With the KMS changes this should never have worked at all (because the
different databases means the credentials conveyed after the KMS-based
authentication would never be valid). However, it was sometimes passing
because of a race condition: the worker could be found in the database
before the new credentials were returned to the worker, causing the
worker to start at the KMS step with the second controller.
This changes the test to use the same database for two controllers, but
to only ever have one running at a time, and uses a sequence of two
changed (or unchanged, depending) status updates from the worker to
ensure that the reload was successful.
* chore(enos): Move terraform-enos-aws-infra to boundary
The terraform-enos-aws-infra repo was a terraform module to set up the base aws infrastructure. Vault made some local updates that might mitigate flakiness we've been seeing ("can't delete due to dependencies" error). We are replacing our usage of that module Vault's local copy.
* chore(enos): Modify service user to allow DeleteRoute
* fixup! chore(enos): Move terraform-enos-aws-infra to boundary
* chore(enos): Rename variable for clarity
The existing pattern was subject to a bug whereby a lock
value was copied every time the value was passed around.
This was happening because of the use of an embedded
protobuf type. To avoid copying a mutex, use a pointer
type in the embedding.
Also fixes a few linter warnings complaining about the use
of unkeyed literals.
* fix (events): convert multierror to stdlib error
multierror errors will be converted to a stdlib error (because
multierror doesn't support json marshaling).
* refact (errors): convert from multierror to stdlib errors.Join(...)
* refact: convert from pkg/errors to stdlib error wrapping
* refact(e2e): Pass in boundary-controller-policy to method
This allows any boundary-enterprise specific test packages to point to their own testdata directory
* test(e2e): Fix assertion statement
* refact(e2e): Move method call for clarity
* Added detail to targets.mdx around target type in relation to whether using injected credentials, i.e. setting type to ssh or tcp
* Update website/content/docs/concepts/domain-model/targets.mdx
* Update website/content/docs/concepts/domain-model/targets.mdx
* docs: Update target type info, add requirements
* docs: Revise SSH credential text
* docs: Clarify reference to SSH
---------
Co-authored-by: Dan Heath <76443935+Dan-Heath@users.noreply.github.com>
* test(e2e): Add worker health check when setting up infra
* test(e2e): Set limits on postgres container
This was done to potentially reduce some load on runners
* refact(e2e): Add env for workers
* test(e2e): Add test for single-hop worker
* fixup! refact(e2e): Add env for workers
* fixup! test(e2e): Add test for single-hop worker
* fixup! test(e2e): Add test for single-hop worker
* fixup! test(e2e): Add test for single-hop worker
* fixup! test(e2e): Add test for single-hop worker
The connectivity state changes for `upstream_connection_state` health field is causing the test to be flakey. Commenting out the field during assertions. `upstream_connection_state` health field is tested in other tests
The SetupSuiteTargetFilters globally mutates the function used for logic
inside the target handler service. This means that we could get
inconsistent logical behavior in certain tests that were run in parallel,
since the logic can change at runtime. Ensure tests that make use
of this function are never run in parallel with other tests.
* fix (auth/ldap): fix which DEK is used for oplog during authenticate
* chore: update go-kms-wrapping dep for new extras/kms changes
The latest version supports setting a table name prefix for a kms
which is needed to fix our oplog DEK problem
* chore: update extras/kms dep
This latest version supports an optional TableNamePrefix which is
required to fix our existing oplog DEK issue.
* fix (oplog): schema oplog DEK fix
These changes will allow use to store the oplog DEK in it's own
set of tables, so they won't get deleted when a scope is deleted
* fix (kms): move oplog DEK into its own internal kms
* tests: update tests to be compatible with oplog fix
* tests: remove migration tests which are incompatible with oplog fix
These tests no longer work because they are missing the required
schema changes for the oplog fix
Damian Debkowski
Dan Heath
Sepehr
April Ayres
Jeff Mitchell
Louis Ruch
Michael Li
Irena Rindos
Jim
Johan Brandhorst-Satzkorn
Adam BouhmadandDan Heath
Danny KnightsandDan Heath
Elim Tsiagbey
Michael Gaffney