76 Commits (moduli-e2e-admin-ui)

Author	SHA1	Message	Date
oss-core-libraries-dashboard[bot]	429247f407	[COMPLIANCE] Update Copyright Headers (#6282) ... * [COMPLIANCE] Update Copyright and License Headers * chore: make gen to generate files with copyright headers * chore: update missed copyright headers --------- Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com> Co-authored-by: Justin Nguyen <justin.nguyen@hashicorp.com>	3 months ago
Sorawis Nilparuk (Bo)	fe09f61a85	chore(test) fix flaky tests (#6315) ... * internal/cmd/commands/server/listener_reload_test.go remove t.Parallel() comment * internal/cmd/commands/server/worker_initial_upstreams_reload_test.go remove t.Parallel * internal/cmd/commands/server/worker_tags_reload_test.go wait by polling worker instead of sleep * internal/daemon/worker/routing_info.go make deep copy in LastRoutingInfoSuccess to avoid race condition * internal/tests/cluster/parallel/orphaned_connections_test.go raise grace period time to allow test to wait for longer * improve logging in sequential tests * move ports around and use t.Cleanup to send shutdown signal to test server * fix one typo * do final assert in t.Cleanup instead of defer * undo t.Cleanup change * add another signal to force shutdown running servers * add exit early and increase server start timeout * tighten workerRPC settings on session tests * tighten more workerRPC timing * make gen * add comment explaining deep copying lastRoutingInfoSuccess	3 months ago
Hugo	2316fecbd6	Remove nhooyr.io/websocket from Boundary (#5992)	8 months ago
Hugo	a65d5d8573	feat: Normalize fields across various Boundary components (#5599) ... Normalizes various IP/Address/Host fields across Boundary resources/components to comply with IPv6 specifications.	11 months ago
Johan Brandhorst-Satzkorn	a43cb90a32	internal/session: ensure orphaned connection cleanup (#5438) ... Previously, the orphaned connection cleanup job would not detect that a connection that was created before a worker had submitted a successful session info was orphaned. We now fall back to using the worker update time as an indicator if the session info time is not set.	1 year ago
Johan Brandhorst-Satzkorn	ec0a3f964b	Worker status refactor (#5417) ... * oss: feat(proto): statistics rpc added to server coordination service * oss: feat(session): add update statistics status service * oss: feat(handlers): add Statistics method to worker service server * oss: feat(worker): add statistics ticking * oss: internal/proto: define the new RoutingInfo RPC * oss: internal/server: repository changes for RoutingInfo RPC * oss: internal/daemon: add RoutingInfo handler to worker service The new RoutingInfo RPC is used to get information from the worker that is used to make routing decisions on the controller. It also handles the initial request from the worker. * oss: feat(db): server_worker_session_info table * oss: feat(proto): session info rpc for server coordination service * oss: feat(server): worker session info request data type * oss: feat(worker): session info ticker * oss: feat(handler): server coordination handler for session info * oss: feat(session): utilize session info request time for session cleanup * oss: proto: fix some gotags comments Some of these fields were missing comments, while others had incorrectly formatted comments. * oss: worker: send connection status to server This is required for the correct tracking of orphaned connections * oss: internal/daemon/worker: add function to wait for Statistics RPC * oss: internal/daemon/worker: add routing info RPC The new RoutingInfo RPC replaces part of the Status RPC, namely the part which is used by the controller and worker to perform decisions around the establishment of new sessions and new worker connections. * oss: internal/daemon/worker: remove unnecessary error check * oss: internal/daemon/worker: lock access to config and upstreams The new confLock protects access to the conf value and to the addressReceivers slice. * oss: worker: replace Status RPC with RoutingInfo * oss: worker: deprecate the Status RPC and related types The Status RPC and related messages have been replaced by the RoutingInfo/SessionInfo/Statistics RPCs. The controller will continue to support the Status RPC until two new minor versions have been released. * oss: internal/event: add default deny for new worker RPCs * oss: internal/daemon/worker: allow RPC interval to be set The new SessionInfo/RoutingInfo/Statistics RPCs run at long intervals, which make some of our cluster tests take a long time to complete. This allows their interval to be configured in tests. * oss: all: use TestWorkerRPCInterval in slow tests This should speed up these tests significantly. * oss: internal/tests/cluster: reset sys eventer in test --------- Co-authored-by: Damian Debkowski <damian.debkowski@hashicorp.com>	1 year ago
