507 Commits (4493dfd527490540ca95e0abff06a9a4e8a883b2)

Author	SHA1	Message	Date
Jeff Mitchell	6116dad2bc	Fix incorrect flag name (#2494)	4 years ago
Louis Ruch	b7684a857a	feat(ssh): Use HostId as HostKeyAlias for connect ssh helper (#2490)	4 years ago
Todd	06fd086004	Add health endpoint for worker (#2442) ... * Return worker process information in the health endpoint. Experimental: The worker_info and returned worker_process_info fields are experimental and can change or be removed without notice. When a user passes in "worker_info=1" or "worker_info=true" and a worker is running the returned json will be returned with a key named "worker_process_info" which value is a json object with information about the worker process.	4 years ago
Irena Rindos	d951e1ebc1	Worker graceful shutdown (#2455) ... * add graceful shutdown to worker	4 years ago
Damian Debkowski	546c5dc5be	feat: static json credentials (#2423)	4 years ago
Jeff Mitchell	53b5e532d5	Remove deprecated methods/fields on targets (#2393)	4 years ago
Louis Ruch	506fdfa5c3	cli(ssh): Do not print private key if consumed (#2451)	4 years ago
Louis Ruch	50490d71ae	chore(targets): Improve help and errors around ssh targets (#2445)	4 years ago
Louis Ruch	5812a42ba3	feat(scheduler): set intervals from config (#2443)	4 years ago
Jeff Mitchell	9002930d65	Adapt shared lock skip logic to dbswap branch (#2437)	4 years ago
Hugo Vieira	bed6e1a0ff	feat(server): Reload database on SIGHUP ... If the database url is updated on Boundary's config and then a SIGHUP triggered, we now connect to the new database, ensure it's OK to use and use that one going forwards instead. This allows a controller to be deployed in a more dynamic infrastructure where, for example, database credentials could change, without having to restart the controller. In this case only a database url config change and a SIGHUP signal to all controllers would be required. This uses an atomic.Pointer to store wrapped DB objects. This allows atomically swapping to the new object. A timeout is introduced so that if the object is swapped after the existing one has been looked up it isn't immediately invalidated. The timeout is a maximum; a ticker once a second that looks at stats to determine how many database connections are still in use and then closes the driver as soon as none are in use. This could be done with mutexes to avoid checking stats in a loop, but that carries its own risk: if a write lock is attempted to be acquired while a query is holding a read lock, the write lock will block, and any subsequent read locks will also block since write locks take priority. As a result, if a query is long-running or timing out, all other queries in the system will become blocked. Our default user request timeout is 90 seconds and some jobs have no timeout at all, so this is not a purely theoretical concern, even if it's unlikely. Refs: #2435 Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>	4 years ago
Hugo Vieira	8ab9ffbcac	refact(cmd): Encapsulate some functionality on Command and Server ... This commit extracts 3 separate pieces of functionality into their own function/method: - Extracts the database opening with the intention to have a function that performs all that functionality but returns the created database object rather than setting it to the Server structure. - Extracts database validation logic, to provide a common code path for upcoming functionality. - Expose schema manager on the Command struct as well as providing common functions to acquire shared lock/close.	4 years ago
Hugo Vieira	621f8a9ff2	fix(schema): Database connection not cleanly closed ... This commit introduces closing the Schema Manager's underlying driver connection. We were only releasing the shared lock but not actually cleaning up the db connection and relied on the fact that the process would exit to do that for us.	4 years ago
Timothy Messier	047a66e87d	fix(worker): Improper reload when running as controller and worker (#2438) ... In cases where the server was started with both a controller and worker stanza, the reload of the config was not properly setting the initial upstream value on the new config. In this case the value is derived from other config values and not necessarily set directly. This now properly initializes the new config so that initial upstream is set in the same manner as the first load. Blame: 5d0cdf680f	4 years ago
Todd	0b942f4493	Only clear tags in set-worker-tags when "null" is set as the value of the -tag flag. (#2434)	4 years ago
Irena Rindos	18dff62b7b	Merge BYOW GA branch to main (#2398) ... * feat(workers): Add ability to read and reinitialize cert authority (#2312) * feat(workers): Return Release Version on worker list and read (#2377) * feat(cli): Read and reinitialize worker certificate authority (#2387)	4 years ago
