The build-ui-ifne target is responsible for deciding
whether the UI assets already exist on disk, or need
to be built by cloning the UI repo and running its build
scripts.
The old configuration would check whether the UI
repo folder existed, and assume that as long as this
folder exists, it can be used to embed the UI assets.
However, if the clone or ui build fails at any point, the
Makefile target isn't able to retry the script.
Correct the path that is checked for to be the path that
is actually included in the assets.go file. This way, the
Makefile script will retry building the UI until a dist
folder is created.
I think this was somehow accidentally included from Vault
back in the day and never removed. As far as I can tell
these options have absolutely no effect on anything
in Boundary and will probably only cause confusion.
* Update golang.org deps and Go version
* Upgrade golangci-lint
* all: fix new vet warnings
https://github.com/golang/go/issues/60529 introduced a new
vet warning for when format strings are used without arguments,
which is technically a bug since it shouldn't be using the functions
taking format string arguments in those cases.
* internal/clientcache: restore user on login
A user that previously had its last auth token deleted
(for example, if they logged out), should be restored
again when they successfully authenticate again.
* internal/clientcache: delete keyringless expired auth tokens
Previously, we would only correctly delete auth tokens
that were expired (or deleted) if they were also in the
keyring.
* internal/clientcache: remove tautological condition
At this stage we already know that at is non-nil, because
the case above would have been true if it was nil.
* internal/clientcache: improve error handling
The previous error handling would have ignored API errors that were not ErrUnauthorized or ErrNotFound.
Handle all API errors the same as other unexpected errors.
* internal/clientcache: make errors distinct
These two error conditions are otherwise impossible
to tell apart.
* test(e2e): Update search test to catch bug (#5551)
---------
Co-authored-by: Michael Li <michael.li@hashicorp.com>
* mod: remove unnecessary import groupings
Move all imports into one of two groupings:
1. Direct dependencies
2. Indirect dependencies
This is the standard used by the go tool. The old groupings
seemed very random.
* mod: update go-plugin dependency
* docs/client-agent: add warning about MacOS 15
MacOS 15.3 has been known to sometimes block users
from using the client agent altogether. Explicitly
allowing it access to incoming network connections
resolves the issue.
* Update website/content/docs/api-clients/client-agent.mdx
Co-authored-by: Robin Beck <stellarsquall@users.noreply.github.com>
---------
Co-authored-by: Robin Beck <stellarsquall@users.noreply.github.com>
This was failing because the compared values weren't
pointers. It was probably caused by a depedency version
update changing the behavior of this function.
* internal/auth/password: add resizable pool
The resizable pool wraps the permit pool with a mutex
to allow it to be resized at runtime.
* internal/auth/password: add concurrency limit
The default concurrency limit is 1, and it can be
set using the SetHashingPermits function.
* internal/cmd/config: allow configuring hashing limits
The new concurrent_password_hash_workers configuration
value can be used to loosen the constraints on the
userpass auth method hashing operation.
* internal/cmd: set password hashing constraints
Sets the password hashing concurrency constraints on
startup and config reload.
* CHANGELOG: add notice about password concurrency limit
Previously, the orphaned connection cleanup job would
not detect that a connection that was created before a
worker had submitted a successful session info was
orphaned. We now fall back to using the worker update
time as an indicator if the session info time is not set.
* oss: feat(proto): statistics rpc added to server coordination service
* oss: feat(session): add update statistics status service
* oss: feat(handlers): add Statistics method to worker service server
* oss: feat(worker): add statistics ticking
* oss: internal/proto: define the new RoutingInfo RPC
* oss: internal/server: repository changes for RoutingInfo RPC
* oss: internal/daemon: add RoutingInfo handler to worker service
The new RoutingInfo RPC is used to get information from the worker
that is used to make routing decisions on the controller. It also
handles the initial request from the worker.
* oss: feat(db): server_worker_session_info table
* oss: feat(proto): session info rpc for server coordination service
* oss: feat(server): worker session info request data type
* oss: feat(worker): session info ticker
* oss: feat(handler): server coordination handler for session info
* oss: feat(session): utilize session info request time for session cleanup
* oss: proto: fix some gotags comments
Some of these fields were missing comments, while others had
incorrectly formatted comments.
