123 Commits (69fc3a47d07969c3e29e1fcd6a9b6d818052d47a)

Author	SHA1	Message	Date
Irena Rindos	f7dbf2a532	Merge pull request #2163 from hashicorp/irindos-clusterid-upstreams ... feat(worker): Map cluster ID in config to upstream address	4 years ago
irenarindos	256498d40f	fixup! feat(worker): Map cluster ID in config to upstream address	4 years ago
Jeff Mitchell	5b978d7fa7	Adjust parameter naming (#2161) ... * Adjust parameter naming for some worker resource fields * Add eventing listener to event when authentication is successful from a downstream worker	4 years ago
irenarindos	3aa7d11419	feat(worker): Map cluster ID in config to upstream address	4 years ago
Jeff Mitchell	f4642930b4	Updates from review of 2076 (#2135)	4 years ago
Haotian	631c174f47	feat(worker): implements WorkerAuthStorage wrapper for worker credential encryption (#2076) ... * Adds WorkerAuthStorage wrapper for worker credential encryption using nodeenrollment library. * Adds AuthStoragePath field in worker config and dev mode to specify directory to store credentials.	4 years ago
Todd	731a45eba6	Merge the worker_status table with the worker table (#2111)	4 years ago
Todd	472d7d520a	Remove the server_id from session table, change it to worker_id on session_connection (#2070) ... * Remove the server_id from session table, change it to worker_id on session_connection This is step 1 in updating the worker table. The worker is becoming a public resource so it must have a public id. We drop the server_id column on the session_connection table and add the worker_id column so we can use the wt_public_key type. Since db migrations are applied while the controller is offline, it should be safe to assume all session connections are not in a running state, thus allowing us to null out all the worker ids in the session_connection table. For now we don't have very good enforcement of the wt_public_id constraints, since the id is currently defined in the worker config, but this will soon change and the worker's id will be generated by the controller.	4 years ago
Haotian	898da56a77	feat(workers): Add storage path parameter to worker config	4 years ago
Timothy Messier	b5080c30c1	fix(config): Prevent panic when setting audit config filter orverrides (#2021) ... This updates the config parsing for this stanza so prevent panics like the following: panic: reflect.Value.MapIndex: value of type string is not assignable to type event.DataClassification goroutine 1 [running]: reflect.Value.assignTo({0x13fbb20, 0xc000a28700, 0x461367}, {0x1693f9d, 0x16}, 0x14375c0, 0x0) /usr/lib/go/src/reflect/value.go:2810 +0x2ad reflect.Value.MapIndex({0x145b1c0, 0xc000a16570, 0xc00072ff20}, {0x13fbb20, 0xc000a28700, 0x98}) /usr/lib/go/src/reflect/value.go:1535 +0x7e github.com/hashicorp/hcl.(*decoder).decodeMap(0x8, {0xc00012b0b0, 0x28}, {0x67b40a8, 0xc0005fdc80}, {0x14bac80, 0xc0005fdc20, 0x1}) /go/pkg/mod/github.com/hashicorp/hcl@v1.0.0/decoder.go:380 +0xa95 github.com/hashicorp/hcl.(*decoder).decode(0xc000731360, {0xc00012b0b0, 0x28}, {0x67b40a8, 0xc0005fdc80}, {0x14bac80, 0xc0005fdc20, 0x0}) /go/pkg/mod/github.com/hashicorp/hcl@v1.0.0/decoder.go:100 +0x395 github.com/hashicorp/hcl.(*decoder).decodeStruct(0x203000, {0xc0005bf500, 0x11}, {0x67b40a8, 0xc0005fdc08}, {0x14fada0, 0xc0005fdc20, 0x7296ce0}) /go/pkg/mod/github.com/hashicorp/hcl@v1.0.0/decoder.go:702 +0x1349 github.com/hashicorp/hcl.(*decoder).decode(0xc000731360, {0xc0005bf500, 0x11}, {0x67b40a8, 0xc0005fdc08}, {0x14fada0, 0xc0005fdc20, 0x0}) /go/pkg/mod/github.com/hashicorp/hcl@v1.0.0/decoder.go:108 +0x62f github.com/hashicorp/hcl.