boundary

Commit Graph

Author	SHA1	Message	Date
Irena Rindos	173e1587d0	Append initial worker upstreams if current upstreams are unresponsive (#2698 ) * Append initial worker upstreams if current upstreams are unresponsive	3 years ago
Todd	7a6983c463	Fix wrapped reverse grpc listener (#2702 )	3 years ago
Haotian	340cfb0d88	refactor(metric): adds filter function to collector init method (#2695 )	3 years ago
Todd	b6c0ccc1e8	Refactor proxy handler to separate connection and protocol handling (#2678 )	3 years ago
Haotian	fbd0a8272b	feat(metric): adds accepted/closed connections counters to worker and controller servers (#2668 ) * adds counters and changelog entry	3 years ago
Irena Rindos	5b162a4433	add worker version to network graph (#2672 ) * add worker version to network graph	3 years ago
Haotian	2b84013379	Revert " feat(metric): adds accepted/closed connections counters for controller and worker cluster connections (#2656 )" for failing a build test (#2660 ) This reverts commit `80f72b8511`.	3 years ago
Haotian	80f72b8511	feat(metric): adds accepted/closed connections counters for controller and worker cluster connections (#2656 ) same contents as PR https://github.com/hashicorp/boundary/pull/2593 but this time actually push to main	3 years ago
Johan Brandhorst-Satzkorn	8908dccf6d	Forward port some release fixes (#2631 ) * fix(worker): Verify contents of loaded session (#2629) * fix(worker): Verify contents of loaded session Previously, it was possible for an empty private key to be used when the session had no user or project associated with it. The new checks guarantee that we will fail gracefully in these cases. * Check against len instead of nil * Add CHANGELOG * fix(session): Always invoke all parts of session cancel trigger The session cancelation trigger would not set the key_id to null appropriately if another one of the fields on the session was already null, since that case statement would be matched first. The new structure matches all statements, in case any of them have special logic (such as in the project case).	3 years ago
Irena Rindos	70e20b5cf5	revert merge llb-multihop-sessions (#2628 )	3 years ago
Irena Rindos	781b03d080	dataplane management (#2624 )	3 years ago
Irena Rindos	011a7cf640	Dataplane routing (#2623 ) * addition of dataplane routing	3 years ago
Jeff Mitchell	0c96c6ff6c	Split grace period into multiple config values (#2578 ) (#2603 ) Co-authored-by: Todd <github@quaddi.com>	3 years ago
Todd	2a4ce02de6	Disconnect PKI workers from upstreams when they are no longer authorized (#2515 )	4 years ago
Hugo Vieira	d206635d74	fix(connection): Make bytes up and down a signed 64-bit integer This fixes a theoretical issue with database interaction. Because the fields in the database are signed 64-bit integers, it's theoretically possible to overflow them if we're using unsigned 64-bit integers in the application code.	4 years ago
Hugo Vieira	c81398cbf3	feat(worker): Report bytes up and down on Status updates With this commit, the Worker now sends BytesUp and BytesDown for each of the connections it handles to the Controller in the Status request. The Controller then persists these fields to the database. There is also a new trigger to prevent bytes_up and bytes_down to change after a connection has been closed, as the last update to a session_connection row should be the one that is performed as part of the connection closure process.	4 years ago
Hugo	f023f05c11	feat(worker): Report bytes up/down on Worker connection closure Introduces data about bytes read and written to the connection close payload. No changes are required in the Controller because the RPC messages already contained the required fields. As of this commit, bytes_up and bytes_down columns in the session_connection table are now populated when a connection closes. Refs: #2509	4 years ago
Hugo	1bb80624b8	feat(worker): net.Conn implementation to count Bytes Read and Written This commit introduces a new net.Conn implementation (countingConn) that will keep track of bytes read and written for a particular client connection. This is then implemented into the worker code using interface composition. Refs: #2501	4 years ago
Johan Brandhorst-Satzkorn	f57454b6b9	Rewrite interface{} to any (#2535 ) * chore: Rewrite interface{} to any * Add ignore revs	4 years ago
