Merge branch 'main' of ssh://github.com/hashicorp/consul

.changelog/20062.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+Upgrade to use Go 1.21.6.
+```

.github/scripts/set_test_package_matrix.sh

@@ -5,13 +5,15 @@
 set -euo pipefail
 export RUNNER_COUNT=$1
 
-if ((RUNNER_COUNT < 1 ))
+if ((RUNNER_COUNT < 2 ))
 then
-  echo ERROR: RUNNER_COUNT must be greater than zero.
+  echo ERROR: RUNNER_COUNT must be greater than 1. Otherwise use the non-split unit test cod in .github/workflows/reusable-unit.yml.
   exit 1 # terminate and indicate error
+else
+  EFFECTIVE_RUNNER_COUNT=$((RUNNER_COUNT-1))
 fi
 
 # set matrix var to list of unique packages containing tests
-matrix="$(go list -json="ImportPath,TestGoFiles" ./... | jq --compact-output '. | select(.TestGoFiles != null) | .ImportPath' | shuf | jq --slurp --compact-output '.' | jq --argjson runnercount $RUNNER_COUNT  -cM '[_nwise(length / $runnercount | ceil)]'))"
+matrix="$(go list -json="ImportPath,TestGoFiles" ./... | jq --compact-output '. | select(.TestGoFiles != null) | select(.ImportPath != "github.com/hashicorp/consul/agent") | .ImportPath' | shuf | jq --slurp --compact-output '.' | jq --argjson runnercount $EFFECTIVE_RUNNER_COUNT  -cM '[_nwise(length / $runnercount | ceil)]' | jq --compact-output  '. += [["github.com/hashicorp/consul/agent"]]'))"
 
 echo "matrix=${matrix}" >> "${GITHUB_OUTPUT}"

.github/workflows/go-tests.yml

@@ -408,17 +408,19 @@ jobs:
       consul-license: ${{secrets.CONSUL_LICENSE}}
       datadog-api-key: "${{ !endsWith(github.repository, '-enterprise') && secrets.DATADOG_API_KEY || '' }}"
 
-  go-test-api-1-19:
+  go-test-api-backwards-compatibility:
+    name: go-test-api-${{ needs.get-go-version.outputs.go-version-previous }}
     needs:
     - setup
+    - get-go-version
     - dev-build
     uses: ./.github/workflows/reusable-unit.yml
     with:
       directory: api
       runs-on: ${{ needs.setup.outputs.compute-large }}
       repository-name: ${{ github.repository }}
       go-tags: "${{ github.event.repository.name == 'consul-enterprise' && 'consulent consuldev' || '' }}"
-      go-version: "1.19"
+      go-version: ${{ needs.get-go-version.outputs.go-version-previous }}
     permissions:
       id-token: write # NOTE: this permission is explicitly required for Vault auth.
       contents: read
@@ -427,17 +429,18 @@ jobs:
       consul-license: ${{secrets.CONSUL_LICENSE}}
       datadog-api-key: "${{ !endsWith(github.repository, '-enterprise') && secrets.DATADOG_API_KEY || '' }}"
 
-  go-test-api-1-20:
+  go-test-api:
     needs:
     - setup
+    - get-go-version
     - dev-build
     uses: ./.github/workflows/reusable-unit.yml
     with:
       directory: api
       runs-on: ${{ needs.setup.outputs.compute-large }}
       repository-name: ${{ github.repository }}
       go-tags: "${{ github.event.repository.name == 'consul-enterprise' && 'consulent consuldev' || '' }}"
-      go-version: "1.20"
+      go-version: ${{ needs.get-go-version.outputs.go-version }}
     permissions:
       id-token: write # NOTE: this permission is explicitly required for Vault auth.
       contents: read
@@ -446,17 +449,19 @@ jobs:
       consul-license: ${{secrets.CONSUL_LICENSE}}
       datadog-api-key: "${{ !endsWith(github.repository, '-enterprise') && secrets.DATADOG_API_KEY || '' }}"
 
-  go-test-sdk-1-19:
+  go-test-sdk-backwards-compatibility:
+    name: go-test-sdk-${{ needs.get-go-version.outputs.go-version-previous }}
     needs:
     - setup
+    - get-go-version
     - dev-build
     uses: ./.github/workflows/reusable-unit.yml
     with:
       directory: sdk
       runs-on: ${{ needs.setup.outputs.compute-large }}
       repository-name: ${{ github.repository }}
       go-tags: "${{ github.event.repository.name == 'consul-enterprise' && 'consulent consuldev' || '' }}"
-      go-version: "1.19"
+      go-version: ${{ needs.get-go-version.outputs.go-version-previous }}
     permissions:
       id-token: write # NOTE: this permission is explicitly required for Vault auth.
       contents: read
@@ -465,17 +470,18 @@ jobs:
       consul-license: ${{secrets.CONSUL_LICENSE}}
       datadog-api-key: "${{ !endsWith(github.repository, '-enterprise') && secrets.DATADOG_API_KEY || '' }}"
 
