This fixes a theoretical issue with database interaction. Because the
fields in the database are signed 64-bit integers, it's theoretically
possible to overflow them if we're using unsigned 64-bit integers in the
application code.
* feat(workers): Add ability to read and reinitialize cert authority (#2312)
* feat(workers): Return Release Version on worker list and read (#2377)
* feat(cli): Read and reinitialize worker certificate authority (#2387)
This adds an action to the API that allows pulling out an activation
token that can be given to a worker in its config (directly or via env
or file). The worker can pass this along with its normal request in
place of its normal nonce and the server will automatically accept it.
Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com>
* feat(credentials): Refactor credential purposes
* Application credentials have been refactored to Brokered credentials
* Egress credentials have been refactored to Injected Application
credentials
Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
* Remove the server_id from session table, change it to worker_id on session_connection
This is step 1 in updating the worker table. The worker is becoming a public resource so it must have
a public id. We drop the server_id column on the session_connection table and add the worker_id column
so we can use the wt_public_key type. Since db migrations are applied while the controller is offline,
it should be safe to assume all session connections are not in a running state, thus allowing us to null
out all the worker ids in the session_connection table.
For now we don't have very good enforcement of the wt_public_id constraints, since the id is currently
defined in the worker config, but this will soon change and the worker's id will be generated by the
controller.
Other parts of the system make use of a "type" field, while the
AuthenticateResponse sets a "token_type" on the response attributes
directly. Rename this field to "type", and move it up to the response
level, to be more consistent with other RPCs.
Also adds a new field to the AuthenticateRequest, "type" which will
replace the "token_type" field over time.
* feat(sdk): Add fields to credential library proto
Adds CredentialType and CredentialMappingOverrides to credential
library SDK.
* feat(api): Add fields to credenttial library service
Adds support for CredentialType and CredentialMappingOverrides
to the credential library service (API)
* feat(cli): Add feilds for credential library cmd
Adds support for CredentialType and CredentialMappingOverrides to the
credential library cmd command.
This adds a parameter to host sets allowing the sync interval to be
user-specified on a per-host-set basis. A value of -1 disables syncing;
a value of null uses the current default.
* Add ability to read and list hosts. Tests to follow.
* Add tests for reading and listing as well as validation checks to not modify hosts.
* Add IpAddress and DnsNames to the api resource. Populate the plugin info.
* Adding go sdk tests for reading and listing hosts and ensuring update and deleting is disallowed.
When creating or updating a target, the following fields should have
been marked as output only:
- host_set_ids
- host_source_ids
- application_credential_source_ids
- application_credential_library_ids
This updates the protobuf and generated files including the swagger file
used by the docs site to correctly mark these are output only.
Fixes#1588
* Remove Prefix Id and Plugin Name fields. Creating catalogs now require either the plugin id or the name of the plugin resource (but not both). Host Catalogs and Host Sets API resources now have a read only plugin field populated with plugin info. Host Catalogs have a plugin id field as a top level field.
Hugo Vieira
Jeff Mitchell
Irena Rindos
Louis RuchandJeff Mitchell
Haotian
Timothy Messier
Todd
Jim
Johan Brandhorst-Satzkorn
irenarindos
Thor
Todd