Irena Rindos	cee5ff7599	Minor documentation fixes for controller-led (#2432) ... * Minor documentation fixes	4 years ago
Jeff Mitchell	fdb60f5b2d	Update comment around undocumented config flag	4 years ago
Jeff Mitchell	730131c105	Add test	4 years ago
Jeff Mitchell	16c9e9b592	Add ability to skip shared lock acquisition	4 years ago
Hugo Vieira	bf1486f75e	refact(target): Add context to RepositoryFactory constructor ... `errors.New` requires a context, so I've made that available from the Controller, and updated all `NewDeprecated` functions to `New` while I was at it	4 years ago
Louis Ruch	d7c4c648ec	bug(vault): Correctly handle credential stores with expired tokens (#2399) ... * bug(vault): Correctly handle credential stores with expired tokens Boundary makes use of a database view to perform CRUD operations on Vault credential stores and libraries. This view did not include credential stores with tokens that have expired in Vault, causing errors when attempting to perform any action against them.	4 years ago
Jeff Mitchell	01fb949d0b	Add controller-led worker auth flow (#2413) ... This adds an action to the API that allows pulling out an activation token that can be given to a worker in its config (directly or via env or file). The worker can pass this along with its normal request in place of its normal nonce and the server will automatically accept it. Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com>	4 years ago
Timothy Messier	5d0cdf680f	feat(worker): Support reloading of initial upstreams on SIGHUP (#2417) ... On a SIGHUP, if the worker's `initial_upstreams` config option has changed, it will use the new values as the address to send its status. Any previously discovered upstream addresses from previous status requests are dropped. Once a successful status request is made to the new addresses, the worker will resume its normal behavior of using the addresses from the response to the status request. This allows a worker to be deployed in a more stable way in a dynamic environment where controller IPs could change. In particular this helps with a case where all controllers are replaced with new controllers running on new IPs. To illustrate with an example, suppose there is an instance group of controllers instances. And there are worker instances that have their config rendered from consul-template that sets `initial_upstreams` to the IPs of the controller instances. If all controller instances are restarted or replaced at the same time and assigned new IPs, a new config will be rendered for the worker. Previously the only way for the worker to use the new value would be for the worker process to be restarted. Otherwise the worker would only know about the previous IPs and would fail to connect to the new controllers. However, a restart would mean any active sessions and session connections on the worker instance would be terminated. With this update, consul-template can send a SIGHUP to the worker, the worker will connect to the new controllers and resume normal status reporting, allowing the sessions and session connections to remain. The same principles would apply for other examples of dynamic environments such as nomad and kubernetes. See: https://github.com/hashicorp/consul-template https://www.nomadproject.io/docs/job-specification/template	4 years ago
Haotian	17ddc301a8	feat(cli): add/set/remove worker tags (#2266) ... * adds CLI commands for add/set/removing worker tags, and respective tests * adds StringSliceMapVar Flag to convert a string from the CLI to a map[string][]string value	4 years ago
Johan Brandhorst-Satzkorn	aef9073fa6	Upgrade to Go 1.19 (#2347)	4 years ago
Irena Rindos	b43e61c8c7	bug(workers): Create worker-led panics on invalid token (#2388) ... * Check for error before returning result	4 years ago
Timothy Messier	79866a287f	feat(schema): Add support for migration hooks ... This adds the ability to define hooks that will run prior to a schema migration. The hooks should only be used when a migration would fail due to data being in an invalid state, likely due to a bug in the previous schema definition. For example if a column was missing a constraint, and a new migration is attempting to add the constraint, there might already be values that violate the new constraint. In such cases, we would want the user to make a decision to address the data, and need to provide them with details about what data is problematic in case they want to manually address the problem. To help the user, if there is a sane way to address the data, we should provide an option to automatically "repair" the data, allowing the migration to continue. However, this still should be an explicit opt-in from the user, and we need to clearly describe what the repair option would do to the user so they understand the consequences of opting in. To accomplish this each migration can be provided a hook that contains a CheckFunc, RepairFunc, and RepairDescription. These functions must operate at the point-in-time of the migration immediately preceding the current migration, as as such they should not use and domain packages or repositories, instead they should use direct sql with the sql library. The description is used to explain what the RepairFunc will do. Hooks should be defined in `internal/db/schema/migrations/oss/oss.go` and registered with the schema edition. See the example in `internal/db/schema/manager_example_test.go` for more details.	4 years ago
