boundary

Commit Graph

Author	SHA1	Message	Date
Jeff Mitchell	163ce184b8	KMS-PKI Workers (#3101 ) This adds a new mechanism for worker authentication that uses the third-party arbitration of the original KMS flow by leveraging recently-added capabilities in nodeenrollment to support a registration wrapper. This allows for workers to be registered to the system with just a name and a matching wrapper, while at the same time allowing these workers to be used for private Vault access and multi-hop as they contain per-worker encryption keys and support rotation. Nodes using this mode will generate and rotate credentials in-memory (using another recently added nodeenrollment capability) so will have a new set of keys on every startup. This has the side effect of ensuring that there is never a conflict or re-use of these credentials. Note that the normal test worker flow was using the now-deprecated KMS method; there is still a test that uses this (explicitly) but all other tests using test workers that did not specify a specific PKI flow now actually use this mechanism. This means there is fairly decent test coverage in a general sense, plus the specific tests updated/added for this feature. This also adds a new KMS type that can be used to have distinct KMSes for upstream authentication vs. accepting from downstream.	3 years ago
Jeff Mitchell	b76b24a4ad	Move prefixes for many packages into the globals package (#3069 ) This is a prerequisite for some enhancements to grant validation	3 years ago
Johan Brandhorst-Satzkorn	3c29308673	chore: Add license headers to all files	3 years ago
Todd	87b09d5e27	Rename router to receiver for secondary connections (#2816 )	3 years ago
Todd	bc409bc7d4	Graceful shutdown blocks on running proxy handler connections (#2789 )	3 years ago
Irena Rindos	d3d1fa0b55	initial commit (#2768 )	3 years ago
Irena Rindos	173e1587d0	Append initial worker upstreams if current upstreams are unresponsive (#2698 ) * Append initial worker upstreams if current upstreams are unresponsive	3 years ago
Irena Rindos	5b162a4433	add worker version to network graph (#2672 ) * add worker version to network graph	3 years ago
Johan Brandhorst-Satzkorn	8908dccf6d	Forward port some release fixes (#2631 ) * fix(worker): Verify contents of loaded session (#2629) * fix(worker): Verify contents of loaded session Previously, it was possible for an empty private key to be used when the session had no user or project associated with it. The new checks guarantee that we will fail gracefully in these cases. * Check against len instead of nil * Add CHANGELOG * fix(session): Always invoke all parts of session cancel trigger The session cancelation trigger would not set the key_id to null appropriately if another one of the fields on the session was already null, since that case statement would be matched first. The new structure matches all statements, in case any of them have special logic (such as in the project case).	3 years ago
Irena Rindos	70e20b5cf5	revert merge llb-multihop-sessions (#2628 )	3 years ago
Irena Rindos	011a7cf640	Dataplane routing (#2623 ) * addition of dataplane routing	3 years ago
Jeff Mitchell	0c96c6ff6c	Split grace period into multiple config values (#2578 ) (#2603 ) Co-authored-by: Todd <github@quaddi.com>	3 years ago
Todd	2a4ce02de6	Disconnect PKI workers from upstreams when they are no longer authorized (#2515 )	4 years ago
Haotian	3be8b6efed	refactor(metric): move common metrics functions out of 'internal' directory (#2536 )	4 years ago
Todd	412e7a2418	Add interfaces and error codes for processing downstream router connections (#2511 ) * Add interfaces and error codes for processing downstream router connections	4 years ago
Irena Rindos	d951e1ebc1	Worker graceful shutdown (#2455 ) * add graceful shutdown to worker	4 years ago
Irena Rindos	fc0ead73e6	feat(workers): worker operational state (#2427 ) * feat(workers): worker operational state	4 years ago
Jeff Mitchell	01fb949d0b	Add controller-led worker auth flow (#2413 ) This adds an action to the API that allows pulling out an activation token that can be given to a worker in its config (directly or via env or file). The worker can pass this along with its normal request in place of its normal nonce and the server will automatically accept it. Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com>	4 years ago
Timothy Messier	5d0cdf680f	feat(worker): Support reloading of initial upstreams on SIGHUP (#2417 ) On a SIGHUP, if the worker's `initial_upstreams` config option has changed, it will use the new values as the address to send its status. Any previously discovered upstream addresses from previous status requests are dropped. Once a successful status request is made to the new addresses, the worker will resume its normal behavior of using the addresses from the response to the status request. This allows a worker to be deployed in a more stable way in a dynamic environment where controller IPs could change. In particular this helps with a case where all controllers are replaced with new controllers running on new IPs. To illustrate with an example, suppose there is an instance group of controllers instances. And there are worker instances that have their config rendered from consul-template that sets `initial_upstreams` to the IPs of the controller instances. If all controller instances are restarted or replaced at the same time and