* fix (events): convert multierror to stdlib error
multierror errors will be converted to a stdlib error (because
multierror doesn't support json marshaling).
* refact (errors): convert from multierror to stdlib errors.Join(...)
* refact: convert from pkg/errors to stdlib error wrapping
* refact(e2e): Pass in boundary-controller-policy to method
This allows any boundary-enterprise specific test packages to point to their own testdata directory
* test(e2e): Fix assertion statement
* refact(e2e): Move method call for clarity
* Added detail to targets.mdx around target type in relation to whether using injected credentials, i.e. setting type to ssh or tcp
* Update website/content/docs/concepts/domain-model/targets.mdx
* Update website/content/docs/concepts/domain-model/targets.mdx
* docs: Update target type info, add requirements
* docs: Revise SSH credential text
* docs: Clarify reference to SSH
---------
Co-authored-by: Dan Heath <76443935+Dan-Heath@users.noreply.github.com>
* test(e2e): Add worker health check when setting up infra
* test(e2e): Set limits on postgres container
This was done to potentially reduce some load on runners
* refact(e2e): Add env for workers
* test(e2e): Add test for single-hop worker
* fixup! refact(e2e): Add env for workers
* fixup! test(e2e): Add test for single-hop worker
* fixup! test(e2e): Add test for single-hop worker
* fixup! test(e2e): Add test for single-hop worker
* fixup! test(e2e): Add test for single-hop worker
The connectivity state changes for `upstream_connection_state` health field is causing the test to be flakey. Commenting out the field during assertions. `upstream_connection_state` health field is tested in other tests
The SetupSuiteTargetFilters globally mutates the function used for logic
inside the target handler service. This means that we could get
inconsistent logical behavior in certain tests that were run in parallel,
since the logic can change at runtime. Ensure tests that make use
of this function are never run in parallel with other tests.
* fix (auth/ldap): fix which DEK is used for oplog during authenticate
* chore: update go-kms-wrapping dep for new extras/kms changes
The latest version supports setting a table name prefix for a kms
which is needed to fix our oplog DEK problem
* chore: update extras/kms dep
This latest version supports an optional TableNamePrefix which is
required to fix our existing oplog DEK issue.
* fix (oplog): schema oplog DEK fix
These changes will allow use to store the oplog DEK in it's own
set of tables, so they won't get deleted when a scope is deleted
* fix (kms): move oplog DEK into its own internal kms
* tests: update tests to be compatible with oplog fix
* tests: remove migration tests which are incompatible with oplog fix
These tests no longer work because they are missing the required
schema changes for the oplog fix
* feat (auth/ldap): add Repo support for max page size and deref aliases (#3670)
* chore: update cap/ldap dependency
This latest version of cap/ldap adds support for MaxPageSize and
DerefAliases
* feat (auth/ldap): add MaxPageSize and DerefAliases to storage proto
* feat (api/authmethods): add new ldap fields.
Add support for maximum_page_size and dereference_aliases
* feat (auth/ldap): schema changes to support new LDAP attributes
* feat (auth/ldap): add Repo support for max page size and deref aliases
* feat (handlers/ldap): add support for new fields (#3674)
Added API support for new ldap fields: MaximumPageSize and
DereferenceAliases
* chore: add CHANGELOG entry for new api auth ldap fields
This reverts commit 2b2eada393. The change
breaks out integration tests because the new Docker image is not
available yet. We'll revert this change once it is.
* internal/perms: Fix grant parser bugs
This fixes two bugs in the grant parser:
1. The parser would accept "," as an output field when parsing from JSON.
This would then make it into the canonical string,
which would make it look like we had a trailing comma.
Disallow the use of a comma as an output field.
2. The parser would accept empty IDs when parsing from JSON.
Make this behavior consistent with the text behavior.
* internal/perms: also handle empty IDs in text form
* internal/perms: disallow any commas
Commas anywhere in ids or output fields corrupt
the canonical output string.
* internal/perms: disallow any reserved characters
id, ids and actions could all contain one of the
reserved characters ",", "=" or ";" when used with
JSON.
* feat: Worker Connectivity Health Check
Add worker upstream connection state. API calls to the worker's ops `/heath?worker_info=1` endpoint should now return a new filed called `upstream_connection_state`
```
{
"worker_process_info":{
"state":"active",
"active_session_count":0,
"upstream_connection_state":"READY"
}
}
```
The states returned will be GRPC connection states: https://grpc.github.io/grpc/core/md_doc_connectivity-semantics-and-api.html
There could be multiple upstream addresses but GRPC manual resolver determines the state of the connection.
* Update multi-hop system-requirements.mdx
Clarifying multi-hop session proxying wording
* docs: Rewrite as list
* Update list to clarify connection steps, multiple upstreams possible per downstream/egress
* docs: Copy edits
* docs: Fix formatting in ordered list
---------
Co-authored-by: Dan Heath <76443935+Dan-Heath@users.noreply.github.com>
Co-authored-by: Joe Thompson <jthompson@hashicorp.com>
Jim
Michael Li
Irena Rindos
Dan Heath
Damian Debkowski
Danny KnightsandDan Heath
Elim Tsiagbey
Johan Brandhorst-Satzkorn
Michael Gaffney
Jeff Mitchell
hashicorp-tsccr[bot]andhashicorp-tsccr[bot]
Louis Ruch
Susmitha Girumala
