* Add support for ssh_private_key credential type in Vault libraries
* Add support for ssh_private_key credential type
* Support jsonpointer for Vault library mapping overrides
* (refactor) change all sql references of user_password to username_password
* refactor(pkg) renamed pkg userpassword to usernamepassword
* refactor(proto) updated protocol buffers to use UsernamePassword
* refactor(code) updated references from UserPassword to UsernamePassword in golang files
* refactor(test) updated unit tests to reference UsernamePassword changes
* refactor(ddtest) updated references in dbtests to use UsernamePassword
* chore(sql-test) fixed spelling issue
* chore(sql) added and updated comments in migartion & tables. fixed indentations
* chore(proto) updated comments to reflect username_password changes
* refactor(tests) updated unit tests to replace user-password with username-password
* refactor(cmd) updated cmd help text to use username
* chore(tests) update test name & comments
* fix(cmd) fixed cmd usage definition for credentials update
* refactor(tests) removed out of scope changes
* fix(sql) incremented sql migration id & updated migration comments
* fix (worker): send workerId when authorizing session
Send the workerId returned from the last success worker status
when authorizing a session.
* fixup! fix (worker): send workerId when authorizing session
* fixup! fix (worker): send workerId when authorizing session
* refactor (worker): deprecate workerId in ActivateSessionRequest
It wasn't being used anywho
* fixup! fix (worker): send workerId when authorizing session
* Update LookupSessionRequest
Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
* Discontinue support for old Server message in ServerCoordinationService. Split message into ServerWorkerStatus and UpstreamServer (which currently contains controller addresses). Remove unnecessary fields. Modify workerStatusServer to use new fields.
Co-authored-by: Todd <github@quaddi.com>
* Install buf with go install
This reduces the impact of using buf on our dependency
closure, which was significant. It also avoids potential
issues with building buf given our own internal dependency
constraints. This has caused issues (including crashes!)
in the past.
See https://github.com/cockroachdb/cockroach/issues/67216#issuecomment-874176186
for more discussion on using tool dependencies generally, and
https://github.com/bufbuild/buf/issues/52
for an example of where this sort of thing caused an issue for a user.
* Upgrade buf version
We should migrate to v1 sooner rather than later, as it has some
breaking changes from v0.
* Change buf lint/breaking commands
These commands were moved up one level for v1
* Migrate to buf.yaml to v1
* Remove unused imports
These were uncovered by using "buf lint".
* Use buf v1.3.1
* Depend on googleapis and grpc-gateway via BSR
* Switch to buf for proto generation
* Remove third party dependency
* Remove unused tools and scripts
* Move local protos up one level
* Temporarily don't fail on breaking changes
* Generate CI config
* Fix generation of controller.json
* Replace use of deprecated flag
* Remove unused import, regenerate files
* Remove temporary skipping over breaking check
Egress credentials Issued during AuthorizeSession are stored in the
session repo. These credentials are retrieved and stored in-memory on the
worker during the LookupSession call. Each proxy handler will need to
handle the credentials as required.
This moves the generated pb files to the `sdk` module. This allows third parties to make use of them if desired (e.g. in upcoming plugins) and moves away from the `gen` nomenclature in the directory, since we are going to be adding some extra interface functions to the messages.
* refactor(worker): Move tcp_proxy into its own package
This refactors:
- the tcp_proxy.go into worker/proxy/tcp
- add a missing unit test for the HandleTcpProxyV1
- refactors session.go into worker/session, needed to avoid import cycle
- adds a baseline for a mock controller session client
- go lint fixes
* Add sleep between spinning listener goroutine and dialing
Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
* Attempt canceling sessions by the client
In some circumstances (like a Ctrl-C), the client knows it's shutting
down and the TOFU token will be lost. In this case it makes sense to
cancel the session rather than have it time out. This introduces a
command enum to the handshake message which can be used for the client
to send commands to the worker -- in this case the only specified
command is to cancel the session. It doesn't occur if the session is
already timed out or if we can't authorize connections as this generally
means the session is already invalid.
* Update deps
This also updates for the new (and required) paradigm for registering
service implementations as spelled out in
https://github.com/grpc/grpc-go/issues/3385
* Roll back dockertest
It's up to the worker to understand what a change in state means, so
there was no functional difference between simply sending a state change
request and a cancel request.
* Possible api changes.
* Worker API update.
* Updating import alias name.
* Moving session down a level as a member of the GetSessionResponse.
* Marshal the auth flag into the GetSessionResponse proto instead of the session.
Louis Ruch
Jeff Mitchell
Todd
Damian Debkowski
JimandJeff Mitchell
irenarindos
HaotianandTodd
Johan Brandhorst-Satzkorn
Todd Knight
Michael Gaffney