CyberCoveLLC/threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Dheath hashiconf assembly (#3818)

Browse Source 
* docs: Update ldap status

* docs: Add new `remote-command` option

* docs: Update terminology

* docs: Add health check metric

* docs: get rid of blank line

* docs: Add copy edits from review feedback

* docs: Update storage bucket credentials doc

* docs: Add new lines to make code blocks readable

* docs: Edits from code review

* docs: Clarify paragraph on credential rotation

* docs: Update field definition in domain model

* docs: Release notes 0.14.0

* docs: Update LDAP entry

* docs: Revise dynamic credential description

* docs: Add superscripts

* docs: Add worker health metric, reorder items

* docs: Fix typo

* Update website/content/docs/release-notes/v0_14_0.mdx

Co-authored-by: Adam Bouhmad <adbouhmad@gmail.com>

* docs: Updates from code review

* docs: Add default port deprecation

---------

Co-authored-by: Adam Bouhmad <adbouhmad@gmail.com>
This commit is contained in:
Dan HeathandAdam Bouhmad authored and GitHub committed 2023-10-11 11:32:44 -04:00
1 parent ae85c5d7ff
commit c979012638
11 files changed
+402 -32
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

website/content/docs/commands/connect/ssh.mdx
+4
View File
@@ -88,3 +88,7 @@ This command performs a target authorization or consumes an existing authorizati
- `username` `(string: "")` - The username you want to pass through to the
client.
You can also specify a username using the **BOUNDARY_CONNECT_USERNAME** environment variable.
- `remote-command` `(string: "")` - A command that you want to run on the remote host.
You can specify a complete command line, or you may include additional arguments.
If you include additional arguments, you must append them to the command and separate them using spaces.
website/content/docs/concepts/domain-model/accounts.mdx
+1 -1
View File
@@ -36,7 +36,7 @@ Password account types have the following additional attributes:
- `password` - (optional)
Not setting the `password` disables the account.
### LDAP account attributes <sup>Beta</sup>
### LDAP account attributes
LDAP account types have the following additional attributes:
website/content/docs/concepts/domain-model/auth-methods.mdx
+5 -5
View File
@@ -45,7 +45,7 @@ The OIDC auth method has the following additional attributes:
responses are allowed.
- `api_url_prefix` (required) The API prefix to use when generating callback URLs
for the provider. You should set the value to an address that allows the provider to reach
for the provider. You should set the value to an address that allows the provider to reach
the controller.
- `callback_url` (output read-only) The URL that should be provided to the IdP
@@ -58,7 +58,7 @@ The OIDC auth method has the following additional attributes:
use with the provider.
- `client-secret` (required) The corresponding client secret.
- `client_secret_hmac` (output read-only) The HMAC of the client secret that the Boundary controller
returns. It is used for comparison to the value's initial setting.
@@ -83,8 +83,8 @@ The OIDC auth method has the following additional attributes:
- `signing-algorithm` (required) The allowed signing algorithm. You can specify this attribute
multiple times for multiple values.
### LDAP auth method attributes <sup>Beta</sup>
### LDAP auth method attributes
The ldap auth method has the following additional attributes:
@@ -179,7 +179,7 @@ The ldap auth method has the following additional attributes:
- `maximum_page_size` - (optional) If set, it specifies a maximum ldap search
result size to use when retrieving the authenticated user's group
memberships. You can use this setting to avoid reaching the LDAP server's max result
size.
size.
- `dereference_aliases` - (optional) If set, it will control how aliases are
dereferenced when you search.
website/content/docs/concepts/domain-model/managed-groups.mdx
+1 -1
View File
@@ -41,7 +41,7 @@ OIDC managed groups have the following additional attributes:
[filtering concepts]: /boundary/docs/concepts/filtering
[oidc managed groups filtering]: /boundary/docs/concepts/filtering/oidc-managed-groups
### LDAP managed group information and attributes <sup>Beta</sup>
### LDAP managed group information and attributes
Membership in LDAP managed groups is evaluated when the auth method is used for
authentication, based on information contained within the LDAP server. Every
website/content/docs/concepts/domain-model/storage-buckets.mdx
+26 -7
View File
