connect: enable proxy.expose configuration

[shoenig]

Part of #6120

Enable configuration of HTTP and gRPC endpoints which should be exposed by
the Connect sidecar proxy. This changeset is the first "non-magical" pass
that lays the groundwork for enabling Consul service checks for tasks
running in a network namespace because they are Connect-enabled. The changes
here provide for full configuration of the

  connect {
    sidecar_service {
      proxy {
        expose {
          paths = [{
                path = <exposed endpoint>
                protocol = <http or grpc>
                local_path_port = <local endpoint port>
                listener_port = <inbound mesh port>
          }, ... ]
       }
    }
  }

stanza. Everything from expose and below is new, and partially implements
the precedent set by Consul:

https://www.consul.io/docs/connect/registration/service-registration.html#expose-paths-configuration-reference

Combined with a task-group level network port-mapping in the form:

  port "exposeExample" { to = -1 }

it is now possible to "punch a hole" through the network namespace
to a specific HTTP or gRPC path, with the anticipated use case of creating
Consul checks on Connect enabled services.

A future PR may introduce more automagic behavior, where we can do things like

1. auto-fill the 'expose.path.local_path_port' with the default value of the
   'service.port' value for task-group level connect-enabled services.

2. automatically generate a port-mapping

3. enable an 'expose.checks' flag which automatically creates exposed endpoints
   for every compatible consul service check (http/grpc checks on connect
   enabled services).

[nickethier]

I did a quickish pass over this. I will do a more thorough review, but wanted your thoughts about how the expose paths are modeled in the job file. I think keeping the api the way that it is so it mimic's the way its modeled in Consul is great. However, I wonder if we could clean up the jobfile UX a little bit by supporting multiple path {...} blocks instead of one paths = [{...}] statement. Thoughts?

[shoenig]

Yeah @nickethier we can definitely tweak the jobfile UX. Just to make sure I understand the suggestion, a more complete example would look something like,

connect {
  sidecar_service {
    proxy {
      expose {

        path {
          path            = "/health"
          protocol        = "http"
          local_path_port = 8080
          listener_port   = "healthcheck"
        }

        path {
          path            = "/metrics"
          protocol        = "grpc"
          local_path_port = 8080
          listener_port   = "metrics"
        }
      }
    }
  }
}

[shoenig]

I made the path stanza block change, and added some forgotten key validation for individual paths.

The automagic pieces will be in more PRs, along with e2e tests and doc updates.

[shoenig]

@nickethier or @schmichael any last thoughts? Otherwise this just needs an approval ~

[github-actions]

I'm going to lock this pull request because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.