boundary

Commit Graph

Author	SHA1	Message	Date
Damian Debkowski	5bd142ddb4	fix(worker): set session.CloseCallTimeout to non-zero value (#5510 )	1 year ago
Elim Tsiagbey	c5cc20c649	fix(worker): add GCP plugin support on the worker (#5484 ) Enable worker to run GCP plugin	1 year ago
Johan Brandhorst-Satzkorn	ec0a3f964b	Worker status refactor (#5417 ) * oss: feat(proto): statistics rpc added to server coordination service * oss: feat(session): add update statistics status service * oss: feat(handlers): add Statistics method to worker service server * oss: feat(worker): add statistics ticking * oss: internal/proto: define the new RoutingInfo RPC * oss: internal/server: repository changes for RoutingInfo RPC * oss: internal/daemon: add RoutingInfo handler to worker service The new RoutingInfo RPC is used to get information from the worker that is used to make routing decisions on the controller. It also handles the initial request from the worker. * oss: feat(db): server_worker_session_info table * oss: feat(proto): session info rpc for server coordination service * oss: feat(server): worker session info request data type * oss: feat(worker): session info ticker * oss: feat(handler): server coordination handler for session info * oss: feat(session): utilize session info request time for session cleanup * oss: proto: fix some gotags comments Some of these fields were missing comments, while others had incorrectly formatted comments. * oss: worker: send connection status to server This is required for the correct tracking of orphaned connections * oss: internal/daemon/worker: add function to wait for Statistics RPC * oss: internal/daemon/worker: add routing info RPC The new RoutingInfo RPC replaces part of the Status RPC, namely the part which is used by the controller and worker to perform decisions around the establishment of new sessions and new worker connections. * oss: internal/daemon/worker: remove unnecessary error check * oss: internal/daemon/worker: lock access to config and upstreams The new confLock protects access to the conf value and to the addressReceivers slice. * oss: worker: replace Status RPC with RoutingInfo * oss: worker: deprecate the Status RPC and related types The Status RPC and related messages have been replaced by the RoutingInfo/SessionInfo/Statistics RPCs. The controller will continue to support the Status RPC until two new minor versions have been released. * oss: internal/event: add default deny for new worker RPCs * oss: internal/daemon/worker: allow RPC interval to be set The new SessionInfo/RoutingInfo/Statistics RPCs run at long intervals, which make some of our cluster tests take a long time to complete. This allows their interval to be configured in tests. * oss: all: use TestWorkerRPCInterval in slow tests This should speed up these tests significantly. * oss: internal/tests/cluster: reset sys eventer in test --------- Co-authored-by: Damian Debkowski <damian.debkowski@hashicorp.com>	1 year ago
Hugo	846c849589	Worker Domain Refactor (#5338 ) * feat(server): Refactor LookupWorkerByName to be a test method * feat(server): Split worker tags table * refact(worker): Export api and config tags * refact(server): Return worker id from UpsertWorkerStatus * refact(server): Create ListWorkerStorageBucketUpdates domain function * refact(server): Use dedicated HCPb-worker list func * refact(server): Create ConnectionRoute domain function * refact(handlers): Move worker selection logic to internal/server package This commit moves all the logic to select a worker to handle a session to the internal/server package. Most functions were moved to this package with no changes, however, there are a couple of notable exceptions: - Given that we don't use GRPC errors in repos, all errors were adjusted to use the internal/errors package instead. - StorageBucketFilterCredIdFn is now used to prevent the internal/server package from importing internal/storage/plugin, which would cause a dep cycle. Callers of SelectSessionWorkers must implement this func which is responsible for returning a storage bucket's worker filter as well as its associated credential id. - authorizeSessionWithWorkerFilter now receives an internal/server.(Repository) object when called. This is transparent to SelectSessionWorkers callers as it is handled internally. feat(server): Add FilteredWithFeatures fn and new server options * refact(server): create new list and lookup worker queries * test(server): Add WorkerList unit tests * feat(server): Implement WorkerList randomness using crypto/rand pkg * chore(db): add index to server_worker table * refact(server): prefix test method with Test * refact(server): rename Downstreamers interface to Graph * chore(server): unexport and rename method * chore: add doc string to WorkerAddress (#5420) --------- Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com> Co-authored-by: irenarindos <irena.rindos@gmail.com>	1 year ago
Hugo	ee9f9fb4a1	feat(worker): Support running AWS host plugin	2 years ago
Johan Brandhorst-Satzkorn	41de35f2b1	internal/daemon/controller+worker: propagate downstream timeout (#5083 ) Propagate the downstream worker timeout into the downstream receiver and downstream ticker so we have a configurable consistent timeout value to use for worker to worker interactions. Also change the atomic.Pointer to an atomic.Int64 for consistency with other values.	2 years ago
