557 Commits (4b526538af660cf4c29988cd514b18fe673dc8a8)

Author	SHA1	Message	Date
irenarindos	16d95262a6	feature(worker): add workerKeyId to status	4 years ago
Jeff Mitchell	d1b3b2441f	Add node rotation (#2142)	4 years ago
Todd	1e3c941be1	Add active session count to the worker (#2145)	4 years ago
Todd	0f7e1ee7fa	Fix canonical tags not getting assigned in the api resource. (#2144)	4 years ago
irenarindos	78150d88d9	feature(WorkerAuth): Create RotateRoots domain and job	4 years ago
Todd	43bcbba47f	Implement UpdateWorker service method (#2133)	4 years ago
irenarindos	4c55305a49	Remove nonce encryption for workerAuth	4 years ago
Jeff Mitchell	4117841cf9	Use persistent storage for worker auth credentials (#2139)	4 years ago
Jim	c1445728e3	tests (servers): additional CreateWorker(...) unit tests (#2134)	4 years ago
Jeff Mitchell	caf19f867e	Rename some variables to remove Nodee	4 years ago
Haotian	1830605a7e	refact(servers) Update api for new worker and controller server tables (#2101) ... * Discontinue support for old Server message in ServerCoordinationService. Split message into ServerWorkerStatus and UpstreamServer (which currently contains controller addresses). Remove unnecessary fields. Modify workerStatusServer to use new fields. Co-authored-by: Todd <github@quaddi.com>	4 years ago
Jeff Mitchell	1987264bc3	Migrate storage to database repo (#2132)	4 years ago
Jim	5f66d8f2af	feature (worker): add WithFetchNodeCredentialsRequest to CreateWorker (#2131) ... * feature (errors): add support fmt specifier with operands to WithMsg(...) * feature (worker): add WithFetchNodeCredentialsRequest to CreateWorker * fixup! feature (worker): add WithFetchNodeCredentialsRequest to CreateWorker	4 years ago
Todd	abbfe45419	Add the Read/List service functions (#2123)	4 years ago
Jim	9da0faabd7	refactor (servers/workerauth): add StoreNodeInformationTx(...) (#2125) ... refactor to export StoreNodeInformationTx(...) which can be used by other repositories within their transactions to store node information.	4 years ago
Jim	6cbb36f2b1	chore (servers): update nodeenrollment dep (#2129) ... The signature for registration.AuthorizeNode(...) changed	4 years ago
Jim	78ffd82581	fix (servers): return unhandled err from storeRootCertificates(...) (#2127)	4 years ago
irenarindos	642e41c9d7	feat(workerAuth): Implement nodeenrollment lib workerauth storage	4 years ago
Todd	4716c1a788	Update List Workers Repo function to allow limits and provide scopes (#2121) ... * Update List Workers Repo function to allow limits and provide scopes Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com> Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>	4 years ago
Todd	587c6372c2	Add worker update to server repo (#2117)	4 years ago
Todd	731a45eba6	Merge the worker_status table with the worker table (#2111)	4 years ago
irenarindos	bf3b0340e5	feat(workerauth): add storage for RootCertificates aggregate	4 years ago
Michael Gaffney	eece174e5e	test(worker): Fix TestDeleteWorker	4 years ago
irenarindos	74fce3776b	feature(workers): add repository DeleteWorker	4 years ago
Jim	70c5da1048	feature (workers): add repository CreateWorker(...) (#2105)	4 years ago
Todd	a281d10206	Add worker config table and view (#2090) ... * Remove the server_id from session table, change it to worker_id on session_connection This is step 1 in updating the worker table. The worker is becoming a public resource so it must have a public id. We drop the server_id column on the session_connection table and add the worker_id column so we can use the wt_public_key type. Since db migrations are applied while the controller is offline, it should be safe to assume all session connections are not in a running state, thus allowing us to null out all the worker ids in the session_connection table. For now we don't have very good enforcement of the wt_public_id constraints, since the id is currently defined in the worker config, but this will soon change and the worker's id will be generated by the controller.	4 years ago
Todd	e5f02dfc26	Refactor the different repo methods into separate files (#2096) ... * Refactor the different repo methods into separate files * Move DefaultLiveness to the repository.go file to be shared across workers and controllers.	4 years ago
Todd	1c575a8762	make gen fix.	4 years ago
