2535 Commits (api/v0.0.50)

Author	SHA1	Message	Date
Todd	e0a7c9acdd	Document the deprecation of include_terminated (#4602) ... * Document the deprecation of include_terminated * Update the changelog	2 years ago
Sepehr	1f48ba5d1a	Telemetry: storage bucket proto (#4824) ... * oss:feat(storage): add observation tag in proto for telemetry * oss:feat(storage): add observation tag in proto service * oss:feat(storage): generate proto files with changes * oss:feat(storage): add storage bucket id to target proto	2 years ago
Uruemu S Aganbi	1aa8c2e1d7	Add observation tags for Session Recording Service (#4825) ... * Add observation tags to session_recording.proto * remove scope_info observation tags * Remove quotes and add tag to storage_bucket_id * Add tags for session recording service * Update proto definitions - Remove gotags on messages - Remove quotes	2 years ago
Johan Brandhorst-Satzkorn	ec289420d3	clientagentcmd: use "localhost" to call client agent (#4816) ... The client agent serves on "localhost:9300" by default. It appears on some systems this resolves to ::1:9300 and on some systems 127.0.0.1:9300. We should use the same address on the client as the server to avoid any incompatibilities between systems.	2 years ago
Johan Brandhorst-Satzkorn	a1391db090	internal/cmd: rename ferry files to client_agent (#4815) ... This was missed in the big rename PR	2 years ago
Johan Brandhorst-Satzkorn	e64443c66f	Rename daemon CLI command to cache (#4808) ... * internal/cmd/wrapper: add deprecation wrapper The deprecation wrapper can be used to display a warning to callers when a command is deprecated. * all: rename daemon to cache Rename the boundary daemon command to boundary cache. This avoids confusion with future client/daemons. * changes daemon to cache in nav --------- Co-authored-by: Robin Beck <stellarsquall@protonmail.ch>	2 years ago
Todd	6936a5448c	update status cli to optionally return some fields (#4810)	2 years ago
Johan Brandhorst-Satzkorn	8ff18f6c3c	internal/cmd: rename ferry to client-agent ... Renames the ferry command and related flags and env vars to client-agent following the new naming decision.	2 years ago
Hugo	9b44974524	docs: Add CHANGELOG entry	2 years ago
Hugo	2983f80eaa	fix(cmd): Support account attribute maps	2 years ago
Hugo	61e2056ef4	fix(auth/ldap): Take user attrs into account when authenticating	2 years ago
Timothy Messier	a2c529b9d1	fix(controller): Use max request duration cluster listener (#4805) ... The cluster listener supports a `max_request_duration` option, and defaults to 90 seconds. However, this configuration was not being use when processing grpc requests from the listener. This meant that requests from worker to controller could hang indefinitely and contributed to the recently fixed issue with database connections being stuck in `idle in transaction`. This commit adds a grpc interceptor that ensures each request has a deadline set to the max request duration for the listener. Refs: 29cd7bc9d6	2 years ago
Timothy Messier	29cd7bc9d6	fix(session): Move encryption/decryption out of database transactions (#4803) ... Several session.Repository methods need to encrypt or decrypt fields when persisting or retrieving a Session. These encrypt/decrypt operations where being performed while within a database transaction. The first step in the encrypt/decrypt operation is to retrieve the kms.Wrapper. While the wrappers get cached in memory, the retrieval still results in a database query to check that the kms collection version has not changed. This query happens with a separate db.Reader, and therefore uses a separate database connection from the transaction being used by the session.Repository. If the controllers are configured with a relatively low `max_open_connections`, and be under sufficient load interactive with sessions, the controller can consume all of the available database connections, and get stuck with open transactions while waiting for a database connection to execute the kms related queries. This can be see by checking pg_stat_activity and seeing transactions stuck in `idle in transaction` with a wait_event of ClientRead. This commit changes all of the Repository methods the perform any encryption or decryption operations, including the retrieval of the kms.Wrapper, outside of a database transaction. An alternative approach would be to unsure that the kms.Wrapper retrieval happens within the same database transaction. However, it seems preferable to avoid doing these relatively expensive operations within a transaction when it is not necessary. As part of this fix, it also eliminates some logic that is no longer needed. During previous would with KMS wrapping, the method of how sessions were encrypted was changed, and some logic to lazily re-encrypt sessions was introduced. However, given that terminated sessions are deleted, and the KMS changes was introduced several versions ago (0.13.0), this lazy re-encrypt logic should no longer be necessary. Refs: edd323b73a See: https://www.postgresql.org/docs/current/monitoring-stats.html#MONITORING-PG-STAT-ACTIVITY-VIEW https://www.postgresql.org/docs/current/runtime-config-client.html#GUC-IDLE-IN-TRANSACTION-SESSION-TIMEOUT https://developer.hashicorp.com/boundary/docs/configuration/controller#max_open_connections	2 years ago
Johan Brandhorst-Satzkorn	111b8fbecf	internal/cmd/ferry: add sessions command (#4800)	2 years ago
