1498 Commits (821d8317dc253549734dd9079bb564c476c19b4c)

Author	SHA1	Message	Date
Irena Rindos	821d8317dc	address op state review feedback (#2453) ... * address op state review feedback	4 years ago
Louis Ruch	c73a13aa3e	scheduler: log details when starting scheduler (#2459)	4 years ago
Jeff Mitchell	53b5e532d5	Remove deprecated methods/fields on targets (#2393)	4 years ago
Louis Ruch	506fdfa5c3	cli(ssh): Do not print private key if consumed (#2451)	4 years ago
Damian Debkowski	5dfabe5f90	fix: show warning log when token will expire before it can be renewed (#2446)	4 years ago
Jeff Mitchell	37fb9815ce	Add session endpoint test for #2448 (#2450)	4 years ago
Timothy Messier	2b994f3005	fix(perms): Properly resolve "only self" for permissions (#2448) ... When generating permissions from the grants, if a single grant was limited to the set of "self" actions, the permission would be marked as only self, even if additional grants were given for non-self actions. This would result in the generated permissions being more limiting then they should be based on the grants. This only impacts the sessions list endpoint. It would result in users that have been granted access to list other user's sessions to be unable to see these results in the list results.	4 years ago
Louis Ruch	50490d71ae	chore(targets): Improve help and errors around ssh targets (#2445)	4 years ago
Damian Debkowski	2db6bee3e2	fix: return an error for vault tokens that will expire before the scheduler can run (#2444)	4 years ago
Louis Ruch	5812a42ba3	feat(scheduler): set intervals from config (#2443)	4 years ago
Irena Rindos	fc0ead73e6	feat(workers): worker operational state (#2427) ... * feat(workers): worker operational state	4 years ago
Jeff Mitchell	9002930d65	Adapt shared lock skip logic to dbswap branch (#2437)	4 years ago
Hugo Vieira	bed6e1a0ff	feat(server): Reload database on SIGHUP ... If the database url is updated on Boundary's config and then a SIGHUP triggered, we now connect to the new database, ensure it's OK to use and use that one going forwards instead. This allows a controller to be deployed in a more dynamic infrastructure where, for example, database credentials could change, without having to restart the controller. In this case only a database url config change and a SIGHUP signal to all controllers would be required. This uses an atomic.Pointer to store wrapped DB objects. This allows atomically swapping to the new object. A timeout is introduced so that if the object is swapped after the existing one has been looked up it isn't immediately invalidated. The timeout is a maximum; a ticker once a second that looks at stats to determine how many database connections are still in use and then closes the driver as soon as none are in use. This could be done with mutexes to avoid checking stats in a loop, but that carries its own risk: if a write lock is attempted to be acquired while a query is holding a read lock, the write lock will block, and any subsequent read locks will also block since write locks take priority. As a result, if a query is long-running or timing out, all other queries in the system will become blocked. Our default user request timeout is 90 seconds and some jobs have no timeout at all, so this is not a purely theoretical concern, even if it's unlikely. Refs: #2435 Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>	4 years ago
Hugo Vieira	8ab9ffbcac	refact(cmd): Encapsulate some functionality on Command and Server ... This commit extracts 3 separate pieces of functionality into their own function/method: - Extracts the database opening with the intention to have a function that performs all that functionality but returns the created database object rather than setting it to the Server structure. - Extracts database validation logic, to provide a common code path for upcoming functionality. - Expose schema manager on the Command struct as well as providing common functions to acquire shared lock/close.	4 years ago
Hugo Vieira	621f8a9ff2	fix(schema): Database connection not cleanly closed ... This commit introduces closing the Schema Manager's underlying driver connection. We were only releasing the shared lock but not actually cleaning up the db connection and relied on the fact that the process would exit to do that for us.	4 years ago
Timothy Messier	047a66e87d	fix(worker): Improper reload when running as controller and worker (#2438) ... In cases where the server was started with both a controller and worker stanza, the reload of the config was not properly setting the initial upstream value on the new config. In this case the value is derived from other config values and not necessarily set directly. This now properly initializes the new config so that initial upstream is set in the same manner as the first load. Blame: 5d0cdf680f	4 years ago
Todd	0b942f4493	Only clear tags in set-worker-tags when "null" is set as the value of the -tag flag. (#2434)	4 years ago
Irena Rindos	18dff62b7b	Merge BYOW GA branch to main (#2398) ... * feat(workers): Add ability to read and reinitialize cert authority (#2312) * feat(workers): Return Release Version on worker list and read (#2377) * feat(cli): Read and reinitialize worker certificate authority (#2387)	4 years ago
