boundary

Commit Graph

Author	SHA1	Message	Date
Michael Li	578d87081a	test(e2e): Add test with scp operations (#3812 ) * chore(e2e): Allow ssh to targets to assist with debugging * test(e2e): Add test with scp operations * CR: Use io.CopyN to optimize memory allocation This mitigates the need to allocate a 256K string	2 years ago
Michael Li	dc912e2a86	test: Update tests to account for deprecated features in 0.14.0 (#3776 ) * chore: Fix comment typo * test(e2e): Update to use new credential library type * test(e2e): Update to use new field name * test(bats): Remove tests that use deprecated subcommand * chore: Update to 0.14.0 * test(credentiallibraries): Update to use new credential library type * doc: Add deprecation notices for 0.14.0 * fixup! doc: Add deprecation notices for 0.14.0	2 years ago
Michael Li	94dd9e84fe	test(e2e): Refactor vault setup method (#3724 ) * refact(e2e): Pass in boundary-controller-policy to method This allows any boundary-enterprise specific test packages to point to their own testdata directory * test(e2e): Fix assertion statement * refact(e2e): Move method call for clarity	2 years ago
Michael Li	ff34cb629e	test(e2e): Add a test for a single-hop worker (#3690 ) * refact(e2e): Add env for workers * test(e2e): Add test for single-hop worker * fixup! refact(e2e): Add env for workers * fixup! test(e2e): Add test for single-hop worker * fixup! test(e2e): Add test for single-hop worker * fixup! test(e2e): Add test for single-hop worker * fixup! test(e2e): Add test for single-hop worker	2 years ago
Michael Li	9a6b0d26cb	test(e2e): Add test for `boundary connect postgres` (#3671 ) * refact(e2e): Rename env * test(e2e): Add test for `connect postgres` * fixup! test(e2e): Add test for `connect postgres`	2 years ago
Michael Li	2774fbb8d4	test(e2e): Add test for `connect ssh -remote-command` (#3642 ) * test(e2e): Add test for`connect ssh -remote-command` * test: Fix comments	3 years ago
Michael Li	55d85f90b9	test(e2e): Refactor migration test docker repo definition (#3578 ) This commit refactors docker repo definitions in the migration test to make it simpler to modify which version of boundary is being used. Additionally, this also refactors where "pull image" is performed to reduce another spot where the docker repository needs to be passed in.	3 years ago
hashicorp-copywrite[bot]	29da0bcb92	[COMPLIANCE] License changes (#3567 ) * Adding explicit MPL license for sub-package. This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository. * Adding explicit MPL license for sub-package This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository. * Updating the license from MPL to Business Source License Going forward, this project will be licensed under the Business Source License v1.1. Please see our blog post for more details at https://hashi.co/bsl-blog, FAQ at www.hashicorp.com/licensing-faq, and details of the license at www.hashicorp.com/bsl. * Update copyright file headers to BUS-1.1 * Rerun make gen This will pick up the last of the license changes * Revert "Rerun make gen" This reverts commit `dbe0968bff`. * Remove copywrite from generation script The current version of copywrite is not sophisticated enough to only apply the copywrite changes to certain subdirectories, so to avoid accidentally relicensing our api and sdk modules, we will stop running the copywrite script until such time that it can do the right thing. * License protobuf API as MPL The protobuf API files are used to generate the SDK, since we want the SDK to be MPL, the protobuf files must also be MPL. This extends to all protobuf files whose sources end up in the SDK directory, including: - internal/proto/controller/api - internal/proto/controller/custom_options - internal/proto/plugin It also includes the generated service directory in internal/gen/controller/api/services, since they are generated from the protobuf sources used for the SDK. * Change website license file name This makes the naming scheme consistent with the rest of the repository. * Add note on licensing to README * Set copywrite license to BUSL * Revert "Add note on licensing to README" This reverts commit `4d865a91a7`. --------- Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com> Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>	3 years ago
Michael Li	6c57aa7fda	test(e2e): Add pieces necessary for enterprise migration test (#3555 )	3 years ago
Michael Li	f88d3892cb	test(e2e): Add infra for ssh certificate injection test (#3532 )	3 years ago
