With the KMS changes this should never have worked at all (because the
different databases means the credentials conveyed after the KMS-based
authentication would never be valid). However, it was sometimes passing
because of a race condition: the worker could be found in the database
before the new credentials were returned to the worker, causing the
worker to start at the KMS step with the second controller.
This changes the test to use the same database for two controllers, but
to only ever have one running at a time, and uses a sequence of two
changed (or unchanged, depending) status updates from the worker to
ensure that the reload was successful.
* chore(enos): Move terraform-enos-aws-infra to boundary
The terraform-enos-aws-infra repo was a terraform module to set up the base aws infrastructure. Vault made some local updates that might mitigate flakiness we've been seeing ("can't delete due to dependencies" error). We are replacing our usage of that module Vault's local copy.
* chore(enos): Modify service user to allow DeleteRoute
* fixup! chore(enos): Move terraform-enos-aws-infra to boundary
* chore(enos): Rename variable for clarity
The existing pattern was subject to a bug whereby a lock
value was copied every time the value was passed around.
This was happening because of the use of an embedded
protobuf type. To avoid copying a mutex, use a pointer
type in the embedding.
Also fixes a few linter warnings complaining about the use
of unkeyed literals.
* fix (events): convert multierror to stdlib error
multierror errors will be converted to a stdlib error (because
multierror doesn't support json marshaling).
* refact (errors): convert from multierror to stdlib errors.Join(...)
* refact: convert from pkg/errors to stdlib error wrapping
* refact(e2e): Pass in boundary-controller-policy to method
This allows any boundary-enterprise specific test packages to point to their own testdata directory
* test(e2e): Fix assertion statement
* refact(e2e): Move method call for clarity
* Added detail to targets.mdx around target type in relation to whether using injected credentials, i.e. setting type to ssh or tcp
* Update website/content/docs/concepts/domain-model/targets.mdx
* Update website/content/docs/concepts/domain-model/targets.mdx
* docs: Update target type info, add requirements
* docs: Revise SSH credential text
* docs: Clarify reference to SSH
---------
Co-authored-by: Dan Heath <76443935+Dan-Heath@users.noreply.github.com>
* test(e2e): Add worker health check when setting up infra
* test(e2e): Set limits on postgres container
This was done to potentially reduce some load on runners
* refact(e2e): Add env for workers
* test(e2e): Add test for single-hop worker
* fixup! refact(e2e): Add env for workers
* fixup! test(e2e): Add test for single-hop worker
* fixup! test(e2e): Add test for single-hop worker
* fixup! test(e2e): Add test for single-hop worker
* fixup! test(e2e): Add test for single-hop worker
The connectivity state changes for `upstream_connection_state` health field is causing the test to be flakey. Commenting out the field during assertions. `upstream_connection_state` health field is tested in other tests
The SetupSuiteTargetFilters globally mutates the function used for logic
inside the target handler service. This means that we could get
inconsistent logical behavior in certain tests that were run in parallel,
since the logic can change at runtime. Ensure tests that make use
of this function are never run in parallel with other tests.
* fix (auth/ldap): fix which DEK is used for oplog during authenticate
* chore: update go-kms-wrapping dep for new extras/kms changes
The latest version supports setting a table name prefix for a kms
which is needed to fix our oplog DEK problem
* chore: update extras/kms dep
This latest version supports an optional TableNamePrefix which is
required to fix our existing oplog DEK issue.
* fix (oplog): schema oplog DEK fix
These changes will allow use to store the oplog DEK in it's own
set of tables, so they won't get deleted when a scope is deleted
* fix (kms): move oplog DEK into its own internal kms
* tests: update tests to be compatible with oplog fix
* tests: remove migration tests which are incompatible with oplog fix
These tests no longer work because they are missing the required
schema changes for the oplog fix
* feat (auth/ldap): add Repo support for max page size and deref aliases (#3670)
* chore: update cap/ldap dependency
This latest version of cap/ldap adds support for MaxPageSize and
DerefAliases
* feat (auth/ldap): add MaxPageSize and DerefAliases to storage proto
* feat (api/authmethods): add new ldap fields.
Add support for maximum_page_size and dereference_aliases
* feat (auth/ldap): schema changes to support new LDAP attributes
* feat (auth/ldap): add Repo support for max page size and deref aliases
* feat (handlers/ldap): add support for new fields (#3674)
Added API support for new ldap fields: MaximumPageSize and
DereferenceAliases
* chore: add CHANGELOG entry for new api auth ldap fields
This reverts commit 2b2eada393. The change
breaks out integration tests because the new Docker image is not
available yet. We'll revert this change once it is.
* internal/perms: Fix grant parser bugs
This fixes two bugs in the grant parser:
1. The parser would accept "," as an output field when parsing from JSON.
This would then make it into the canonical string,
which would make it look like we had a trailing comma.
Disallow the use of a comma as an output field.
2. The parser would accept empty IDs when parsing from JSON.
Make this behavior consistent with the text behavior.
* internal/perms: also handle empty IDs in text form
* internal/perms: disallow any commas
Commas anywhere in ids or output fields corrupt
the canonical output string.
* internal/perms: disallow any reserved characters
id, ids and actions could all contain one of the
reserved characters ",", "=" or ";" when used with
JSON.
* feat: Worker Connectivity Health Check
Add worker upstream connection state. API calls to the worker's ops `/heath?worker_info=1` endpoint should now return a new filed called `upstream_connection_state`
```
{
"worker_process_info":{
"state":"active",
"active_session_count":0,
"upstream_connection_state":"READY"
}
}
```
The states returned will be GRPC connection states: https://grpc.github.io/grpc/core/md_doc_connectivity-semantics-and-api.html
There could be multiple upstream addresses but GRPC manual resolver determines the state of the connection.
Sepehr
April Ayres
Jeff Mitchell
Louis Ruch
Michael Li
Irena Rindos
Jim
Johan Brandhorst-Satzkorn
Adam BouhmadandDan Heath
Damian Debkowski
Danny KnightsandDan Heath
Elim Tsiagbey
Michael Gaffney
hashicorp-tsccr[bot]andhashicorp-tsccr[bot]