-  go-test-sdk-1-20:
+  go-test-sdk:
     needs:
     - setup
+    - get-go-version
     - dev-build
     uses: ./.github/workflows/reusable-unit.yml
     with:
       directory: sdk
       runs-on: ${{ needs.setup.outputs.compute-large }}
       repository-name: ${{ github.repository }}
       go-tags: "${{ github.event.repository.name == 'consul-enterprise' && 'consulent consuldev' || '' }}"
-      go-version: "1.20"
+      go-version: ${{ needs.get-go-version.outputs.go-version }}
     permissions:
       id-token: write # NOTE: this permission is explicitly required for Vault auth.
       contents: read
@@ -521,10 +527,10 @@ jobs:
     - go-test-race
     - go-test-envoyextensions
     - go-test-troubleshoot
-    - go-test-api-1-19
-    - go-test-api-1-20
-    - go-test-sdk-1-19
-    - go-test-sdk-1-20
+    - go-test-api-backwards-compatibility
+    - go-test-api
+    - go-test-sdk-backwards-compatibility
+    - go-test-sdk
     - go-test-32bit
     # - go-test-s390x
     runs-on: ${{ fromJSON(needs.setup.outputs.compute-small) }}

.github/workflows/reusable-get-go-version.yml

@@ -6,13 +6,17 @@ on:
       go-version:
         description: "The Go version detected by this workflow"
         value: ${{ jobs.get-go-version.outputs.go-version }}
+      go-version-previous:
+        description: "The Go version (MAJOR.MINOR) prior to the current one, used for backwards compatibility testing"
+        value: ${{ jobs.get-go-version.outputs.go-version-previous }}
 
 jobs:
   get-go-version:
     name: "Determine Go toolchain version"
     runs-on: ubuntu-latest
     outputs:
       go-version: ${{ steps.get-go-version.outputs.go-version }}
+      go-version-previous: ${{ steps.get-go-version.outputs.go-version-previous }}
     steps:
       - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
       - name: Determine Go version
@@ -32,3 +36,7 @@ jobs:
           GO_VERSION=$(head -n 1 .go-version)
           echo "Building with Go ${GO_VERSION}"
           echo "go-version=${GO_VERSION}" >> $GITHUB_OUTPUT
+          GO_MINOR_VERSION=${GO_VERSION%.*}
+          GO_VERSION_PREVIOUS="${GO_MINOR_VERSION%.*}.$((${GO_MINOR_VERSION#*.}-1))"
+          echo "Previous version ${GO_VERSION_PREVIOUS}"
+          echo "go-version-previous=${GO_VERSION_PREVIOUS}" >> $GITHUB_OUTPUT

.github/workflows/reusable-lint.yml

@@ -51,10 +51,12 @@ jobs:
         with:
           go-version: ${{ inputs.go-version }}
       - run: go env
+      - name: Set golangci-lint version
+        run: echo "GOLANGCI_LINT_VERSION=$(make --no-print-directory print-GOLANGCI_LINT_VERSION)" >> $GITHUB_ENV
       - name: lint-${{ matrix.directory }}
         uses: golangci/golangci-lint-action@639cd343e1d3b897ff35927a75193d57cfcba299 # v3.6.0
         with:
           working-directory: ${{ matrix.directory }}
-          version: v1.51.1
+          version: ${{ env.GOLANGCI_LINT_VERSION }}
           args: --build-tags="${{ env.GOTAGS }}" -v
           skip-cache: true

.github/workflows/test-integrations.yml

@@ -160,6 +160,7 @@ jobs:
     runs-on: ${{ fromJSON(needs.setup.outputs.compute-large) }}
     needs:
       - setup
+      - get-go-version
       - dev-build
     permissions:
       id-token: write # NOTE: this permission is explicitly required for Vault auth.
@@ -179,8 +180,9 @@ jobs:
 
       - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
         with:
-          # Do not explicitly set Go version here, as it should depend on what Vault declares.
-          go-version-file: 'go.mod'
+          # We use the current Consul Go version here since Vault is installed as a binary
+          # and tests are run from the Consul repo.
+          go-version: ${{ needs.get-go-version.outputs.go-version }}
 