@@ -38,29 +38,48 @@ You must provide a name for the bucket in the external object store.
- `secrets` - (Optional) A collection of sensitive fields, like [credentials][], which the plugin uses to interface with the backing service.
These fields are write only.
### AWS S3 attributes and secrets
## AWS S3 attributes and secrets
At this time, the only supported storage for storage buckets is AWS S3.
In AWS S3, a storage bucket contains the bucket name, region, and optional prefix, as well as any credentials needed to access the bucket, such as the secret key.
#### Attributes
The AWS S3 storage bucket can use static or dynamic credentials.
You can configure static credentials using an access key and secret key or dynamic credentials using the AWS [`AssumeRole` API](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole).
### Attributes
AWS S3 buckets have the following attributes:
- `region` - (Required) The S3 region to configure the storage bucket in.
- `disable_credential_rotation` - (Optional) If set to `true`, credential rotation is not performed.
- `disable_credential_rotation` - (Optional for static credentials, Required for dynamic credentials) If set to `true`, credential rotation is not performed.
By default, the AWS plugin [rotates credentials](https://github.com/hashicorp/boundary-plugin-aws/blob/main/README.md#credential-rotation).
Note that this attribute is required, if you use dynamic credentials.
- `role_arn` - (Optional) The ARN (Amazon Resource Name) role that is attached to the EC2 instance that the self-managed worker runs on.
The Role ARN is required if the AWS S3 bucket is configured to use dynamic credentials using `AssumeRole`.
- `role_external_id` - (Optional) A required value if you delegate third party access to your AWS resources.
You can configure this value if your AWS S3 bucket is configured to use dynamic credentials.
For more information, refer to the AWS documentation for [How to use an external ID when granting access to your AWS resources to a third party](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html).
- `role_session_name`: (Optional) A unique identifier for the AWS session.
You can use this value to control how IAM principals and applications name their role sesions when they assume an IAM role.
By providing a session name, you enable tracking session actions in AWS CloudTrail logs.
You can configure this value if your AWS S3 bucket is configured to use dynamic credentials.
For more information, refer to the AWS documentation for [Logging IAM and AWS STS API calls with AWS CloudTrail](https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html).
- `role_tags`: (Optional) An object with key-value pair attributes that is passed when you assume an IAM role.
For more information, refer to the AWS documentation for [Passing session tags in AWS STS](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html).
#### Secrets
### Secrets
AWS S3 buckets have the following secrets:
AWS S3 buckets can have the following secrets:
- `access_key_id` - (Required) The access key ID for the IAM user to use with this storage bucket.
- `secret_access_key` - (Required) The secret access key for the IAM user to use with this storage bucket.
- `access_key_id` - (Optional) The access key ID for the IAM user to use with this storage bucket.
Access keys are required if the AWS S3 bucket is configured to use static credentials.
- `secret_access_key` - (Optional) The secret access key for the IAM user to use with this storage bucket.
Secret access keys are required if the AWS S3 bucket is configured to use static credentials.
## Referenced by
- [Session recordings](/boundary/docs/concepts/domain-model/session-recordings)
- [Create a storage bucket](/boundary/docs/configuration/session-recording/create-storage-bucket)
## Service API docs
website/content/docs/configuration/session-recording/create-storage-bucket.mdx
+104 -16
View File
@@ -30,7 +30,10 @@ At this time, the only supported storage is AWS S3.
- An AWS S3 storage bucket
You must associate the Boundary storage bucket with an AWS S3 storage bucket.
An AWS S3 storage bucket contains the bucket name, region, and optional prefix, as well as any credentials needed to access the bucket, such as the access and secret key.
An AWS S3 storage bucket contains the bucket name, region, and optional prefix, as well as any credentials needed to access the bucket.
The AWS S3 storage bucket can use static or dynamic credentials.
You can configure static credentials using an access key and secret key or dynamic credentials using the AWS [`AssumeRole` API](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole).
