boundary

Commit Graph

Author	SHA1	Message	Date
Jim	723dbdfedf	fix (boundary dev): make the LDAP auth method active-public (#3344 )	3 years ago
Jeff Mitchell	8322916fb4	Remove all deprecated Err/Wrap/E calls (#3286 )	3 years ago
Todd	8980143278	Allow kms purpose "downstream-worker-auth" (#3299 )	3 years ago
Jim	d4e537c88d	chore: updgrade pgx direct deps to v5 (#3258 )	3 years ago
Jim	d49fde2299	feat(cli/session-recordings): add download cmd	3 years ago
Danielle Miu	a4a14fc7fc	merged commit for plugin rework, storage bucket sql and proto, storage bucket secret rewrapping, storage bucket repository	3 years ago
Louis Ruch	798a1f952a	feat(storage): Add support for storage plugins	3 years ago
Louis Ruch	351444f1bd	refact(plugin): Move host loopback plugin into internal/plugin/loopback	3 years ago
Jim	20cf521cc0	feat(bsr): add bsr kms support in config, dev and tests	3 years ago
Jim	b974063a52	chore (boundary/dev): remove typo (#3194 )	3 years ago
Jim	af1092e8e8	feat (boundary/dev): add connection info for dev ldap server when running via `boundary dev` (#3193 ) * chore (dev/ldap): update gldap dependency This update fixes the dup entries returned when searching for users and/or groups * feat (boundary/dev): add connection info for dev ldap server	3 years ago
Jim	667ea285be	feature (boundary dev): add support for dev ldap auth method (#3192 )	3 years ago
Jeff Mitchell	163ce184b8	KMS-PKI Workers (#3101 ) This adds a new mechanism for worker authentication that uses the third-party arbitration of the original KMS flow by leveraging recently-added capabilities in nodeenrollment to support a registration wrapper. This allows for workers to be registered to the system with just a name and a matching wrapper, while at the same time allowing these workers to be used for private Vault access and multi-hop as they contain per-worker encryption keys and support rotation. Nodes using this mode will generate and rotate credentials in-memory (using another recently added nodeenrollment capability) so will have a new set of keys on every startup. This has the side effect of ensuring that there is never a conflict or re-use of these credentials. Note that the normal test worker flow was using the now-deprecated KMS method; there is still a test that uses this (explicitly) but all other tests using test workers that did not specify a specific PKI flow now actually use this mechanism. This means there is fairly decent test coverage in a general sense, plus the specific tests updated/added for this feature. This also adds a new KMS type that can be used to have distinct KMSes for upstream authentication vs. accepting from downstream.	3 years ago
Elim Tsiagbey	16f48686a7	Refactor Target Repository (#3092 ) - Refactor the Target domain repository functions so that they no longer return 4 different types. `Target` struct now contains `HostSource` & `CredentialSources` with Getters & Setters - Extending `Target` to contain `HostSource` & `CredentialSources` enables `funcs` to just return `Target` instead of multiple return types. This also allows easy future refactors and extensions of `Target`	3 years ago
Jeff Mitchell	b76b24a4ad	Move prefixes for many packages into the globals package (#3069 ) This is a prerequisite for some enhancements to grant validation	3 years ago
Jeff Mitchell	b2bab45c13	Port over changes (#3061 ) (#3062 )	3 years ago
Johan Brandhorst-Satzkorn	4146c0c55d	Upgrade Go version to 1.20 (#2898 ) * chore: Upgrade Go version * fix: Upgrade golangci-lint to support 1.20 * fix: Don't use t.SetEnv in parallel tests This is a panic in Go 1.20 and it sounds like a recipe for distaster in general.	3 years ago
Johan Brandhorst-Satzkorn	3c29308673	chore: Add license headers to all files	3 years ago
Timothy Messier	e66ea15fef	fix(cli): Status code on api error When using the json output of the cli (`-format=json`), a successful call to the controller API would place the HTTP status code in the JSON as `status_code`. However, if there was an error from the API the status code would be placed in the JSON as `status`. In order to be consistent, this adds a `status_code` field to the error response case. For backwards compatibility it still populates `status` in the error case. This inconsistency was missed partially due to a bug in the CLI tests. The assertion on status code was not valid and would always be successful. Thus this also fixes the assertions and tests.	3 years ago
