boundary

Commit Graph

Author	SHA1	Message	Date
dani	b31c6a2834	update loopback to normalize endpoint_url (#5603 )	1 year ago
Damian Debkowski	1820d43d38	fix(daemon): set correct permissions on cache.db file (#5613 )	1 year ago
Ryan Derr	4cc5c07214	Migrate Controller Repo Usage From Store To Server (#5609 ) * Create Server Domain Package For Controller * Resolve Comments	1 year ago
Ryan Derr	6c0b3a8a1c	Controller Liveliness Query Split (#5602 ) * Initial Update Controller Call And Sample Test * Update Controller Start Logic To Upsert * Chore Make Gen * Lowercase User For GCP Instance Label * Resolve Comments	1 year ago
Johan Brandhorst-Satzkorn	3a49c8c483	Update golang.org deps and Go version (#5595 ) * Update golang.org deps and Go version * Upgrade golangci-lint * all: fix new vet warnings https://github.com/golang/go/issues/60529 introduced a new vet warning for when format strings are used without arguments, which is technically a bug since it shouldn't be using the functions taking format string arguments in those cases.	1 year ago
dani	2ed3430069	Modify storage bucket service to include NormalizeStorageBucketData (#5590 ) NormalizeStorageBucketData normalizes a given's storage bucket attributes before persisting. Co-authored-by: Danielle Miu <29378233+DanielleMiu@users.noreply.github.com>	1 year ago
Damian Debkowski	70cdd3823c	fix(db): return expected rows err for migration logs (#5597 )	1 year ago
Damian Debkowski	29ab0c3594	fix(handlers): resolve nil reference pointer for authorize session (#5596 )	1 year ago
Damian Debkowski	32be170562	fix(token): utilize a more accurate comparison method (#5594 )	1 year ago
Johan Brandhorst-Satzkorn	262693f47c	Restore soft deleted users on authentication (#5549 ) * internal/clientcache: restore user on login A user that previously had its last auth token deleted (for example, if they logged out), should be restored again when they successfully authenticate again. * internal/clientcache: delete keyringless expired auth tokens Previously, we would only correctly delete auth tokens that were expired (or deleted) if they were also in the keyring. * internal/clientcache: remove tautological condition At this stage we already know that at is non-nil, because the case above would have been true if it was nil. * internal/clientcache: improve error handling The previous error handling would have ignored API errors that were not ErrUnauthorized or ErrNotFound. Handle all API errors the same as other unexpected errors. * internal/clientcache: make errors distinct These two error conditions are otherwise impossible to tell apart. * test(e2e): Update search test to catch bug (#5551) --------- Co-authored-by: Michael Li <michael.li@hashicorp.com>	1 year ago
Johan Brandhorst-Satzkorn	99f4bc092f	Update go-plugin dep (#5552 ) * mod: remove unnecessary import groupings Move all imports into one of two groupings: 1. Direct dependencies 2. Indirect dependencies This is the standard used by the go tool. The old groupings seemed very random. * mod: update go-plugin dependency	1 year ago
Johan Brandhorst-Satzkorn	5de0c8c102	internal: ensure schema manager is closed (#5521 ) This releases the connection it holds indefinitely	1 year ago
Damian Debkowski	acc40e0d08	fix: resolve small issues in db transactions (#5522 ) * fix: use the db transaction reader and writer * fix: internal/server: use ctx when scanning rows * fix(host): pass db tx reader/writer into helper funcs * fix: more precise nil check against db.Reader & db.Writer --------- Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>	1 year ago
Cameron Perera	fc5aa31add	bump ui commit to c9a74f2 (#5512 )	1 year ago
Damian Debkowski	5bd142ddb4	fix(worker): set session.CloseCallTimeout to non-zero value (#5510 )	1 year ago
Lauren	43338db7ed	bump ui commit 835b302c1 (#5508 )	1 year ago
Louis Ruch	47e314ebc2	fix(scheduler): ignore 404 when updating job run (#5495 )	1 year ago
Lisbet Alvarez	348abb164a	bump ui commit ae1e6d2 (#5490 )	1 year ago
Elim Tsiagbey	c5cc20c649	fix(worker): add GCP plugin support on the worker (#5484 ) Enable worker to run GCP plugin	1 year ago
Lauren	6065350d35	bump ui commit 639aa47e1 (#5485 )	1 year ago
Damian Debkowski	94e2aceaca	fix(alias): remove unnecessary subquery from alias refresh (#5481 )	1 year ago
Lauren	bdd2332586	bump ui commit fed32aa57 (#5475 )	1 year ago
Johan Brandhorst-Satzkorn	936d320ca6	internal/scheduler/job: fix test failure (#5472 ) This was failing because the compared values weren't pointers. It was probably caused by a depedency version update changing the behavior of this function.	1 year ago
