Add initial templating support to Vault credential libraries
This adds support for templating various account and user values into
Vault dynamic credential library POST bodies and GET/POST paths.
It also unifies how parameters are used in grants, with backwards
compatibility.
This fixes a theoretical issue with database interaction. Because the
fields in the database are signed 64-bit integers, it's theoretically
possible to overflow them if we're using unsigned 64-bit integers in the
application code.
With this commit, the Worker now sends BytesUp and BytesDown for each
of the connections it handles to the Controller in the Status request.
The Controller then persists these fields to the database. There is also
a new trigger to prevent bytes_up and bytes_down to change after a
connection has been closed, as the last update to a session_connection
row should be the one that is performed as part of the connection
closure process.
Introduces data about bytes read and written to the connection close
payload. No changes are required in the Controller because the RPC
messages already contained the required fields. As of this commit,
bytes_up and bytes_down columns in the session_connection table are now
populated when a connection closes.
Refs: #2509
This commit introduces a new net.Conn implementation (countingConn) that
will keep track of bytes read and written for a particular client
connection. This is then implemented into the worker code using
interface composition.
Refs: #2501
* Randomize order of worker output. This uses the standard
rand.Shuffle() call; cribbed from
https://pkg.go.dev/math/rand#example-Shuffle
* Have some error/eventing in the worker status path use the base
context instead of the status-call-specific context to allow eventing
after a timeout event
* Return worker process information in the health endpoint.
Experimental: The worker_info and returned worker_process_info fields are experimental and can change or be removed without notice.
When a user passes in "worker_info=1" or "worker_info=true" and a worker is running the returned json will be returned with a key named "worker_process_info" which value is a json object with information about the worker process.
This commit extracts 3 separate pieces of functionality into their own
function/method:
- Extracts the database opening with the intention to have a function
that performs all that functionality but returns the created database
object rather than setting it to the Server structure.
- Extracts database validation logic, to provide a common code path for
upcoming functionality.
- Expose schema manager on the Command struct as well as providing
common functions to acquire shared lock/close.
In cases where the server was started with both a controller and worker
stanza, the reload of the config was not properly setting the initial
upstream value on the new config. In this case the value is derived from
other config values and not necessarily set directly.
This now properly initializes the new config so that initial upstream is
set in the same manner as the first load.
Blame: 5d0cdf680f
* feat(workers): Add ability to read and reinitialize cert authority (#2312)
* feat(workers): Return Release Version on worker list and read (#2377)
* feat(cli): Read and reinitialize worker certificate authority (#2387)
Using the new Permissions object, we can build a list of the level of
access a user should have based on the grants they've been given,
meaining we don't need to fetch all resources from the database to then
remove the ones the user shouldn't be able to see.
This commit also removes some unused options in `ListTargets`
for the sake of simplicity.
This adds a context to the session.RepositoryFactory, allowing
errors.NewDeprecated to be replaced with errors.New. It also removes the
common.SessionRepoFactory, instead packages just directly import from
the session package.
This builds on previous performance improvements to the list behavior by
reducing the number of queries against the database and the amount of
data transfered in order to retrieve a list of sessions. Previously, a
query was performed to retrieve a tuple of `(session_id, scope_id,
user_id)` for the requested scope, including all child scopes if the
request was recursive. These tuples were evaluated against the
requesting user's grants to identify the sessions that they were
authorized to list. In the case of clusters with a large number of
sessions, this would result in a large amount of data needing to be
transfered for sessions that would not be used. Then a second query
would be used to retrieve the full session information for the session
ids that were authorized.
This changes the list behavior to evaluate a set of permissions from
the requesting user's grants, use these permissions when constructing a
session repository, and retrieve the list of sessions the user is
authorized to list in a signle query.
Ref:
d74103482932070678dc
Disabling the auth was resulting in some unrealistic tests setup and
expectations. It also makes it difficult to refactor any behavior in the
authn/authz flow since this option can bypass most of it.
Disabling the auth was resulting in some unrealistic tests setup and
expectations. It also makes it difficult to refactor any behavior in the
authn/authz flow since this option can bypass most of it.
* feat(workers): added latencies histogram for server side multihop workers
* refactor(daemon): combine common grpc metric functions into daemon/internal/metric
Co-authored-by: Todd <github@quaddi.com>
* bug(vault): Correctly handle credential stores with expired tokens
Boundary makes use of a database view to perform CRUD operations on
Vault credential stores and libraries. This view did not include
credential stores with tokens that have expired in Vault, causing
errors when attempting to perform any action against them.
This adds an action to the API that allows pulling out an activation
token that can be given to a worker in its config (directly or via env
or file). The worker can pass this along with its normal request in
place of its normal nonce and the server will automatically accept it.
Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com>
Todd
Jeff MitchellandTodd
Irena Rindos
Hugo Vieira
Johan Brandhorst-Satzkorn
Haotian
Louis Ruch
Damian Debkowski
Timothy Messier