Todd	3fbf901739	Add source to worker tags table (#2087) ... * Remove the server_id from session table, change it to worker_id on session_connection This is step 1 in updating the worker table. The worker is becoming a public resource so it must have a public id. We drop the server_id column on the session_connection table and add the worker_id column so we can use the wt_public_key type. Since db migrations are applied while the controller is offline, it should be safe to assume all session connections are not in a running state, thus allowing us to null out all the worker ids in the session_connection table. For now we don't have very good enforcement of the wt_public_id contraints, since the id is currently defined in the worker config, but this will soon change and the worker's id will be generated by the controller. * Adding worker tag db writing test. * Move the server table back to the top. * Update comment for the worker object. * Update comment for the worker table. * Add worker tag sources ("config" or "api") * Revert renaming of UpsertWorker until later. * Remove no longer needed files. * Moving the TestWorker into the servers package. Fix the worker tags test. * Update internal/proto/controller/storage/servers/store/v1/worker.proto Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com> * Place the repos back together so they can be refactored in a different PR. Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com>	4 years ago
irenarindos	af3f75ffaf	fixup! feat(pki): Add PKI schemas and protos	4 years ago
irenarindos	20c314787d	fixup! feat(pki): Add PKI schemas and protos	4 years ago
irenarindos	88a6ca036f	feat(pki): Add PKI schemas and protos	4 years ago
Todd	2ecd550e27	Add fields to server_worker to be a boundary resource (#2083) ... * Remove the server_id from session table, change it to worker_id on session_connection This is step 1 in updating the worker table. The worker is becoming a public resource so it must have a public id. We drop the server_id column on the session_connection table and add the worker_id column so we can use the wt_public_key type. Since db migrations are applied while the controller is offline, it should be safe to assume all session connections are not in a running state, thus allowing us to null out all the worker ids in the session_connection table. For now we don't have very good enforcement of the wt_public_id contraints, since the id is currently defined in the worker config, but this will soon change and the worker's id will be generated by the controller. * Updating server_id references to controller_id. * Adding worker tag db writing test. * Move the server table back to the top. * Update comment for the worker object. * Update comment for the worker table. * Update the newWorkerId call to take a context and fix its error. * Correct comment for the wt_network_address domain.	4 years ago
Todd	472d7d520a	Remove the server_id from session table, change it to worker_id on session_connection (#2070) ... * Remove the server_id from session table, change it to worker_id on session_connection This is step 1 in updating the worker table. The worker is becoming a public resource so it must have a public id. We drop the server_id column on the session_connection table and add the worker_id column so we can use the wt_public_key type. Since db migrations are applied while the controller is offline, it should be safe to assume all session connections are not in a running state, thus allowing us to null out all the worker ids in the session_connection table. For now we don't have very good enforcement of the wt_public_id constraints, since the id is currently defined in the worker config, but this will soon change and the worker's id will be generated by the controller.	4 years ago
Jeff Mitchell	2f06513a3a	Merge branch 'main' into llb-byow	4 years ago
Jim	785241237e	refactor (kms): adopt the go-kms-wrapping/extras/kms package (#2027) ... * feature (db): add Db.UnderlyingDB() This is needed to allow for integration with bits that need a *dbw.DB * feature (kms): add new go-kms-wrapping/extras/kms dependency * refactor (kms): schema changes required to adopt extras/kms pkg * refactor (kms/iam): rename to DeprecateCreateKeysTx(...) * refactor (kms): remove deprecated test * refactor (kms): refactor Kms type This refactor includes renaming the existing type to DeprecatedKms and then refactoring the Kms type to become a wrapper of go-kms-wrapping/extras/kms * refactor (kms): delete all the unneeded bits All this stuff is not needed now that we're using go-kms-wrapping/extras/kms * refactor (db): fixup tests after kms refactor * refactor (kms/tests): use testing.TB for test helpers Our test helper packages were not possible to use with benchmarks. This refactor switches to testing.TB to allow both tests and benchmarks to use the helpers. * tests (session benchmarks): refactor to use new Kms type * refactor (schema): rm test which relies on deprecated Kms code * refactor (kms): post rebase on main changes required * chore (kms refactor): re-add unit test from main * refactor (kms): uses migrations that don't include KMS schema changes	4 years ago