       - name: Install Vault
         run: |

.go-version

@@ -1 +1 @@
-1.20.12
+1.21.6

.golangci.yml

@@ -98,18 +98,14 @@ linters-settings:
               - google.golang.org/protobuf
 
   depguard:
-    list-type: denylist
-    include-go-root: true
-    # A list of packages for the list type specified.
-    # Default: []
-    packages:
-      - net/rpc
-    # A list of packages for the list type specified.
-    # Specify an error message to output when a denied package is used.
-    # Default: []
-    packages-with-error-message:
-      - net/rpc: "only use forked copy in github.com/hashicorp/consul-net-rpc/net/rpc"
-      - github.com/golang/protobuf: "only use google.golang.org/protobuf"
+    rules:
+      main:
+        listMode: lax
+        deny:
+        - pkg: net/rpc
+          desc: "only use forked copy in github.com/hashicorp/consul-net-rpc/net/rpc"
+        - pkg: github.com/golang/protobuf
+          desc: "only use google.golang.org/protobuf"
 
 run:
   timeout: 10m

.grpcmocks.yaml

@@ -2,8 +2,9 @@
 # SPDX-License-Identifier: BUSL-1.1
 
 with-expecter: true
-all: true
 recursive: true
+include-regex: ".*"
+exclude-regex: "(serverStream|Is(Inmem|Cloning).*Client)"
 # We don't want the mocks within proto-public to prevent forcing a dependency
 # of the testify library on the modules usage. The mocks are only for
 # internal testing purposes. Other consumers can generated the mocks into

Makefile

@@ -10,7 +10,7 @@ GO_MODULES := $(shell find . -name go.mod -exec dirname {} \; | grep -v "proto-g
 # These version variables can either be a valid string for "go install <module>@<version>"
 # or the string @DEV to imply use what is currently installed locally.
 ###
-GOLANGCI_LINT_VERSION='v1.51.1'
+GOLANGCI_LINT_VERSION='v1.55.2'
 MOCKERY_VERSION='v2.37.1'
 BUF_VERSION='v1.26.0'
 

agent/acl_endpoint_test.go

@@ -2217,7 +2217,7 @@ func TestACL_Authorize(t *testing.T) {
 	}
 
 	t.Parallel()
-	a1 := NewTestAgent(t, TestACLConfigWithParams(nil))
+	a1 := NewTestAgent(t, TestACLConfigWithParams(nil), TestAgentOpts{DisableACLBootstrapCheck: true})
 	defer a1.Shutdown()
 
 	testrpc.WaitForTestAgent(t, a1.RPC, "dc1", testrpc.WithToken(TestDefaultInitialManagementToken))
@@ -2253,7 +2253,7 @@ func TestACL_Authorize(t *testing.T) {
 	secondaryParams.ReplicationToken = secondaryParams.InitialManagementToken
 	secondaryParams.EnableTokenReplication = true
 
-	a2 := NewTestAgent(t, `datacenter = "dc2" `+TestACLConfigWithParams(secondaryParams))
+	a2 := NewTestAgent(t, `datacenter = "dc2" `+TestACLConfigWithParams(secondaryParams), TestAgentOpts{DisableACLBootstrapCheck: true})
 	defer a2.Shutdown()
 
 	addr := fmt.Sprintf("127.0.0.1:%d", a1.Config.SerfPortWAN)

agent/agent.go

@@ -24,18 +24,19 @@ import (
 
 	"github.com/armon/go-metrics"
 	"github.com/armon/go-metrics/prometheus"
+	"github.com/rboyer/safeio"
+	"golang.org/x/net/http2"
+	"golang.org/x/net/http2/h2c"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/keepalive"
+
 	"github.com/hashicorp/go-connlimit"
 	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-memdb"
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/hcp-scada-provider/capability"
 	"github.com/hashicorp/raft"
 	"github.com/hashicorp/serf/serf"
-	"github.com/rboyer/safeio"
-	"golang.org/x/net/http2"
-	"golang.org/x/net/http2/h2c"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/keepalive"
 
 	"github.com/hashicorp/consul/acl"
 	"github.com/hashicorp/consul/acl/resolver"
@@ -240,6 +241,9 @@ type Agent struct {
 	// config is the agent configuration.
 	config *config.RuntimeConfig
 
+	displayOnlyConfigCopy     *config.RuntimeConfig
+	displayOnlyConfigCopyLock sync.Mutex
+
 	// Used for writing our logs
 	logger hclog.InterceptLogger
 
@@ -4438,11 +4442,22 @@ func (a *Agent) reloadConfigInternal(newCfg *config.RuntimeConfig) error {
 	a.config.EnableDebug = newCfg.EnableDebug
 
 	// update Agent config with new config
-	a.config = newCfg.DeepCopy()
+	a.displayOnlyConfigCopyLock.Lock()
+	a.displayOnlyConfigCopy = newCfg.DeepCopy()
+	a.displayOnlyConfigCopyLock.Unlock()
 
 	return nil
 }
 
+func (a *Agent) getRuntimeConfigForDisplay() *config.RuntimeConfig {
+	a.displayOnlyConfigCopyLock.Lock()
+	defer a.displayOnlyConfigCopyLock.Unlock()
+	if a.displayOnlyConfigCopy != nil {
+		return a.displayOnlyConfigCopy.DeepCopy()
+	}
+	return a.config
+}
+
 // LocalBlockingQuery performs a blocking query in a generic way against
 // local agent state that has no RPC or raft to back it. It uses `hash` parameter
 // instead of an `index`.