- An AWS IAM role policy with the following statement:
```json
{
@@ -139,23 +142,75 @@ Complete the following steps to create a storage bucket in Boundary for session
<Tabs>
<Tab heading="CLI">
The required fields for creating a storage bucket vary depending on whether you configured the AWS S3 bucket with static or dynamic credentials:
<Tabs>
<Tab heading="Static credentials">
1. Log in to Boundary.
1. Use the following command to create a storage bucket in Boundary:
```bash
boundary storage-buckets create -bucket-name mybucket1 -plugin-name aws -secrets ‘{“access_key_id”: “123456789” , “secret_access_key” : “123/456789/12345678”}’ -worker-filter ‘“dev” in “/tags/type”’ -attributes ‘{“region”:”us-east-1”,”disable_credential_rotation”:true}’ -scope-id o_1234567890
```
```shell-session
boundary storage-buckets create \
-bucket-name mybucket1 \
-plugin-name aws \
-secrets ‘{“access_key_id”: “123456789” , “secret_access_key” : “123/456789/12345678”}’ \
-worker-filter ‘“dev” in “/tags/type”’ \
-attributes ‘{“region”:”us-east-1”,”disable_credential_rotation”:true}’ \
-scope-id o_1234567890
```
Replace the values above with the following required AWS secrets and any optional [attributes](/boundary/docs/concepts/domain-model/storage-buckets) you want to associate with the Boundary storage bucket:
Replace the values above with the following required AWS secrets and any optional [attributes](/boundary/docs/concepts/domain-model/storage-buckets) you want to associate with the Boundary storage bucket:
- `region`: (Required) The AWS region to use.
- `bucket-name`: (Required) Name of the AWS bucket you want to associate with the Boundary storage bucket.
- `access_key_id`: (Required) The AWS access key to use.
- `secret_access_key_id`: (Required) The AWS secret access key to use.
- `region`: (Required) The AWS region to use.
- `bucket-name`: (Required) Name of the AWS bucket you want to associate with the Boundary storage bucket.
- `access_key_id`: (Required) The AWS access key to use.
- `secret_access_key_id`: (Required) The AWS secret access key to use.
This attribute contains the secret access key for static credentials.
- `worker-filter`: (Required) A filter that indicates which Boundary workers have access to the storage. The filter must match an existing worker in order to create a Boundary storage bucket.
- `shared_credentials_file`: (Optional) The shared credentials file to use.
- `shared_credentials_profile`: (Optional) The profile name to use in the shared credentials file.
- `worker-filter`: (Required) A filter that indicates which Boundary workers have access to the storage. The filter must match an existing worker in order to create a Boundary storage bucket.
- `shared_credentials_file`: (Optional) The shared credentials file to use.
- `shared_credentials_profile`: (Optional) The profile name to use in the shared credentials file.
- `disable_credential_rotation`: (Optional) Prevents the AWS plugin from automatically rotating credentials.
Although credentials are stored encrypted in Boundary, by default the [AWS plugin](https://github.com/hashicorp/boundary-plugin-aws) attempts to rotate the credentials you provide. The given credentials are used to create a new credential, and then the original credential is revoked. After rotation, only Boundary knows the client secret the plugin uses.
</Tab>
<Tab heading="Dynamic credentials">
1. Log in to Boundary.
1. Use the following command to create a storage bucket in Boundary:
```shell-session
boundary storage-buckets create \
-bucket-name mybucket1 \
-plugin-name aws \
-worker-filter ‘“dev” in “/tags/type”’ \
-attributes ‘{“region”:”us-east-1”,”disable_credential_rotation”:true,"role_arn":"arn:aws:iam::123456789012:role/S3Access"}’ \
-scope-id o_1234567890
```
Replace the values above with the following required AWS secrets and any optional [attributes](/boundary/docs/concepts/domain-model/storage-buckets) you want to associate with the Boundary storage bucket:
- `region`: (Required) The AWS region to use.
- `bucket-name`: (Required) Name of the AWS bucket you want to associate with the Boundary storage bucket.
- `role_arn`: (Required) The ARN (Amazon Resource Name) role that is attached to the EC2 instance that the self-managed worker runs on.
- `role_external_id`: (Optional) A required value if you delegate third party access to your AWS resources.