Hugo	846c849589	Worker Domain Refactor (#5338) ... * feat(server): Refactor LookupWorkerByName to be a test method * feat(server): Split worker tags table * refact(worker): Export api and config tags * refact(server): Return worker id from UpsertWorkerStatus * refact(server): Create ListWorkerStorageBucketUpdates domain function * refact(server): Use dedicated HCPb-worker list func * refact(server): Create ConnectionRoute domain function * refact(handlers): Move worker selection logic to internal/server package This commit moves all the logic to select a worker to handle a session to the internal/server package. Most functions were moved to this package with no changes, however, there are a couple of notable exceptions: - Given that we don't use GRPC errors in repos, all errors were adjusted to use the internal/errors package instead. - StorageBucketFilterCredIdFn is now used to prevent the internal/server package from importing internal/storage/plugin, which would cause a dep cycle. Callers of SelectSessionWorkers must implement this func which is responsible for returning a storage bucket's worker filter as well as its associated credential id. - authorizeSessionWithWorkerFilter now receives an internal/server.(*Repository) object when called. This is transparent to SelectSessionWorkers callers as it is handled internally. * feat(server): Add FilteredWithFeatures fn and new server options * refact(server): create new list and lookup worker queries * test(server): Add WorkerList unit tests * feat(server): Implement WorkerList randomness using crypto/rand pkg * chore(db): add index to server_worker table * refact(server): prefix test method with Test * refact(server): rename Downstreamers interface to Graph * chore(server): unexport and rename method * chore: add doc string to WorkerAddress (#5420) --------- Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com> Co-authored-by: irenarindos <irena.rindos@gmail.com>	1 year ago
Damian Debkowski	dd1482b5ac	test(cluster): check worker status multiple times (#5393)	1 year ago
Damian Debkowski	98bb4c8c31	test(cluster): split tests between parallel and sequential packages (#5390)	1 year ago
dani	62c41191ff	[fix] allow IPv6 controllers, workers, and targets (#5221) ... Co-authored-by: Damian Debkowski <damian.debkowski@hashicorp.com>	1 year ago
Damian Debkowski	9576ed40dc	test: improve test to ensure ipv6 compatability (#5113)	2 years ago
Johan Brandhorst-Satzkorn	a830892fec	Some test fixes (#5084) ... * internal/session: update variable name in test This was missed in #5071 * internal/tests/cluster: skip failing tests These tests will need to be fixed or removed. It is not clear why they are failing, but they are always failing. * Makefile: try upgrading golangci-lint * internal/host/plugin: fix flaky test Hosts contain IP addresses in string form, whose order is not defined.	2 years ago
Irena Rindos	325949c23a	chore: removed commented out time.sleep calls (#4770)	2 years ago
Louis Ruch	7921ce22fd	test(grant): Use ID to validate version check (#4274) ... * test(grant): Use ID to validate version check * Update docs from id to ids * Remove 'id' in 0.16.0	2 years ago
Jeff Mitchell	f5dd457b34	Multiple grant scope IDs (#4251) ... Co-authored-by: Timothy Messier <tim.messier@gmail.com> Co-authored-by: Todd <github@quaddi.com>	2 years ago
Jeff Mitchell	fff5f9506f	Migrate proxy logic to the API package (#4216) ... This allows arbitrary programs to have an easy mechanism to make connections through Boundary using Go. Internal cluster tests and test helpers have been migrated to use this package, as well as the `connect` command. --------- Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>	2 years ago
Jeff Mitchell	9332179a01	Remove the deprecated old KMS worker auth mechanism (#3935) ... This has been superceded by the nodeenrollment-based KMS worker auth mechanism. This commit only removes the ability to connect with this mechanism; some upgrade logic will remain intact for a bit and can be removed later.	2 years ago
Jeff Mitchell	fe4c43305c	Move and export ExpectWorkers (#4207) ... This is a useful test function and keeping it in the cluster package means it can't be used by api/cli tests.	2 years ago
Irena Rindos	9733a250fa	refact(event): move observability/event to event (#3704)	3 years ago
Johan Brandhorst-Satzkorn	f89515a19c	all: avoid mutating global state in parallel tests (#3687) ... The SetupSuiteTargetFilters globally mutates the function used for logic inside the target handler service. This means that we could get inconsistent logical behavior in certain tests that were run in parallel, since the logic can change at runtime. Ensure tests that make use of this function are never run in parallel with other tests.	3 years ago