Todd	73f7004c74	Add RLocks for all read access to s.connInfoMaps in a session (#2553 ) * Add RLocks for all read access to s.connInfoMaps in a session	4 years ago
Jeff Mitchell	37273d7a9c	Fix two items: (#2544 ) * Randomize order of worker output. This uses the standard rand.Shuffle() call; cribbed from https://pkg.go.dev/math/rand#example-Shuffle * Have some error/eventing in the worker status path use the base context instead of the status-call-specific context to allow eventing after a timeout event	4 years ago
Haotian	3be8b6efed	refactor(metric): move common metrics functions out of 'internal' directory (#2536 )	4 years ago
Todd	412e7a2418	Add interfaces and error codes for processing downstream router connections (#2511 ) * Add interfaces and error codes for processing downstream router connections	4 years ago
Todd	2f68c604c5	Add test helper for creating a multihop worker setup (#2513 ) * Add test helper for creating a multihop worker setup.	4 years ago
Irena Rindos	4493dfd527	use prior and current worker auth keys (#2495 ) * use prior and current worker auth keys	4 years ago
Jeff Mitchell	74a007bfdd	Adapt to new nodeenrollment X25519KeyProducer interface (#2491 )	4 years ago
Louis Ruch	b7684a857a	feat(ssh): Use HostId as HostKeyAlias for connect ssh helper (#2490 )	4 years ago
Irena Rindos	bd4f5f3801	update worker auth rotate (#2484 )	4 years ago
Todd	06fd086004	Add health endpoint for worker (#2442 ) * Return worker process information in the health endpoint. Experimental: The worker_info and returned worker_process_info fields are experimental and can change or be removed without notice. When a user passes in "worker_info=1" or "worker_info=true" and a worker is running the returned json will be returned with a key named "worker_process_info" which value is a json object with information about the worker process.	4 years ago
Irena Rindos	d951e1ebc1	Worker graceful shutdown (#2455 ) * add graceful shutdown to worker	4 years ago
Louis Ruch	50490d71ae	chore(targets): Improve help and errors around ssh targets (#2445 )	4 years ago
Irena Rindos	fc0ead73e6	feat(workers): worker operational state (#2427 ) * feat(workers): worker operational state	4 years ago
Irena Rindos	18dff62b7b	Merge BYOW GA branch to main (#2398 ) * feat(workers): Add ability to read and reinitialize cert authority (#2312) * feat(workers): Return Release Version on worker list and read (#2377) * feat(cli): Read and reinitialize worker certificate authority (#2387)	4 years ago
Haotian	5c715478e4	feat(workers): Add metrics for worker server-side grpc connections, refactor repeated code into common location (#2367 ) * feat(workers): added latencies histogram for server side multihop workers * refactor(daemon): combine common grpc metric functions into daemon/internal/metric Co-authored-by: Todd <github@quaddi.com>	4 years ago
Jeff Mitchell	01fb949d0b	Add controller-led worker auth flow (#2413 ) This adds an action to the API that allows pulling out an activation token that can be given to a worker in its config (directly or via env or file). The worker can pass this along with its normal request in place of its normal nonce and the server will automatically accept it. Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com>	4 years ago
Timothy Messier	5d0cdf680f	feat(worker): Support reloading of initial upstreams on SIGHUP (#2417 ) On a SIGHUP, if the worker's `initial_upstreams` config option has changed, it will use the new values as the address to send its status. Any previously discovered upstream addresses from previous status requests are dropped. Once a successful status request is made to the new addresses, the worker will resume its normal behavior of using the addresses from the response to the status request. This allows a worker to be deployed in a more stable way in a dynamic environment where controller IPs could change. In particular this helps with a case where all controllers are replaced with new controllers running on new IPs. To illustrate with an example, suppose there is an instance group of controllers instances. And there are worker instances that have their config rendered from consul-template that sets `initial_upstreams` to