make(map[string]*pbpeering.Peering),
+		ProxyDefaults:  make(map[string]*structs.ProxyConfigEntry),
+		SamenessGroups: make(map[string]*structs.SamenessGroupConfigEntry),
 	}
 }
 
@@ -57,6 +59,13 @@ func (e *DiscoveryChainSet) GetService(sid structs.ServiceID) *structs.ServiceCo
 	return nil
 }
 
+func (e *DiscoveryChainSet) GetSamenessGroup(name string) *structs.SamenessGroupConfigEntry {
+	if e.SamenessGroups != nil {
+		return e.SamenessGroups[name]
+	}
+	return nil
+}
+
 func (e *DiscoveryChainSet) GetProxyDefaults(partition string) *structs.ProxyConfigEntry {
 	if e.ProxyDefaults != nil {
 		return e.ProxyDefaults[partition]
@@ -104,6 +113,16 @@ func (e *DiscoveryChainSet) AddServices(entries ...*structs.ServiceConfigEntry)
 	}
 }
 
+// AddSamenessGroup adds service configs. Convenience function for testing.
+func (e *DiscoveryChainSet) AddSamenessGroup(entries ...*structs.SamenessGroupConfigEntry) {
+	if e.Services == nil {
+		e.SamenessGroups = make(map[string]*structs.SamenessGroupConfigEntry)
+	}
+	for _, entry := range entries {
+		e.SamenessGroups[entry.Name] = entry
+	}
+}
+
 // AddProxyDefaults adds proxy-defaults configs. Convenience function for testing.
 func (e *DiscoveryChainSet) AddProxyDefaults(entries ...*structs.ProxyConfigEntry) {
 	if e.ProxyDefaults == nil {
@@ -137,6 +156,8 @@ func (e *DiscoveryChainSet) AddEntries(entries ...structs.ConfigEntry) {
 			e.AddResolvers(entry.(*structs.ServiceResolverConfigEntry))
 		case structs.ServiceDefaults:
 			e.AddServices(entry.(*structs.ServiceConfigEntry))
+		case structs.SamenessGroup:
+			e.AddSamenessGroup(entry.(*structs.SamenessGroupConfigEntry))
 		case structs.ProxyDefaults:
 			if entry.GetName() != structs.ProxyConfigGlobal {
 				panic("the only supported proxy-defaults name is '" + structs.ProxyConfigGlobal + "'")

agent/consul/discoverychain/compile.go

@@ -930,7 +930,8 @@ RESOLVE_AGAIN:
 	//
 	// TODO(rb): What about a redirected subset reference? (web/v2, but web redirects to alt/"")
 
-	if resolver.Redirect != nil {
+	// Redirects to sameness groups are technically failovers.
+	if resolver.Redirect != nil && resolver.Redirect.SamenessGroup == "" {
 		redirect := resolver.Redirect
 
 		redirectedTarget := c.rewriteTarget(
@@ -1070,6 +1071,23 @@ RESOLVE_AGAIN:
 	// reasonably if there is some sort of graph loop below.
 	c.recordNode(node)
 
+	var err error
+	// Determine which failover definitions apply.
+	var failoverTargets []*structs.DiscoveryTarget
+	var failoverPolicy *structs.ServiceResolverFailoverPolicy
+	proxyDefault := c.entries.GetProxyDefaults(targetID.PartitionOrDefault())
+	if proxyDefault != nil {
+		failoverPolicy = proxyDefault.FailoverPolicy
+	}
+
+	if resolver.Redirect != nil && resolver.Redirect.SamenessGroup != "" {
+		opts := resolver.Redirect.ToDiscoveryTargetOpts()
+		failoverTargets, err = c.makeSamenessGroupFailover(target, opts, resolver.Redirect.SamenessGroup)
+		if err != nil {
+			return nil, err
+		}
+	}
+
 	if len(resolver.Failover) > 0 {
 		f := resolver.Failover
 