hashicorp-copywrite[bot]	29da0bcb92	[COMPLIANCE] License changes (#3567) ... * Adding explicit MPL license for sub-package. This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository. * Adding explicit MPL license for sub-package This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository. * Updating the license from MPL to Business Source License Going forward, this project will be licensed under the Business Source License v1.1. Please see our blog post for more details at https://hashi.co/bsl-blog, FAQ at www.hashicorp.com/licensing-faq, and details of the license at www.hashicorp.com/bsl. * Update copyright file headers to BUS-1.1 * Rerun make gen This will pick up the last of the license changes * Revert "Rerun make gen" This reverts commit dbe0968bff. * Remove copywrite from generation script The current version of copywrite is not sophisticated enough to only apply the copywrite changes to certain subdirectories, so to avoid accidentally relicensing our api and sdk modules, we will stop running the copywrite script until such time that it can do the right thing. * License protobuf API as MPL The protobuf API files are used to generate the SDK, since we want the SDK to be MPL, the protobuf files must also be MPL. This extends to all protobuf files whose sources end up in the SDK directory, including: - internal/proto/controller/api - internal/proto/controller/custom_options - internal/proto/plugin It also includes the generated service directory in internal/gen/controller/api/services, since they are generated from the protobuf sources used for the SDK. * Change website license file name This makes the naming scheme consistent with the rest of the repository. * Add note on licensing to README * Set copywrite license to BUSL * Revert "Add note on licensing to README" This reverts commit 4d865a91a7. --------- Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com> Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>	3 years ago
Jim	fabcb8eeeb	fix: update recursive auth-method listing test (#3348) ... Recently, we made the initial dev ldap auth-method active-public, so it now shows up in listings. This simply fixes the tests to reflect that change.	3 years ago
Jeff Mitchell	929ede1c18	Modify some tests to expose error cases that weren't being exposed (#3302)	3 years ago
Jeff Mitchell	c149bc4a79	Allow slashes in authorize-session when using target name (#3249) ... This requires specifying `**` as the selector in the proto, which will match any segments and simply requires that the verb is the last part of the URL, which it already is.	3 years ago
Jeff Mitchell	769a7c9e1c	Remove cleanup calls for test controller/worker (#3245) ... A previous commit added a call to t.Cleanup in the NewTestController/NewTestWorker commands; as a result these statements are no longer needed.	3 years ago
Jim	667ea285be	feature (boundary dev): add support for dev ldap auth method (#3192)	3 years ago
Johan Brandhorst-Satzkorn	c1a61b9e34	internal/tests/cluster: switch flaky test to polling (#3153) ... * internal/tests/cluster: switch flaky test to polling Also extend deadline from 10 seconds to 1 minute, hopefully this should fix any flakiness in this test. * fixup! internal/tests/cluster: switch flaky test to polling	3 years ago
Jeff Mitchell	bdf7bf7702	Do not allow PKI-KMS workers to have names updated via API (#3143) ... Do not allow PKI-KMS workers to have names updated via API This would cause their public IDs to change, which we do not want. Descriptions are also disallowed, since those come from the config file. This also adds logic to allow upgrading from old KMS method to new, with a test. Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com>	3 years ago
Jeff Mitchell	163ce184b8	KMS-PKI Workers (#3101) ... This adds a new mechanism for worker authentication that uses the third-party arbitration of the original KMS flow by leveraging recently-added capabilities in nodeenrollment to support a registration wrapper. This allows for workers to be registered to the system with just a name and a matching wrapper, while at the same time allowing these workers to be used for private Vault access and multi-hop as they contain per-worker encryption keys and support rotation. Nodes using this mode will generate and rotate credentials in-memory (using another recently added nodeenrollment capability) so will have a new set of keys on every startup. This has the side effect of ensuring that there is never a conflict or re-use of these credentials. Note that the normal test worker flow was using the now-deprecated KMS method; there is still a test that uses this (explicitly) but all other tests using test workers that did not specify a specific PKI flow now actually use this mechanism. This means there is fairly decent test coverage in a general sense, plus the specific tests updated/added for this feature. This also adds a new KMS type that can be used to have distinct KMSes for upstream authentication vs. accepting from downstream.	3 years ago
Johan Brandhorst-Satzkorn	3c29308673	chore: Add license headers to all files	3 years ago
Irena Rindos	9135cc7668	In absence of ingress filter, use directly connected worker (#2757) ... * directly connected ingress filtering	3 years ago
Irena Rindos	173e1587d0	Append initial worker upstreams if current upstreams are unresponsive (#2698) ... * Append initial worker upstreams if current upstreams are unresponsive	3 years ago
Irena Rindos	834a2a88f7	feat(targets): Addition of egress and ingress worker filters (#2654) ... * feat(targets): Addition of egress and ingress worker filters	3 years ago
Jeff Mitchell	0c96c6ff6c	Split grace period into multiple config values (#2578) (#2603) ... Co-authored-by: Todd <github@quaddi.com>	3 years ago
