boundary

Commit Graph

Author	SHA1	Message	Date
Jeff Mitchell	4e0c2d79ac	Add grant scope IDs to role list (#4893 ) This adds grant_scope_ids in the output of role listing. The lookup for grant scope IDs was changed to allow taking in a set of roles instead of just a single role, and the results are collated afterwards. --------- Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>	2 years ago
Michael Li	e2872275dc	chore: Update UI version (#4897 )	2 years ago
Johan Brandhorst-Satzkorn	c6f3c375f3	api: remove deprecated grant_scope_id field (#4886 ) * api: remove deprecated grant_scope_id field The grant_scope_id field was deprecated in 0.15.0, so we can remove it for 0.17.0. * Fix tests * Fix more tests * Remove an option and some related code that stuck around * Fix bats tests --------- Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>	2 years ago
Jeff Mitchell	d547e0d459	Add test ability to reinitialize worker auth roots on startup (#4895 )	2 years ago
Irena Rindos	b54608b9f2	worker auth: use new previous pkix field (#4894 ) * worker auth: use new previous pkix field	2 years ago
Irena Rindos	61e7ab4738	Allow descriptions to contain newlines and other whitespace (#2599 ) * Allow names and descriptions to contain newlines and other whitespace * separate validate name from validate description * update changelog --------- Co-authored-by: Danielle Miu <29378233+DanielleMiu@users.noreply.github.com>	2 years ago
Irena Rindos	08f391c5d6	workerauth: satisfy NodeIdLoader interface (#4870 ) * workerauth: satisfy NodeIdLoader interface	2 years ago
David Bond	0c25dbad13	Use appropriate gRPC error codes for OIDC (#4877 ) This commit makes modifications to the OIDC request handlers to return appropriate gRPC status codes on errors. Before this change, boundary presents the internal error codes to clients. This causes problems for reverse proxies, as these status codes are mapped to non-standard HTTP response codes which are ultimately all turned into 500 responses when 4xx status codes are more appropriate and descriptive of the error returned. Some modifications in this commit include calls to `event.WriteError` so that the internal error is written to the controller log for visibility. Comments about potential duplicate logs are now removed as `event.WriteError` is not called when using functions from the `handlers` package. Signed-off-by: David Bond <davidsbond93@gmail.com>	2 years ago
Michael Li	2467f9107a	test(db): Fix skip command (#4860 )	2 years ago
Michael Li	e18e3ab783	test: Fix tests due to time (#4855 ) * test(billing): Calculate time deltas from a fixed time Some time calculations are impacted when using the current day vs. the start of the month. * test(db): Conditionally skip tests at end of month Certain tests fail when run on the last day of the month because of edge cases in the setup of test data (for example, if today is May 31 and NZ time is June 1). This adds conditional logic to skip those tests when run on the last day of a month. * CR: typo	2 years ago
Todd	e0a7c9acdd	Document the deprecation of include_terminated (#4602 ) * Document the deprecation of include_terminated * Update the changelog	2 years ago
Sepehr	1f48ba5d1a	Telemetry: storage bucket proto (#4824 ) * oss:feat(storage): add observation tag in proto for telemetry * oss:feat(storage): add observation tag in proto service * oss:feat(storage): generate proto files with changes * oss:feat(storage): add storage bucket id to target proto	2 years ago
Uruemu S Aganbi	1aa8c2e1d7	Add observation tags for Session Recording Service (#4825 ) * Add observation tags to session_recording.proto * remove scope_info observation tags * Remove quotes and add tag to storage_bucket_id * Add tags for session recording service * Update proto definitions - Remove gotags on messages - Remove quotes	2 years ago