Sorawis Nilparuk (Bo)	7c4451dc73	Bug: fix groups in children scopes being filtered out by grants (#5418 ) * add utility functions for grants tests * use passed in scopeID to create user * add test for groups list * groups: set ParentScopeId before FetchActionSetForId * add comment to TestRoleGrantsForToken * lint and ran make gen * fix import groups * add an additional test case * remove print * changelog * fix(alias): set parent scope id for alias resource (#5434) set the `ParentScopeId` before fetching authorized actions for alias * fix(worker): set parent scope id for worker resource (#5435) set the `ParentScopeId` before fetching authorized actions for worker * fix(user): children scopes being filtered out by grants for user (#5436) * fix(user): children scopes being filtered out by grants for user Resources are being filtered out due to missing ParentScopeId when constructing Resource to pass into authResults.FetchActionSetForId. * fix(scope): set parent scope id for worker resource (#5439) set the `ParentScopeId` before fetching authorized actions for worker * fix(target): set parent scope id for target resource (#5447) set the `ParentScopeId` before fetching authorized actions for target * fix(roles): set parent scope id for roles resource (#5452) * fix(roles): set parent scope id for roles resource set the `ParentScopeId` before fetching authorized actions for role resource * test(managed-group): add grants test coverage (#5453) * fix(managed-group): set parent scope id for managed-group resource set the ParentScopeId before fetching authorized actions for managed resource * fix(host): set parent scope id for host resource (#5455) set the `ParentScopeId` before fetching authorized actions for host resource * fix(host-set): set parent scope id for host-set resource (#5456) set the ParentScopeId before fetching authorized actions for host-set resource * fix(host-catalog): set parent scope id for host-catalog resource (#5457) set the ParentScopeId before fetching authorized actions for host-catalog resource * fix(credential-store): set parent scope id for credential-store resource (#5458) set the ParentScopeId before fetching authorized actions for credential-store resource * fix(authmethods): set parent scope ID for auth methods resource (#5448) * handlers/authmethods: fix children permission * documentation * formatting * fix(credential): set parent scope id for credential resource (#5459) set the `ParentScopeId` before fetching authorized actions for credential resource * fix(accounts): bug grants filter children accounts (#5431) * handlers/accounts: fix children grants filtering out results unexpectedly * make gen * fix(authtokens): set parent scope ID for auth token resource (#5451) * fix authtokens not passing children scope ID * make gen * fix(credential-libraries): set parent scope ID (#5463) * fix(common) set parent ID before fetching action setsparent ID before fetching action sets (#5467) * fix(common) set parent ID before fetching action sets * make gen * additional test * rename test * more tests * remove duplicate test * make gen * Update CHANGELOG.md Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com> --------- Co-authored-by: Elim Tsiagbey <elim.tsiagbey@hashicorp.com> Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>	1 year ago
Lauren	54d438f367	bump ui commit 064375d45 (#5471 )	1 year ago
April Ayres	b18b586ec8	add noOp license validator function (#5468 )	1 year ago
Johan Brandhorst-Satzkorn	40cb9f5c9e	Restrict concurrent password hashes (#5437 ) * internal/auth/password: add resizable pool The resizable pool wraps the permit pool with a mutex to allow it to be resized at runtime. * internal/auth/password: add concurrency limit The default concurrency limit is 1, and it can be set using the SetHashingPermits function. * internal/cmd/config: allow configuring hashing limits The new concurrent_password_hash_workers configuration value can be used to loosen the constraints on the userpass auth method hashing operation. * internal/cmd: set password hashing constraints Sets the password hashing concurrency constraints on startup and config reload. * CHANGELOG: add notice about password concurrency limit	1 year ago
Irena Rindos	dfe4f91be3	refactor(server): refactor worker tags (#5445 ) * refactor(server): refactor worker tags	1 year ago
Lauren	4731bc8747	bump-ui-commit-904864b14 (#5449 )	1 year ago
Johan Brandhorst-Satzkorn	a43cb90a32	internal/session: ensure orphaned connection cleanup (#5438 ) Previously, the orphaned connection cleanup job would not detect that a connection that was created before a worker had submitted a successful session info was orphaned. We now fall back to using the worker update time as an indicator if the session info time is not set.	1 year ago