Hugo Vieira	f85da3ee2b	feat(cmd): Create target using address on boundary dev / database init Creates a target using an address for boundary dev and when first init-ing boundary (boundary database init). It also makes this newly created target the default one (ttcp_1234567890). The target using host sources is now a secondary target (ttcp_0987654321).	3 years ago
Jeff Mitchell	b286060ea8	Fix string regression in attribute parsing (#2759 ) In #2721, the ability for key-only values was added via using a wrapperspb.StringValue that could be null. This introduced a bug because originally the default case for `-attr` was to get the string value but instead it used the incoming value as-is to allow for nulls; the null check was moved up later but the original behavior was not restored. As a result, non-explicitly-quoted strings carried through the wrapperspb.StringValue, resulting in a map for the value in JSON instead of a string. This also fixes the ability to set explicitly quoted strings.	3 years ago
Jeff Mitchell	098248be18	Add the ability for CLI map values to contain keys only, which map to JSON nulls (#2721 )	3 years ago
Johan Brandhorst-Satzkorn	df02501dcc	Create new "previous-root" key purpose for root key migrations (#2639 ) (#2648 ) * Update go-kms-wrapping dependency * Apply changes suggested by Jeff * Fix listener test * Add note about config fix to CHANGELOG * Review comments Co-authored-by: Dan Heath <76443935+Dan-Heath@users.noreply.github.com> Co-authored-by: Dan Heath <76443935+Dan-Heath@users.noreply.github.com>	3 years ago
Jeff Mitchell	0c96c6ff6c	Split grace period into multiple config values (#2578 ) (#2603 ) Co-authored-by: Todd <github@quaddi.com>	3 years ago
Irena Rindos	b26814a3cc	move user variables into globals (#2580 ) * move user variables into globals	4 years ago
Jeff Mitchell	cede1aec93	Add initial templating support to Vault credential libraries (#2569 ) (#2575 ) Add initial templating support to Vault credential libraries This adds support for templating various account and user values into Vault dynamic credential library POST bodies and GET/POST paths. It also unifies how parameters are used in grants, with backwards compatibility.	4 years ago
Johan Brandhorst-Satzkorn	f57454b6b9	Rewrite interface{} to any (#2535 ) * chore: Rewrite interface{} to any * Add ignore revs	4 years ago
Haotian	3be8b6efed	refactor(metric): move common metrics functions out of 'internal' directory (#2536 )	4 years ago
Irena Rindos	d951e1ebc1	Worker graceful shutdown (#2455 ) * add graceful shutdown to worker	4 years ago
Damian Debkowski	546c5dc5be	feat: static json credentials (#2423 )	4 years ago
Hugo Vieira	8ab9ffbcac	refact(cmd): Encapsulate some functionality on Command and Server This commit extracts 3 separate pieces of functionality into their own function/method: - Extracts the database opening with the intention to have a function that performs all that functionality but returns the created database object rather than setting it to the Server structure. - Extracts database validation logic, to provide a common code path for upcoming functionality. - Expose schema manager on the Command struct as well as providing common functions to acquire shared lock/close.	4 years ago
Timothy Messier	047a66e87d	fix(worker): Improper reload when running as controller and worker (#2438 ) In cases where the server was started with both a controller and worker stanza, the reload of the config was not properly setting the initial upstream value on the new config. In this case the value is derived from other config values and not necessarily set directly. This now properly initializes the new config so that initial upstream is set in the same manner as the first load. Blame: `5d0cdf680f`	4 years ago
Jeff Mitchell	16c9e9b592	Add ability to skip shared lock acquisition	4 years ago
Hugo Vieira	bf1486f75e	refact(target): Add context to RepositoryFactory constructor `errors.New` requires a context, so I've made that available from the Controller, and updated all `NewDeprecated` functions to `New` while I was at it	4 years ago