Todd	5a06e4fe66	Auto generate the permissions pages. (#4786) ... * Auto generate the permissions pages. * Add add- set- remove- auto descriptions. Hide scope line when no scope provided * Document the resource info struct	2 years ago
Todd	c3f9fde5d7	Wait to select tokens until we know we need to (#4794) ... AuthToken selection involves checking to seeing if the one we are picking has been canceled or expired on the boundary controller. If we are only searching locally and not performing a refresh, there is no need to check if the tokens have expired or not.	2 years ago
Irena Rindos	6f09819e9f	chore: fix workers tag cmd help strings (#4780)	2 years ago
Irena Rindos	325949c23a	chore: removed commented out time.sleep calls (#4770)	2 years ago
Michael Milton	f7e59d5d04	Add hidden ferry pause and resume commands (#4771) ... * Add hidden ferry pause and resume functions * add check for 200 status * include pause/resume status in ferry status, fix output * put error string back to previous state	2 years ago
Irena Rindos	52f53a149c	bug: test fails on end of month (#4748)	2 years ago
Kerim Satirli	e54519975b	adds missing space in mlock warning (#4286)	2 years ago
Stan Ryzhov	99f7e470f2	test(bats): Verify alias can be created with host id	2 years ago
Stan Ryzhov	60706a49e5	test(bats): Verify invalid inputs for aliases	2 years ago
Cameron Perera	e0306293be	chore: bump ui commit to dd92321 (#4745)	2 years ago
Lisbet Alvarez	5876b29758	bump ui commit (#4740)	2 years ago
Todd	3cae272c27	Hide ferry specific flags (#4737)	2 years ago
Zhihe Li	3b66f0651c	chore: bump ui commit (#4734)	2 years ago
Irena Rindos	16d23fa55f	bug(scopes): scopes list returns 500 without perms (#4731)	2 years ago
Todd	7ccc099807	Use the default retry limit across client cache (#4727)	2 years ago
Cameron Perera	e792dd0ea5	chore: bump ui commit to dccf06c (#4724)	2 years ago
Cameron Perera	7018234724	chore: bump ui commit to 5ae490c (#4713)	2 years ago
Lisbet Alvarez	a73076d666	bump ui commit to a6bdc4f (#4707)	2 years ago
Cameron Perera	4b48943c12	chore: bump ui commit to 3e9a06a (#4702)	2 years ago
Timothy Messier	7c14aeaf41	fix(session): Use active transaction (#4592) ... When closing orphaned connections and checking if a session is not active, the repository was opening a transaction, but then calling the original reader instead of using the reader/writer from the transaction. This would result in a transaction being opend, then a separate transaction being used to run the query, and finally the original transaction would commit without any statements being executed. Co-authored-by: Sorawis Nilparuk (Bo) <sorawis.nilparuk@hashicorp.com>	2 years ago
Sorawis Nilparuk (Bo)	8f457c9c93	make newSendCtx also handle context.DeadlineExceeded (#4603) ... * make newSendCtx also handle context.DeadlineExceeded * add assertion to check that context is valid	2 years ago
Todd	7df9144fbf	Fix typos in request validation errors for aliases (#4671) ... * Fix typos in request validation errors for aliases * Add format validation for destination id field.	2 years ago
Michael Li	ca1196cdc9	test(worker): Address flake in TestMonitorUpstreamConnectionState (#4668) ... * test(worker): Address flake * test(worker): refactor `TestMonitorUpstreamConnectionState` tests * test(worker): remove assertion for grpc shutdown state --------- Co-authored-by: Elim Tsiagbey <elim.tsiagbey@hashicorp.com>	2 years ago
Carlos Alcaide Corvo	db2a4d9015	Bump UI version (#4664)	2 years ago
Todd	55cf055285	Fix build and test breakage. (#4659)	2 years ago
Cameron Perera	15737b0ca8	chore: bump ui commit to f9cd1c3 (#4658)	2 years ago
Todd	adea8e0f14	Change aliases to resolvable aliases in client cache (#4656)	2 years ago
Irena Rindos	0160258bb5	bug: fix data race in hclogger (#4645) ... * bug: fix data race in hclogger	2 years ago
Todd	608b6bb2b7	Add ListResolvableAliases SDK changes (#4653) ... * Add API changs for list resolvable aliases	2 years ago
Todd	0d67b86543	Add ListResolvableAliases to the user service (#4609) ... * Add ListResolvableAliases to the user service There are a few non common ways this method uses our ACL and grant system. A user is able to list resolvable aliases for another user if they are granted permission to do so. That means we had to load the grants for the user being listed for and not the requester when determining if an alias is able to resolve to a destination for which the requested user has permission. Similarly, the grant hash used for the list pagination is required to be that of the user being listed and not the requester.	2 years ago
Carlos Alcaide Corvo	267b8ab972	Bump UI version to include MinIO support (#4650)	2 years ago
Cameron Perera	87b0866d8f	chore: bump ui commit to 98c16ad (#4647)	2 years ago
Cameron Perera	200524126d	chore: bump ui commit to 80b633a (#4642)	2 years ago
dani	1a77e4da86	Boundary Plugin MinIO (#4621) ... feat(storage): Add storage support for MinIO via new built-in plugin	2 years ago
Louis Ruch	2e6edb843d	feat(vault): Add headers to client interface	2 years ago
Louis Ruch	0cfca44cf5	fix(vault): Fixes credential_vault_credential_private view ... The worker_filter column was dropped from the credential_vault_credential_private view in the 56/02_add_data_key_foreign_key_references.up.sql migration. Any credential renewal/revocations that relied on the worker filter would not successfully renew.	2 years ago