Don't error worker filters if a key isn't found, treat it as a non-match (#900)

CHANGELOG.md

@@ -6,6 +6,11 @@ Canonical reference for changes, improvements, and bugfixes for Boundary.
 
 ### Changes/Deprecations
 
+* authentication: The `auth-methods/<id>:authenticate` action is deprecated and
+  will be removed in a few releases. Instead, each auth method will define its
+  own action or actions that are valid. This is necessary to support multi-step
+  authentication schemes in upcoming releases. For the `password` auth method,
+  the new action is `auth-methods/<id>:authenticate:login`.
 * permissions: Update some errors to make them more descriptive, and disallow
   permissions in some forms where they will never take effect, preventing
   possible confusion (existing grants already saved to the database will not be
@@ -16,11 +21,6 @@ Canonical reference for changes, improvements, and bugfixes for Boundary.
   * `type=<some_type>;actions=<some_actions>` where one of the actions is _not_
     `create` or `list`. This format operates only on collections so assigning
     more actions this way will never work
-* authentication: The `auth-methods/<id>:authenticate` action is deprecated and
-  will be removed in a few releases. Instead, each auth method will define its
-  own action or actions that are valid. This is necessary to support multi-step
-  authentication schemes in upcoming releases. For the `password` auth method,
-  the new action is `auth-methods/<id>:authenticate:login`.
 
 ### New and Improved
 
@@ -38,6 +38,9 @@ Canonical reference for changes, improvements, and bugfixes for Boundary.
 * server: When shutting down a controller release the shared advisory lock with a non cancelled context.
   ([Issue](https://github.com/hashicorp/boundary/pull/909),
   [PR](https://github.com/hashicorp/boundary/pull/918))
+* targets: If a worker filter references a key that doesn't exist, treat it as a
+  non-match rather than an error
+  ([PR](https://github.com/hashicorp/boundary/pull/900))
   
 ## 0.1.5 (2021/01/29)
 

go.mod

@@ -45,6 +45,7 @@ require (
 	github.com/mitchellh/go-wordwrap v1.0.1
 	github.com/mitchellh/gox v1.0.1
 	github.com/mitchellh/mapstructure v1.4.1
+	github.com/mitchellh/pointerstructure v1.1.1
 	github.com/mr-tron/base58 v1.2.0
 	github.com/oligot/go-mod-upgrade v0.3.0
 	github.com/ory/dockertest/v3 v3.6.0

internal/servers/controller/handlers/targets/target_service.go

@@ -30,6 +30,7 @@ import (
 	"github.com/hashicorp/boundary/internal/types/scope"
 	"github.com/hashicorp/boundary/sdk/strutil"
 	"github.com/hashicorp/go-bexpr"
+	"github.com/mitchellh/pointerstructure"
 	"github.com/mr-tron/base58"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/protobuf/proto"
@@ -498,7 +499,7 @@ HostSetIterationLoop:
 				"tags": tagMap[worker],
 			}
 			ok, err := eval.Evaluate(filterInput)
-			if err != nil {
+			if err != nil && !stderrors.Is(err, pointerstructure.ErrNotFound) {
 				return nil, handlers.ApiErrorWithCodeAndMessage(
 					codes.FailedPrecondition,
 					fmt.Sprintf("Worker filter expression evaluation resulted in error: %s", err))

internal/tests/cluster/worker_tagging_test.go

@@ -56,6 +56,7 @@ func TestWorkerTagging(t *testing.T) {
 	conf.Worker.Name = "w1"
 	conf.Worker.Tags = map[string][]string{
 		"region": {"east"},
+		"foo":    {"bar"},
 	}
 	w1 := worker.NewTestWorker(t, &worker.TestWorkerOpts{
 		Config:             conf,
@@ -122,6 +123,11 @@ func TestWorkerTagging(t *testing.T) {
 			filter:     `"/name" matches "w[23]" and "three" in "/tags/az"`,
 			expWorkers: []string{w2Addr, w3Addr},
 		},
+		{
+			name:       "key not found doesn't error",
+			filter:     `"bar" in "/tags/foo"`,
+			expWorkers: []string{w1Addr},
+		},
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {

website/content/docs/concepts/filtering/worker-tags.mdx

@@ -74,6 +74,13 @@ nested under `tags` and include a `name` value:
 }
 ```
 
+!> If an expression fails due to a key not being found within the input data,
+the worker is not included in the final set, so ensure that all workers that
+should match a given filter are populated with tags referenced in the filter
+string. As a corollary, it is not possible to distinguish between a worker that
+is not included due to the expression itself and a worker that did not have
+correct tags.
+
 Following are some examples of using these values in filters:
 
 - Name regex: `"/name" matches "web-prod-us-east-[12]"`, which would
@@ -83,5 +90,4 @@ Following are some examples of using these values in filters:
   values, so it must use the `in` operator to search in the collection. If you
   know that you have only one value, an equivalent would be `"/tags/region/0" == "us-east-1"`.
 
-- Grouping: `("us-east-1" in "/tags/region" and "/name" == "web-prod-us-east-1")
-or "webservers" in "/tags/type"`
+- Grouping: `("us-east-1" in "/tags/region" and "/name" == "web-prod-us-east-1") or "webservers" in "/tags/type"`