(*decoder).decodePtr(0x8, {0xc0005bf500, 0x11}, {0x67b40a8, 0xc0005fdc08}, {0x1442220, 0xc0005ca2f0, 0x1}) /go/pkg/mod/github.com/hashicorp/hcl@v1.0.0/decoder.go:405 +0xd3 github.com/hashicorp/hcl.(*decoder).decode(0xc000731360, {0xc0005bf500, 0x11}, {0x67b40a8, 0xc0005fdc08}, {0x1442220, 0xc0005ca2f0, 0x12}) /go/pkg/mod/github.com/hashicorp/hcl@v1.0.0/decoder.go:102 +0x3e8 github.com/hashicorp/hcl.(*decoder).decodeStruct(0x7f8c99b698f0, {0x1676310, 0x4}, {0x67b40d0, 0xc0005c82a0}, {0x1621c80, 0xc0005ca240, 0x0}) /go/pkg/mod/github.com/hashicorp/hcl@v1.0.0/decoder.go:702 +0x1349 github.com/hashicorp/hcl.(*decoder).decode(0xc000731360, {0x1676310, 0x4}, {0x67b40d0, 0xc0005c82a0}, {0x1621c80, 0xc0005ca240, 0xc0005ca240}) /go/pkg/mod/github.com/hashicorp/hcl@v1.0.0/decoder.go:108 +0x62f github.com/hashicorp/hcl.DecodeObject({0x1442400, 0xc0005ca240}, {0x67b40d0, 0xc0005c82a0}) /go/pkg/mod/github.com/hashicorp/hcl@v1.0.0/decoder.go:60 +0x126 github.com/hashicorp/boundary/internal/cmd/config.parseEventing(0xc0005fa2a0) /go/src/github.com/hashicorp/boundary/internal/cmd/config/config.go:622 +0x1ec github.com/hashicorp/boundary/internal/cmd/config.Parse({0xc000683100, 0x66c}) /go/src/github.com/hashicorp/boundary/internal/cmd/config/config.go:553 +0x149b github.com/hashicorp/boundary/internal/cmd/config.LoadFile({0x7fff4c8fdeef, 0xc0008e2d40}, {0x0, 0x0}) /go/src/github.com/hashicorp/boundary/internal/cmd/config/config.go:306 +0x6f github.com/hashicorp/boundary/internal/cmd/commands/database.(*InitCommand).ParseFlagsAndConfig(0xc0005ae000, {0xc000132030, 0x2, 0x2}) /go/src/github.com/hashicorp/boundary/internal/cmd/commands/database/init.go:516 +0x605 github.com/hashicorp/boundary/internal/cmd/commands/database.(*InitCommand).Run(0xc0005ae000, {0xc000132030, 0xc0002857a0, 0xc000285788}) /go/src/github.com/hashicorp/boundary/internal/cmd/commands/database/init.go:175 +0x4a github.com/mitchellh/cli.(*CLI).Run(0xc0002b2c80) /go/pkg/mod/github.com/mitchellh/cli@v1.1.2/cli.go:262 +0x5f8 github.com/hashicorp/boundary/internal/cmd.RunCustom({0xc000132010, 0x60, 0x0}, 0x0) /go/src/github.com/hashicorp/boundary/internal/cmd/main.go:186 +0x9d6 github.com/hashicorp/boundary/internal/cmd.Run(...) /go/src/github.com/hashicorp/boundary/internal/cmd/main.go:92 main.main() /go/src/github.com/hashicorp/boundary/cmd/boundary/main.go:13 +0xc9	4 years ago
Hugo	244237cd2f	feat(controller): Add health endpoint (#1882) ... * feat(controller): New health service and server This change also implements a new listener purpose, `ops`. `ops` (short for operations) is a new listener purpose that is responsible for serving Boundary's operations endpoints, like health and possibly metrics. At Startup: `ops` listeners get configured as late as possible to catch any errors with the startup process; At Shutdown: If the health endpoint has been set-up, we introduce a configurable delay in the process. This is to enable the health endpoint to report unhealthy for that amount of time. `ops` listeners are also the last listeners to be shutdown.	4 years ago
Jeff Mitchell	7eb29261b2	Update to go-kms-wrapping version 2, and plugin-based KMS (#1901)	4 years ago
Hugo Vieira	5f36057f65	feat(config): Env/file support for Worker description	4 years ago
Irena Rindos	7bf787ec40	feat(config): Add env and file support for database max connections	4 years ago
Hugo Vieira	8462a65637	feat(config): Add env/file support to Worker.Controllers field ... This feature allows the user to set the `controllers` field to a string that points to either an environment variable or file. We then dynamically pull out the value and parse it into the config.	4 years ago