Johan Brandhorst-Satzkorn	ec0a3f964b	Worker status refactor (#5417 ) * oss: feat(proto): statistics rpc added to server coordination service * oss: feat(session): add update statistics status service * oss: feat(handlers): add Statistics method to worker service server * oss: feat(worker): add statistics ticking * oss: internal/proto: define the new RoutingInfo RPC * oss: internal/server: repository changes for RoutingInfo RPC * oss: internal/daemon: add RoutingInfo handler to worker service The new RoutingInfo RPC is used to get information from the worker that is used to make routing decisions on the controller. It also handles the initial request from the worker. * oss: feat(db): server_worker_session_info table * oss: feat(proto): session info rpc for server coordination service * oss: feat(server): worker session info request data type * oss: feat(worker): session info ticker * oss: feat(handler): server coordination handler for session info * oss: feat(session): utilize session info request time for session cleanup * oss: proto: fix some gotags comments Some of these fields were missing comments, while others had incorrectly formatted comments. * oss: worker: send connection status to server This is required for the correct tracking of orphaned connections * oss: internal/daemon/worker: add function to wait for Statistics RPC * oss: internal/daemon/worker: add routing info RPC The new RoutingInfo RPC replaces part of the Status RPC, namely the part which is used by the controller and worker to perform decisions around the establishment of new sessions and new worker connections. * oss: internal/daemon/worker: remove unnecessary error check * oss: internal/daemon/worker: lock access to config and upstreams The new confLock protects access to the conf value and to the addressReceivers slice. * oss: worker: replace Status RPC with RoutingInfo * oss: worker: deprecate the Status RPC and related types The Status RPC and related messages have been replaced by the RoutingInfo/SessionInfo/Statistics RPCs. The controller will continue to support the Status RPC until two new minor versions have been released. * oss: internal/event: add default deny for new worker RPCs * oss: internal/daemon/worker: allow RPC interval to be set The new SessionInfo/RoutingInfo/Statistics RPCs run at long intervals, which make some of our cluster tests take a long time to complete. This allows their interval to be configured in tests. * oss: all: use TestWorkerRPCInterval in slow tests This should speed up these tests significantly. * oss: internal/tests/cluster: reset sys eventer in test --------- Co-authored-by: Damian Debkowski <damian.debkowski@hashicorp.com>	1 year ago
Hugo	346ac58fa3	feat(cmd): Default to azure plugin when performing db migration (#5422 )	1 year ago
Timothy Messier	71af25f584	fix(db): Remove begin when assembling migrations (#5148 ) When building the set of migrations to run as part of executing the `database migrate` or `database init`, the migrations are collected and combined to run within a database transaction. As such the `begin` and `commit` statements in the migration files should get removed from the final set of statements that get executed. However, when the migrations files were updated to include copyright and license headers, this broke the logic that would strip out the `begin` statement. While this does not cause any issue with executing the statements in a single transaction, it does result in noise in the database server's logs, with log messages like: BEGIN WARNING: 25001: there is already a transaction in progress BEGIN LOCATION: BeginTransactionBlock, xact.c:3778 This commit fixes the logic to correctly strip the `begin` for files that have the header lines.	1 year ago
Hugo	846c849589	Worker Domain Refactor (#5338 ) * feat(server): Refactor LookupWorkerByName to be a test method * feat(server): Split worker tags table * refact(worker): Export api and config tags * refact(server): Return worker id from UpsertWorkerStatus * refact(server): Create ListWorkerStorageBucketUpdates domain function * refact(server): Use dedicated HCPb-worker list func * refact(server): Create ConnectionRoute domain function * refact(handlers): Move worker selection logic to internal/server package This commit moves all the logic to select a worker to handle a session to the internal/server package. Most functions were moved to this package with no changes, however, there are a couple of notable exceptions: - Given that we don't use GRPC errors in repos, all errors were adjusted to use the internal/errors package instead. - StorageBucketFilterCredIdFn is now used to prevent the internal/server package from importing internal/storage/plugin, which would cause a dep cycle. Callers of SelectSessionWorkers must implement this func which is responsible for returning a storage bucket's worker filter as well as its associated credential id. - authorizeSessionWithWorkerFilter now receives an internal/server.(Repository) object when called. This is transparent to SelectSessionWorkers callers as it is handled internally. feat(server): Add FilteredWithFeatures fn and new server options * refact(server): create new list and lookup worker queries * test(server): Add WorkerList unit tests * feat(server): Implement WorkerList randomness using crypto/rand pkg * chore(db): add index to server_worker table * refact(server): prefix test method with Test * refact(server): rename Downstreamers interface to Graph * chore(server): unexport and rename method * chore: add doc string to WorkerAddress (#5420) --------- Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com> Co-authored-by: irenarindos <irena.rindos@gmail.com>	1 year ago
