* bug(vault): Correctly handle credential stores with expired tokens
Boundary makes use of a database view to perform CRUD operations on
Vault credential stores and libraries. This view did not include
credential stores with tokens that have expired in Vault, causing
errors when attempting to perform any action against them.
* adds CLI commands for add/set/removing worker tags, and respective tests
* adds StringSliceMapVar Flag to convert a string from the CLI to a map[string][]string value
* [QTI-275] Add infrastructure integration testing
On pull requests that originate from branches of the `hashicorp/boundary`
repo, we now conditionally dispatch infrastructure integration tests using
the Enos framework. The `integration` Enos scenario includes two `builder`
variants which allow developers or CI to deploy a Boundary cluster in AWS
using either a local `boundary` install bundle or that which is produced
in the `build` workflow for CRT. The `test` variants determine which type
of infrastructure integration test to run. At present those options are
`cli_ui` (Bats CLI tests) or `smoke` (creates target instances and a
target host catalog and verifies that `boundary` works).
In addition to the new workflow and quality scenarios, we simplified the
some `build` workflow steps and added Go module caching to speed up the
build pipeline.
See the [enos/README.md](https://github.com/hashicorp/boundary/blob/main/enos/README.md)
for a detailed explanation on how to configure and execute Enos scenarios
from your machine.
Signed-off-by: Ryan Cragun <me@ryan.ec>
Co-authored-by: Rebecca Willett <rwillett@hashicorp.com>
Co-authored-by: Josh Branch <jbrand@hashicorp.com>
* feat(credentials): Refactor credential purposes
* Application credentials have been refactored to Brokered credentials
* Egress credentials have been refactored to Injected Application
credentials
Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
* (test) added more context to error details for cli commands
* (fix) refactor solution to utilize custom error type casting
* (test) added api unit test to validate InvalidArgumentError return message
* Update internal/types/subtypes/error.go
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* (refactor) rename InvalidArgumentError into UnknownSubtypeIDError
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* Discontinue support for old Server message in ServerCoordinationService. Split message into ServerWorkerStatus and UpstreamServer (which currently contains controller addresses). Remove unnecessary fields. Modify workerStatusServer to use new fields.
Co-authored-by: Todd <github@quaddi.com>
This test was using the third element in the result from a list request
to craft the input for the next assertion. However, one of the test
targets that is created does not have a default port set. Since the
target list call is not ordered, sometimes this element could be the
third element and a panic would result when default port interface was
converted to a float64.
This fixes the panic like:
--- FAIL: TestList (1.31s)
panic: interface conversion: interface {} is nil, not float64 [recovered]
panic: interface conversion: interface {} is nil, not float64
goroutine 1694 [running]:
testing.tRunner.func1.2({0x14b2320, 0xc002f486f0})
/prefix/usr/lib/go/src/testing/testing.go:1389 +0x24e
testing.tRunner.func1()
/prefix/usr/lib/go/src/testing/testing.go:1392 +0x39f
panic({0x14b2320, 0xc002f486f0})
/prefix/usr/lib/go/src/runtime/panic.go:838 +0x207
github.com/hashicorp/boundary/internal/tests/api/targets_test.TestList(0xc000f81380)
/go/src/github.com/hashicorp/boundary/internal/tests/api/targets/target_test.go:193 +0x174b
testing.tRunner(0xc000f81380, 0x2b933a8)
/prefix/usr/lib/go/src/testing/testing.go:1439 +0x102
created by testing.(*T).Run
/prefix/usr/lib/go/src/testing/testing.go:1486 +0x35f
FAIL github.com/hashicorp/boundary/internal/tests/api/targets 5.742s
FAIL
Refs: #2003
* Remove the server_id from session table, change it to worker_id on session_connection
This is step 1 in updating the worker table. The worker is becoming a public resource so it must have
a public id. We drop the server_id column on the session_connection table and add the worker_id column
so we can use the wt_public_key type. Since db migrations are applied while the controller is offline,
it should be safe to assume all session connections are not in a running state, thus allowing us to null
out all the worker ids in the session_connection table.
For now we don't have very good enforcement of the wt_public_id constraints, since the id is currently
defined in the worker config, but this will soon change and the worker's id will be generated by the
controller.
* Move the server daemons into their own package
With this change the internal/server package now is dedicated to the server domain (workers and controllers) and not to the server daemons.
The hope is that this will make it easier to keep the daemons decoupled from the representation of the servers in the database.
Our test helper packages were not possible to use
with benchmarks. This refactor switches to testing.TB
to allow both tests and benchmarks to use the helpers.
This updates the target resources to use a oneof for attributes. This
allows requests to the targets service to leverage the new
subtypes.AttributeTransformerInterceptor so that attributes are strongly
typed prior to the service handler.
The new `subtype.AttributeTransformerInterceptor` can return an error if
it fails to transform the attributes. This is mainly if invalid
attribute fields were included for a particular subtype. This error case
used to be checked in the grpc service handler functions. However, now
that it is happening in the interceptor, the `errorInterceptor` needs to
be moved up in the stack so that it will process the response of the new
transformation interceptor.
The `errorInterceptor` used to be after the `auditRequestInterceptor`
and prior to the `auditResponseInterceptor`, meaning that the
`auditResponseInterceptor` would have access to the result of the
`errorInterceptor`. But it seems the `auditRequestInterceptor` does not
use or need any of the headers set by the `errorInterceptor` so it
should be safe to move the `errorInterceptor`. This is important since
the `subtype.AttributeTransformerInterceptor` needs to be before the
audit interceptors in the stack to properly transform requests/responses
so they can be audited with the complete classification information.
This reduces the chance that we'll hit a failure due to a mismatched
worker address, on the certificate, especially if a worker has multiple
addresses. We aren't relying on IP/DNS for security anyways, so let's
not have it be a hindrance.
This change introduces a `nonceFn` field that can be changed
by a test but at runtime is transparent to the code that calls it.
The current nonce-generating logic defaults to a test-only field which
opens us up to this value inadvertently being set.
With this change, the default behavior becomes using `base62` to
generate a random nonce, and any tests have to explicitly change that.
Louis Ruch
Haotian
Irena Rindos
Todd
Damian Debkowski
Jim
Timothy Messier
Hugo Vieira