1662 Commits (fc2bf0083858a8117f2caee972ffd79aa0aa2b07)

Author	SHA1	Message	Date
Todd	fe5b554370	AuthorizedDownstreamWorkers now separated from AuthorizedWorkers to maintain API compatibility (#2957) ... * AuthorizedDownstreamWorkers now separated from AuthorizedWorkers to maintain API compatibility	3 years ago
Todd	3461caee41	fix downstream manager test (#2950)	3 years ago
Johan Brandhorst-Satzkorn	cf412b95a2	fix: Support streaming HTTP responses (#2956) ... * all: Upgrade listenerutil dependency The new listenerutil implements http.Flusher, which is necessary for streaming responses from the grpc-gateway to work. * daemon/controller: Remove newline delimiter in streaming responses The default gRPC-Gateway HTTPBody marshaler uses newlines as a delimiter. This introduces newlines in our streamed responses. Wrapping the default marshaler lets us define a nil delimiter, which ensures our streaming responses are unaffected by the server side chunking.	3 years ago
Todd	1e89be1b1a	Downstream worker connections are tracked by worker id (#2949) ... When possible downstream workers will include their worker id information in the connections they establish with the upstream using the nodeenrollment library. The tracking listener now tracks connections that are connected in this same way instead of just connections of type *tls.Conn.	3 years ago
Johan Brandhorst-Satzkorn	4146c0c55d	Upgrade Go version to 1.20 (#2898) ... * chore: Upgrade Go version * fix: Upgrade golangci-lint to support 1.20 * fix: Don't use t.SetEnv in parallel tests This is a panic in Go 1.20 and it sounds like a recipe for distaster in general.	3 years ago
Eng Zer Jun	6403b0f389	test: use `t.TempDir` to create temporary test directory (#2922) ... This commit replaces `os.MkdirTemp` with `t.TempDir` in tests. The directory created by `t.TempDir` is automatically removed when the test and all its subtests [complete. Prior to this commit, temporary directory created using `os.MkdirTemp` needs to be removed manually by calling `os.RemoveAll`, which is omitted in some tests. The error handling boilerplate e.g. defer func() { if err := os.RemoveAll(dir); err != nil { t.Fatal(err) } } is also tedious, but `t.TempDir` handles this for us nicely. Reference: https://pkg.go.dev/testing#T.TempDir Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>	3 years ago
Damian Debkowski	cabe362534	fix(handler): return targetId as hostId for cli edge case support (#2920)	3 years ago
Haotian	f88547bbf5	fix(cli): update plural resource mentions in generated help texts (#2918)	3 years ago
Jeff Mitchell	1e9057d8a3	Update KMS references	3 years ago
Damian Debkowski	84b410974b	fix(handlers): return error when updating json cred w/ empty obj (#2903) ... * fix(handlers): return error when updating json cred w/ empty obj * chore(handlers): split cond stmt & refactor func name	3 years ago
Timothy Messier	e25b0e7888	fix(credentiallibraries): Fallback logic to support 0.11.x cli (#2910)	3 years ago
Cameron Perera	42858c4c0d	chore: bump ui commit (#2913)	3 years ago
Johan Brandhorst-Satzkorn	48e4fcce25	fix: remove file number dependency from test ... This was failing because of the added comments. This isn't a crucial part of the test, so remove it.	3 years ago
Johan Brandhorst-Satzkorn	3c29308673	chore: Add license headers to all files	3 years ago
Cameron Perera	80774077d6	chore: bump ui commit for 0.12.x release (#2904)	3 years ago
Timothy Messier	718e183a1e	fix(credentiallibraries): Correctly populate attrs for vault-generic (#2901)	3 years ago
Timothy Messier	f9a2f44f5b	test(cli): Add tests for vault-ssh-certificate credential library ... This adds tests for updating specific fields of the credential library.	3 years ago
Timothy Messier	e66ea15fef	fix(cli): Status code on api error ... When using the json output of the cli (`-format=json`), a successful call to the controller API would place the HTTP status code in the JSON as `status_code`. However, if there was an error from the API the status code would be placed in the JSON as `status`. In order to be consistent, this adds a `status_code` field to the error response case. For backwards compatibility it still populates `status` in the error case. This inconsistency was missed partially due to a bug in the CLI tests. The assertion on status code was not valid and would always be successful. Thus this also fixes the assertions and tests.	3 years ago
Irena Rindos	4114b41527	Filter managed workers from egress workers when the host address is unsafe (#2899)	3 years ago
Hugo	e455e31f9e	fix(target): Incorrectly allowing whitespace on Target's address field (#2862)	3 years ago
Timothy Messier	32dd7f07d0	fix(vault): Only persist revokable credentials ... When issuing credentials from vault credential libraries, only persist the vault credential if it is revokable. A credential that is revokable has a valid lease id that can be used to revoke the lease in vault. If the credential is not revokable it is also not renewable since renewing also requires a lease id. See: https://developer.hashicorp.com/vault/docs/concepts/lease	3 years ago
Timothy Messier	12a53bbfa9	feat(target): Allow vault ssh cert library as credential source ... This allows the new vault ssh certificate credential library to be used as an injected application credential source.	3 years ago
Timothy Messier	1aaaf4af1d	feat(controller): Translate ssh certificate credentials for worker	3 years ago
Timothy Messier	6a41bf1237	feat(wh): Support vault ssh certificate credentials ... This expands the wh_credential_dimension to include fields for the new vault ssh certificate credential library.	3 years ago
Timothy Messier	89a55632ba	feat(cli): Add vault ssh certificate credential library	3 years ago
Haotian	43f0ba89cf	feat(credentiallibraries): support vault ssh certificates	3 years ago
