* Add generic read/update/delete commands
This adds three generic commands that use the resource prefix to
determine the subcommand to run and pass through args over to that
subcommand. Since this occurs very early on and to avoid loading
essentially every internal resource package, I moved subtype definitions
to globals.
* Update main.go
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* Update changelog and remove another deprecated command
---------
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
The Vault Credential Store only accepts Vault tokens that have a TTL
greater than the internal job scheduler's run frequency. This prevents a
Vault Credential Store from being created with a Vault token that will
expire before Boundary can renew it.
The Vault test server, by default, creates Vault tokens with a TTL equal
to the duration of time remaining until `t.Deadline()` is reached.
This change sets the test controller's default job scheduler duration to
be half of time remaining until `t.Deadline()`. The default job
scheduler duration can still be overridden by setting a duration on
`TestConrollerOpts.SchedulerRunJobInterval`.
This change fixes the error received when running:
go test -timeout 30s \
-tags devlicense \
-run '^TestList$' \
github.com/hashicorp/boundary/internal/tests/api/credentialstores
Which returned this error:
{"kind":"Internal",
"message":"credentialstores.(Service).createInRepo: unable to create
credential store: vault.(Repository).CreateCredentialStore: unknown,
unknown: error #0: scheduler interval must be greater than token
ttl. scheduler jobs interval value: 1m0s"}
In #2076 the refactor changed the position of a parenthesis, causing
the dev key to truncate the base64 representation instead of specifying
which bytes to base64 encode.
We don't need this slicing anymore anyways since we now do individual
key generation calls so just remove it.
The TestObject test helper previously returned an error,
but it's easier to have it perform the error check itself,
as it conventionally done with test helpers.
This is a lint error but wasn't caught because it was a
historic problem. It's appearing again now because we're
adding another method to this type as part of the
pagination workflow.
* fix: monitorUpstreamConnectionState CPU consumption
`monitorUpstreamConnectionState()` is a goroutine that listens for GRPC client connection changes using GRPC's `WaitForStateChange` method. `monitorUpstreamConnectionState()` was consuming the a lot of CPU. It was continuously running and not actually waiting for state changes. The `state` for `monitorUpstreamConnectionState()` was not getting correctly updated which caused the loop to continuously run instead of waiting for new state changes.
Update GRPC `WaitForStateChange` method to use the same `state` that gets updated.
We inadvertently used
kms.GetWrapper(ctx, am.ScopeId, kms.KeyPurposeDatabase)
which resulted in the use of a database key for an oplog entry.
See:
https://github.com/hashicorp/boundary/pull/3665/files#diff-bcf83b5283886c98fc45b6435fdc94d87d545b2768c6beac8acd14eb9d6b13f1
This fixes the issue with the missing "Database" purpose key when
we converted the oplog keys into their own tables.
We chosen to truncate the existing oplog entries to eliminate any
references to a Database kms key in existing oplog entries.
In preparation for putting proxy code in the api package this creates some necessary fields in the target output and it pre-moves credential parsing and proxy handshake code to their new places. This will make the diff for the actual proxy code move quite a bit smaller.
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
With a suitably slow system -- say, if you're waiting on a Windows
Terminal to output text inside a virtual machine -- the expected order
of things can be thrown off. One specific way this can happen is that
the worker can attempt to dial and have its dial fail because of the
slowness causing the dial context to time out. If, because of the
slowness, we also haven't released the log gate yet, then the event with
the failure information will be queued, along with the context that was
used.
Unfortunately, in some of these error cases, the context that was used
was the dial context instead of the system base context. In many other
places in the function it was the system base context so this is just a
mismatch, probably from code written at different times.
Normally this wouldn't be a problem as we'd fall back to the underlying
logger, but when we release the log gate, things happen differently:
it's a synchronous function and on error it causes us to abandon
system startup entirely.
This commit fixes the issue with using the incorrect context. It's an
open question whether we should change the behavior around errors when
replaying queued events, falling back to the underlying logger instead
of erroring.
* chore: Fix comment typo
* test(e2e): Update to use new credential library type
* test(e2e): Update to use new field name
* test(bats): Remove tests that use deprecated subcommand
* chore: Update to 0.14.0
* test(credentiallibraries): Update to use new credential library type
* doc: Add deprecation notices for 0.14.0
* fixup! doc: Add deprecation notices for 0.14.0
With the KMS changes this should never have worked at all (because the
different databases means the credentials conveyed after the KMS-based
authentication would never be valid). However, it was sometimes passing
because of a race condition: the worker could be found in the database
before the new credentials were returned to the worker, causing the
worker to start at the KMS step with the second controller.
This changes the test to use the same database for two controllers, but
to only ever have one running at a time, and uses a sequence of two
changed (or unchanged, depending) status updates from the worker to
ensure that the reload was successful.
The existing pattern was subject to a bug whereby a lock
value was copied every time the value was passed around.
This was happening because of the use of an embedded
protobuf type. To avoid copying a mutex, use a pointer
type in the embedding.
Also fixes a few linter warnings complaining about the use
of unkeyed literals.
guangwu
Sorawis Nilparuk (Bo)
Jeff MitchellandJohan Brandhorst-Satzkorn
Michael Gaffney
Sepehr
Jim
dani
Elim Tsiagbey
Michael Li
Devon Anderson
Devon Anderson
April Ayres
Sepehr
April Ayres
Irena Rindos