For more information, refer to the AWS documentation for [How to use an external ID when granting access to your AWS resources to a third party](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html).
- `role_session_name`: (Optional) A unique identifier for the AWS session.
You can use this value to control how IAM principals and applications name their role sesions when they assume an IAM role.
By providing a session name, you enable tracking session actions in AWS CloudTrail logs.
For more information, refer to the AWS documentation for [Logging IAM and AWS STS API calls with AWS CloudTrail](https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html).
- `role_tags`: (Optional) An object with key-value pair attributes that is passed when you assume an IAM role.
For more information, refer to the AWS documentation for [Passing session tags in AWS STS](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html).
- `worker-filter`: (Required) A filter that indicates which Boundary workers have access to the storage. The filter must match an existing worker in order to create a Boundary storage bucket.
- `shared_credentials_file`: (Optional) The shared credentials file to use.
- `shared_credentials_profile`: (Optional) The profile name to use in the shared credentials file.
- `disable_credential_rotation`: (Required) Prevents the AWS plugin from automatically rotating credentials.
This option must be set to `true` if you use dynamic credentials.
</Tab>
</Tabs>
</Tab>
@@ -172,12 +227,42 @@ Complete the following steps to create a storage bucket in Boundary for session
- **Bucket name**: (Required) Name of the AWS bucket you want to associate with the Boundary storage bucket.
- **Bucket prefix**: (Optional) A base path where session recordings are stored.
- **Region**: (Required) The AWS region to use.
- **Credential type**: (Required) The type of credential you want to use to authenticate to the external storage.
The required fields for creating a storage bucket vary depending on whether you configured the AWS S3 bucket with static or dynamic credentials:
- **Static**: Authenticates to the storage bucket using an access key that AWS generates.
- **Dynamic**: Authenticates to the storage bucket using credentials that were generated by AWS `AssumeRole`.
<Tabs>
<Tab heading="Static credentials">
- **Access key ID**: (Required) The access key ID that AWS generates for the IAM user to use with the storage bucket.
- **Secret access key**: (Required) The secret access key that AWS generates for the IAM user to use with this storage bucket.
- **Worker filter** (Required) A filter that indicates which Boundary workers have access to the storage. The filter must match an existing worker in order to create a Boundary storage bucket.
- **Disable credential rotation** (Optional) Although credentials are stored encrypted within Boundary, by default the [AWS plugin](https://github.com/hashicorp/boundary-plugin-aws) attempts to rotate the credentials you provide. The given credentials are used to create a new credential, and then the original credential is revoked. After rotation, only Boundary knows the client secret the plugin uses.
- **Worker filter**: (Required) A filter that indicates which Boundary workers have access to the storage. The filter must match an existing worker in order to create a Boundary storage bucket.
- **Disable credential rotation**: (Optional) Prevents the AWS plugin from automatically rotating credentials.
Select this option to disable this behavior and prevent the automatic rotation of credentials.
Although credentials are stored encrypted in Boundary, by default the [AWS plugin](https://github.com/hashicorp/boundary-plugin-aws) attempts to rotate the credentials you provide.
The given credentials are used to create a new credential, and then the original credential is revoked.
After rotation, only Boundary knows the client secret the plugin uses.
</Tab>
<Tab heading="Dynamic credentials">
- **Role ARN**: (Required) The ARN (Amazon Resource Name) role that is attached to the EC2 instance that the self-managed worker runs on.
- **Role external ID**: (Optional) A required value if you delegate third party access to your AWS resources.
For more information, refer to the AWS documentation for [How to use an external ID when granting access to your AWS resources to a third party](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html).
- **Role session name**: (Optional) A unique identifier for the AWS session.
You can use this value to control how IAM principals and applications name their role sesions when they assume an IAM role.
