boundary

Commit Graph

Author	SHA1	Message	Date
Timothy Messier	758e7b8bf1	test(credentials): Disable rate limiting for test This test quickly polls a list endpoint, which exceeds the default rate limits before the test can complete in CI.	2 years ago
Timothy Messier	a7730b02ac	test(host_catalog): Fix flaky assertion	2 years ago
Timothy Messier	6e233c879f	fix(ratelimit): Round up when setting Retry-After header Previously this would truncate to the nearest integer, which could result in clients retrying before the quota has reset, and getting rate limited again. This also includes an update from go-rate that will round up when reporting the reset time for the RateLimit header. Note that in the case of a 503, the Retry-After header was already being set correctly. See: https://github.com/hashicorp/go-rate/pull/8	2 years ago
Timothy Messier	35b91c66de	refact(ratelimit): Rename MaxEntries to MaxQuotas	2 years ago
Timothy Messier	a150c588bb	feat(controller): Emit sys event detailing the rate limit configuration A sys event will be emitted when the controller is constructed, and if the rate limits are changed via a SIGHUP. The event contains the details of the rate limits for each combination of resource and action. This event can be used by operators to confirm the limits are set as they would expect based on the controller config.	2 years ago
Timothy Messier	9438be4506	feat(ratelimier): Support disabling rate limiting	2 years ago
Timothy Messier	d0c3da5f1d	refact(ratelimiter): Updates due to refactor in go-rate	2 years ago
Timothy Messier	3c2bed92b0	feat(ratelimit): Expose metrics on quota usage This provides two prometheus metrics to monitor the rate limiter: boundary_controller_api_ratelimiter_quota_storage_capacity: This is a gague that shows the total number of quotas that can be stored at a given moment by the rate limiter. boundary_controller_api_ratelimiter_quota_storage_usage: This is a gague that shows the number of quotas currently being stored by the limiter. If this becomes equal to the capacity, requests that would result in a new quota being created will get limited and receive a 429 status code.	2 years ago
Timothy Messier	0bc423ebd8	feat(controller): Reload api rate limits on SIGHUP	2 years ago
Timothy Messier	f54f2c0fc4	fix(ratelimit): Correctly extract ids from paths with punctuation	2 years ago
Timothy Messier	26854b01a8	feat(ratelimit): Set RateLimit and RateLimit-Policy headers	2 years ago
Timothy Messier	e337cf8f69	feat(controller): Add authtoken public id to request context This allows for http middleware handler functions that run later in the handler function stack to have access to the extracted auth token public id.	2 years ago
Timothy Messier	059d4992de	feat(ratelimit): Add support for limits per ip address and auth token	2 years ago
Timothy Messier	00bd2899af	feat(controller): Add ratelimiter http middleware	2 years ago
Timothy Messier	2853324479	feat(ratelimit): Add http middleware handler function	2 years ago
Timothy Messier	6da47443fd	feat(ratelimit): Create rate limits from configs	2 years ago
Timothy Messier	61fcd857ec	feat(resource): Add function to get type from plural string	2 years ago
Timothy Messier	51adde4b2c	feat(handlers): Register actions for each resource type This registers the ActionSets for each resource when the handler packages are initialized. This then allows other packages to retrieve the ActionSets for a given resource from the action package. The initial consumer of this will be the ratelimit package so that it can programmatically enumerate all of the valid combinations of a resource and action. This leaves a number of TODO to refactor the handler packages to also retrieve the action sets from the registered actions instead of using a package variable. This is left as a TODO since there is some inconsistencies in how these package variables are used between the handlers. For example a number of packages use a map of subtypes to ActionSets which is then used withing the handler implementation. Others use a map, but don't seem to use it at all. And others just use an ActionSet.	2 years ago
Timothy Messier	3f4a723541	feat(action): Add registrar for valid actions by resource	2 years ago
Timothy Messier	8643d8e6c6	feat(errors): Add code for invalid configuration	2 years ago
Timothy Messier	c52caae345	refact(action): Make ActionSet behave as a set instead of a list This switches the implementation of an ActionSet from a slice to a map to ensure the elements in an ActionSet are unique. This allows for other packages to perform set operations such as a union or difference without needing to account for duplicates.	2 years ago
Timothy Messier	bee45dc486	feat(config): Add fields for controller rate limit configuration	2 years ago
Timothy Messier	0fb77358e5	feat(ratelimit): Define initial ratelimit package and Config	2 years ago
Lisbet Alvarez	8584f71791	update ui commitish (#4087 )	2 years ago