Todd	d8a443e238	Merge branch 'main' into llb-byow ... # Conflicts: # internal/daemon/controller/handlers/targets/target_service.go # internal/daemon/controller/handlers/workers/multihop_service.go # internal/daemon/controller/handlers/workers/worker_proxy_service.go # internal/daemon/controller/handlers/workers/worker_service.go # internal/daemon/worker/status.go # internal/daemon/worker/worker.go	4 years ago
Todd	b58dada40d	Move the server daemons into their own package (#2061) ... * Move the server daemons into their own package With this change the internal/server package now is dedicated to the server domain (workers and controllers) and not to the server daemons. The hope is that this will make it easier to keep the daemons decoupled from the representation of the servers in the database.	4 years ago
Jeff Mitchell	ab4d542fad	Add multihop auth support (#32)	4 years ago
irenarindos	9e27605213	refact(servers): Split server table into worker and controller	4 years ago
Jeff Mitchell	f748af7b02	Initial BYOW auth PoC (#29)	4 years ago
Todd	687dd1bda6	Move the session cleanup job logic into the session package. (#2060) ... * Move the session cleanup job logic into the session package. This is part of a broader effort to more narrowly define the purpose of the internal/server directory to be for interacting with servers themselves. Future changes will continue to remove things from this directory until the purpose of the directory is clearly working primarily with the boundary servers resource.	4 years ago
Jeff Mitchell	4cf2a87e8d	Update targets to new listing method (#2045) ... This uses the prefetch method to fetch resource IDs and validate them for authz by the user before then fetching the full list of targets.	4 years ago
Johan Brandhorst-Satzkorn	e864652b33	feat(sessions): Add list benchmarks ... The list benchmark tests uses pre-created database dumps to run its benchmarks. This benchmark will be used to guide optimizations around listing of sessions. Fixes https://hashicorp.atlassian.net/browse/ICU-4042	4 years ago
Johan Brandhorst-Satzkorn	7f9b294a7e	refact(all): Use testing.TB for test helpers ... Our test helper packages were not possible to use with benchmarks. This refactor switches to testing.TB to allow both tests and benchmarks to use the helpers.	4 years ago
Jeff Mitchell	b41e983503	Reorder authz check for sessions (#2042) ... * Reorder session authz checks This implements a mechanism for service handlers to pass a repo satisfying an interface into the scope IDs listing function. The purpose of this interface is to allow the same function to perform authorization checking against resources rather than requiring service handlers to fetch all resources in the determined set of scopes and then perform this checking. While this could be done in each service handler, this approach centralizes the logic, which has the nice benefit of removing some boilerplate from service handler list functions that have adapted to it. Tests haven't changed, which is expected -- the function should return exactly what was being returned before, simply faster.	4 years ago
Todd	5603652d33	Make the {id} regexp less strict for identifying the "path" label value. (#2034) ... Previously we were matching what boundary considers an id, but that is determined after requests are routed by grpc-gateway. This changes the regexp to match any path segment to try to behave the same way that grpc-gateway would when assigning values to the {id} variable declared in the protobuf.	4 years ago
Timothy Messier	3be5c44907	feat(target): Classify resources for audit events	4 years ago
Timothy Messier	c8be4a9890	refact(target): Switch subtype attributes to oneof ... This updates the target resources to use a oneof for attributes. This allows requests to the targets service to leverage the new subtypes.AttributeTransformerInterceptor so that attributes are strongly typed prior to the service handler.	4 years ago
Timothy Messier	4599e64cab	feat(event): Remove BOUNDARY_DEVELOPER_ENABLE_EVENTS env var	4 years ago