By providing a session name, you enable tracking session actions in AWS CloudTrail logs.
For more information, refer to the AWS documentation for [Logging IAM and AWS STS API calls with AWS CloudTrail](https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html).
- **Role tags**: An object with key-value pair attributes that is passed when you assume an IAM role.
For more information, refer to the AWS documentation for [Passing session tags in AWS STS](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html).
- **Worker filter**: (Required) A filter that indicates which Boundary workers have access to the storage. The filter must match an existing worker in order to create a Boundary storage bucket.
- **Disable credential rotation**: (Required) Prevents the AWS plugin from automatically rotating credentials.
This option is required if you use dynamic credentials.
</Tab>
</Tabs>
1. Select **Save**.
@@ -185,4 +270,7 @@ Complete the following steps to create a storage bucket in Boundary for session
</Tabs>
Boundary creates the storage bucket resource and provides you with the bucket's ID.
Once the storage bucket is created in Boundary, you can use the bucket's ID to [enable session recording on targets](/boundary/docs/configuration/session-recording/enable-session-recording).
## Next steps
After the storage bucket is created in Boundary, you can use the bucket's ID to [enable session recording on targets](/boundary/docs/configuration/session-recording/enable-session-recording).
website/content/docs/operations/health.mdx
+33 -1
View File
@@ -45,7 +45,7 @@ a string that is parseable by
## API
The new controller health service introduces a single read-only endpoint:
The controller health service introduces a single read-only endpoint:
| Status | Description |
|--------------|----------------------------------------------------------------|
@@ -55,6 +55,38 @@ The new controller health service introduces a single read-only endpoint:
All responses return empty bodies. `GET /health` does not support any input.
## Example response
When you check the health endpoint, Boundary returns a response with the following worker information:
```json
❯ curl "worker:9403/health?worker_info=1"
{
"worker_process_info":{
"state":"active",
"active_session_count":0,
"upstream_connection_state":"READY"
}
}
```
The response contains the following fields:
- `state` - The operational state of the worker.
Possible worker states include active, shutdown, and unknown.
- `active_session_count` - The number of active sessions on the worker.
- `upstream_connection_state` - The connection state of the worker.
This value indicates whether the worker can connect to an upstream address or connection.
It can be any of the following states:
- `CONNECTING` - The channel is trying to make a connection and is waiting for name resolution or the connection establishment.
- `READY` - The channel has successfully established a connection, and any attempts to communicate have succeeded.
- `TRANSIENT_FAILURE` - The channel suffered a transient failure such as a time out or socket error.
A channel in this state will switch to the `CONNECTING` state and try to establish a connection.
- `IDLE` - The channel is not attempting to create a connection because there are no calls.
- `SHUTDOWN` - The channel is shutting down.
Any new calls fail immediately.
Pending calls may continue running until Boundary cancels them.
## Example configuration
Health checks are available for a controller defined with a `purpose = "ops"`
website/content/docs/release-notes/v0_14_0.mdx
+203
View File
@@ -0,0 +1,203 @@
---
layout: docs
page_title: v0.14.0
description: |-
Boundary release notes for v0.14.0
---
# Boundary 0.14.0 release notes
**GA date:** October 11, 2023
@include 'release-notes/intro.mdx'
## New features
<table>
<thead>
<tr>
<th style={{verticalAlign: 'middle'}}>Feature</th>
<th style={{verticalAlign: 'middle'}}>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td style={{verticalAlign: 'middle'}}>
Boundary Desktop embedded terminal
</td>
<td style={{verticalAlign: 'middle'}}>
An embedded terminal has been added to the Boundary Desktop client for convenience. Now you can use the CLI directly from within Boundary Desktop.
<br /><br />
Learn more:&nbsp;
<a href="/boundary/tutorials/oss-getting-started/oss-getting-started-desktop-app">Install Boundary Desktop tutorial</a>
</td>
</tr>
<tr>
<td style={{verticalAlign: 'middle'}}>
LDAP authorization method
</td>
<td style={{verticalAlign: 'middle'}}>