Johan Brandhorst-Satzkorn	ec289420d3	clientagentcmd: use "localhost" to call client agent (#4816 ) The client agent serves on "localhost:9300" by default. It appears on some systems this resolves to ::1:9300 and on some systems 127.0.0.1:9300. We should use the same address on the client as the server to avoid any incompatibilities between systems.	2 years ago
Johan Brandhorst-Satzkorn	a1391db090	internal/cmd: rename ferry files to client_agent (#4815 ) This was missed in the big rename PR	2 years ago
Johan Brandhorst-Satzkorn	e64443c66f	Rename daemon CLI command to cache (#4808 ) * internal/cmd/wrapper: add deprecation wrapper The deprecation wrapper can be used to display a warning to callers when a command is deprecated. * all: rename daemon to cache Rename the boundary daemon command to boundary cache. This avoids confusion with future client/daemons. * changes daemon to cache in nav --------- Co-authored-by: Robin Beck <stellarsquall@protonmail.ch>	2 years ago
Todd	6936a5448c	update status cli to optionally return some fields (#4810 )	2 years ago
Johan Brandhorst-Satzkorn	8ff18f6c3c	internal/cmd: rename ferry to client-agent Renames the ferry command and related flags and env vars to client-agent following the new naming decision.	2 years ago
Hugo	9b44974524	docs: Add CHANGELOG entry	2 years ago
Hugo	2983f80eaa	fix(cmd): Support account attribute maps	2 years ago
Hugo	61e2056ef4	fix(auth/ldap): Take user attrs into account when authenticating	2 years ago
Timothy Messier	a2c529b9d1	fix(controller): Use max request duration cluster listener (#4805 ) The cluster listener supports a `max_request_duration` option, and defaults to 90 seconds. However, this configuration was not being use when processing grpc requests from the listener. This meant that requests from worker to controller could hang indefinitely and contributed to the recently fixed issue with database connections being stuck in `idle in transaction`. This commit adds a grpc interceptor that ensures each request has a deadline set to the max request duration for the listener. Refs: `29cd7bc9d6`	2 years ago
Timothy Messier	29cd7bc9d6	fix(session): Move encryption/decryption out of database transactions (#4803 ) Several session.Repository methods need to encrypt or decrypt fields when persisting or retrieving a Session. These encrypt/decrypt operations where being performed while within a database transaction. The first step in the encrypt/decrypt operation is to retrieve the kms.Wrapper. While the wrappers get cached in memory, the retrieval still results in a database query to check that the kms collection version has not changed. This query happens with a separate db.Reader, and therefore uses a separate database connection from the transaction being used by the session.Repository. If the controllers are configured with a relatively low `max_open_connections`, and be under sufficient load interactive with sessions, the controller can consume all of the available database connections, and get stuck with open transactions while waiting for a database connection to execute the kms related queries. This can be see by checking pg_stat_activity and seeing transactions stuck in `idle in transaction` with a wait_event of ClientRead. This commit changes all of the Repository methods the perform any encryption or decryption operations, including the retrieval of the kms.Wrapper, outside of a database transaction. An alternative approach would be to unsure that the kms.Wrapper retrieval happens within the same database transaction. However, it seems preferable to avoid doing these relatively expensive operations within a transaction when it is not necessary. As part of this fix, it also eliminates some logic that is no longer needed. During previous would with KMS wrapping, the method of how sessions were encrypted was changed, and some logic to lazily re-encrypt sessions was introduced. However, given that terminated sessions are deleted, and the KMS changes was introduced several versions ago (0.13.0), this lazy re-encrypt logic should no longer be necessary. Refs: `edd323b73a` See: https://www.postgresql.org/docs/current/monitoring-stats.html#MONITORING-PG-STAT-ACTIVITY-VIEW https://www.postgresql.org/docs/current/runtime-config-client.html#GUC-IDLE-IN-TRANSACTION-SESSION-TIMEOUT https://developer.hashicorp.com/boundary/docs/configuration/controller#max_open_connections	2 years ago