Hugo Vieira	c81398cbf3	feat(worker): Report bytes up and down on Status updates ... With this commit, the Worker now sends BytesUp and BytesDown for each of the connections it handles to the Controller in the Status request. The Controller then persists these fields to the database. There is also a new trigger to prevent bytes_up and bytes_down to change after a connection has been closed, as the last update to a session_connection row should be the one that is performed as part of the connection closure process.	4 years ago
Johan Brandhorst-Satzkorn	f57454b6b9	Rewrite interface{} to any (#2535) ... * chore: Rewrite interface{} to any * Add ignore revs	4 years ago
Irena Rindos	dde0c35f23	Update request data in session manager (#2369) ... * bug(session): Update request data in session manager	4 years ago
Todd	1aad2627c8	OSS side of second downstream connections (see enterprise PR 69) (#2292)	4 years ago
Damian Debkowski	c2bfcc0664	refactor(api module): enforce typed definitions (#2238)	4 years ago
Todd	19b549c44a	Rename package servers to server (#2222)	4 years ago
Haotian	40ba275759	feat(worker): add 'initial_upstreams' field to worker config to prepare to replace 'controllers' field. Update worker config description on website.	4 years ago
Todd	472d7d520a	Remove the server_id from session table, change it to worker_id on session_connection (#2070) ... * Remove the server_id from session table, change it to worker_id on session_connection This is step 1 in updating the worker table. The worker is becoming a public resource so it must have a public id. We drop the server_id column on the session_connection table and add the worker_id column so we can use the wt_public_key type. Since db migrations are applied while the controller is offline, it should be safe to assume all session connections are not in a running state, thus allowing us to null out all the worker ids in the session_connection table. For now we don't have very good enforcement of the wt_public_id constraints, since the id is currently defined in the worker config, but this will soon change and the worker's id will be generated by the controller.	4 years ago
Todd	b58dada40d	Move the server daemons into their own package (#2061) ... * Move the server daemons into their own package With this change the internal/server package now is dedicated to the server domain (workers and controllers) and not to the server daemons. The hope is that this will make it easier to keep the daemons decoupled from the representation of the servers in the database.	4 years ago
Jeff Mitchell	bf9e7874b1	Use custom X.509 verification logic for proxy connections (#2008) ... This reduces the chance that we'll hit a failure due to a mismatched worker address, on the certificate, especially if a worker has multiple addresses. We aren't relying on IP/DNS for security anyways, so let's not have it be a hindrance.	4 years ago
Hugo Vieira	aae944be37	test(worker): Remove test-only hooks from actual code ... This change introduces a `nonceFn` field that can be changed by a test but at runtime is transparent to the code that calls it. The current nonce-generating logic defaults to a test-only field which opens us up to this value inadvertently being set. With this change, the default behavior becomes using `base62` to generate a random nonce, and any tests have to explicitly change that.	4 years ago
Hugo Vieira	61e310998f	refactor(worker): Decouple listeners/servers shutdown ... This change is the Worker-side counterpart to the change in eebdfb88dc.	4 years ago
Hugo Vieira	eebdfb88dc	refact(controller): Decouple listeners/servers shutdown from Worker ... In general, these changes were introduced in the same vein of the changes to controller `startListeners`. Specifically, these changes also decouple the Controller and the Worker shutdown processes. Currently, a call to `stopListeners` on an instance that is running as both a Controller and a Worker would stop the listeners for both. Lastly, we also add unit/integration tests to the shutdown code.	4 years ago
Timothy Messier	79670180a7	refact(session): Move domain logic of Worker Status into domain service ... This creates a domain service function `session.WorkerStatusReport`. The service performs two functions: 1. Checks the status for all of the reported sessions, returning a report of the sessions that are in a "non-active" state, i.e. "cacneling" or "terminated". 2. Looks for any "orphaned" session connections, i.e. connections that are active but were not reported by the worker. These connections are marked as closed. This also removes the "ShouldCloseConnectionsOnWorker" logic, as this was determined to not be a possible state, and was unnecessary.	4 years ago
Irena Rindos	5a2c0db586	fix(session connections): Create session connection repository	4 years ago
Timothy Messier	533b434d1a	refact(controller/targets): Move tcp functionality into subpackage ... This follows a similar pattern as the target domain package, providing a subpackage for the tcp target functionality, allowing this to be pluggable.	4 years ago