Haotian	17ddc301a8	feat(cli): add/set/remove worker tags (#2266 ) * adds CLI commands for add/set/removing worker tags, and respective tests * adds StringSliceMapVar Flag to convert a string from the CLI to a map[string][]string value	4 years ago
Johan Brandhorst-Satzkorn	aef9073fa6	Upgrade to Go 1.19 (#2347 )	4 years ago
Jeff Mitchell	a56d7aa4d0	Ensure that "null" can only be specified in "set-" commands (#2363 ) This allows a check function to be set to determine whether it is allowed to be set. This also ensures that if null is allowed it is either the only value or not set.	4 years ago
Jeff Mitchell	f1b737c62e	Fix error validation code in attr parsing (#2353 ) For a flag type used for attributes/secrets, values have always been able to be used with env:// or file:// format, but the error check to see whether the value was successfully parsed was doing a simple string equality rather than `errors.Is`. As a result a value containing a colon would trip up this check and cause an error, rather than allowing it to be used as a bare value.	4 years ago
Jeff Mitchell	fa17fdf9d7	Update wording and fix a missing prompt (#2329 )	4 years ago
Jeff Mitchell	fe2ee7ef4a	Change behavior of `-token` and `-password` to support env/file only (#2327 ) * Revert "Remove `-token` flag (#2303)" This reverts commit `65cff995d7`. * Change behavior of -token * Add use of MustParsePath * Update changelog * Use errors.Is	4 years ago
Jeff Mitchell	8800ec9c94	Reorganize logic to allow a poison pill (#2317 )	4 years ago
Jeff Mitchell	65cff995d7	Remove `-token` flag (#2303 ) Token values can be shown in output of `ps` and so, and we support env vars and keyrings, so remove it.	4 years ago
Damian Debkowski	c2bfcc0664	refactor(api module): enforce typed definitions (#2238 )	4 years ago
Jeff Mitchell	7ab7c8eaf4	Have fallback eventing use json format (#2216 ) * Have fallback eventing use json format The server will initialize a logger via InitFallbackLogger(...) after setting up the server's logging (and honoring the related cmd flags). This fallback logger will be used if when no eventer is initialized. If no fallback logger is initialized, then a event.defaultLogger() will be used if no eventer is defined. Co-authored-by: Jim <jlambert@hashicorp.com>	4 years ago
Timothy Messier	fd5d15af27	feat(config): Add database config options for idle connection management (#2176 ) This adds two new config options for the `database` stanza: - `max_idle_connections` - `max_idle_time` These correspond to settings for the underlying `sql.DB` instance. They can be used to have finer control over the controller's database connection pool. For example this can be used to mitigate the high connection overhead when connecting to postgres by setting a high `max_idle_connections` and either setting `max_idle_time` to zero or to a high duration. Alternatively, if using a connection pool like pgpool-II or pgbouncer, `max_idle_connections` can be set to 0. See: https://pkg.go.dev/database/sql#DB.SetMaxIdleConns https://pkg.go.dev/database/sql#DB.SetConnMaxIdleTime https://www.pgpool.net/mediawiki/index.php/Main_Page https://www.pgbouncer.org/	4 years ago
Todd	19b549c44a	Rename package servers to server (#2222 )	4 years ago
Todd	eb37fc8d07	Quote tags before printing them out. (#2211 )	4 years ago
Jeff Mitchell	32d04b9ce7	Allow a worker to use KMS auth but accept PKI for proxy (#2206 ) This essentially worked for non-dev mode before but would create storage directories that weren't actually used or needed, and it didn't work in dev mode because it made assumptions about the presence of a worker auth kms or not. This fixes those behaviors.	4 years ago
Jeff Mitchell	704d68848c	Merge remote-tracking branch 'origin/main' into llb-byow	4 years ago
Johan Brandhorst-Satzkorn	d06ac0d370	Propagate plugin execution dir to CreatePlugin (#2183 ) * fix: Propagate plugin options to CreatePlugin Plugin options were previously only applied to the BuildPluginMap call, resulting in the plugin execution_dir variable being ineffective. Also add a test to verify functionality * fix: Support plugin execution_dir for all plugins Previously, only external host plugins would respect the plugin execution dir. Now, all uses of the embedded plugins respect the configuration.	4 years ago

1 2 3 4 5 ...

251 Commits (4cb020fb3fa1df66b4539d2ed046a63d2db5cf7c)