Johan Brandhorst-Satzkorn	111b8fbecf	internal/cmd/ferry: add sessions command (#4800 )	2 years ago
Todd	5a06e4fe66	Auto generate the permissions pages. (#4786 ) * Auto generate the permissions pages. * Add add- set- remove- auto descriptions. Hide scope line when no scope provided * Document the resource info struct	2 years ago
Todd	c3f9fde5d7	Wait to select tokens until we know we need to (#4794 ) AuthToken selection involves checking to seeing if the one we are picking has been canceled or expired on the boundary controller. If we are only searching locally and not performing a refresh, there is no need to check if the tokens have expired or not.	2 years ago
Irena Rindos	6f09819e9f	chore: fix workers tag cmd help strings (#4780 )	2 years ago
Irena Rindos	325949c23a	chore: removed commented out time.sleep calls (#4770 )	2 years ago
Michael Milton	f7e59d5d04	Add hidden ferry pause and resume commands (#4771 ) * Add hidden ferry pause and resume functions * add check for 200 status * include pause/resume status in ferry status, fix output * put error string back to previous state	2 years ago
Irena Rindos	52f53a149c	bug: test fails on end of month (#4748 )	2 years ago
Kerim Satirli	e54519975b	adds missing space in mlock warning (#4286 )	2 years ago
Stan Ryzhov	99f7e470f2	test(bats): Verify alias can be created with host id	2 years ago
Stan Ryzhov	60706a49e5	test(bats): Verify invalid inputs for aliases	2 years ago
Cameron Perera	e0306293be	chore: bump ui commit to dd92321 (#4745 )	2 years ago
Lisbet Alvarez	5876b29758	bump ui commit (#4740 )	2 years ago
Todd	3cae272c27	Hide ferry specific flags (#4737 )	2 years ago
Zhihe Li	3b66f0651c	chore: bump ui commit (#4734 )	2 years ago
Irena Rindos	16d23fa55f	bug(scopes): scopes list returns 500 without perms (#4731 )	2 years ago
Todd	7ccc099807	Use the default retry limit across client cache (#4727 )	2 years ago
Cameron Perera	e792dd0ea5	chore: bump ui commit to dccf06c (#4724 )	2 years ago
Cameron Perera	7018234724	chore: bump ui commit to 5ae490c (#4713 )	2 years ago
Lisbet Alvarez	a73076d666	bump ui commit to a6bdc4f (#4707 )	2 years ago
Cameron Perera	4b48943c12	chore: bump ui commit to 3e9a06a (#4702 )	2 years ago
Timothy Messier	7c14aeaf41	fix(session): Use active transaction (#4592 ) When closing orphaned connections and checking if a session is not active, the repository was opening a transaction, but then calling the original reader instead of using the reader/writer from the transaction. This would result in a transaction being opend, then a separate transaction being used to run the query, and finally the original transaction would commit without any statements being executed. Co-authored-by: Sorawis Nilparuk (Bo) <sorawis.nilparuk@hashicorp.com>	2 years ago
Sorawis Nilparuk (Bo)	8f457c9c93	make newSendCtx also handle context.DeadlineExceeded (#4603 ) * make newSendCtx also handle context.DeadlineExceeded * add assertion to check that context is valid	2 years ago
Todd	7df9144fbf	Fix typos in request validation errors for aliases (#4671 ) * Fix typos in request validation errors for aliases * Add format validation for destination id field.	2 years ago
Michael Li	ca1196cdc9	test(worker): Address flake in TestMonitorUpstreamConnectionState (#4668 ) * test(worker): Address flake * test(worker): refactor `TestMonitorUpstreamConnectionState` tests * test(worker): remove assertion for grpc shutdown state --------- Co-authored-by: Elim Tsiagbey <elim.tsiagbey@hashicorp.com>	2 years ago
Carlos Alcaide Corvo	db2a4d9015	Bump UI version (#4664 )	2 years ago
Todd	55cf055285	Fix build and test breakage. (#4659 )	2 years ago
Cameron Perera	15737b0ca8	chore: bump ui commit to f9cd1c3 (#4658 )	2 years ago

1 2 3 4 5 ...

2545 Commits (4e0c2d79ac886e8d8804bcba12aaf2f6ff84a722)