the IPs of the controller instances. If all controller instances are restarted or replaced at the same time and assigned new IPs, a new config will be rendered for the worker. Previously the only way for the worker to use the new value would be for the worker process to be restarted. Otherwise the worker would only know about the previous IPs and would fail to connect to the new controllers. However, a restart would mean any active sessions and session connections on the worker instance would be terminated. With this update, consul-template can send a SIGHUP to the worker, the worker will connect to the new controllers and resume normal status reporting, allowing the sessions and session connections to remain. The same principles would apply for other examples of dynamic environments such as nomad and kubernetes. See: https://github.com/hashicorp/consul-template https://www.nomadproject.io/docs/job-specification/template	4 years ago
Jeff Mitchell	9b271d7dd8	Fix error about unimplemented HcpbWorkers call (#2361 ) Although there is a compile time check on the type, it will always succeed due to the Unimplemented embedding requirement. As a result, this PR also changes Unimplemented calls to Unsafe calls, which were added later "for those that prefer their code to break"; the comments on these state: // UnsafeXServiceServer may be embedded to opt out of forward compatibility for this service. // Use of this interface is not recommended, as added methods to XServiceServer will // result in compilation errors. See https://github.com/grpc/grpc-go/issues/4500#issuecomment-852597871 for some more context. I think we're fine with compilation errors though; we own both the server and client side of things and generally are going to add new methods only when we intend to also add them on the client side. Notably, what the comment does not indicate is that it will break at runtime; already it should return a suitable (404 or 405) error if the client requests a method that does not exist.	4 years ago
Johan Brandhorst-Satzkorn	aef9073fa6	Upgrade to Go 1.19 (#2347 )	4 years ago
Irena Rindos	dde0c35f23	Update request data in session manager (#2369 ) * bug(session): Update request data in session manager	4 years ago
Jim	2818bb65cd	feature (downstreams): Add hooks for optional downstream workers/router (#2359 ) This includes the required interfaces, factories, error codes, etc	4 years ago
Jeff Mitchell	07bca9dd66	Ensure initial upstreams is empty before hcpb worker listing (#2334 ) The intention of the code was to have one-hop-away workers list KMS workers to get initial upstreams, and have other workers continue using what was in their config file. However, nothing stops people from having initial_upstreams but _also_ adding a cluster ID in their config file, in which case we'd always run this check and replace the config-set initial upstreams. So, ensure the config-set initial upstreams is also len zero.	4 years ago
Jeff Mitchell	090b2b28f8	Clean up some dev config kms code (#2321 ) * Clean up some dev config kms code Although it didn't matter in the combined state, the KMS for auth storage was not actually being set properly if only a worker was being instantiated.	4 years ago
Jeff Mitchell	8800ec9c94	Reorganize logic to allow a poison pill (#2317 )	4 years ago
Jeff Mitchell	4bd249d347	Fix some missing net.JoinHostPort calls (#2305 )	4 years ago
Todd	1aad2627c8	OSS side of second downstream connections (see enterprise PR 69) (#2292 )	4 years ago
Jeff Mitchell	8f2ef45a01	Update against new version of nodeenrollment split listener (#2280 )	4 years ago
Louis Ruch	a17e973712	feat(credentials): Refactor credential purposes (#2260 ) * feat(credentials): Refactor credential purposes * Application credentials have been refactored to Brokered credentials * Egress credentials have been refactored to Injected Application credentials Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>	4 years ago
Jeff Mitchell	fb3b2209e5	Add WithType to worker listing (#2252 )	4 years ago
Jeff Mitchell	1596ff3d1c	Update against new nodee conn type (#2245 )	4 years ago
Jeff Mitchell	6b48346bf3	Add managed worker address fetching (#2244 )	4 years ago

1 2

98 Commits (cc42c51e5e1bb2c52bd79a080b99f3c5fcf5fd28)