54 Commits (02ff2db66e015aed51a2b9d1735dcc8036d9bfba)

Author	SHA1	Message	Date
Jim	70ad081e39	Events: convert from hclog to events (#1409)	5 years ago
Jim	11124794bf	Events: add node for formatting/filtering cloudevents (#1390)	5 years ago
Chris Marchesi	1ebb8efab6	Apply extra review feedback from #1340 (#1400) ... * internal/servers/controller: refactor WaitForNextWorkerStatusUpdate * internal/servers/worker: use connId instead of conn.GetConnectionId() * internal/servers/worker: remove Worker.logClose * internal/session: complement versus inclusive state search * internal/session: use ScanRows instead of Scan * internal/session: make closeConnectionsForDeadServersCte results gormable * internal/tests/cluster: rename TestWorkerSessionCleanup to TestSessionCleanup * Simplify SQL query for CloseConnectionsForDeadWorkers (#1410) Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>	5 years ago
Jeff Mitchell	ce52acb968	Update strutil import	5 years ago
Jeff Mitchell	140c54e319	Repoint base62 import	5 years ago
Chris Marchesi	5a70875726	internal/servers/controller: Worker failure connection cleanup (#1340) ... This commit adds the support to do the following: * Mark connections for non-reporting workers as closed. This is the controller counterpart to the worker functionality (see #1330). This is written as a scheduled job that does the work DB-side in a single atomic query. * Works to reconcile states if such a broken controller-worker connection resumes and a worker reports a connection as connected that should be disconnected. In this case, the controller will send an update request, and the worker will honor it and terminate the connection. * Further refinement of the grace period setting has been added here. We have converged on the current server "liveness" setting as our default here, which is half of the previous 30s (15 seconds, in other words). Additionally, this is now configurable on the controller and worker side, with the caveat that it's currently impossible to do so in config as the setting has been untagged in HCL. This is exposed so that we can run some sophisticated testing scenarios where we skew the grace period to either the controller or worker to ensure the aforementioned reconciliation works. * Some repository functions have been added to support the new functionality, in addition to some test code to the worker to allow querying of session state while testing. * Finally, we've added some add timestamp subtraction functions as well, basically serving as the opposite of the addition functions.	5 years ago
Jeff Mitchell	2cbcf9a563	Update usage of shared-secure-libs (#1393)	5 years ago
Jim	1daa3ebefe	integrate events into the servers (#1355)	5 years ago
Chris Marchesi	9f9acce972	[Merge to main] internal/servers/worker: Controller failure connection cleanup (#1330) (#1357) ... This commit adds some rudimentary functionality for cleaning up connections on controller failure, or more specifically, a failure to communicate with the controllers. In this scenario, when a status cannot be sent for any reason for longer than 30 seconds, the worker will close all connections that are normally not cleaned up (so for sessions that currently are *not* in the progress of being canceled or terminated). Status requests now time out after 10 seconds if they are not made successfully. Session status is not touched during this process, but natural cleanup or connectionless sessions will still occur. This should be okay, as the session should be added on re-connect if need be. A few other changes are made to cancelConnections: first, error logging has been moved to the function so that we can handle errors requesting cancellation directly within the function; this entails simply just locally marking these connections as closed with a warning. Second, there was a minor logging bug where closed connections were not properly being noted in the last trace log, this has been fixed. Additional changes: * Circle: Set acceptance test no_output_timeout to 30m	5 years ago
Jeff Mitchell	054c0aa538	Update password generated account IDs (#1290)	5 years ago
Jeff Mitchell	ad93315b59	Add predictable account IDs in dev mode (#1271)	5 years ago
Jeff Mitchell	7da892a054	Managed Groups OIDC Repo (#1254)	5 years ago
Jeff Mitchell	15bd1a5245	Add initial SQL for managed groups (#1253)	5 years ago
s-christoff	9ceeb3bd65	Add -container-image flag (#1112)	5 years ago
Jim	dd0f34bc35	Add new OIDC auth method. (#1090) ... Co-authored-by: Todd Knight <T.Alan.Knight@gmail.com> Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com> Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>	5 years ago
Jeff Mitchell	6605b4c9f8	Revamp authenticate (#1025)	5 years ago
Jeff Mitchell	22462cdd84	Add read:self and cancel:self to sessions; add dev unpriv user (#923) ... * Sessions support for read:self and cancel:self permissions. This is automatic with fallback; no API change is needed. * Strips out values from listing if only self actions are allowed on the resource and the user ID is different. This prevents a default ACL of id=*;type=session;actions=read:self,cancel:self from causing all values to be visible when listing. * Adds an unprivileged user to development/testing instances. This user has only default permissions plus the ability to authorize sessions in the default target.	5 years ago
