1517 Commits (4493dfd527490540ca95e0abff06a9a4e8a883b2)

Author	SHA1	Message	Date
Irena Rindos	4493dfd527	use prior and current worker auth keys (#2495) ... * use prior and current worker auth keys	4 years ago
Hugo	902ca3cccb	fix(genapi): uint64 fields failing to be unmarshalled (#2492) ... uint64 fields get marshalled into json by protobuf as strings, so we have to tell the json parser to look for strings when unmarshalling.	4 years ago
Jeff Mitchell	6116dad2bc	Fix incorrect flag name (#2494)	4 years ago
Jeff Mitchell	74a007bfdd	Adapt to new nodeenrollment X25519KeyProducer interface (#2491)	4 years ago
Louis Ruch	b7684a857a	feat(ssh): Use HostId as HostKeyAlias for connect ssh helper (#2490)	4 years ago
Zhihe Li	fd0cbbc776	Bump UI commitish (#2489)	4 years ago
Todd	d270513b5a	Add error printing when cluster listeners and their consumers error. (#2488)	4 years ago
Zhihe Li	8ab3c4c1f4	Bump UI commitish (#2487)	4 years ago
Irena Rindos	bd4f5f3801	update worker auth rotate (#2484)	4 years ago
Louis Ruch	b78d83e242	log(vault): Log formatted duration instead of nanoseconds (#2481)	4 years ago
Zhihe Li	423f3be251	Bump UI commitish (#2480)	4 years ago
Johan Brandhorst-Satzkorn	5dbcda512a	Fix enos bats test errors (#2468) ... * test(cli): Remove skips in CI for cli tests * fix(enos): Fix enos bats tests The tests still sometimes suffer from timing issues, but I was able to run a successful run (setup, run, destroy) of the tests from my machine at least once. There were 2 issues: - Some tests in groups.bats were hardcoding the default user id - The default grants for a user in a project were missing the permission to connect to a target. We now add this explicitly. Co-authored-by: Timothy Messier <tim.messier@gmail.com>	4 years ago
Todd	06fd086004	Add health endpoint for worker (#2442) ... * Return worker process information in the health endpoint. Experimental: The worker_info and returned worker_process_info fields are experimental and can change or be removed without notice. When a user passes in "worker_info=1" or "worker_info=true" and a worker is running the returned json will be returned with a key named "worker_process_info" which value is a json object with information about the worker process.	4 years ago
Zhihe Li	309574b694	bump UI commitish (#2470)	4 years ago
Irena Rindos	d951e1ebc1	Worker graceful shutdown (#2455) ... * add graceful shutdown to worker	4 years ago
Timothy Messier	a2ef14283b	fix(org): Address bug that prevented deleting an org (#2465) ... The schema changes introduced in 0.10.2 introduced a bug where an org could not be deleted if there was a session for an org scoped user. It would result in an error like: scope.(Service).deleteFromRepo: unable to delete scope: \ iam.(Repository).DeleteScope: failed for o_VkNy46KwfS: \ iam.(Repository).delete: db.DoTx: iam.(Repository).delete: \ db.Delete: insert or update on table "session" violates foreign key constraint "target_fkey": integrity violation: error #1003 A worker around would be to first delete all projects in the org, then finally delete the org. This fix adds a regression test to the sqltests and updates several constraints on the session table to be deferrable. Since the org delete is a single transaction, this allows all of the necessary resources to be deleted before attempting to enforce these constrains. See: https://www.postgresql.org/docs/current/sql-set-constraints.html Blame: 3a28ab614	4 years ago
Damian Debkowski	546c5dc5be	feat: static json credentials (#2423)	4 years ago
Timothy Messier	f28bcd4aa7	chore(cli): Run bats tests against boundary dev in CI ... Several of these tests are being skipped in the enos run. This seems to be due to differences in the setup that is performed. When these tests were run manually, `boundary dev` was used which performs some setup of resources automatically. However since enos uses a non-dev controller, a similar setup is performed via the enos modules. Until the discrepancies between the setup can be investigated, this adds a separate CI job to run the tests against `boundary dev`. These tests are all passing, without any being skipped. This test suite can still be useful even if the enos version is fixed, since this test suite will run much faster, and therefore identify failures sooner.	4 years ago
