boundary

Commit Graph

Author	SHA1	Message	Date
Michael Milton	2e69d59dd2	feat(billing): Add cli subcommand for monthly active user counts	2 years ago
Jeff Mitchell	c3297bb96f	Remove worker type from CLI output (#4396 ) This does not currently remove the field from the message on the API but since it will now always show `pki` it's meaningless and causing confusion for some users.	2 years ago
Jeff Mitchell	014a5a7aae	Vet/race fixes (#4421 ) This addresses all found vet/race fixes in community edition. --------- Co-authored-by: Damian Debkowski <damian.debkowski@hashicorp.com>	2 years ago
Jeff Mitchell	35cef97bd4	Linter fixes PR 3 (#4415 ) * Linter fixes * fix(bsr): update test to register TEST protocol once --------- Co-authored-by: Damian Debkowski <damian.debkowski@hashicorp.com>	2 years ago
Jeff Mitchell	49803e653c	Linter fixes numero 2 (#4408 )	2 years ago
Jeff Mitchell	25bce9e8ff	Fix linter warnings	2 years ago
Louis Ruch	d59f089819	feat(policies): Update SDK/API to support setting/clearing attributes (#4385 )	2 years ago
Irena Rindos	da30653486	commands: fix plurals (#4369 ) * commands: fix plurals	2 years ago
Todd	eb6d0dbd6a	Use the intercepted token always. If the keyring matches, use it from there (#4355 ) * Use the intercepted token if present, use it through the keyring if keyring contains it * fixup! Use the intercepted token if present, use it through the keyring if keyring contains it * Apply suggestions from code review Co-authored-by: Jim <jlambert@hashicorp.com> --------- Co-authored-by: Jim <jlambert@hashicorp.com>	2 years ago
Yong Zhang	e34d3bb415	Fix example scope id for role grants (#4348 ) * Rename example scope id * revert newline at eof	2 years ago
Todd	d500f24014	fix: boundary authenticate returns an API error code when auth fails (#4342 )	2 years ago
Todd	dde833e8cf	Decrease number of flags shown for daemon/search (#4312 ) * Decrease number of flags shown for daemon/search * Update changelog --------- Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com> Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>	2 years ago
Jeff Mitchell	e91c4cbfe2	Remove support for 'id' field in grants (#4290 )	2 years ago
Louis Ruch	7921ce22fd	test(grant): Use ID to validate version check (#4274 ) * test(grant): Use ID to validate version check * Update docs from id to ids * Remove 'id' in 0.16.0	2 years ago
Louis Ruch	fe6126438e	chore: Fix typos (#4285 )	2 years ago
dani	6a55245394	fix(cli): StoragePolicyId indent on list scopes (#4279 )	2 years ago
Jeff Mitchell	f5dd457b34	Multiple grant scope IDs (#4251 ) Co-authored-by: Timothy Messier <tim.messier@gmail.com> Co-authored-by: Todd <github@quaddi.com>	2 years ago
Todd	0dac9005c1	Boundary auth without a keyring configured behaves like -keyring-type none (#4268 )	2 years ago
Jeff Mitchell	fff5f9506f	Migrate proxy logic to the API package (#4216 ) This allows arbitrary programs to have an easy mechanism to make connections through Boundary using Go. Internal cluster tests and test helpers have been migrated to use this package, as well as the `connect` command. --------- Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>	2 years ago
Timothy Messier	9c5c17a3ee	feat(cmd): Disable postgres JIT for boundary dev After updating `boundary dev` to use postgres:12 by default, it was noticed that the responsiveness of boundary was noticeably slower. This is due to the introduction of JIT being enabled by default in postgres:12. JIT seems to incur noticeable overhead without providing benefits, at least for the instance used for `boundary dev`. It is also worth noting that for postgres:14 and newer, JIT does not get triggered for the same queries since they seem to result in a cheaper query plan that does not exceed the default threshold for JIT. See: https://www.postgresql.org/docs/current/jit.html ICU-12283	2 years ago
Todd	884a0cb1fc	Fix daemon synopsis and command grouping (#4249 )	2 years ago
Jeff Mitchell	253d79116c	Swap id field in grants to ids since that's now standardized (#4250 ) * Swap id field in grants to ids since that's now standardized * Fix some tests I missed * Update generated resource table	2 years ago
Todd	962f9bd638	Pass in options to NewCommand call (#4248 )	2 years ago
Damian Debkowski	621b535dde	chore: move infinity retention definition	2 years ago
Louis Ruch	b237fe24f1	feat(cmd): Add help text for storage policy scope funcs	2 years ago
Damian Debkowski	5c1ef080cc	feat(cmd): session recording reapply storage policy	2 years ago
Louis Ruch	f26243e9af	feat(recording): Delete Session Recording	2 years ago
Louis Ruch	86f10f3ea4	feat(recording): Add RetainUntil and DeleteAfter to Session Recording CLI	2 years ago
Louis Ruch	20897640cd	feat(cli): Add support for Scope Storage Policy	2 years ago
Hugo	08e8d96514	feat(cmd): Policies	2 years ago