Michael Li	cce722c773	test(e2e): Add "update host set filter" check (#3482 )	3 years ago
Michael Li	e821781c94	test(e2e): Update grants to use new ids field (#3475 )	3 years ago
Michael Li	1cb6743f69	test(e2e): Use vault-generic credential library type (#3462 ) The vault credential library type will be deprecated at some point in favor of the vault-generic credential library type.	3 years ago
Stan Ryzhov	732973c7b8	test(e2e): Add test to connect to target via its name and scope (#3387 )	3 years ago
Michael Li	eed17d63b5	test(e2e): Update to use fmt.Sprintf (#3388 )	3 years ago
Michael Li	0af862ba5d	test(e2e): Update test names (#3362 )	3 years ago
Michael Li	42ab20b37b	refact(e2e): Rename some test files and methods (#3360 ) * refact: Rename method for clarity * refact: Rename test files for clarity * test(e2e): Add method for removing brokered credential	3 years ago
Stan Ryzhov	dbad3eee56	test(e2e): Update env variables and target creation (#3339 )	3 years ago
Michael Li	401493d225	test(e2e): Rename test packages (#3334 )	3 years ago
Jim	d4e537c88d	chore: updgrade pgx direct deps to v5 (#3258 )	3 years ago
Michael Li	615fa686c4	test(e2e): Add test that checks that session ends after deleting project (#3221 ) * test(e2e): Add test that checks that session ends after deleting project * CR: Update to create target with address * CR: Rename method for clarification	3 years ago
Josh Brand	603c3c8c9c	fix(e2e): Fix path to echo in connect_test & update scenarios for local builds (#3208 )	3 years ago
Michael Li	b88050a4c4	test(e2e): Fix assertion statement (#3190 )	3 years ago
Michael Li	cecc959a94	test(e2e): Clean up user if test fails (#3180 )	3 years ago
Michael Li	33f3a5ff9c	test(e2e): Add test that uses new worker resource (#3177 )	3 years ago
Jeff Mitchell	20391e3503	Add default client port to targets and use in connect command (#2767 )	3 years ago
Stan Ryzhov	5e9ffd57d4	test(e2e): add test to verify user is logged out on its auth-token deletion (#3160 )	3 years ago
Stan Ryzhov	c675dc07ec	test(e2e): Verify different credentials are brokered to target (#3149 ) * test(e2e): Verify json credentials are brokered back * test(e2e): Get expected json credentials from file * test(e2e): Check private key credentials are brokered to target * test(e2e): Regenerate test .pem file for every test	3 years ago
Michael Li	28b98348cc	test(e2e): Refactor WaitForSessionStatus methods (#3115 )	3 years ago
Michael Li	acda0c3892	chore(enos): Add scenario that uses docker containers for infrastructure (#3073 ) Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>	3 years ago
Michael Li	5ec75924df	refact(e2e): Set up variables to prepare for docker implementation (#2992 ) * refact(e2e): Explicitly define port used for targets To maintain consistency for how we define ports, this change explicitly defines the port used in the enos scenario as opposed to relying on a "default" value. This change is in support of work that attempts to spin up test infrastructure using docker. The openssh-server image uses Port 2222, which needs to be passed to the test suite. * refact(e2e): Add optional "Internal" Vault Address parameter This change enables scenarios that need two different Vault addresses, one used by the Vault CLI and one by the Boundary server instance. In the case when using a Docker container, the Boundary server needs the Vault address "internal" to the Docker network, whereas the Vault CLI running outside of the network needs a different address.	3 years ago
Michael Li	96918f0ab6	test(e2e/migration): Add additional resources to database before migrating (#2948 )	3 years ago
Michael Li	fcddd972bf	test(e2e): Add test for `boundary version` (#2933 ) During testing, there was an issue observed where some additional characters were added to the version output. This test validates that output.	3 years ago
Michael Li	8ad861f426	test(e2e): Update migration test to use vault docker container (#2909 ) * fix(enos): Make sure enos reports test as failure After updating this command to save off the output from running `go test`, enos would not report when tests failed. This was due to the extra pipe hiding the exit status of the prior commands. Adding this option should return the status of the last command to exit with a non-zero status. * doc(e2e): Fix comments * refact(e2e): Update AuthenticateCli to accept auth method id * refact(e2e/migration): Use docker to set up vault instead of enos * refact(e2e/migration): Adjust where environment variables are set	3 years ago
Johan Brandhorst-Satzkorn	3c29308673	chore: Add license headers to all files	3 years ago