Irena Rindos	cee5ff7599	Minor documentation fixes for controller-led (#2432) ... * Minor documentation fixes	4 years ago
Jeff Mitchell	fdb60f5b2d	Update comment around undocumented config flag	4 years ago
Jeff Mitchell	730131c105	Add test	4 years ago
Jeff Mitchell	16c9e9b592	Add ability to skip shared lock acquisition	4 years ago
Hugo Vieira	bf1486f75e	refact(target): Add context to RepositoryFactory constructor ... `errors.New` requires a context, so I've made that available from the Controller, and updated all `NewDeprecated` functions to `New` while I was at it	4 years ago
Hugo Vieira	bf263fbd7d	perf(target): Use new Permissions object to determine resource access ... Using the new Permissions object, we can build a list of the level of access a user should have based on the grants they've been given, meaining we don't need to fetch all resources from the database to then remove the ones the user shouldn't be able to see. This commit also removes some unused options in `ListTargets` for the sake of simplicity.	4 years ago
Hugo Vieira	63196ee4ca	feat(target): Implement new WithPermissions option ... Also changes the Target RepositoryFactory to allow for passing options at construction time.	4 years ago
Hugo Vieira	224f8d2d4e	refact(controller): Move Target Repository Factory to the target package	4 years ago
Timothy Messier	1e1e5a5ff5	doc(perms): Clarify some details in godoc for ListPermissions	4 years ago
Timothy Messier	e65f1f32a7	chore(session): Remove repository method that was only used in tests ... This unexported method was only used by a single test, and was taking advantage of its implmentation to populate Connections rather than Sessions. This repository should only interact with Sessions, since there is a separate repository for Connections.	4 years ago
Timothy Messier	eb61ac6304	refact(session): Add context to session factory ... This adds a context to the session.RepositoryFactory, allowing errors.NewDeprecated to be replaced with errors.New. It also removes the common.SessionRepoFactory, instead packages just directly import from the session package.	4 years ago
Timothy Messier	febf0b9984	refact(controller): Use session repo factory that takes options	4 years ago
Timothy Messier	68568828e6	perf(sessions): Use session repository with permissions ... This builds on previous performance improvements to the list behavior by reducing the number of queries against the database and the amount of data transfered in order to retrieve a list of sessions. Previously, a query was performed to retrieve a tuple of `(session_id, scope_id, user_id)` for the requested scope, including all child scopes if the request was recursive. These tuples were evaluated against the requesting user's grants to identify the sessions that they were authorized to list. In the case of clusters with a large number of sessions, this would result in a large amount of data needing to be transfered for sessions that would not be used. Then a second query would be used to retrieve the full session information for the session ids that were authorized. This changes the list behavior to evaluate a set of permissions from the requesting user's grants, use these permissions when constructing a session repository, and retrieve the list of sessions the user is authorized to list in a signle query. Ref: d741034829 32070678dc	4 years ago
Timothy Messier	2fbdcf6ce0	feat(session): Use permissions for limiting list results ... The session repository can now be passed an optional set of permissions. The permissions are used to restrict results from the repository. Currently this only impacts the List method. This enabled the sessions service to use a single query to retrieve sessions and replaces the previous behavior where the session service would first request all sessions for a given set of scopes, evaluate the permissions, and then request sessions based on a set of session ids.	4 years ago
Timothy Messier	e4bb847ad1	feat(auth): Expose ACL from VerifyResults	4 years ago
Timothy Messier	05b3d2917b	feat(perms): Add UserPermissions ... This is used to associate a user with a set of permissions which is necessary for repositories that need honor the OnlySelf aspect of a Permission.	4 years ago
Timothy Messier	39fedd843c	test(targets): Remove auth.DisabledAuthTestContext from tests ... Disabling the auth was resulting in some unrealistic tests setup and expectations. It also makes it difficult to refactor any behavior in the authn/authz flow since this option can bypass most of it.	4 years ago
Timothy Messier	02cef3d8a8	test(sessions): Remove auth.DisabledAuthTestContext from tests ... Disabling the auth was resulting in some unrealistic tests setup and expectations. It also makes it difficult to refactor any behavior in the authn/authz flow since this option can bypass most of it.	4 years ago
Hugo Vieira	ccb17df01a	feat(auth): Get all authorised scope info for a given list request	4 years ago
Hugo Vieira	9ee5a9f713	feat(perms): Derive permissions list from user grants	4 years ago