Jeff Mitchell	9332179a01	Remove the deprecated old KMS worker auth mechanism (#3935 ) This has been superceded by the nodeenrollment-based KMS worker auth mechanism. This commit only removes the ability to connect with this mechanism; some upgrade logic will remain intact for a bit and can be removed later.	2 years ago
Todd	5aa560387c	Add pagination for iam Roles (#4161 ) * Add pagination for iam Roles	2 years ago
Todd	97f800d396	Fix rebase issues	2 years ago
Todd	71b09222ae	Add status command to the boundary client cache (#3871 ) * Add status command to the boundary client cache	2 years ago
Todd	3a7ea64a31	Add skip daemon flag and send recently authed tokens to daemon (#3883 ) * Add skip daemon flag and send recently authed tokens to daemon * Rename flag skip-daemon to skip-cache-daemon * adding option test * move common.Options to base.Option * SocketAddress returns *url.URL, fix search test	2 years ago
Jim	fba9d1cdf1	Add client daemon repo, server, and cmd The commands added are: boundary daemon start boundary daemon stop boundary daemon add-token boundary daemon status boundary search If these actions are performed on a platform that doesn't support sqlite natively in go an error is returned. Besides some hooks into the cmd package all the significant logic resides in internal/clientcache feat (cmds/authenticate): output the token name when storing token feat: update go-dbw which now uses pure go sqlite driver refact (base.Command): export FlagOutputCurlString Exporting FlagOutputCurlString allows other commands that embed the base.Command to access the flag as needed feat: add a cache Repository to manage cache storage feat: add a "cache" CLI command This new command will support both managing and searching the local CLI cache daemon. feat: start cache daemon as needed when issue CLI commands Move files to new directories and add persona table (#3526) * Add persona table and move files to new directories Client daemon now uses unix sockets and update pathing (#3535) * Add unix socket listen and dialers with file permissions applied * Update the pathing to match RFC Cache refreshing now uses all stored personas. (#3545) Updating headers for LLB files Decouple daemon and cache server (#3566) * Separate daemon from server * Add persona handler to daemon server (#3579) Moved search to use mql and added tests for the search command (#3589) * search uses hashicorp/mql Windows support for client side daemon (#3618) * exec.Command for background process * Log to stderr when in foreground and file always * Use pid files across platform for start and stop Requests with version info must match the daemon's version (#3640) * requests with version info must match daemons Update dependencies and breakout cgo/pure go sqlite drivers (#3657) upgrade go-dbw deps and add cgo build tags Enable graceful shutdown in windows (#3695) * Enable graceful shutdown in windows Co-authored-by: Jim <jlambert@hashicorp.com> Targets delete when a persona changes address or user id (#3673) * Handle cache refresh in repo Add sessions to the client side cache (#3682) * Add sessions to repository * Search command supports sessions * adding session related tests to db and refresh Change cache schema from personas to tokens+users (#3737) * Change from personas to tokens+users * Separate keyring tokens from auth tokens Add support for keyringless auth tokens (#3765) * Add support for keyringless auth tokens Remove expired auth tokens from cache (#3768) * Remove expired auth tokens from cache Complete the TODO of checking for inflight tx (#3779) Delete tokens that the controller says are invalid (#3782) fix search test with boundary token check (#3799) Collect resource info in repository_<resource>s.go (#3769) * Collect resource info in repository_<resource>s.go * Move search logic into the domain (#3794) Daemon and search restricted to supported platforms (#3801) * Daemon and search restricted to supported platforms Reorganize the clientcache packages (#3814) * Refactor for self contained domain logic * Put clientcache stuff under internal	2 years ago
Johan Brandhorst-Satzkorn	9ce5a14ef0	config: add max_page_size variable The max_page_size variable lets operators control the size of the pagination pages. This value configures both the maximum permitted page size and the default page size when none is explicitly provided. Operators can tweak this option up or down to increase or reduce the load on the database during pagination.	2 years ago
Timothy Messier	a77c88ae5d	feat(ratelimit): Increase default values (#4129 ) This increases the default rate limits to: - 1,500 reqs / 30 seconds for list actions in total - 1,500 reqs / 30 seconds for list actions per IP address - 150 reqs / 30 seconds for list actions per auth token And for all other actions: - 30,000 reqs / 30 seconds for list actions in total - 30,000 reqs / 30 seconds for list actions per IP address - 3,000 reqs / 30 seconds for list actions per auth token This seems to be a reasonable default for a small to medium size cluster based on some scale testing. (cherry picked from commit `237c8b6084`)	2 years ago