Danielle	3a78a74571	feat(vault): Support Issuing SSH Cert Credentials ... Allows the new credential library type to be pulled from the db and used for issuing ssh certificate type credentials. The ssh cert library interfaces with vault's ssh secrets engine to either issu certificates directly from vault, or to generate them within boundary and have vault sign them as a certificate authority for authentication. See: https://developer.hashicorp.com/vault/api-docs/secret/ssh#sign-ssh-key https://developer.hashicorp.com/vault/api-docs/secret/ssh#generate-certificate-and-key	3 years ago
Haotian	823b8cdfc6	feat(vault): Add CRUDL methods for ssh certificate cred library (#2765) ... This defines a new credential library type for ssh certificates. It adds new repository methods to support CRUDL of the new ssh certificate credential library. Co-authored-by: Timothy Messier <tim.messier@gmail.com>	3 years ago
Danielle	7833dd73c0	refact(vault): Create issuingCredentialLibrary Interface ... Allows for new issuing credential library implementations in the future. Moved db and decrypt logic to privateCredentialLibraryAllTypes from issueCredentialLibrary. This also removes sessionId from retrieveCredential, it was not needed and removing allows retrieveCredential to be reused for credentials issued outside current workflow.	3 years ago
Cameron Perera	f4951c385f	chore: bump ui commit to include vault ssh cert feature (#2883)	3 years ago
Todd	d8aea569c5	Only return live workers in ListHcpbWorkersResponse (#2876)	3 years ago
Irena Rindos	a030c15403	Support HCPBInt in hcpb_cluster_id field (#2880) ... * initial commit	3 years ago
Johan Brandhorst-Satzkorn	55259029f1	Add job run cleaner (#2866) ... * chore: remove duplicate import * feat: Add job run cleaner The new job cleans job runs older than a configured interval. Configure the job to clean jobs older than 1 minute.	3 years ago
Cameron Perera	bc332541c3	chore: bump ui commit for host set link fixes (#2875)	3 years ago
Cameron Perera	e64b8eaef1	chore: update UI commit to include onboarding updates (#2870)	3 years ago
Irena Rindos	ed9f2b2730	bug(workers): Check initial upstreams for an HCBP environment (#2869)	3 years ago
Jeff Malnick	a3c4cef648	Use primary auth method if no auth method ID is provided (#2725) ... * feat: default to using primary auth method with authenticating * Add ability to specify scope ID flag in authenticate method --------- Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>	3 years ago
Irena Rindos	2e3fd041ef	Target worker filters migration fix (#2859)	3 years ago
Jeff Mitchell	19180af0eb	Fix target port handling (#2846) ... * Fix target port handling This fixes two issues that compounded on each other (see the Changelog update for more information): * The verification logic for hosts was not correct for update operations (in multiple ways) which meant that a host could be updated after creation to have a port. Targets had a previously fixed bug where they did not require a default port, which meant that ports could be used from hosts * A recent (unreleased) change had prioritized any port coming from the host over the default port, which would mean there was no way if a host had a port specified to use it in multiple targets. This fixes the update verification logic, and strikes a middle ground between breaking things and not by allowing existing addresses with ports to be used with targets but ignoring that port, instead requiring targets to have default port set at authorize time (currently there is backwards compat that does not require this due to the original optional port bug). * Update CHANGELOG.md Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>	3 years ago
Cameron Perera	9f49d1a7f8	bump ui commit (#2841)	3 years ago
Irena Rindos	00a73f64d9	bug(sessions): Fix authorizeSession race conditions in handleProxy (#2795) ... * initial commit	3 years ago
Todd	d66b92abe0	Add directly connected downstream workers to the worker resource api (#2831)	3 years ago
Todd	87b09d5e27	Rename router to receiver for secondary connections (#2816)	3 years ago
Todd	b359561e51	Filter WorkerList by feature and go from version string to version.Info (#2807)	3 years ago
Hugo	0bee55aa19	fix(target): Correct accounting of updated rows when deleting address (#2799) ... If an update call was made to a target that removed an address, for a target that already did not have an address, the incorrect number of rows updated was being reported. During the update the target's version was correctly being updated, resulting in one row being updated. However then the delete call would result in zero rows being deleted, since there was no address associated with the target, and this would replace the value for the returned rowsUpdated. This resulted in the target service thinking that no update happened, and it would report an error.	3 years ago
Jim	e64163ad1d	fix (controller): prevent panic when controller stops when there's no listener (#2793)	3 years ago
Cameron Perera	4195821d29	bump ui commit to latest on main (#2798)	3 years ago
Todd	bc409bc7d4	Graceful shutdown blocks on running proxy handler connections (#2789)	3 years ago
Irena Rindos	e238893c21	Unset worker auth when Boundary dev uses a kms worker (#2786)	3 years ago
Timothy Messier	e2248c1360	fix(wh): Associate session fact with credential dimensions (#2787) ... The wh_upsert_credential_group function was incorrectly attempting to update the session connection fact table. There are a couple problems with this: 1. At the time that this runs, there would be no session connection facts for this session. 2. This function is meant to update the session fact table, there is a separate function that associates the credential group with the session connection facts. This also fixes another bug that was causing expired rows of the credential dimension to be included in the group membership. And finally it fixes a typo in the function name.	3 years ago