Haotian	5c715478e4	feat(workers): Add metrics for worker server-side grpc connections, refactor repeated code into common location (#2367) ... * feat(workers): added latencies histogram for server side multihop workers * refactor(daemon): combine common grpc metric functions into daemon/internal/metric Co-authored-by: Todd <github@quaddi.com>	4 years ago
Johan Brandhorst-Satzkorn	25f7caa3bf	Update googleapis/grpc-gateway dependency (#2424) ... This fixes some CI issues. See https://docs.buf.build/faq#googleapis-failure for more information.	4 years ago
Louis Ruch	d7c4c648ec	bug(vault): Correctly handle credential stores with expired tokens (#2399) ... * bug(vault): Correctly handle credential stores with expired tokens Boundary makes use of a database view to perform CRUD operations on Vault credential stores and libraries. This view did not include credential stores with tokens that have expired in Vault, causing errors when attempting to perform any action against them.	4 years ago
Jeff Mitchell	01fb949d0b	Add controller-led worker auth flow (#2413) ... This adds an action to the API that allows pulling out an activation token that can be given to a worker in its config (directly or via env or file). The worker can pass this along with its normal request in place of its normal nonce and the server will automatically accept it. Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com>	4 years ago
Timothy Messier	5d0cdf680f	feat(worker): Support reloading of initial upstreams on SIGHUP (#2417) ... On a SIGHUP, if the worker's `initial_upstreams` config option has changed, it will use the new values as the address to send its status. Any previously discovered upstream addresses from previous status requests are dropped. Once a successful status request is made to the new addresses, the worker will resume its normal behavior of using the addresses from the response to the status request. This allows a worker to be deployed in a more stable way in a dynamic environment where controller IPs could change. In particular this helps with a case where all controllers are replaced with new controllers running on new IPs. To illustrate with an example, suppose there is an instance group of controllers instances. And there are worker instances that have their config rendered from consul-template that sets `initial_upstreams` to the IPs of the controller instances. If all controller instances are restarted or replaced at the same time and assigned new IPs, a new config will be rendered for the worker. Previously the only way for the worker to use the new value would be for the worker process to be restarted. Otherwise the worker would only know about the previous IPs and would fail to connect to the new controllers. However, a restart would mean any active sessions and session connections on the worker instance would be terminated. With this update, consul-template can send a SIGHUP to the worker, the worker will connect to the new controllers and resume normal status reporting, allowing the sessions and session connections to remain. The same principles would apply for other examples of dynamic environments such as nomad and kubernetes. See: https://github.com/hashicorp/consul-template https://www.nomadproject.io/docs/job-specification/template	4 years ago
Johan Brandhorst-Satzkorn	de2c40fa77	Fork pgtap-docker to support arm64 (#2411) ... * feat(sql): Fork pgtap to support arm64 This forks pgtap-docker and builds the image locally, and updates our references to use our forked image. * fixup! feat(sql): Fork pgtap to support arm64	4 years ago
Irena Rindos	db21ead31c	Vault proxy supporting code (#2415) ... * Vault proxy supporting methods	4 years ago
Damian Debkowski	3f70644978	fix(db): update host_plugin_set to set project_id value (#2410)	4 years ago
Jeff Mitchell	9b271d7dd8	Fix error about unimplemented HcpbWorkers call (#2361) ... Although there is a compile time check on the type, it will always succeed due to the Unimplemented embedding requirement. As a result, this PR also changes Unimplemented calls to Unsafe calls, which were added later "for those that prefer their code to break"; the comments on these state: // UnsafeXServiceServer may be embedded to opt out of forward compatibility for this service. // Use of this interface is not recommended, as added methods to XServiceServer will // result in compilation errors. See https://github.com/grpc/grpc-go/issues/4500#issuecomment-852597871 for some more context. I think we're fine with compilation errors though; we own both the server and client side of things and generally are going to add new methods only when we intend to also add them on the client side. Notably, what the comment does not indicate is that it will break at runtime; already it should return a suitable (404 or 405) error if the client requests a method that does not exist.	4 years ago
Haotian	17ddc301a8	feat(cli): add/set/remove worker tags (#2266) ... * adds CLI commands for add/set/removing worker tags, and respective tests * adds StringSliceMapVar Flag to convert a string from the CLI to a map[string][]string value	4 years ago
Irena Rindos	b4b95e0f0e	refactor(vault): add context and remove deprecated errors (#2396) ... * refact(vault): add context and remove deprecated errors	4 years ago
Johan Brandhorst-Satzkorn	aef9073fa6	Upgrade to Go 1.19 (#2347)	4 years ago