Jim	798e86cefe	tests (ldap managed groups): extend tests to include ldap grps for GrantsForUser(...) (#3972 ) * chore (managed groups): just a small rename to improve readability * test (aut/ldap): add a test for user grants based on ldap grp * tests (role grant): extend TestGrantsForUser(...) to cover ldap grps * refact (iam.(Repository).GrantsForUser): more readable grantsQuery Convert existing CTE to use sub-selects for readability	2 years ago
Johan Brandhorst-Satzkorn	a89573b35f	subtypes,handlers: add runtime trace regions (#4060 ) * subtypes,handlers: add runtime trace regions The subtype.Filterable and handlers.ProtoToStruct functions are costly and worth measuring whenever runtime tracing is in use. This has almost no cost when tracing is not in use, so there's little harm in having them in place. * testing: Add TRACING.md TRACING.md contains information about how to perform Go runtime tracing of the Boundary application.	2 years ago
Jim	18729721a1	fix (plugins/gcpkms): update dep to fix issue with using gcp kms (#4058 )	2 years ago
Elim Tsiagbey	8b8d2822df	feat(oidc): OIDC Prompt (#4053 ) Boundary OIDC method does not currently support passing in prompts during authentication. This change adds the capability of passing OIDC prompts. Prompts are optional OIDC parameters that determine the behaviour of the authentication server: https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest ## Changes - New `auth_oidc_prompt` table which contains all the prompts for OIDC auth method - New `auth_oidc_prompt_enm` table which contains possible enum values for a prompt - Currently supported: - `none`: The Authorization Server MUST NOT display any authentication or consent user interface pages - `login`: The Authorization Server SHOULD prompt the End-User for reauthentication - `consent`: The Authorization Server SHOULD prompt the End-User for consent before returning information to the Client - `select_account`: The Authorization Server SHOULD prompt the End-User to select a user account - `oidc_auth_method_with_value_obj` view has been updated to return `prompt` value - Add `prompt` option for OIDC auth method CLI create and update - Pass configured prompt during OIDC authentication - Add `prompt` API validation for create and update	2 years ago
Jeff Mitchell	b6df5693b5	Add generic read/update/delete commands (#3992 ) * Add generic read/update/delete commands This adds three generic commands that use the resource prefix to determine the subcommand to run and pass through args over to that subcommand. Since this occurs very early on and to avoid loading essentially every internal resource package, I moved subtype definitions to globals. This replaces #3967 Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com> * De-duplicate Subtype code (#4031) Co-authored-by: Timothy Messier <tim.messier@gmail.com> --------- Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com> Co-authored-by: Timothy Messier <tim.messier@gmail.com>	2 years ago
Sepehr	5c84a8861a	Observation(event): adding op instead of type details paylaod (#4043 ) * Observation(event): adding op instead of type details paylaod * Observation(events): removing op check in details	2 years ago
Michael Li	4f262e7de5	test(bats): Use correct attribute for the test (#4033 )	2 years ago
Jeff Mitchell	cb1386932d	Use sdk wspb library and remove internal (#4025 )	2 years ago
Jeff Mitchell	cf3900a906	Fix three minor issues: (#4022 ) * If passing a private key without specifying it in URL syntax, give a proper error message (previously we were only making sure it was a scheme we knew how to handle, but we need to also be more informative if it's not a URL at all) * If the handshake from the proxy fails, don't hang, just exit * Update some error messages to use capitalization in line with our standard CLI error format	2 years ago
Damian Debkowski	12600617ba	fix(plugin): remove unit test race condition (#4002 )	2 years ago
Jeff Mitchell	92f7d8cfb2	Minor test fixes (#4004 ) * Minor test fixes The auth rotation test fix allows us to keep checking if we did not yet see the expected bytes in case the call to lookup succeeds but we are late in rotating due to parallelism. The api credentials test fix allows us to check if at _least_ one rotation has happened. That way if two rotations happen before we check again due to parallelism, this is deemed a successful result. * Add timeout to auth rotation test	2 years ago
Timothy Messier	dd23f6fdbf	Update websocket library (#3908 ) The nhooyr/websocket library now has a release with the new default behavior that removes the message size limit. This allows us to switch off of the fork and back to the upstream. In the same release that includes the fix we need for the boundary client, the wspb helper package was removed from websocket. This package contained some functions to read and write protobuf messages. However, it was using the deprecated github.com/golang/protobuf/proto library. To avoid this dependancy in the library they opted to just remove wspb. Thus this provides a replacement implementation that uses google.golang.org/protobuf/proto. Notably the newer proto library seems to lack an equivalent of proto.NewBuffer so writes to the websocket and not able to leverage a sync.Pool of byte.Buffers to reduce allocations. Refs: `88bb253554` See: `ac385120c6`	2 years ago
