569 Commits (c2bc19c71fac7c3ccf106b3cdf0c19fb7ecf899d)

Author	SHA1	Message	Date
Johan Brandhorst-Satzkorn	40cb9f5c9e	Restrict concurrent password hashes (#5437) ... * internal/auth/password: add resizable pool The resizable pool wraps the permit pool with a mutex to allow it to be resized at runtime. * internal/auth/password: add concurrency limit The default concurrency limit is 1, and it can be set using the SetHashingPermits function. * internal/cmd/config: allow configuring hashing limits The new concurrent_password_hash_workers configuration value can be used to loosen the constraints on the userpass auth method hashing operation. * internal/cmd: set password hashing constraints Sets the password hashing concurrency constraints on startup and config reload. * CHANGELOG: add notice about password concurrency limit	1 year ago
Hugo	346ac58fa3	feat(cmd): Default to azure plugin when performing db migration (#5422)	1 year ago
Hugo	846c849589	Worker Domain Refactor (#5338) ... * feat(server): Refactor LookupWorkerByName to be a test method * feat(server): Split worker tags table * refact(worker): Export api and config tags * refact(server): Return worker id from UpsertWorkerStatus * refact(server): Create ListWorkerStorageBucketUpdates domain function * refact(server): Use dedicated HCPb-worker list func * refact(server): Create ConnectionRoute domain function * refact(handlers): Move worker selection logic to internal/server package This commit moves all the logic to select a worker to handle a session to the internal/server package. Most functions were moved to this package with no changes, however, there are a couple of notable exceptions: - Given that we don't use GRPC errors in repos, all errors were adjusted to use the internal/errors package instead. - StorageBucketFilterCredIdFn is now used to prevent the internal/server package from importing internal/storage/plugin, which would cause a dep cycle. Callers of SelectSessionWorkers must implement this func which is responsible for returning a storage bucket's worker filter as well as its associated credential id. - authorizeSessionWithWorkerFilter now receives an internal/server.(*Repository) object when called. This is transparent to SelectSessionWorkers callers as it is handled internally. * feat(server): Add FilteredWithFeatures fn and new server options * refact(server): create new list and lookup worker queries * test(server): Add WorkerList unit tests * feat(server): Implement WorkerList randomness using crypto/rand pkg * chore(db): add index to server_worker table * refact(server): prefix test method with Test * refact(server): rename Downstreamers interface to Graph * chore(server): unexport and rename method * chore: add doc string to WorkerAddress (#5420) --------- Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com> Co-authored-by: irenarindos <irena.rindos@gmail.com>	1 year ago
Johan Brandhorst-Satzkorn	1a6320794e	cmd: propagate keyring reading errors (#5360) ... Reading a token from the keyring can sometimes fail for reasons other than the token not being present in the keyring. This PR introduces a new error used to indicate that the token requested could not be found in the keyring and propagates errors from the keyring up to the caller, so that the caller can act on them. Additionally, this fixes a bug in the client cache where it would incorrectly assume that a token had been removed from the keyring, when in fact there was an error reading from the keyring.	1 year ago
Johan Brandhorst-Satzkorn	10370edf59	internal/commands/server: prevent test panic on timeout (#5249) ... Previously, if one of these tests failed to start their servers before the timeout, there was a risk that the goroutine started to run the server would invoke t.Errorf after the test itself had concluded. Replace t.Errorf with fmt.Printf to avoid the panic, and include the test name for debugging.	1 year ago
Elim Tsiagbey	514bcc19f6	feat(gcp): add GCP plugin (#5229) ... Add GCP as a supported plugin for dynamic host catalogs	1 year ago
dani	62c41191ff	[fix] allow IPv6 controllers, workers, and targets (#5221) ... Co-authored-by: Damian Debkowski <damian.debkowski@hashicorp.com>	1 year ago
Hugo	ee9f9fb4a1	feat(worker): Support running AWS host plugin	2 years ago
Hugo	c3d03f69d8	feat(cmd): Support plugin host catalog worker filter	2 years ago
Jeff Mitchell	62d4f8453b	Don't explode grants from the DB (#5104) ... This removes the Cartesian product in the DB for GrantsForUser in favor of returning the actual grant scope information and dealing with it in application code. (cherry picked from commit 913cd53682)	2 years ago
Irena Rindos	35679c6a5b	chore(config): remove deprecated controllers field (#5125) ... * chore(config): remove deprecated controllers field	2 years ago
Irena Rindos	eb33649ded	(clientagentcmd): plumb thru env var (#5123) ... * (clientagentcmd): plumb thru env var	2 years ago
Ryan Derr	913e6d755f	ICU-11661 Add scope name in options slice for authorized-sessions (#5108)	2 years ago
Irena Rindos	83b61275d5	(cmd): unhide client agent commands (#5097)	2 years ago
Jeff Mitchell	66af7dba98	Allow reloading some server timings (#5071) ... Allows changing grace period and a few other things timing-related via HUP instead of just a restart. Tested manually via config changes and HUP.	2 years ago