Johan Brandhorst-Satzkorn	1cbe1ca463	internal/event: fix log processor race (#5401 ) The cloud events formatter Process function would call the signer without protecting it, which was racy with the Rotate function.	1 year ago
Johan Brandhorst-Satzkorn	7b30697ddd	internal/session: fix race condition in connection cleanup (#5402 ) The totalClosed variable was accessed in both the Status and the Run functions, which may be called from independent goroutines.	1 year ago
Damian Debkowski	868d7b8a2d	test(daemon): remove tests with multihop (#5397 )	1 year ago
David Kanney	2342e4b644	fix(target): Assign session connection limit to SessionAuthorization.ConnectionLimit (#5396 ) * fix(target): Assign session connection limit to SessionAuthorization.ConnectionLimit * test(target): Update TestAuthorizeSession & TestAuthorizeSessionTypedCredentials to check session connection limit	1 year ago
Damian Debkowski	dd1482b5ac	test(cluster): check worker status multiple times (#5393 )	1 year ago
Johan Brandhorst-Satzkorn	1a6320794e	cmd: propagate keyring reading errors (#5360 ) Reading a token from the keyring can sometimes fail for reasons other than the token not being present in the keyring. This PR introduces a new error used to indicate that the token requested could not be found in the keyring and propagates errors from the keyring up to the caller, so that the caller can act on them. Additionally, this fixes a bug in the client cache where it would incorrectly assume that a token had been removed from the keyring, when in fact there was an error reading from the keyring.	1 year ago
Damian Debkowski	98bb4c8c31	test(cluster): split tests between parallel and sequential packages (#5390 )	1 year ago
Johan Brandhorst-Satzkorn	1b6b22ef4f	internal/daemon/worker: improve runtime and reduce noise (#5387 ) TestRotationTicking would previously wait for 5 rotations, which is pretty slow considering each rotation takes 20 seconds. Reduce the number to 3, and use require instead of assert to remove noise during flaky test runs. This doesn't fix the flakiness of this test, but it should reduce the log spam.	1 year ago
Johan Brandhorst-Satzkorn	20f11ab01b	Revert "internal/daemon: speed up multi-worker tests (#5370 )" (#5386 ) Unfortunately, this started causing the enterprise tests to break in an unexpected way. Reverting to spend some more time testing the changes.	1 year ago
Johan Brandhorst-Satzkorn	862a30c389	internal/daemon: speed up multi-worker tests (#5370 ) Instead of sleeping, we can poll for the desired state. Also, run shutdowns in parallel.	1 year ago
David Kanney	f62e67584e	chore: Clarify GrantHash behavior when there are no GrantTuples (#5334 ) * chore: Simplify appending * test(grants): De-dupe hash comparison * chore(grants): Remove TODO & add clarifying comment * test(grants): Add test cases to enforce empty grants behavior	1 year ago
Johan Brandhorst-Satzkorn	c85fad27f6	internal/event: avoid reusing canceled context (#5304 ) Don't error in ReleaseGate if the context used for the original event has been cancelled. Any error in ReleaseGate causes the controller to terminate its startup. If a user was trying to send a request to the Boundary controller as it started up, the context tied to the request would be reused to attempt logging the observation associated with the request after the logging gate was released. This would always fail, as the context associated with the request was canceled. We now use a new context timeout for events logged after the release gate is released, if the original context was canceled.	1 year ago
Bharath Gajjala	58cc322c63	Refactor redundant append operations in test setup (#5211 ) * Refactor redundant append operations in test setup - Simplified code by removing unnecessary if-else conditions in the wantUserIds and wantGroupIds blocks. Fixes #5205 * chore: fmt fix	1 year ago
Johan Brandhorst-Satzkorn	10370edf59	internal/commands/server: prevent test panic on timeout (#5249 ) Previously, if one of these tests failed to start their servers before the timeout, there was a risk that the goroutine started to run the server would invoke t.Errorf after the test itself had concluded. Replace t.Errorf with fmt.Printf to avoid the panic, and include the test name for debugging.	1 year ago
Michael Gaffney	e086fd3007	test(batch): Fix data races in tests Fixes: `9b984b0ab6`	1 year ago
Johan Brandhorst-Satzkorn	a2be306eb4	More managed groups limit fixes (#5245 ) * internal/handlers/managed_groups: ensure membership lookup is unlimited Previously, we would only show the first 10,000 members in the group, giving the impression that a complete list was performed. Now we list all members. * internal/handlers/accounts: ensure group lookup is unlimited Previously, we would only show the first 10,000 managed group memberships. Now we list all group memberships of an account.	1 year ago

1 2 3 4 5 ...

2709 Commits (8b9d5cba5b37e6180a694ca4d397bac2bc8a38bf)