Irena Rindos	5601f2bc5f	feat(config) Add env and file support to Plugins execution dir	4 years ago
Irena Rindos	1f43ec174f	Merge branch 'main' into irenarindos-env-file-controllerconfig	4 years ago
Irena Rindos	161916f6d3	feat(config): Add env and file support to Controller description	4 years ago
Hugo Vieira	1576af70cc	feat(config): Add env and file support to Worker Tags ... This feature allows the user to set the `tags` field to a string that points to either an environment variable or file. We then dynamically pull out the value and parse it into the config. This can also be done at the keys level, where you set your keys directly in Boundary's config file, but point the values to env/file.	4 years ago
Todd	808b986834	Read and List Plugin based Hosts (#1655) ... * Add ability to read and list hosts. Tests to follow. * Add tests for reading and listing as well as validation checks to not modify hosts. * Add IpAddress and DnsNames to the api resource. Populate the plugin info. * Adding go sdk tests for reading and listing hosts and ensuring update and deleting is disallowed.	5 years ago
Jeff Mitchell	f01a8060a0	Merge branch 'main' into plugin-hostcatalogs	5 years ago
Jeff Mitchell	c05324282f	Rename the UI passthrough dir flag/env var (#1600) ... This puts it more in line with other upcoming options that use "dir" instead of "directory" (plus it's easier to type), and makes it clear that this directory and the passthrough behavior is related to the UI as opposed to other upcoming items.	5 years ago
Jeff Mitchell	1c8e0ed1e1	Add scaffolding for external host plugins and convert aws/azure over (#1581)	5 years ago
Jim	5f46207e76	Events: add redact/encrypt node for audit events to Eventer (#1490) ... * feat (events): Add new options needed for AuditConfig WithAuditWrapper and WithFilterOperations all for optional paramters when creating AuditConfig types. * refactor (event): Change EventerConfig.Sinks to a ptr We need to modify the SinkConfig.AuditConfig during the NewEventer factory, so we have to use a ptr not a ref. * feat (events): Add audit configuration types * feat (events): add audit config to sink configuration. * feat (events): add redact/encrypt node for audit events to Eventer Integrate the encrypt.Filter node from the eventlogger into the event.Eventer, so audit events can be redacted/encrypted based on data classifications. * test (events) Add test protobufs for events Add test protobufs along with a test service for testing the audit event encrypt node	5 years ago
Jim	00cb18efbe	use parseutil.ParseDurationSecond(...) which allows a value without a suffix to be treated as seconds instead of nanoseconds (#1447)	5 years ago
Jim	acc3dda2df	parse the duration string specified in an event file config into a time.Duration (#1446)	5 years ago
Jeff Mitchell	c75c97a872	Normalize event configuration (#1444) ... * Normalize event configuration This updates event configuration stanzas to more closely match behavior for listeners and kmses: * Singular "sink" instead of "sinks" (probably not the most correct option, but a consistent option, and one that makes sense for HCL) * Allows sinks to have the type defined at the start of the block * Moves type-specific configuration to a specific named block Co-authored-by: Jim <jlambert@hashicorp.com>	5 years ago
Jim	11124794bf	Events: add node for formatting/filtering cloudevents (#1390)	5 years ago
Louis Ruch	74aba58c73	Remove Telemetry from config tests (#1401)	5 years ago
Jeff Mitchell	ed6c59a053	Update the rest of the shared libs locations	5 years ago
Jeff Mitchell	4900f249e6	Update parseutil import location	5 years ago
Jeff Mitchell	ce52acb968	Update strutil import	5 years ago