The LDAP auth method is no longer in beta, it is now fully supported. Administrators can now create, manage, and delete LDAP auth methods along with managed groups and accounts using the admin console UI.
<br /><br />
Learn more:&nbsp;
<a href="/boundary/docs/concepts/domain-model/auth-methods">Auth methods</a>
</td>
</tr>
<tr>
<td style={{verticalAlign: 'middle'}}>
Dynamic credential support for storage buckets <sup>HCP/ENT</sup>
</td>
<td style={{verticalAlign: 'middle'}}>
You can now configure dynamic credentials for AWS S3 storage buckets using the Amazon Web Services (AWS) <code>AssumeRole</code> API. We recommend that you configure credentials using <code>AssumeRole</code> instead of access keys when possible.
<br /><br />
Learn more:&nbsp;
<a href="/boundary/docs/configuration/session-recording/create-storage-bucket">Create a storage bucket</a>
</td>
</tr>
<tr>
<td style={{verticalAlign: 'middle'}}>
Remote pass-through commands for SSH
</td>
<td style={{verticalAlign: 'middle'}}>
A new SSH flag, <code>remote-command</code> was introduced to the <a href="/boundary/docs/commands/connect/ssh">boundary connect ssh helper</a>. It lets you run the specified commands on the remote-machine using pass-through arguments.
<br /><br />
Learn more:&nbsp;
<a href="/boundary/docs/commands/connect/ssh">connect ssh command</a>
</td>
</tr>
<tr>
<td style={{verticalAlign: 'middle'}}>
New worker health metric
</td>
<td style={{verticalAlign: 'middle'}}>
A new metric was added to the health endpoint to check the connection state of the worker and whether it can connect to an upstream controller. The result is automatically included in the response when you run the health endpoint.
<br /><br />
Learn more:&nbsp;
<a href="/boundary/docs/operations/health">Boundary health endpoints</a>
</td>
</tr>
<tr>
<td style={{verticalAlign: 'middle'}}>
Improved telemetry
</td>
<td style={{verticalAlign: 'middle'}}>
Improved telemetry was added to Boundary. You can enable telemetry to gather information about your Boundary cluster.
<br /><br />
Learn more:&nbsp;
<a href="/boundary/docs/configuration/events">events stanza</a>
</td>
</tr>
</tbody>
</table>
## Known issues and breaking changes
<table>
<thead>
<tr>
<th style={{verticalAlign: 'middle'}}>Version</th>
<th style={{verticalAlign: 'middle'}}>Issue</th>
<th style={{verticalAligh: 'middle'}}>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td style={{verticalAlign: 'middle'}}>
0.13.0+
</td>
<td style={{verticalAlign: 'middle'}}>
Rotation of AWS access and secret keys during a session results in stale recordings
</td>
<td style={{verticalAlign: 'middle'}}>
In Boundary version 0.13.0+, when you rotate a storage bucket's secrets, any new sessions use the new credentials. However, previously established sessions continue to use the old credentials.
<br /><br />
As a best practice, administrators should rotate credentials in a phased manner, ensuring that all previously established sessions are completed before revoking the stale credentials.
Otherwise, you may end up with recordings that aren't stored in the remote storage bucket, and are unable to be played back.
</td>
</tr>
<tr>
<td style={{verticalAlign: 'middle'}}>
0.13.0+
</td>
<td style={{verticalAlign: 'middle'}}>
Unsupported recovery workflow during worker failure
</td>
<td style={{verticalAlign: 'middle'}}>
If a worker fails during a recording, there is no way to recover the recording. This could happen due to a network connectivity issue or because a worker is scaled down, for example.
<br /><br />
Learn more:&nbsp;
<a href="/boundary/docs/troubleshoot/troubleshoot-recorded-sessions#unsupported-recovery-workflow">Unsupported recovery workflow</a>
</td>
</tr>
</tbody>
</table>
## Feature deprecations and EOL
<table>
<thead>
<tr>
<th style={{verticalAlign: 'middle'}}>EOL</th>
<th style={{verticalAlign: 'middle'}}>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td style={{verticalAlign: 'middle'}}>
<code>vault</code> credential library subtype
</td>
<td style={{verticalAlign: 'middle'}}>
As noted in the <a href="/boundary/docs/release-notes/v0_12_0#deprecations-and-changes">v0.12.0 release notes</a>, the <code>vault</code> credential library subtype was renamed to <code>vault-generic</code>. The <code>vault</code> subtype is removed in this release, you must use <code>vault-generic</code> now.
<br /><br />
Learn more:&nbsp;
<a href="/boundary/docs/concepts/domain-model/credential-libraries">Credential libraries</a>
</td>
</tr>
<tr>
<td style={{verticalAlign: 'middle'}}>