Haotian	43f0ba89cf	feat(credentiallibraries): support vault ssh certificates	3 years ago
Michael Li	036a71fc93	test(e2e): Add test for updated `boundary authenticate` command (#2848 )	3 years ago
Michael Li	461b194cde	fix(e2e): Address flake due to timing (#2774 ) Observed a flake in this test where a session was still reporting 0 bytes up/down on the first read. Modifying the checks to be more resilient.	3 years ago
Damian Debkowski	b3ba9c5b4d	test(enos): new e2e test for target address (#2732 ) Co-authored-by: Hugo <hugoamvieira@users.noreply.github.com>	3 years ago
Michael Li	fdf3318f72	test(e2e): Add tests for bytes_up/bytes_down (#2740 ) * refact(e2e): Create env files for consistency * refact(e2e): Addmethod for waiting for session * test(e2e): Add bytes up/down test * fix(e2e): Fix require.Equal statements to have the correct order * fix(e2e): Fix loop variable	3 years ago
Michael Li	ff8f1be0a1	test(e2e): Add test for when an incorrect tag is used in a dynamic host catalog (#2731 ) * refact(e2e): Move Dynamic Host Catalog env to its own file This keeps each scenario consistent (an env_test.go file in each directory) * refact(e2e): Update to use type casting * refact(e2e): Rename existing dynamic host catalog test * test(e2e): Add test for an empty dynamic host catalog This test verifies that you fail to connect to a target with an empty host set (in a dynamic host catalog) * fix(e2e): Update return statement since we know err is nil * fix(e2e): Add ok checks in type assertions	3 years ago
Michael Li	8bd883a37d	test(e2e): Add tests to validate that session ends after target is deleted (#2709 ) * test(e2e): Add more "session end" tests These tests validate that the session ends when the respective project or target is deleted. It also ensures that the session can still be read after the deletion of the corresponding item. * Removing test from PR due to bug This test found a bug that will be resolved in the future. Taking this test out of the PR and will add it once the bug is fixed.	3 years ago
Michael Li	1596b02e53	test(e2e): Add database migration test (#2627 ) * test(e2e): Add database migration test * chore(enos): Add enos scenario for migration test * chore(enos): Update go test command to use count option * doc(e2e): Update readme with migration test details * Fix: Typo * CR: Use different library * CR: Add additional context in comment * CR: Move some code from test into functions * doc(e2e): Add instructions to more easily retrieve environment variables * refact(e2e): Create some more methods to increase test readability	3 years ago
Michael Li	0eb7c04c1d	test(e2e): Add tests to validate that session ends after host source is deleted (#2689 )	3 years ago
Michael Li	45171a3f56	refact(e2e): Changes to support an automated migration test (#2676 ) * refact(e2e): Move cleanup steps into each test The migration test needed to create some resources, but doesn't care about cleaning up because the test would take care of spinning down the docker container that it's using. To maintain flexibility going forward, we'll establish that tests are responsible for cleaning up (rather than the methods they use) * refact(e2e): Use new env var for skip check Currently, the e2e tests use the E2E_PASSWORD_AUTH_METHOD_ID environment variable to determine if the test should be skipped. However, the new migration test does not require a pre-existing boundary cluster and would not have this environment variable. As a result, we needed an alternative way to check if an e2e test should be skipped when running tests in ci. * refact(e2e): Create more common boundary methods * fix(e2e): Set to string value Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>	3 years ago
Michael Li	2d90dc2c97	test(e2e): Minor clerical updates to key destruction tests (#2674 )	3 years ago