Chris Marchesi	5a70875726	internal/servers/controller: Worker failure connection cleanup (#1340) ... This commit adds the support to do the following: * Mark connections for non-reporting workers as closed. This is the controller counterpart to the worker functionality (see #1330). This is written as a scheduled job that does the work DB-side in a single atomic query. * Works to reconcile states if such a broken controller-worker connection resumes and a worker reports a connection as connected that should be disconnected. In this case, the controller will send an update request, and the worker will honor it and terminate the connection. * Further refinement of the grace period setting has been added here. We have converged on the current server "liveness" setting as our default here, which is half of the previous 30s (15 seconds, in other words). Additionally, this is now configurable on the controller and worker side, with the caveat that it's currently impossible to do so in config as the setting has been untagged in HCL. This is exposed so that we can run some sophisticated testing scenarios where we skew the grace period to either the controller or worker to ensure the aforementioned reconciliation works. * Some repository functions have been added to support the new functionality, in addition to some test code to the worker to allow querying of session state while testing. * Finally, we've added some add timestamp subtraction functions as well, basically serving as the opposite of the addition functions.	5 years ago
Jeff Mitchell	2cbcf9a563	Update usage of shared-secure-libs (#1393)	5 years ago
Jim	1daa3ebefe	integrate events into the servers (#1355)	5 years ago
Jeff Mitchell	9c945b7021	Migrate ParseAddress to shared-secure-libs (#1313)	5 years ago
Jeff Mitchell	765829be6e	Update CORS to have an allowed_origin of `*` by default (#1249) ... * Update CORS to have an allowed_origin of `*` by default * Update changelog	5 years ago
Jeff Mitchell	13545e3171	Revert "internal/cmd/config: allow explicit origin list w/implicit CORS toggle (#1247)" (#1248) ... This reverts commit 579fc621ec.	5 years ago
Chris Marchesi	579fc621ec	internal/cmd/config: allow explicit origin list w/implicit CORS toggle (#1247) ... This ensures that cors_allowed_origins can be set when cors_enabled is not explicitly specified and allowed to be its default (currently true). The current behavior is to clobber this value when cors_enabled is not explicitly set, ultimately setting it to the default of "serve://boundary" only.	5 years ago
Jeff Mitchell	f32e7f9144	Add ability for the controller/worker name to be read from env/file (#1181)	5 years ago
Dylan Scott	4ae5003763	PR #1001: Postgres Connection Pooling Control (#1015)	5 years ago
Jeff Mitchell	c54aedcf1a	By default, add Boundary Desktop's origin to allowed CORS origins (#1121) ... This also adds support for a flag to disable this behavior. Fixes #1093	5 years ago
Jeff Mitchell	17ad2410cd	Add extra tags config test	5 years ago
Jeff Mitchell	4738ceee5d	Add TLS certificate and worker tag reloading on SIGHUP (ICU-1142) (ICU-1143) (#959)	5 years ago
Jeff Mitchell	0993747702	Change server default allowed origin (#931)	5 years ago
Jeff Mitchell	e9da3a871d	Switch on CORS by default if not specified (#928)	5 years ago
Todd Knight	1f9fcad1cd	Adding Migrate Command (#872)	5 years ago
Jeff Mitchell	717a3b52ee	Add worker tagging (#862) ... This allows workers to have tags assigned to them, which can then be filtered to control which targets they are allowed to serve.	5 years ago