Timothy Messier	c41e31381d	test(cli): Fix session read and cancellation test	4 years ago
Irena Rindos	821d8317dc	address op state review feedback (#2453) ... * address op state review feedback	4 years ago
Louis Ruch	c73a13aa3e	scheduler: log details when starting scheduler (#2459)	4 years ago
Jeff Mitchell	53b5e532d5	Remove deprecated methods/fields on targets (#2393)	4 years ago
Louis Ruch	506fdfa5c3	cli(ssh): Do not print private key if consumed (#2451)	4 years ago
Damian Debkowski	5dfabe5f90	fix: show warning log when token will expire before it can be renewed (#2446)	4 years ago
Jeff Mitchell	37fb9815ce	Add session endpoint test for #2448 (#2450)	4 years ago
Timothy Messier	2b994f3005	fix(perms): Properly resolve "only self" for permissions (#2448) ... When generating permissions from the grants, if a single grant was limited to the set of "self" actions, the permission would be marked as only self, even if additional grants were given for non-self actions. This would result in the generated permissions being more limiting then they should be based on the grants. This only impacts the sessions list endpoint. It would result in users that have been granted access to list other user's sessions to be unable to see these results in the list results.	4 years ago
Louis Ruch	50490d71ae	chore(targets): Improve help and errors around ssh targets (#2445)	4 years ago
Damian Debkowski	2db6bee3e2	fix: return an error for vault tokens that will expire before the scheduler can run (#2444)	4 years ago
Louis Ruch	5812a42ba3	feat(scheduler): set intervals from config (#2443)	4 years ago
Irena Rindos	fc0ead73e6	feat(workers): worker operational state (#2427) ... * feat(workers): worker operational state	4 years ago
Jeff Mitchell	9002930d65	Adapt shared lock skip logic to dbswap branch (#2437)	4 years ago
Hugo Vieira	bed6e1a0ff	feat(server): Reload database on SIGHUP ... If the database url is updated on Boundary's config and then a SIGHUP triggered, we now connect to the new database, ensure it's OK to use and use that one going forwards instead. This allows a controller to be deployed in a more dynamic infrastructure where, for example, database credentials could change, without having to restart the controller. In this case only a database url config change and a SIGHUP signal to all controllers would be required. This uses an atomic.Pointer to store wrapped DB objects. This allows atomically swapping to the new object. A timeout is introduced so that if the object is swapped after the existing one has been looked up it isn't immediately invalidated. The timeout is a maximum; a ticker once a second that looks at stats to determine how many database connections are still in use and then closes the driver as soon as none are in use. This could be done with mutexes to avoid checking stats in a loop, but that carries its own risk: if a write lock is attempted to be acquired while a query is holding a read lock, the write lock will block, and any subsequent read locks will also block since write locks take priority. As a result, if a query is long-running or timing out, all other queries in the system will become blocked. Our default user request timeout is 90 seconds and some jobs have no timeout at all, so this is not a purely theoretical concern, even if it's unlikely. Refs: #2435 Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>	4 years ago
Hugo Vieira	8ab9ffbcac	refact(cmd): Encapsulate some functionality on Command and Server ... This commit extracts 3 separate pieces of functionality into their own function/method: - Extracts the database opening with the intention to have a function that performs all that functionality but returns the created database object rather than setting it to the Server structure. - Extracts database validation logic, to provide a common code path for upcoming functionality. - Expose schema manager on the Command struct as well as providing common functions to acquire shared lock/close.	4 years ago
Hugo Vieira	621f8a9ff2	fix(schema): Database connection not cleanly closed ... This commit introduces closing the Schema Manager's underlying driver connection. We were only releasing the shared lock but not actually cleaning up the db connection and relied on the fact that the process would exit to do that for us.	4 years ago