Michael Gaffney	d638378d57	fix(vault): Set the Vault TLS client options if specified Two Vault client settings were not being properly used when constructing a Vault client. The `TLS Skip Verify` setting was only being set if a `CA Cert` was also configured. This fix sets the `TLS Skip Verify` when configured regardless of other settings. Closes #3961. The `TLS Server Name` setting was never being set. Bad programmers. This fix now sets it on the Vault client if the Vault Credential Store has been configured to use a value for this setting. Closes #3962.	2 years ago
Jeff Mitchell	a9e372930d	Revert `0bf60996c5` (#3990 ) Post-merge some issues were discovered with the ways typing is used for proto reflection. This will be reworked without moving the subtypes around.	2 years ago
guangwu	8bb6632512	chore: remove refs to deprecated io/ioutil (#3811 ) Signed-off-by: guoguangwu <guoguangwu@magic-shield.com>	2 years ago
Sorawis Nilparuk (Bo)	45eb3b7b51	support remote-dev format for cluster ID (#3637 )	2 years ago
Jeff Mitchell	0bf60996c5	Add generic read/update/delete commands (#3967 ) * Add generic read/update/delete commands This adds three generic commands that use the resource prefix to determine the subcommand to run and pass through args over to that subcommand. Since this occurs very early on and to avoid loading essentially every internal resource package, I moved subtype definitions to globals. * Update main.go Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com> * Update changelog and remove another deprecated command --------- Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>	2 years ago
Jeff Mitchell	de4ce93931	Update main module deps (#3971 )	2 years ago
Michael Gaffney	90276b5e91	tests: Set a default job run interval based on the test deadline The Vault Credential Store only accepts Vault tokens that have a TTL greater than the internal job scheduler's run frequency. This prevents a Vault Credential Store from being created with a Vault token that will expire before Boundary can renew it. The Vault test server, by default, creates Vault tokens with a TTL equal to the duration of time remaining until `t.Deadline()` is reached. This change sets the test controller's default job scheduler duration to be half of time remaining until `t.Deadline()`. The default job scheduler duration can still be overridden by setting a duration on `TestConrollerOpts.SchedulerRunJobInterval`. This change fixes the error received when running: go test -timeout 30s \ -tags devlicense \ -run '^TestList$' \ github.com/hashicorp/boundary/internal/tests/api/credentialstores Which returned this error: {"kind":"Internal", "message":"credentialstores.(Service).createInRepo: unable to create credential store: vault.(Repository).CreateCredentialStore: unknown, unknown: error #0: scheduler interval must be greater than token ttl. scheduler jobs interval value: 1m0s"}	2 years ago
Sepehr	4dce290aeb	telemetry(observations): fix the details flag check (#3960 ) * telemetry(observations): fix the details flag check * telemetry(observations): fix the test names	2 years ago
Jeff Mitchell	b000aa3068	Fix dev key generation (#3951 ) In #2076 the refactor changed the position of a parenthesis, causing the dev key to truncate the base64 representation instead of specifying which bytes to base64 encode. We don't need this slicing anymore anyways since we now do individual key generation calls so just remove it.	2 years ago
Jim	75cef86a34	feat (authmethod/password): add additional telmemetry for passwd acct authen (#3958 )	2 years ago
Johan Brandhorst-Satzkorn	6081b6c58d	internal/credential: simplify TestObject test helper (#3899 ) The TestObject test helper previously returned an error, but it's easier to have it perform the error check itself, as it conventionally done with test helpers.	2 years ago
Sepehr	f9dee55e4d	Telemetry(observations): add oidc and ldap observation events (#3945 ) * telemetry(observations): Add observations for oidc and ldap authentications * telemetry(observations): Add tests ldap and oidc observation events	2 years ago
Johan Brandhorst-Satzkorn	940eb61282	sqltest: fix typo (#3886 )	3 years ago
Johan Brandhorst-Satzkorn	894927ffd2	internal/host: fix inconsistent receiver (#3894 ) This is a lint error but wasn't caught because it was a historic problem. It's appearing again now because we're adding another method to this type as part of the pagination workflow.	3 years ago

1 2 3 4 5 ...

2112 Commits (758e7b8bf1bb0534a6ec2175dfdac563cbceb4e6)