@@ -1083,8 +1101,10 @@ RESOLVE_AGAIN:
 			return node, nil
 		}
 
-		// Determine which failover definitions apply.
-		var failoverTargets []*structs.DiscoveryTarget
+		if failover.Policy != nil {
+			failoverPolicy = failover.Policy
+		}
+
 		if len(failover.Datacenters) > 0 {
 			opts := failover.ToDiscoveryTargetOpts()
 			for _, dc := range failover.Datacenters {
@@ -1103,6 +1123,11 @@ RESOLVE_AGAIN:
 					failoverTargets = append(failoverTargets, failoverTarget)
 				}
 			}
+		} else if failover.SamenessGroup != "" {
+			failoverTargets, err = c.makeSamenessGroupFailover(target, failover.ToDiscoveryTargetOpts(), failover.SamenessGroup)
+			if err != nil {
+				return nil, err
+			}
 		} else {
 			// Rewrite the target as per the failover policy.
 			failoverTarget := c.rewriteTarget(target, failover.ToDiscoveryTargetOpts())
@@ -1111,37 +1136,55 @@ RESOLVE_AGAIN:
 			}
 		}
 
-		// If we filtered everything out then no point in having a failover.
-		if len(failoverTargets) > 0 {
-			df := &structs.DiscoveryFailover{}
-			node.Resolver.Failover = df
+	}
 
-			if failover.Policy == nil || failover.Policy.Mode == "" {
-				proxyDefault := c.entries.GetProxyDefaults(targetID.PartitionOrDefault())
-				if proxyDefault != nil {
-					df.Policy = proxyDefault.FailoverPolicy
-				}
-			} else {
-				df.Policy = failover.Policy
-			}
+	// If we filtered everything out then no point in having a failover.
+	if len(failoverTargets) > 0 {
+		df := &structs.DiscoveryFailover{}
+		node.Resolver.Failover = df
 
-			// Take care of doing any redirects or configuration loading
-			// related to targets by cheating a bit and recursing into
-			// ourselves.
-			for _, target := range failoverTargets {
-				failoverResolveNode, err := c.getResolverNode(target, true)
-				if err != nil {
-					return nil, err
-				}
-				failoverTarget := failoverResolveNode.Resolver.Target
-				df.Targets = append(df.Targets, failoverTarget)
+		df.Policy = failoverPolicy
+
+		// Take care of doing any redirects or configuration loading
+		// related to targets by cheating a bit and recursing into
+		// ourselves.
+		for _, target := range failoverTargets {
+			failoverResolveNode, err := c.getResolverNode(target, true)
+			if err != nil {
+				return nil, err
 			}
+			failoverTarget := failoverResolveNode.Resolver.Target
+			df.Targets = append(df.Targets, failoverTarget)
 		}
 	}
 
 	return node, nil
 }
 
+func (c *compiler) makeSamenessGroupFailover(target *structs.DiscoveryTarget, opts structs.DiscoveryTargetOpts, samenessGroupName string) ([]*structs.DiscoveryTarget, error) {
+	samenessGroup := c.entries.GetSamenessGroup(samenessGroupName)
+	if samenessGroup == nil {
+		return nil, &structs.ConfigEntryGraphError{
+			Message: fmt.Sprintf(
+				"sameness group missing for service %q",
+				target.Service,
+			),
+		}
+	}
+
+	var failoverTargets []*structs.DiscoveryTarget
+	for _, t := range samenessGroup.ToFailoverTargets() {
+		// Rewrite the target as per the failover policy.
+		targetOpts := structs.MergeDiscoveryTargetOpts(opts, t.ToDiscoveryTargetOpts())
+		failoverTarget := c.rewriteTarget(target, targetOpts)
+		if failoverTarget.ID != target.ID { // don't failover to yourself
+			failoverTargets = append(failoverTargets, failoverTarget)
+		}
+	}
+
+	return failoverTargets, nil
+}
+
 func newDefaultServiceResolver(sid structs.ServiceID) *structs.ServiceResolverConfigEntry {
 	return &structs.ServiceResolverConfigEntry{
 		Kind:           structs.ServiceResolver,

agent/consul/discoverychain/gateway.go

@@ -128,6 +128,29 @@ func (l *GatewayChainSynthesizer) Synthesize(chains ...*structs.CompiledDiscover
 			return nil, nil, err
 		}
 