Jeff Malnick	11c7c8dbe8	feat: make auth token staleness and duration configurable (#777) ... * feat: make auth token time to live and staleness configurable * docs: add configuration docs for auth token TTL and staleness Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>	6 years ago
Jeff Mitchell	e2e4631929	Add ability to set public cluster address (#761)	6 years ago
Jeff Mitchell	a982fc9437	Remove proxy proto documentation for now (#606) ... We haven't tested it with the new lib yet. We can add this back whenever we get to testing it.	6 years ago
Jeff Mitchell	8d8a7358f8	Add AdditionalVerification function (#423)	6 years ago
Jeff Mitchell	38ce9d9eac	Combine controller and worker commands (#415)	6 years ago
Jeff Mitchell	262ff06042	Add public address config option (#405)	6 years ago
Jeff Mitchell	dd06615c2e	Add database initialization command (#400)	6 years ago
Jeff Mitchell	c4e2b88022	Add database URL. (#365) ... * Add database URL. This allows specification of either a file://, env://, or other string. If it starts with file:// or env:// the actual value will be read from those resources. * Tidy up the KMS output * Also run migrations in test mode when specifying the URL	6 years ago
Jeff Mitchell	23156afa11	Add in most of the proxy flow (#326)	6 years ago
Jeff Mitchell	936c970635	Remove unneeded and breaking test	6 years ago
Jeff Mitchell	28df6eb7b0	Update config encrypt/decrypt CLI command (#309) ... This updates the command to our emergent standards. It also enables using a separate config file for a config kms, which allows non-string values to be encrypted. This allowed some nice cleanup as well.	6 years ago
Jeff Mitchell	b47cca0329	Add (non-db aspects of) the recovery key workflow (#286)	6 years ago
Jim	9570897032	basic keys mgmt repo (#264)	6 years ago
Jeff Mitchell	282177afc2	Remove the default org (#270)	6 years ago
Jeff Mitchell	fff15bc9f3	Rename KMS purpose 'controller' to 'root'	6 years ago
Jeff Mitchell	5d104a7a01	Migrate off Vault's internalshared folder to the separated-out repo	6 years ago
Jeff Mitchell	203e2b5dc2	Initial worker porting steps (#232)	6 years ago
Jeff Mitchell	6661117d4c	The name. The name. The name!	6 years ago
Jeff Mitchell	982693d8f5	Update tests	6 years ago
Jeff Malnick	8afcbd4c8e	Add config CLI command and encrypt/decrypt sub-commands (#77)	6 years ago
Jeff Mitchell	374a3991a2	Add a passthrough directory feature. (#76) ... This is only compiled in when a `dev` build tag is specified (see #75) for safety. Attempting to use the flag without that tag at build time will fail. However, it is always available within the codebase itself so that tests can be written against this functionality in a programmatic way. Manual testing was performed; no plans to add automated ones as this isn't production-necessary nor exported functionality.	6 years ago
Jeff Mitchell	fafdcbbfa4	CORS support (#73) ... This adds per-listener CORS support. Logic is ported from Vault, along with a fully new test suite.	6 years ago
Jeff Mitchell	062ce6079f	Create dev org in database (#41) ... These changes create a dev org in the database on startup. They also plumb through a dev-org-id flag that allows specifying a chosen org ID in dev mode. The logic will allow us to let people specify a default org ID in the config file too, although currently that's not enabled. Several other improvements were made as well: * Consolidation of some code from across the server commands * Plumbing shutdownch through so we can use it for canceling contexts during startup	6 years ago
Jeff Mitchell	5acda6a0b1	Begin purpose-based listener refactoring (#4)	6 years ago
Jeff Mitchell	07032f6908	Refactoring and the worker is more distinct now (#3)	6 years ago