Hugo	1c62470ba6	chore(cmd): Move FlagClientAgentPort and flagTargetDefaultPort to uint16	2 years ago
Hugo	bf9dbd818e	chore(cmd): Remove IntVar and move to Int64Var	2 years ago
Hugo	3195dcba4e	chore(cmd): Remove UintVar and move to Uint64Var	2 years ago
Damian Debkowski	4131c4b324	feat(cmd): display remote storage states for workers	2 years ago
Johan Brandhorst-Satzkorn	c6f3c375f3	api: remove deprecated grant_scope_id field (#4886) ... * api: remove deprecated grant_scope_id field The grant_scope_id field was deprecated in 0.15.0, so we can remove it for 0.17.0. * Fix tests * Fix more tests * Remove an option and some related code that stuck around * Fix bats tests --------- Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>	2 years ago
Jeff Mitchell	d547e0d459	Add test ability to reinitialize worker auth roots on startup (#4895)	2 years ago
Johan Brandhorst-Satzkorn	ec289420d3	clientagentcmd: use "localhost" to call client agent (#4816) ... The client agent serves on "localhost:9300" by default. It appears on some systems this resolves to ::1:9300 and on some systems 127.0.0.1:9300. We should use the same address on the client as the server to avoid any incompatibilities between systems.	2 years ago
Todd	6936a5448c	update status cli to optionally return some fields (#4810)	2 years ago
Johan Brandhorst-Satzkorn	8ff18f6c3c	internal/cmd: rename ferry to client-agent ... Renames the ferry command and related flags and env vars to client-agent following the new naming decision.	2 years ago
Hugo	2983f80eaa	fix(cmd): Support account attribute maps	2 years ago
Johan Brandhorst-Satzkorn	111b8fbecf	internal/cmd/ferry: add sessions command (#4800)	2 years ago
Irena Rindos	6f09819e9f	chore: fix workers tag cmd help strings (#4780)	2 years ago
Michael Milton	f7e59d5d04	Add hidden ferry pause and resume commands (#4771) ... * Add hidden ferry pause and resume functions * add check for 200 status * include pause/resume status in ferry status, fix output * put error string back to previous state	2 years ago
Kerim Satirli	e54519975b	adds missing space in mlock warning (#4286)	2 years ago
dani	1a77e4da86	Boundary Plugin MinIO (#4621) ... feat(storage): Add storage support for MinIO via new built-in plugin	2 years ago
Elim Tsiagbey	2c140b1e09	feat: Local Storage State API & CLI ... - add `local_storage_state` value to API & CLI	2 years ago
Damian Debkowski	aea473c77b	feat: new worker config for minimumAvailableCapacity	2 years ago
Jeff Mitchell	d396a33930	Fix controller-only in dev not showing events (#4594)	2 years ago
Todd	95c507fad5	Add hidden ferry commands and auto adding tokens to ferry daemon (#4572) ... * Add boundary ferry command (#4462) * Add boundary ferry status (#4463) * Add sending auth token automatically to ferry daemon (#4465) * Hide ferry cmds, background error msgs, and dont retry background add-token requests (#4571)	2 years ago
Todd	cb1e9b570b	Add CLI flags for creating an alias with a target (#4512) ... * Add CLI flags for creating an alias with a target * Add bats tests	2 years ago
Jeff Mitchell	7105270cd5	Make TestServer_ReloadWorkerTags non-parallel ... This will hopefully help with flakiness. Note: this was tested on the Ent side	2 years ago
Jeff Mitchell	19b19d6756	Comment out parallel statements causing test failures (#4528) ... It hasn't been investigated why this is happening (getting a number of 403 errors) but for now removing parallel fixes it.	2 years ago
Jeff Mitchell	9408b2b299	Add some more fixes caught by race detector (#4488)	2 years ago
Irena Rindos	e80e9a6da5	feat(dev): create initial alias targets for boundary dev (#4433) ... * feat(dev): create initial alias targets for boundary dev	2 years ago
Todd	24a2089db8	Add aliases to table format output for target reads (#4416)	2 years ago
Todd	305bb09c35	Treat alias values like other required fields in API and CLI (#4404) ... * Treat Alias values like other required fields in API and CLI * Fix protoc versions since we recently rebased on main which uses updated version	2 years ago
Todd	a6c96d69ae	Add TargetAliasAuthorizeSessionArgumentsHostId api options (#4397) ... * Add host id api option	2 years ago
Irena Rindos	ba21e076bb	cli(aliases): Support aliases for connect and targets in the CLI (#4356) ... * cli(aliases): Support aliases for boundary connect and boundary targets CLI	2 years ago
Todd	78e10864c4	Add alias CLI CRUDL commands (#4353) ... * Add alias CLI CRUDL commands	2 years ago
Michael Milton	2e69d59dd2	feat(billing): Add cli subcommand for monthly active user counts	2 years ago
Jeff Mitchell	c3297bb96f	Remove worker type from CLI output (#4396) ... This does not currently remove the field from the message on the API but since it will now always show `pki` it's meaningless and causing confusion for some users.	2 years ago
Jeff Mitchell	35cef97bd4	Linter fixes PR 3 (#4415) ... * Linter fixes * fix(bsr): update test to register TEST protocol once --------- Co-authored-by: Damian Debkowski <damian.debkowski@hashicorp.com>	2 years ago
Jeff Mitchell	49803e653c	Linter fixes numero 2 (#4408)	2 years ago
Jeff Mitchell	25bce9e8ff	Fix linter warnings	2 years ago
Louis Ruch	d59f089819	feat(policies): Update SDK/API to support setting/clearing attributes (#4385)	2 years ago