Timothy Messier	6e233c879f	fix(ratelimit): Round up when setting Retry-After header Previously this would truncate to the nearest integer, which could result in clients retrying before the quota has reset, and getting rate limited again. This also includes an update from go-rate that will round up when reporting the reset time for the RateLimit header. Note that in the case of a 503, the Retry-After header was already being set correctly. See: https://github.com/hashicorp/go-rate/pull/8	2 years ago
Timothy Messier	35b91c66de	refact(ratelimit): Rename MaxEntries to MaxQuotas	2 years ago
Timothy Messier	9438be4506	feat(ratelimier): Support disabling rate limiting	2 years ago
Timothy Messier	0bc423ebd8	feat(controller): Reload api rate limits on SIGHUP	2 years ago
Timothy Messier	6da47443fd	feat(ratelimit): Create rate limits from configs	2 years ago
Timothy Messier	bee45dc486	feat(config): Add fields for controller rate limit configuration	2 years ago
Elim Tsiagbey	8b8d2822df	feat(oidc): OIDC Prompt (#4053 ) Boundary OIDC method does not currently support passing in prompts during authentication. This change adds the capability of passing OIDC prompts. Prompts are optional OIDC parameters that determine the behaviour of the authentication server: https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest ## Changes - New `auth_oidc_prompt` table which contains all the prompts for OIDC auth method - New `auth_oidc_prompt_enm` table which contains possible enum values for a prompt - Currently supported: - `none`: The Authorization Server MUST NOT display any authentication or consent user interface pages - `login`: The Authorization Server SHOULD prompt the End-User for reauthentication - `consent`: The Authorization Server SHOULD prompt the End-User for consent before returning information to the Client - `select_account`: The Authorization Server SHOULD prompt the End-User to select a user account - `oidc_auth_method_with_value_obj` view has been updated to return `prompt` value - Add `prompt` option for OIDC auth method CLI create and update - Pass configured prompt during OIDC authentication - Add `prompt` API validation for create and update	2 years ago
Jeff Mitchell	b6df5693b5	Add generic read/update/delete commands (#3992 ) * Add generic read/update/delete commands This adds three generic commands that use the resource prefix to determine the subcommand to run and pass through args over to that subcommand. Since this occurs very early on and to avoid loading essentially every internal resource package, I moved subtype definitions to globals. This replaces #3967 Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com> * De-duplicate Subtype code (#4031) Co-authored-by: Timothy Messier <tim.messier@gmail.com> --------- Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com> Co-authored-by: Timothy Messier <tim.messier@gmail.com>	2 years ago
Jeff Mitchell	cb1386932d	Use sdk wspb library and remove internal (#4025 )	2 years ago
Jeff Mitchell	cf3900a906	Fix three minor issues: (#4022 ) * If passing a private key without specifying it in URL syntax, give a proper error message (previously we were only making sure it was a scheme we knew how to handle, but we need to also be more informative if it's not a URL at all) * If the handshake from the proxy fails, don't hang, just exit * Update some error messages to use capitalization in line with our standard CLI error format	2 years ago
Timothy Messier	dd23f6fdbf	Update websocket library (#3908 ) The nhooyr/websocket library now has a release with the new default behavior that removes the message size limit. This allows us to switch off of the fork and back to the upstream. In the same release that includes the fix we need for the boundary client, the wspb helper package was removed from websocket. This package contained some functions to read and write protobuf messages. However, it was using the deprecated github.com/golang/protobuf/proto library. To avoid this dependancy in the library they opted to just remove wspb. Thus this provides a replacement implementation that uses google.golang.org/protobuf/proto. Notably the newer proto library seems to lack an equivalent of proto.NewBuffer so writes to the websocket and not able to leverage a sync.Pool of byte.Buffers to reduce allocations. Refs: `88bb253554` See: `ac385120c6`	2 years ago
Jeff Mitchell	a9e372930d	Revert `0bf60996c5` (#3990 ) Post-merge some issues were discovered with the ways typing is used for proto reflection. This will be reworked without moving the subtypes around.	2 years ago

1 2 3 4 5 ...

670 Commits (2e69d59dd2c8edd452ddf753b4fbf8a41d963b76)