Johan Brandhorst-Satzkorn	edd323b73a	Key Rotation/Destruction (#2477 ) (#2607 ) * Key Rotation/Destruction (#2477) * fix: Correct kms.CreateKeys comment This method does not return anything. * feat(kms): Add new ListKeys method The new ListKeys method wraps the underlying KMS wrapper, returning all the keys in the scope specified. * feat(scopes): Add new scope actions for key management Adds list-keys, rotate-keys and revoke-keys actions for scopes. * feat(scopes): Add ListKeys API endpoint This new endpoint lists all keys in a scope * feat(api): Add ListKeys to Scopes client This has to be a custom function because it is a custom action and doesn't map well to any of the existing templates, or generalises well in a way that would make it reasonable to create a new template. * feat(cli): Add new scopes list-keys command * add RotateKeys function to the kms repository * Add Rotate Keys Endpoint to Scopes Api (#2360) * add rotate keys endpoint * add tests for RotateKeys endpoint * remove that one comment I forgot about * addressing more PR comments * Add Rotate Keys CLI Command (#2395) * add cli command and client * add bats tests * fix some info text and pr comments * write a new rotate keys description * Add Missing DEK Foreign Keys (#2408) * add missing fks * mark key as nullable in gorm * update tests to use a new wrapper with a real key_id * fix formatting in test and add keys for auth_token test * replace key values * revert postgres_40_01_test.go * style: reformat sql for readability * refactor: change type of key_id columns to kms_private_id * Store key_id and scope_id with oplog entries, re-type columns referencing data key version (#2431) * fix(db): Correct types of data key version referencers * fix(oplog): Fix missing error handling * feat(oplog): Store key_id and scope_id with oplog entries This migration truncates all existing oplog entries, as migrating existing data would have been complex and likely unnecessary. * Update view references * Always delete oplog entries when dropping keys * Fix rebase issues * Fix sql tests * Add schema for new kms destruction jobs (#2479) * feat: Add schema for new kms destruction jobs The schema lets us manage destruction jobs per-table while providing a guarantee that only one run is running at a time. * Apply suggestions from code review Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com> * Fix table reference and tests Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com> * update domain, api, and cli to all include key versions in outputs (#2472) * update domain, api, and cli to all include key versions in outputs * fix go sum * add migration to fix immutable error * fix final test issue as well as make gen issue * rebase and fix * address johan pr comments * make gen, didn't realize comments were included * update migrations based on new migration 55 file 03 * Move migrations to 56 * feat: Add key version rewrapping function registry (#2478) The new RegisterTableRewrapFn can be used by a domain to register a callback to use when rewrapping data in a specific table name. * feat(kms): Add scopeId to RewrapFn (#2539) This makes it much easier for rewrap functions to look up the correct wrapper and limit the number of rows searched. * Update Root Cert Proto Definition (#2542) * update root cert proto definition to properly identify public_key as the table primary key * add the test fix as well * Rewrap Functions for Encrypted Tables (#2532) * add oidc rewrap * add argon2 config rewrap * add auth token rewrapping * add worker auth cert rewrapping * check the err * add username password credential rewrapping * add ssh private key credential rewrapping * add vault client certificate rewrap function * add host catalog secret rewrap function * cleanup a little * add host vault token rewrap function * add session credential rewrap function * add session rewrap function * add worker auth rewrap function * update test to include full assert gamut * add session rewrap function TEST * bring all tests up to current standards, make more readable, and include full assert gamut * rework all rewrap functions to utilize scope id * update comments, queries, sql refs, etc, in response to PR comments * forgot a comment * remove hmac updates and fix a couple comments again * Rewrapping Registered Tables Test (#2555) * add the registered table test as well as the two missing rewrap functions * address pr comments, add db r/w conversions, cmp.diff, sql comment, remove (now) faulty immutable test * Add ability to list key version destruction jobs, recurring jobs and destroying key versions (#2498) * feat(kms): Add ability to list data key version destruction jobs * feat(scopes): Add ListKeyVersionDestructionJobs * feat(cli): Add list-key-version-destruction-jobs * feat(kms): Add recurring job that performs table rewrapping The new recurring job runs for each job table with a registered rewrapping callback. It attempts to become the running run and start its rewrapping, gracefully handling sudden interruptions by resuming it's work if it finds evidence of sudden interruption. * feat(kms): Add recurring job for destroying key versions The new job monitors the database