Jeff Mitchell	a56d7aa4d0	Ensure that "null" can only be specified in "set-" commands (#2363) ... This allows a check function to be set to determine whether it is allowed to be set. This also ensures that if null is allowed it is either the only value or not set.	4 years ago
Jeff Mitchell	f1b737c62e	Fix error validation code in attr parsing (#2353) ... For a flag type used for attributes/secrets, values have always been able to be used with env:// or file:// format, but the error check to see whether the value was successfully parsed was doing a simple string equality rather than `errors.Is`. As a result a value containing a colon would trip up this check and cause an error, rather than allowing it to be used as a bare value.	4 years ago
Jeff Mitchell	02dd28f587	Add support for SSH private key passphrases (#2331) ... This adds support for encrypted SSH keys via passphrase. Co-authored-by: Louis Ruch <louisruch@gmail.com> Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>	4 years ago
Louis Ruch	dcccaf1bcf	bug(cmd): Ensure RunShutdownFuncs is called when an early error occurs (#2333) ... * bug(cmd): Ensure RunShutdownFuncs is called when an early error occurs	4 years ago
Jeff Mitchell	fa17fdf9d7	Update wording and fix a missing prompt (#2329)	4 years ago
Jeff Mitchell	fe2ee7ef4a	Change behavior of `-token` and `-password` to support env/file only (#2327) ... * Revert "Remove `-token` flag (#2303)" This reverts commit 65cff995d7. * Change behavior of -token * Add use of MustParsePath * Update changelog * Use errors.Is	4 years ago
Louis Ruch	53dbd51f14	Only consume ssh brokered credentials if the target is tcp (#2323)	4 years ago
Jeff Mitchell	26ffa705e5	Add parsepath logic to password in various places (#2325) ... * Add parsepath logic to password in various places: * Account password create/set/change * Authenticate Also fixes a bug where confirmation on a change-password call would run for the current password instead of the new one.	4 years ago
Jeff Mitchell	090b2b28f8	Clean up some dev config kms code (#2321) ... * Clean up some dev config kms code Although it didn't matter in the combined state, the KMS for auth storage was not actually being set properly if only a worker was being instantiated.	4 years ago
Jeff Mitchell	8800ec9c94	Reorganize logic to allow a poison pill (#2317)	4 years ago
Louis Ruch	fc25178827	bug(server): Start ops listener even if controller is nil (#2314)	4 years ago
Jeff Mitchell	65cff995d7	Remove `-token` flag (#2303) ... Token values can be shown in output of `ps` and so, and we support env vars and keyrings, so remove it.	4 years ago
Damian Debkowski	2db5840790	fix(cli) check error value in executeExtraActionsImpl funcs (#2293)	4 years ago
irenarindos	4908aba546	feat(vault): Add unimplemented worker filter support to OSS	4 years ago
Damian Debkowski	1e44ed3d92	fix(cli) check error value from command func (#2286)	4 years ago
Jeff Mitchell	5117cf9548	Add some safety checks in server command (#2288)	4 years ago
Timothy Messier	439566cd10	feat(target): Add ssh target support to sdk/api/cli ... This add the generated code and additional configuration to support sending the ssh target subtype to the api via the sdk or cli. The cli now supports an additional subcommand for the ssh target subtype: boundary targets create ssh boundary targets update ssh	4 years ago
Jeff Mitchell	1ef6e87a26	Add extra commands funcs (#2279)	4 years ago
Damian Debkowski	c2bfcc0664	refactor(api module): enforce typed definitions (#2238)	4 years ago
Louis Ruch	d6c1402223	bug(cli): Correctly generate private key file (#2274)	4 years ago
Louis Ruch	7d1a989ea7	feat(cli): Support using brokered private key in ssh subcommand (#2267) ... * feat(cli): Support using brokered private key in ssh subcommand	4 years ago
Louis Ruch	a17e973712	feat(credentials): Refactor credential purposes (#2260) ... * feat(credentials): Refactor credential purposes * Application credentials have been refactored to Brokered credentials * Egress credentials have been refactored to Injected Application credentials Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>	4 years ago