assigned new IPs, a new config will be rendered for the worker. Previously the only way for the worker to use the new value would be for the worker process to be restarted. Otherwise the worker would only know about the previous IPs and would fail to connect to the new controllers. However, a restart would mean any active sessions and session connections on the worker instance would be terminated. With this update, consul-template can send a SIGHUP to the worker, the worker will connect to the new controllers and resume normal status reporting, allowing the sessions and session connections to remain. The same principles would apply for other examples of dynamic environments such as nomad and kubernetes. See: https://github.com/hashicorp/consul-template https://www.nomadproject.io/docs/job-specification/template	4 years ago
Jim	2818bb65cd	feature (downstreams): Add hooks for optional downstream workers/router (#2359 ) This includes the required interfaces, factories, error codes, etc	4 years ago
Jeff Mitchell	8800ec9c94	Reorganize logic to allow a poison pill (#2317 )	4 years ago
Todd	1aad2627c8	OSS side of second downstream connections (see enterprise PR 69) (#2292 )	4 years ago
Todd	155c5f578b	Create session manager for workers to use to interact with sessions (#2235 )	4 years ago
Todd	9af6c09c36	Move generated pb.go file in to the internal/gen directory (#2225 )	4 years ago
Todd	19b549c44a	Rename package servers to server (#2222 )	4 years ago
Jim	bd167da7d1	fix (worker): send workerId when authorizing session (#2207 ) * fix (worker): send workerId when authorizing session Send the workerId returned from the last success worker status when authorizing a session. * fixup! fix (worker): send workerId when authorizing session * fixup! fix (worker): send workerId when authorizing session * refactor (worker): deprecate workerId in ActivateSessionRequest It wasn't being used anywho * fixup! fix (worker): send workerId when authorizing session * Update LookupSessionRequest Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>	4 years ago
Jeff Mitchell	32d04b9ce7	Allow a worker to use KMS auth but accept PKI for proxy (#2206 ) This essentially worked for non-dev mode before but would create storage directories that weren't actually used or needed, and it didn't work in dev mode because it made assumptions about the presence of a worker auth kms or not. This fixes those behaviors.	4 years ago
Jeff Mitchell	9a4545e59e	Fix eventing and worker name setup (#2204 ) * Don't automatically create worker names, as this is now invalid for PKI workers * Fix a check in dev that clears out name/description in exactly the wrong cases * Change eventing setup to use a hostname-based ID instead of the name (which could change on every start anyways)	4 years ago
Jeff Mitchell	5a7291131f	Make current key update on rotation	4 years ago
irenarindos	16d95262a6	feature(worker): add workerKeyId to status	4 years ago
Jeff Mitchell	d1b3b2441f	Add node rotation (#2142 )	4 years ago
Jeff Mitchell	4117841cf9	Use persistent storage for worker auth credentials (#2139 )	4 years ago
Jeff Mitchell	caf19f867e	Rename some variables to remove Nodee	4 years ago
Jeff Mitchell	f4642930b4	Updates from review of 2076 (#2135 )	4 years ago
Haotian	631c174f47	feat(worker): implements WorkerAuthStorage wrapper for worker credential encryption (#2076 ) * Adds WorkerAuthStorage wrapper for worker credential encryption using nodeenrollment library. * Adds AuthStoragePath field in worker config and dev mode to specify directory to store credentials.	4 years ago
Haotian	1830605a7e	refact(servers) Update api for new worker and controller server tables (#2101 ) * Discontinue support for old Server message in ServerCoordinationService. Split message into ServerWorkerStatus and UpstreamServer (which currently contains controller addresses). Remove unnecessary fields. Modify workerStatusServer to use new fields. Co-authored-by: Todd <github@quaddi.com>	4 years ago
Jeff Mitchell	1987264bc3	Migrate storage to database repo (#2132 )	4 years ago
Jeff Mitchell	5c76017dd6	Fix nil storage	4 years ago
Jeff Mitchell	46e97a2b91	Update to new nodee lib bits (#2120 )	4 years ago
Jeff Mitchell	1f550722a2	Sync against current library state	4 years ago
Jeff Mitchell	0581e164f1	Update nodeenrollment dep	4 years ago
Jeff Mitchell	00e57db60f	Adapt to library changes	4 years ago
Haotian	898da56a77	feat(workers): Add storage path parameter to worker config	4 years ago
Todd	b83f4ece39	Manual merge of main into llb-byow.	4 years ago
Todd	d8a443e238	Merge branch 'main' into llb-byow # Conflicts: # internal/daemon/controller/handlers/targets/target_service.go # internal/daemon/controller/handlers/workers/multihop_service.go # internal/daemon/controller/handlers/workers/worker_proxy_service.go # internal/daemon/controller/handlers/workers/worker_service.go # internal/daemon/worker/status.go # internal/daemon/worker/worker.go	4 years ago
Todd	b58dada40d	Move the server daemons into their own package (#2061 ) * Move the server daemons into their own package With this change the internal/server package now is dedicated to the server domain (workers and controllers) and not to the server daemons. The hope is that this will make it easier to keep the daemons decoupled from the representation of the servers in the database.	4 years ago

46 Commits (8c5464802d00a9d47f261d56b643d74bbb6382d7)