+		node := compiled.Nodes[compiled.StartNode]
+		if node.IsRouter() {
+			resolverPrefix := structs.DiscoveryGraphNodeTypeResolver + ":" + node.Name
+
+			// clean out the clusters that will get added for the router
+			for name := range compiled.Nodes {
+				if strings.HasPrefix(name, resolverPrefix) {
+					delete(compiled.Nodes, name)
+				}
+			}
+
+			// clean out the route rules that'll get added for the router
+			filtered := []*structs.DiscoveryRoute{}
+			for _, route := range node.Routes {
+				if strings.HasPrefix(route.NextNode, resolverPrefix) {
+					continue
+				}
+				filtered = append(filtered, route)
+			}
+			node.Routes = filtered
+		}
+		compiled.Nodes[compiled.StartNode] = node
+
 		// fix up the nodes for the terminal targets to either be a splitter or resolver if there is no splitter present
 		for name, node := range compiled.Nodes {
 			switch node.Type {

agent/consul/discoverychain/gateway_test.go

@@ -47,7 +47,7 @@ func TestGatewayChainSynthesizer_AddHTTPRoute(t *testing.T) {
 		route                     structs.HTTPRouteConfigEntry
 		expectedMatchesByHostname map[string][]hostnameMatch
 	}{
-		"no hostanames": {
+		"no hostnames": {
 			route: structs.HTTPRouteConfigEntry{
 				Kind: structs.HTTPRoute,
 				Name: "route",
@@ -539,15 +539,6 @@ func TestGatewayChainSynthesizer_Synthesize(t *testing.T) {
 				Protocol:    "http",
 				StartNode:   "router:gateway-suffix-9b9265b.default.default",
 				Nodes: map[string]*structs.DiscoveryGraphNode{
-					"resolver:gateway-suffix-9b9265b.default.default.dc1": {
-						Type: "resolver",
-						Name: "gateway-suffix-9b9265b.default.default.dc1",
-						Resolver: &structs.DiscoveryResolver{
-							Target:         "gateway-suffix-9b9265b.default.default.dc1",
-							Default:        true,
-							ConnectTimeout: 5000000000,
-						},
-					},
 					"router:gateway-suffix-9b9265b.default.default": {
 						Type: "router",
 						Name: "gateway-suffix-9b9265b.default.default",
@@ -569,20 +560,6 @@ func TestGatewayChainSynthesizer_Synthesize(t *testing.T) {
 								},
 							},
 							NextNode: "resolver:foo.default.default.dc1",
-						}, {
-							Definition: &structs.ServiceRoute{
-								Match: &structs.ServiceRouteMatch{
-									HTTP: &structs.ServiceRouteHTTPMatch{
-										PathPrefix: "/",
-									},
-								},
-								Destination: &structs.ServiceRouteDestination{
-									Service:   "gateway-suffix-9b9265b",
-									Partition: "default",
-									Namespace: "default",
-								},
-							},
-							NextNode: "resolver:gateway-suffix-9b9265b.default.default.dc1",
 						}},
 					},
 					"resolver:foo.default.default.dc1": {
@@ -704,15 +681,6 @@ func TestGatewayChainSynthesizer_ComplexChain(t *testing.T) {
 				Protocol:    "http",
 				StartNode:   "router:gateway-suffix-9b9265b.default.default",
 				Nodes: map[string]*structs.DiscoveryGraphNode{
-					"resolver:gateway-suffix-9b9265b.default.default.dc1": {
-						Type: "resolver",
-						Name: "gateway-suffix-9b9265b.default.default.dc1",
-						Resolver: &structs.DiscoveryResolver{
-							Target:         "gateway-suffix-9b9265b.default.default.dc1",
-							Default:        true,
-							ConnectTimeout: 5000000000,
-						},
-					},
 					"resolver:service-one.default.default.dc1": {
 						Type: "resolver",
 						Name: "service-one.default.default.dc1",
@@ -770,20 +738,6 @@ func TestGatewayChainSynthesizer_ComplexChain(t *testing.T) {
 								},
 							},
 							NextNode: "splitter:splitter-one.default.default",
-						}, {
-							Definition: &structs.ServiceRoute{
-								Match: &structs.ServiceRouteMatch{
-									HTTP: &structs.ServiceRouteHTTPMatch{
-										PathPrefix: "/",
-									},
-								},
-								Destination: &structs.ServiceRouteDestination{
-									Service:   "gateway-suffix-9b9265b",
-									Partition: "default",
-									Namespace: "default",
-								},
-							},
-							NextNode: "resolver:gateway-suffix-9b9265b.default.default.dc1",
 						}},
 					},
 					"splitter:splitter-one.default.default": {