Jeff Mitchell	66af7dba98	Allow reloading some server timings (#5071 ) Allows changing grace period and a few other things timing-related via HUP instead of just a restart. Tested manually via config changes and HUP.	2 years ago
Johan Brandhorst-Satzkorn	96688b36d5	internal/daemon: simplify time update tests (#5041 ) Using time.After makes the intent clearer	2 years ago
Sorawis Nilparuk (Bo)	350ac90a57	implement configurable getDownstreamWorker timeout (#5007 ) * implement configurable getDownstreamWorker timeout * add parsing test * typos * fix tests * fix worker tests * 0 is a valid value	2 years ago
dani	1a77e4da86	Boundary Plugin MinIO (#4621 ) feat(storage): Add storage support for MinIO via new built-in plugin	2 years ago
Elim Tsiagbey	a23c57e7c6	feat: add storageEventListener nil check Only shutdown the storageEventListener if the storageEventListener is not nil	2 years ago
Elim Tsiagbey	3f94c900f0	feat: Add worker event listener - add worker event listener - add worker event handler - start event listener when a worker starts	2 years ago
Elim Tsiagbey	8506ed3e2c	feat: Report Local Storage State Status - add `LocalStorageState` to worker status reports - update worker service handler to process `LocalStorageState`. If is empty for workers older workers, we set the `LocalStorageState` to `unknown` - update field mask paths to support `LocalStorageState`	2 years ago
Damian Debkowski	aea473c77b	feat: new worker config for minimumAvailableCapacity	2 years ago
Jeff Mitchell	9408b2b299	Add some more fixes caught by race detector (#4488 )	2 years ago
Jeff Mitchell	014a5a7aae	Vet/race fixes (#4421 ) This addresses all found vet/race fixes in community edition. --------- Co-authored-by: Damian Debkowski <damian.debkowski@hashicorp.com>	2 years ago
Jeff Mitchell	8e71caa2e3	Address some review feedback	2 years ago
Jeff Mitchell	9332179a01	Remove the deprecated old KMS worker auth mechanism (#3935 ) This has been superceded by the nodeenrollment-based KMS worker auth mechanism. This commit only removes the ability to connect with this mechanism; some upgrade logic will remain intact for a bit and can be removed later.	2 years ago
Jeff Mitchell	20ac42c851	Add some useful dev flags (#3865 )	3 years ago
dani	9413837b6a	pass storage an empty context so it can close cleanly (#3653 ) Co-authored-by: Danielle Miu <29378233+DanielleMiu@users.noreply.github.com>	3 years ago
Irena Rindos	9733a250fa	refact(event): move observability/event to event (#3704 )	3 years ago
Elim Tsiagbey	fabd4093de	feat: Worker Connectivity Health Check (#3650 ) * feat: Worker Connectivity Health Check Add worker upstream connection state. API calls to the worker's ops `/heath?worker_info=1` endpoint should now return a new filed called `upstream_connection_state` ``` { "worker_process_info":{ "state":"active", "active_session_count":0, "upstream_connection_state":"READY" } } ``` The states returned will be GRPC connection states: https://grpc.github.io/grpc/core/md_doc_connectivity-semantics-and-api.html There could be multiple upstream addresses but GRPC manual resolver determines the state of the connection.	3 years ago
hashicorp-copywrite[bot]	29da0bcb92	[COMPLIANCE] License changes (#3567 ) * Adding explicit MPL license for sub-package. This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository. * Adding explicit MPL license for sub-package This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository. * Updating the license from MPL to Business Source License Going forward, this project will be licensed under the Business Source License v1.1. Please see our blog post for more details at https://hashi.co/bsl-blog, FAQ at www.hashicorp.com/licensing-faq, and details of the license at www.hashicorp.com/bsl. * Update copyright file headers to BUS-1.1 * Rerun make gen This will pick up the last of the license changes * Revert "Rerun make gen" This reverts commit `dbe0968bff`. * Remove copywrite from generation script The current version of copywrite is not sophisticated enough to only apply the copywrite changes to certain subdirectories, so to avoid accidentally relicensing our api and sdk modules, we will stop running the copywrite script until such time that it can do the right thing. * License protobuf API as MPL The protobuf API files are used to generate the SDK, since we want the SDK to be MPL, the protobuf files must also be MPL. This extends to all protobuf files whose sources end up in the SDK directory, including: - internal/proto/controller/api - internal/proto/controller/custom_options - internal/proto/plugin It also includes the generated service directory in internal/gen/controller/api/services, since they are generated from the protobuf sources used for the SDK. * Change website license file name This makes the naming scheme consistent with the rest of the repository. * Add note on licensing to README * Set copywrite license to BUSL * Revert "Add note on licensing to README" This reverts commit `4d865a91a7`. --------- Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com> Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>	3 years ago