Todd Knight	1f9fcad1cd	Adding Migrate Command (#872)	5 years ago
Jeff Mitchell	717a3b52ee	Add worker tagging (#862) ... This allows workers to have tags assigned to them, which can then be filtered to control which targets they are allowed to serve.	5 years ago
Todd Knight	ec6151d174	Organize DB Schema Migration Code and DB Init Checks (#842) ... Create Schema Manager and propagate contexts into the DB calls downstream. Add checks at controller startup and database init for correct schema version and schema migration dirty bit being set.	5 years ago
Jeff Mitchell	e2e4631929	Add ability to set public cluster address (#761)	5 years ago
Jeff Mitchell	1f48d97327	Support for Unix domain socket listeners (#705) ... The client already supports protocol-agnostic transport so handles unix:/// schemes.	5 years ago
Jeff Mitchell	fa700dc002	Add account ID templating (#518) ... * Remove default role and create via the same mechanism as other initial resources	6 years ago
Todd Knight	fd0da998e8	SDK error revamp (#432) ... SDK methods now return 1 error. To differentiate between Client errors and Server errors I've also implemented the AsServerError function which returns an *api.Error if it is an error originating from the remote server or nil otherwise.	6 years ago
Jeff Mitchell	41a3c66ea1	Add names to init output (#428)	6 years ago
Jeff Mitchell	31fe9292b3	Instantiate default resources (#425)	6 years ago
Jeff Mitchell	8d8a7358f8	Add AdditionalVerification function (#423)	6 years ago
Jeff Mitchell	dd06615c2e	Add database initialization command (#400)	6 years ago
Jeff Mitchell	ff8ce053e1	Don't try to recreate resources when adding test cluster members	6 years ago
Jeff Mitchell	37e9fed2e3	Allow not destroying dev databases (#366) ... This also shifts some logic around to better prepare for non-dev-mode workloads, although it does not actually call the KMS creation functions and initial auth method creation from non-dev commands yet.	6 years ago
Jeff Mitchell	c4e2b88022	Add database URL. (#365) ... * Add database URL. This allows specification of either a file://, env://, or other string. If it starts with file:// or env:// the actual value will be read from those resources. * Tidy up the KMS output * Also run migrations in test mode when specifying the URL	6 years ago
Jeff Mitchell	a00ee7a948	Add Result types to Go SDK and properly populate body/map fields (#358)	6 years ago
Todd Knight	c3ecea172d	Generate new version of SDK resources and Add Tests (#331)	6 years ago
Jeff Mitchell	c4522aa813	Update host sets and auth system to new paradigm (#319)	6 years ago
Jeff Mitchell	b53812a5c1	Add ability to skip automatic auth method creation (#306) ... This is useful if you, for instance, want Terraform to be 100% responsible for creation of resources (outside of the static ones that cannot be removed or modified, like u_anon). This will mean using the recovery mechanism for initial setup, but that isn't an issue once TF supports that :-)	6 years ago
Jeff Mitchell	ac4d9fa311	Add nonce storage and replay prevention test (#293)	6 years ago
Jeff Mitchell	b47cca0329	Add (non-db aspects of) the recovery key workflow (#286)	6 years ago
Jim	9570897032	basic keys mgmt repo (#264)	6 years ago
Jeff Mitchell	282177afc2	Remove the default org (#270)	6 years ago
Jeff Mitchell	fff15bc9f3	Rename KMS purpose 'controller' to 'root'	6 years ago
Jeff Mitchell	203e2b5dc2	Initial worker porting steps (#232)	6 years ago
Jeff Mitchell	4cfab04307	Migrate user name to login name (#255)	6 years ago
Jeff Mitchell	6661117d4c	The name. The name. The name!	6 years ago
Jeff Mitchell	df4730b1a0	Minor fixes and first API test changeover (#243)	6 years ago
Todd Knight	f84991c0f1	Use authenticate and Auth Method repo functions (#242)	6 years ago
Jeff Mitchell	388a13b10d	Convert scopes to the new paradigm (#206)	6 years ago
Todd Knight	28dbcd84bd	Authenticate Handler API and SDK, and much more (#183)	6 years ago
Jeff Mitchell	8de5371499	Enable UI handling logic with dev passthrough directories. (#145) ... * Enable UI handling logic with dev passthrough directories. * Add tests and fix a couple of things	6 years ago
Todd Knight	df6ca5289f	Create User Service Handler and SDK (#106) ... * Create user handler stuff. * Fixing Not Found errors from DB. * Fixing param names. * Update the proto's go package generation. * Generate the user resource. * Adding SDK methods for users. * Fix the base type of Users and add tests. * Connect user service to the controller handler. * Attach the default org to the Test Controller's client. * Take into account the provided request paths when the client builds the org/project path prefix. * Adding comments to the API. * rename repo function to repoFn. * Fix typo in update mask errors. * Clean up tests. * Remove special checks for request url content in the api client and fix CORS test.	6 years ago
Jeff Mitchell	fafdcbbfa4	CORS support (#73) ... This adds per-listener CORS support. Logic is ported from Vault, along with a fully new test suite.	6 years ago