* docs/client-agent: indent PAN docs correctly
Identifying the primary network interface is a sub-heading under the
PAN troubleshooting section.
* docs/transparent-sessions: add known issue around containers/VMs
VMs/containers that do not have access to the local network cannot
use aliases through transparent sessions.
* docs: TS public beta docs
* docs: Updates
* docs: Move Client Agent sections
* docs: Updates
* docs: Fix typo
* docs: Remove x86
* docs: Add lead in sentence for links
* docs: FAQ updates
* docs: Edits and file name fixes
* Update website/content/docs/api-clients/client-agent.mdx
Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com>
* docs: Add alias refresh interval
* docs: Remove recurse only option
* Update website/content/docs/api-clients/client-agent.mdx
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* Update website/content/docs/api-clients/client-agent.mdx
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* Update website/content/docs/api-clients/client-agent.mdx
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* Update website/content/docs/api-clients/client-agent.mdx
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* Update website/content/docs/api-clients/client-agent.mdx
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* Update website/content/docs/api-clients/client-agent.mdx
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* Update website/content/docs/api-clients/client-agent.mdx
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* Update website/content/docs/api-clients/client-agent.mdx
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* Update website/content/docs/api-clients/client-agent.mdx
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* Update website/content/docs/concepts/transparent-sessions.mdx
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* Update website/content/docs/concepts/transparent-sessions.mdx
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* Update website/content/docs/concepts/transparent-sessions.mdx
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* Update website/content/docs/concepts/transparent-sessions.mdx
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* Update website/content/docs/concepts/transparent-sessions.mdx
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* docs: Updates from code review
* docs: Update support request
* docs: Fix a typo
* Update website/content/docs/api-clients/client-agent.mdx
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* docs: Delete log example, create tabs
* client-agent: rework configuration docs
The section in the configuration talking about reloading the config
was repetitive and verbose. Combine the different sections into
two separate sections, one for updating general values and
one for reloading values, on MacOS only.
This also removes the specific Log section.
* docs: Minor rewrites
* client-agent: consistently use $ for shell sessions
* aliases: discourage single-word aliases
The use of single-word aliases breaks Transparent Sessions
on Windows, so we should discourage it. See ICU-15255 for more information.
* transparent-sessions: add known issues
Add two new known issues.
* client-agent: add troubleshooting section
* transparent-sessions: emphasize troubleshooting guide
* correct links
I haven't actually validated these links, but they
are now consistent with the rest of the links.
* Review comments
* client-agent: clarify that not all sessions are listed by command
* transparent-session: add known issue regarding Windows installer
* docs: Minor rewrites
* docs: Fix a typo
* docs: Add AssumeRole support
* docs: Add Backblaze support
* docs: Minor revision
* docs: Update MinIO reqs
* docs: Add supported Hitachi version
* docs: Trigger a new build
* docs: Clarify Desktop compatibility with control plane
* Update website/content/docs/enterprise/supported-versions.mdx
Co-authored-by: Robin Beck <stellarsquall@users.noreply.github.com>
* docs: Release notes 0.18.0
* docs: Add link to Client Agent docs
* docs: Update ts definition
* docs: Remove stray line
* docs: Fix minor issues with the assembly branch
* docs: Move section
* docs: Add section
* docs: Remove duplicate section
---------
Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com>
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
Co-authored-by: Robin Beck <stellarsquall@users.noreply.github.com>
* Update controller.mdx - public_cluster_addr
Updating public_cluster_addr to indicate that it is used if a load balancer is used for controllers. Also added a note about not including https:// and http:// in the address
* docs: Minor rewrite
* docs: Minor rewrite
---------
Co-authored-by: Dan Heath <76443935+Dan-Heath@users.noreply.github.com>
When a resource relating to a session is deleted,
notably a target, host, or auth_token, the corresponding sessions are
marked as canceled via a database trigger that calls the cancel_session
function. This function was performing a select as part of the insert
call to ensure that it would not attempt to insert a session_sate of
canceled if it was an invalid state transition. However, since this
function was first introduced, there has been additional constraints
added that would prevent an invalid state transition. In addition,
performing a select as part of an insert increases the chances for
contention with other queries that interact with the session_state
table, especially since a large number of sessions and session_state
rows can be included in a single transaction when things like
auth_tokens or targets get deleted.
Now, the cancel_function will perform the insert, and catch any of the
potential violations, allowing the query to continue without needing to
perform the select, thus reduction the potential for contention.
This issue was surfaced through other changes (PR 5137).
Given that the eventer works in a singleton pattern (see sysEventer
global variable), performing this shallow object copy can cause a data
race because the copy operation reads the underlying eventer data
structures. At the same time, given the global nature of this eventer,
other goroutines can be writing to those same data structures.
Since we're already using a singleton pattern in this package, and given
that the current copy operation is shallow, copying the object doesn't
seem necessary, so this commit changes `StandardWriter` to build the
`logAdapter` with the `e` eventer directly instead of copying it.
This replaces the start_time, end_time, and previous_end_time columns on
the session_state table with a time range column that records when the
state was active. This allowed for dropping several constraints on the
session_state table that were used to ensure that states for a session
did not overlap. Instead this can be ensured with a single exclusion
constraint. By reducing the number of constraints, it improves the
performance for a number of queries involved with session state. Most
notably when resolving delete cascades of resources related to sessions,
such as targets, where as part of the delete transaction large numbers
of sessions get canceled. Similarly, when sessions get deleted, and the
corresponding session_state rows are deleted, these constraints all must
be checked during the transaction.
The domain layer continues to expose StartTime and EndTime fields on
session.State. However it drops PreviousEndTime, which was never used by
anything calling the domain layer.
See:
https://www.postgresql.org/docs/current/ddl-constraints.html#DDL-CONSTRAINTS-EXCLUSIONhttps://www.postgresql.org/docs/current/rangetypes.html
Cache speed up and additional performance improvements
This includes several changes to improve the performance of the
client cache, including:
* Making the sqlite database for the cache persistent, so the cache does
not need to be rebuilt each time the boundary client is started.
* Limiting the number of results retrieved when listing resources to 250.
* Preventing redundant refreshes running at the same time for a given
client.
* Adding indexes to the cache database.
It also refactors the grants query that is run to fetch grants for a
user when processing a controller API request. This greatly reduces the
amount of data that is returned from the database, but required a number
of changes in the application logic to account for different kinds of
grant scopes.
Lastly this makes some performance improvements in the controller
database. It adds several indexes to help with the grants query and with
delete cascades for several resources. And it changes the delete trigger
for sessions to run per statement instead of per row to help with bulk
deleting of sessions.
Dan Heath
Irena Rindos
Michael Li
Jim
Johan Brandhorst-Satzkorn
hashicorp-tsccr[bot]andhashicorp-tsccr[bot]
Cameron Perera
Lisbet Alvarez
Danny KnightsandDan Heath
vanphan24andDan Heath
Timothy Messier
Hugo
Michael Gaffney
Ryan Derr
Jeff Mitchell