<code>status</code> field
</td>
<td style={{verticalAlign: 'middle'}}>
As noted in the <a href="https://github.com/hashicorp/boundary/blob/main/CHANGELOG.md#deprecationschanges-3">v0.12.0 changelog</a>, using the <code>-format=json</code> option with the CLI produced inconsistent results. The <code>status</code> field is removed in this release. The <code>status_code</code> field is now used for both successful requests and errors.
</td>
</tr>
<tr>
<td style={{verticalAlign: 'middle'}}>
Default port value
</td>
<td style={{verticalAlign: 'middle'}}>
As noted in the <a href="/boundary/docs/release-notes/v0_12_0#deprecations-and-changes">v0.12.0 release notes</a>, targets now require a default port value. Previously, any ports that you defined as part of a host address were ignored, but allowed as part of the target definition. From this version on, if you define a port on a host address it results in an error.
<br /><br />
Learn more:&nbsp;
<a href="/boundary/docs/concepts/domain-model/targets">Targets</a>
</td>
</tr>
<tr>
<td style={{verticalAlign: 'middle'}}>
Application credentials parameter
</td>
<td style={{verticalAlign: 'middle'}}>
As noted in the <a href="https://github.com/hashicorp/boundary/blob/main/CHANGELOG.md#deprecationschanges-6">v0.10.0 changelog</a>, the <code>target</code> subcommands for application credentials were renamed to brokered credentials. The application credentials subcommands are removed in this release. You must use the brokered credential subcommands instead.
<br /><br />
Learn more:&nbsp;
<a href="/boundary/docs/commands/targets">targets</a>
</td>
</tr>
</tbody>
</table>
website/content/docs/troubleshoot/troubleshoot-recorded-sessions.mdx
+17 -1
View File
@@ -11,7 +11,7 @@ Refer to the following for information about how to troubleshoot recorded sessio
## Known bugs
**Rotation of AWS access and secret keys during a session results in stale recordings**
**Rotation of AWS access and secret keys during a session results in stale recordings:**
In Boundary version 0.13.0, when you rotate a storage bucket's secrets, any new sessions use the new credentials.
However, previously established sessions continue to use the old credentials.
@@ -19,6 +19,22 @@ However, previously established sessions continue to use the old credentials.
As a best practice, administrators should rotate credentials in a phased manner, ensuring that all previously established sessions are completed before revoking the stale credentials.
Otherwise, you may end up with recordings that aren't stored in the remote storage bucket and are unable to be played back.
<a id="unsupported-recovery-workflow"></a>
**Unsupported recovery workflow during worker failure:**
If a worker fails during a recording, there is no way to recover the recording.
This could happen due to a network connectivity issue or because a worker is scaled down, for example.
There are a number of currently unsupported failure cases, including when the worker:
- Crashes and restarts while servicing connections and channels for session to an SSH target
- Crashes and restarts while closing a channel, before all files are synced to remote storage
- Crashes and restarts while closing a connection recorder, before all files are synced to remote storage
- Crashes and restarts while closing a session recorder, before all files are synced to remote storage
- Crashes and never restarts or is seen again while closing a channel/connection recorer/session recorder
- Loses its connection to the controller and cancels sessions, it must resend the information when com
## Tips
When you create or update a storage bucket, the actions `GetBucketAcl` and `GetEncryptionConfiguration` can be helpful in debugging access issues.
website/content/partials/release-notes/intro.mdx
+4
View File
@@ -0,0 +1,4 @@
Release notes provide an at-a-glance summary of key updates to new versions of Boundary.
For a comprehensive list of product updates, improvements, and bug fixes refer to the [changelog](https://github.com/hashicorp/boundary/blob/main/CHANGELOG.md) included with the Boundary code on GitHub.
We encourage you to [upgrade to the latest release of Boundary](/boundary/tutorials/self-managed-deployment/upgrade-version) to take advantage of continuing improvements, critical fixes, and new features.
website/data/docs-nav-data.json
+4
View File
@@ -1414,6 +1414,10 @@
"title": "Overview",
"path": "release-notes"
},
{
"title": "v0.14.0",
"path": "release-notes/v0_14_0"
},
{
"title": "v0.13.0",
"path": "release-notes/v0_13_0"