Merge branch 'main' into conformance/run-api-gateway-conformance

.changelog/2143.txt

@@ -0,0 +1,4 @@
+
+```release-note:feature
+consul-telemetry-collector: Configure envoy proxy config during registration when consul-telemetry-collector is enabled.
+```

.changelog/2156.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+control-plane: add support for idleTimeout in the Service Router config
+```

.changelog/2183.txt

@@ -0,0 +1,3 @@
+```release-note:security
+Fix Prometheus CVEs by bumping controller-runtime.
+```

.changelog/2194.txt

@@ -0,0 +1,3 @@
+```release-note:
+crd: fix bug on service intentions CRD causing some updates to be ignored.
+```

.changelog/2195.txt

@@ -0,0 +1,3 @@
+```release-note:imrpovement
+consul-telemetry-collector: add acceptance tests for consul telemetry collector component.
+```

.changelog/2204.txt

@@ -0,0 +1,3 @@
+```release-note:security
+Bump Dockerfile base image for RedHat UBI `consul-k8s-control-plane` image to `ubi-minimal:9.2`. 
+```

.changelog/2205.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+cli: update cloud preset to enable telemetry collector
+```

.changelog/2209.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+helm: Add `JWTProvider` CRD for configuring the `jwt-provider` config entry.
+```

.changelog/2213.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+helm: Update the ServiceIntentions CRD to support `JWT` fields.
+```

.github/workflows/build.yml

@@ -164,7 +164,7 @@ jobs:
         if: ${{ matrix.goos == 'linux' && matrix.component == 'cli' && matrix.goarch == 'amd64'}}
         uses: addnab/docker-run-action@v3  # TSCCR: no entry for repository "addnab/docker-run-action"
         with:
-          image: registry.access.redhat.com/ubi8/ubi:latest
+          image: registry.access.redhat.com/ubi9/ubi:latest
           options: -v ${{ github.workspace }}:/work
           run: |
             dnf install -qy openssl

CONTRIBUTING.md

@@ -214,6 +214,7 @@ rebase the branch on main, fixing any conflicts along the way before the code ca
     ```go
     // ServiceRouter is the Schema for the servicerouters API
     // +kubebuilder:printcolumn:name="Synced",type="string",JSONPath=".status.conditions[?(@.type==\"Synced\")].status",description="The sync status of the resource with Consul"
+    // +kubebuilder:printcolumn:name="Last Synced",type="date",JSONPath=".status.lastSyncedTime",description="The last successful synced time of the resource with Consul"
     // +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp",description="The age of the resource"
     type ServiceRouter struct {
     ```
@@ -232,7 +233,7 @@ rebase the branch on main, fixing any conflicts along the way before the code ca
     ```
 1. Go to the Consul `api` package for the config entry, e.g. https://github.com/hashicorp/consul/blob/main/api/config_entry_gateways.go
 1. Copy the top-level fields over into the `Spec` struct except for
-   `Kind`, `Name`, `Namespace`, `Meta`, `CreateIndex` and `ModifyIndex`. In this
+   `Kind`, `Name`, `Namespace`, `Partition`, `Meta`, `CreateIndex` and `ModifyIndex`. In this
    example, the top-level fields remaining are `TLS` and `Listeners`:
    
     ```go

Makefile

@@ -138,7 +138,7 @@ ifeq (, $(shell which controller-gen))
 	CONTROLLER_GEN_TMP_DIR=$$(mktemp -d) ;\
 	cd $$CONTROLLER_GEN_TMP_DIR ;\
 	go mod init tmp ;\
-	go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.8.0 ;\
+	go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.10.0 ;\
 	rm -rf $$CONTROLLER_GEN_TMP_DIR ;\
 	}
 CONTROLLER_GEN=$(shell go env GOPATH)/bin/controller-gen

acceptance/framework/config/config.go

@@ -46,11 +46,14 @@ type TestConfig struct {
 
 	DisablePeering bool
 
-	HelmChartVersion string
-	ConsulImage      string
-	ConsulK8SImage   string
-	ConsulVersion    *version.Version
-	EnvoyImage       string
+	HelmChartVersion     string
+	ConsulImage          string
+	ConsulK8SImage       string
+	ConsulVersion        *version.Version
+	EnvoyImage           string
+	ConsulCollectorImage string
+
+	HCPResourceID string
 
 	VaultHelmChartVersion string
 	VaultServerVersion    string

acceptance/framework/flags/flags.go

@@ -39,9 +39,12 @@ type TestFlags struct {
 	flagConsulK8sImage        string
 	flagConsulVersion         string
 	flagEnvoyImage            string
+	flagConsulCollectorImage  string
 	flagVaultHelmChartVersion string
 	flagVaultServerVersion    string
 
+	flagHCPResourceID string
+
 	flagNoCleanupOnFailure bool
 
 	flagDebugDirectory string
@@ -74,9 +77,12 @@ func (t *TestFlags) init() {
 	flag.StringVar(&t.flagConsulVersion, "consul-version", "", "The consul version used for all tests.")
 	flag.StringVar(&t.flagHelmChartVersion, "helm-chart-version", config.HelmChartPath, "The helm chart used for all tests.")
 	flag.StringVar(&t.flagEnvoyImage, "envoy-image", "", "The Envoy image to use for all tests.")
+	flag.StringVar(&t.flagConsulCollectorImage, "consul-collector-image", "", "The consul collector image to use for all tests.")
 	flag.StringVar(&t.flagVaultServerVersion, "vault-server-version", "", "The vault serverversion used for all tests.")
 	flag.StringVar(&t.flagVaultHelmChartVersion, "vault-helm-chart-version", "", "The Vault helm chart used for all tests.")
 