Todd	5a68d789ec	Initialize base context when creating New worker and not at start (#3294 )	3 years ago
Louis Ruch	281f217dcc	feat(plugins): Refactor host plugins to boundary plugins (#3262 )	3 years ago
Todd	59ae4b5901	Expand the recorder manager interface	3 years ago
Todd	feb87e717e	Add Closed error code and rename recorder cache to manager	3 years ago
Louis Ruch	798a1f952a	feat(storage): Add support for storage plugins	3 years ago
Jim	410bec1e00	feature(worker/controller): register UpstreamMessageServiceServer	3 years ago
Louis Ruch	def8e47f32	feat(storage): Add pluginInfo to storageBucket	3 years ago
Louis Ruch	52fbc6410c	feat(storage): Add interface, options and errors	3 years ago
Todd	bd2bca987d	Add the first iteration of the recorder cache and wire it in	3 years ago
Jeff Mitchell	e8559d142a	Fix worker auth rotation test (#3243 ) Most of the changes here are changes or enhancements that are useful for tests. The crux of the issue was that I had pulled up one var to the package level so it could be read from tests, but that var was not being reset between tests. It's not even used in tests anymore, so I put it back to function-local.	3 years ago
Jeff Mitchell	163ce184b8	KMS-PKI Workers (#3101 ) This adds a new mechanism for worker authentication that uses the third-party arbitration of the original KMS flow by leveraging recently-added capabilities in nodeenrollment to support a registration wrapper. This allows for workers to be registered to the system with just a name and a matching wrapper, while at the same time allowing these workers to be used for private Vault access and multi-hop as they contain per-worker encryption keys and support rotation. Nodes using this mode will generate and rotate credentials in-memory (using another recently added nodeenrollment capability) so will have a new set of keys on every startup. This has the side effect of ensuring that there is never a conflict or re-use of these credentials. Note that the normal test worker flow was using the now-deprecated KMS method; there is still a test that uses this (explicitly) but all other tests using test workers that did not specify a specific PKI flow now actually use this mechanism. This means there is fairly decent test coverage in a general sense, plus the specific tests updated/added for this feature. This also adds a new KMS type that can be used to have distinct KMSes for upstream authentication vs. accepting from downstream.	3 years ago
Jeff Mitchell	b76b24a4ad	Move prefixes for many packages into the globals package (#3069 ) This is a prerequisite for some enhancements to grant validation	3 years ago
Johan Brandhorst-Satzkorn	3c29308673	chore: Add license headers to all files	3 years ago
Todd	87b09d5e27	Rename router to receiver for secondary connections (#2816 )	3 years ago
Todd	bc409bc7d4	Graceful shutdown blocks on running proxy handler connections (#2789 )	3 years ago
Irena Rindos	d3d1fa0b55	initial commit (#2768 )	3 years ago
Irena Rindos	173e1587d0	Append initial worker upstreams if current upstreams are unresponsive (#2698 ) * Append initial worker upstreams if current upstreams are unresponsive	3 years ago
Irena Rindos	5b162a4433	add worker version to network graph (#2672 ) * add worker version to network graph	3 years ago
Johan Brandhorst-Satzkorn	8908dccf6d	Forward port some release fixes (#2631 ) * fix(worker): Verify contents of loaded session (#2629) * fix(worker): Verify contents of loaded session Previously, it was possible for an empty private key to be used when the session had no user or project associated with it. The new checks guarantee that we will fail gracefully in these cases. * Check against len instead of nil * Add CHANGELOG * fix(session): Always invoke all parts of session cancel trigger The session cancelation trigger would not set the key_id to null appropriately if another one of the fields on the session was already null, since that case statement would be matched first. The new structure matches all statements, in case any of them have special logic (such as in the project case).	3 years ago
Irena Rindos	70e20b5cf5	revert merge llb-multihop-sessions (#2628 )	3 years ago
Irena Rindos	011a7cf640	Dataplane routing (#2623 ) * addition of dataplane routing	3 years ago
Jeff Mitchell	0c96c6ff6c	Split grace period into multiple config values (#2578 ) (#2603 ) Co-authored-by: Todd <github@quaddi.com>	3 years ago
Todd	2a4ce02de6	Disconnect PKI workers from upstreams when they are no longer authorized (#2515 )	4 years ago
Haotian	3be8b6efed	refactor(metric): move common metrics functions out of 'internal' directory (#2536 )	4 years ago
Todd	412e7a2418	Add interfaces and error codes for processing downstream router connections (#2511 ) * Add interfaces and error codes for processing downstream router connections	4 years ago
Irena Rindos	d951e1ebc1	Worker graceful shutdown (#2455 ) * add graceful shutdown to worker	4 years ago
Irena Rindos	fc0ead73e6	feat(workers): worker operational state (#2427 ) * feat(workers): worker operational state	4 years ago

1 2

79 Commits (db68e85d88ea307fcd4fdf79656227df5a80df64)