for data key version destruction jobs that have finished rewrapping all its data, performing the final data key version revocation. * feat(kms): Add DestroyKeyVersion DestroyKeyVersion immediately destroys a key version if it is a root key version or a data key version which encrypts no data. If the data key version encrypts data which needs to be rewrapped, it queues an asynchronous job to complete the rewrapping operation. * feat(scopes): Add DestroyKeyVersion API endpoint * feat(cli): Add scopes destroy-key-version CLI command * Ensure all secret updates include key ID (#2556) * feat(all): Ensure all secret updates include key ID When updating a secret, it is paramount that the key ID is also updated, as it is the only means we have of ensuring that we only destroy keys once there is no more data associated with the key. * Remove fix to session repository for now This breaks the current private key derivation method * add new encrypt/decrypt funcs and made necessary proto changes (#2557) * add new encrypt/decrypt funcs and made necessary proto changes * address all PR comments * fix test panic * add param checking to rewraps * fix(schema): Correctly organize migrations again * Review comments part 1 * Review comments part 2 * Review comments part 3 * Store cert private key, encrypt tofu token (#2583) * fix(session): store cert private key, encrypt tofu token Previously, we would derive a session certificate private key from the session key used in each project, and not store the key. We would also encrypt the tofu token with the database key but not store a reference to this key in the database. This change fixes this by replacing our key derivation with a key generation step, and instead store the generated key, encrypted, in the database. We also ensure that any new tofu tokens are encrypted with the same key. To handle existing sessions, we lazily rewrite the sessions whenever a user lists them. There is a minor risk that a user could end up destroying the database key that encrypts the tofu token before that session has been rewrapped, but this is going to be rare and temporary. * feat(session): Allow the random source for secrets to be configured * Review comments * Minor fixes * More minor fixes * More small fixes Co-authored-by: Danielle Miu <dani.miu@hashicorp.com> Co-authored-by: Danielle <29378233+DanielleMiu@users.noreply.github.com> Co-authored-by: Michael Gaffney <mike@gaffney.cc> Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com> * fix(session): Unset session key ID when scope is deleted Unsetting the key ID allows the session to live beyond the lifetime of the scope, while allowing the scope to cascade delete its keys. * fix(migrations): Rewrite migration 56 tests These tests can no longer use the normal test helpers as they try to use the new oplog table structure, so we have to manually write all the interactions. * fix(migrations): Rename migration 58 file name This was the name used in the release branch, update it to the new migration number. * fix(e2e): Add some comments and debug to kms tests * fix(session): Handle empty project and user IDs in read When a project or user is deleted, the session is automatically canceled and the respective field on the session is unset. LookupSession did not handle this case gracefully, and would error on decryption in this state. Skip decrypting sessions that do not have either a user or project to avoid this error. The decrypted values are not used for a canceled session. * Fix worker test * Increase test timeout Co-authored-by: Danielle Miu <dani.miu@hashicorp.com> Co-authored-by: Danielle <29378233+DanielleMiu@users.noreply.github.com> Co-authored-by: Michael Gaffney <mike@gaffney.cc> Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>	3 years ago
Michael Li	ae28bf7838	test(e2e): Update test to also use a username/password credential in vault (#2595 ) * test(e2e): Add test that uses a vault username/password * refact(e2e): Use go:embed for policy file	3 years ago
Michael Li	80cdbc305d	test(e2e): Check that an active session ends if the user is deleted (#2588 ) Adds a new test to the e2e test suite that checks that an active session ends once the user is deleted.	3 years ago
Michael Li	d68d57e884	fix(e2e): Add retry when checking if session is active (#2586 ) Observed some flakiness here. A test reported that the session was still "pending". Adding additional retries to ensure that it will eventually go active.	3 years ago

1 2

57 Commits (1afcefcd7b58de0cefa10db7c70ddfcbe1cd0d53)