+	flag.StringVar(&t.flagHCPResourceID, "hcp-resource-id", "", "The hcp resource id to use for all tests.")
+
 	flag.BoolVar(&t.flagEnableMultiCluster, "enable-multi-cluster", false,
 		"If true, the tests that require multiple Kubernetes clusters will be run. "+
 			"At least one of -secondary-kubeconfig or -secondary-kubecontext is required when this flag is used.")
@@ -176,9 +182,12 @@ func (t *TestFlags) TestConfigFromFlags() *config.TestConfig {
 		ConsulK8SImage:        t.flagConsulK8sImage,
 		ConsulVersion:         consulVersion,
 		EnvoyImage:            t.flagEnvoyImage,
+		ConsulCollectorImage:  t.flagConsulCollectorImage,
 		VaultHelmChartVersion: t.flagVaultHelmChartVersion,
 		VaultServerVersion:    t.flagVaultServerVersion,
 
+		HCPResourceID: t.flagHCPResourceID,
+
 		NoCleanupOnFailure: t.flagNoCleanupOnFailure,
 		DebugDirectory:     tempDir,
 		UseAKS:             t.flagUseAKS,

acceptance/go.mod

@@ -5,7 +5,7 @@ go 1.20
 require (
 	github.com/gruntwork-io/terratest v0.31.2
 	github.com/hashicorp/consul-k8s/control-plane v0.0.0-20221117191905-0b1cc2b631e3
-	github.com/hashicorp/consul/api v1.20.0
+	github.com/hashicorp/consul/api v1.10.1-0.20230530193107-04a0d0133ae4
 	github.com/hashicorp/consul/sdk v0.13.1
 	github.com/hashicorp/go-uuid v1.0.3
 	github.com/hashicorp/go-version v1.6.0
@@ -97,6 +97,7 @@ require (
 	github.com/urfave/cli v1.22.2 // indirect
 	go.uber.org/atomic v1.7.0 // indirect
 	golang.org/x/crypto v0.0.0-20220411220226-7b82a4e95df4 // indirect
+	golang.org/x/exp v0.0.0-20230321023759-10a507213a29 // indirect
 	golang.org/x/net v0.8.0 // indirect
 	golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b // indirect
 	golang.org/x/sys v0.6.0 // indirect

acceptance/go.sum

@@ -362,6 +362,8 @@ github.com/gruntwork-io/terratest v0.31.2 h1:xvYHA80MUq5kx670dM18HInewOrrQrAN+Xb
 github.com/gruntwork-io/terratest v0.31.2/go.mod h1:EEgJie28gX/4AD71IFqgMj6e99KP5mi81hEtzmDjxTo=
 github.com/hashicorp/consul-k8s/control-plane v0.0.0-20221117191905-0b1cc2b631e3 h1:4wROIZB8Y4cN/wPILChc2zQ/q00z1VyJitdgyLbITdU=
 github.com/hashicorp/consul-k8s/control-plane v0.0.0-20221117191905-0b1cc2b631e3/go.mod h1:j9Db/whkzvNC+KP2GftY0HxxleLm9swxXjlu3tYaOAw=
+github.com/hashicorp/consul/api v1.10.1-0.20230530193107-04a0d0133ae4 h1:6kUTk+YBgA5X5b3gNAoI18WEK4/t75LcWSimEgmpFdg=
+github.com/hashicorp/consul/api v1.10.1-0.20230530193107-04a0d0133ae4/go.mod h1:tXfrC6o0yFTgAW46xd5Ic8STHc9oIBcRVBcwhX5KNCQ=
 github.com/hashicorp/consul/api v1.20.0 h1:9IHTjNVSZ7MIwjlW3N3a7iGiykCMDpxZu8jsxFJh0yc=
 github.com/hashicorp/consul/api v1.20.0/go.mod h1:nR64eD44KQ59Of/ECwt2vUmIK2DKsDzAwTmwmLl8Wpo=
 github.com/hashicorp/consul/sdk v0.13.1 h1:EygWVWWMczTzXGpO93awkHFzfUka6hLYJ0qhETd+6lY=
@@ -749,6 +751,8 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
+golang.org/x/exp v0.0.0-20230321023759-10a507213a29 h1:ooxPy7fPvB4kwsA2h+iBNHkAbp/4JxTSwCmvdjEYmug=
+golang.org/x/exp v0.0.0-20230321023759-10a507213a29/go.mod h1:CxIveKay+FTh1D0yPZemJVgC/95VzuuOLq5Qi4xnoYc=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=