Timothy Messier	047a66e87d	fix(worker): Improper reload when running as controller and worker (#2438) ... In cases where the server was started with both a controller and worker stanza, the reload of the config was not properly setting the initial upstream value on the new config. In this case the value is derived from other config values and not necessarily set directly. This now properly initializes the new config so that initial upstream is set in the same manner as the first load. Blame: 5d0cdf680f	4 years ago
Todd	0b942f4493	Only clear tags in set-worker-tags when "null" is set as the value of the -tag flag. (#2434)	4 years ago
Irena Rindos	18dff62b7b	Merge BYOW GA branch to main (#2398) ... * feat(workers): Add ability to read and reinitialize cert authority (#2312) * feat(workers): Return Release Version on worker list and read (#2377) * feat(cli): Read and reinitialize worker certificate authority (#2387)	4 years ago
Irena Rindos	cee5ff7599	Minor documentation fixes for controller-led (#2432) ... * Minor documentation fixes	4 years ago
Jeff Mitchell	fdb60f5b2d	Update comment around undocumented config flag	4 years ago
Jeff Mitchell	730131c105	Add test	4 years ago
Jeff Mitchell	16c9e9b592	Add ability to skip shared lock acquisition	4 years ago
Hugo Vieira	bf1486f75e	refact(target): Add context to RepositoryFactory constructor ... `errors.New` requires a context, so I've made that available from the Controller, and updated all `NewDeprecated` functions to `New` while I was at it	4 years ago
Hugo Vieira	bf263fbd7d	perf(target): Use new Permissions object to determine resource access ... Using the new Permissions object, we can build a list of the level of access a user should have based on the grants they've been given, meaining we don't need to fetch all resources from the database to then remove the ones the user shouldn't be able to see. This commit also removes some unused options in `ListTargets` for the sake of simplicity.	4 years ago
Hugo Vieira	63196ee4ca	feat(target): Implement new WithPermissions option ... Also changes the Target RepositoryFactory to allow for passing options at construction time.	4 years ago
Hugo Vieira	224f8d2d4e	refact(controller): Move Target Repository Factory to the target package	4 years ago
Timothy Messier	1e1e5a5ff5	doc(perms): Clarify some details in godoc for ListPermissions	4 years ago
Timothy Messier	e65f1f32a7	chore(session): Remove repository method that was only used in tests ... This unexported method was only used by a single test, and was taking advantage of its implmentation to populate Connections rather than Sessions. This repository should only interact with Sessions, since there is a separate repository for Connections.	4 years ago
Timothy Messier	eb61ac6304	refact(session): Add context to session factory ... This adds a context to the session.RepositoryFactory, allowing errors.NewDeprecated to be replaced with errors.New. It also removes the common.SessionRepoFactory, instead packages just directly import from the session package.	4 years ago
Timothy Messier	febf0b9984	refact(controller): Use session repo factory that takes options	4 years ago
Timothy Messier	68568828e6	perf(sessions): Use session repository with permissions ... This builds on previous performance improvements to the list behavior by reducing the number of queries against the database and the amount of data transfered in order to retrieve a list of sessions. Previously, a query was performed to retrieve a tuple of `(session_id, scope_id, user_id)` for the requested scope, including all child scopes if the request was recursive. These tuples were evaluated against the requesting user's grants to identify the sessions that they were authorized to list. In the case of clusters with a large number of sessions, this would result in a large amount of data needing to be transfered for sessions that would not be used. Then a second query would be used to retrieve the full session information for the session ids that were authorized. This changes the list behavior to evaluate a set of permissions from the requesting user's grants, use these permissions when constructing a session repository, and retrieve the list of sessions the user is authorized to list in a signle query. Ref: d741034829 32070678dc	4 years ago