* oss: worker: send connection status to server
This is required for the correct tracking of orphaned connections
* oss: internal/daemon/worker: add function to wait for Statistics RPC
* oss: internal/daemon/worker: add routing info RPC
The new RoutingInfo RPC replaces part of the Status RPC,
namely the part which is used by the controller and worker
to perform decisions around the establishment of new sessions
and new worker connections.
* oss: internal/daemon/worker: remove unnecessary error check
* oss: internal/daemon/worker: lock access to config and upstreams
The new confLock protects access to the conf value and to the
addressReceivers slice.
* oss: worker: replace Status RPC with RoutingInfo
* oss: worker: deprecate the Status RPC and related types
The Status RPC and related messages have been replaced
by the RoutingInfo/SessionInfo/Statistics RPCs. The controller
will continue to support the Status RPC until two new minor
versions have been released.
* oss: internal/event: add default deny for new worker RPCs
* oss: internal/daemon/worker: allow RPC interval to be set
The new SessionInfo/RoutingInfo/Statistics RPCs run at
long intervals, which make some of our cluster tests take
a long time to complete. This allows their interval to be
configured in tests.
* oss: all: use TestWorkerRPCInterval in slow tests
This should speed up these tests significantly.
* oss: internal/tests/cluster: reset sys eventer in test
---------
Co-authored-by: Damian Debkowski <damian.debkowski@hashicorp.com>
Reading a token from the keyring can sometimes fail for reasons
other than the token not being present in the keyring. This PR
introduces a new error used to indicate that the token requested
could not be found in the keyring and propagates errors from the
keyring up to the caller, so that the caller can act on them.
Additionally, this fixes a bug in the client cache where it would
incorrectly assume that a token had been removed from the
keyring, when in fact there was an error reading from the keyring.
TestRotationTicking would previously wait for 5 rotations, which is
pretty slow considering each rotation takes 20 seconds. Reduce
the number to 3, and use require instead of assert to remove
noise during flaky test runs.
This doesn't fix the flakiness of this test, but it should reduce the log spam.
Don't error in ReleaseGate if the context used for the original
event has been cancelled. Any error in ReleaseGate causes the
controller to terminate its startup. If a user was trying to send
a request to the Boundary controller as it started up, the context
tied to the request would be reused to attempt logging the
observation associated with the request after the logging gate
was released. This would always fail, as the context associated
with the request was canceled.
We now use a new context timeout for events logged after the release
gate is released, if the original context was canceled.
* Update release dir owner group
The old group only contains a service account. I updated it to the self managed release engineering group instead.
* Remove release engineering as code owners
Actually lets just remove this group, as per their justification in #4057
Previously, if one of these tests failed to start their servers before
the timeout, there was a risk that the goroutine started to run
the server would invoke t.Errorf after the test itself had concluded.
Replace t.Errorf with fmt.Printf to avoid the panic, and include
the test name for debugging.
* internal/handlers/managed_groups: ensure membership lookup is unlimited
Previously, we would only show the first 10,000 members in the group,
giving the impression that a complete list was performed. Now we
list all members.
* internal/handlers/accounts: ensure group lookup is unlimited
Previously, we would only show the first 10,000 managed group
memberships. Now we list all group memberships of an account.
Previously, we would list the managed groups with an implied
filter of db.DefaultLimit (10,000), which would incorrectly remove
a user from managed group memberships if there were more
than 10,000 managed groups in an auth method. Explicitly
set the list limit to unlimited to ensure all managed groups are
updated appropriately.
* docs/client-agent: clarify use of override_upstream_dns_servers
The override_upstream_dns_servers option is recommended whenever
a user needs to override the DNS servers discovered from the system.
However, if a user supplies a DNS server that is only useable while
connected to a specific network, it will break the internet in
cases where it is not able to resolve these DNS servers.
Encourage users to supply both the VPN servers and the default
DNS servers.
* Update website/content/docs/api-clients/client-agent.mdx
Co-authored-by: Dan Heath <76443935+Dan-Heath@users.noreply.github.com>
* Update website/content/docs/api-clients/client-agent.mdx
Co-authored-by: Dan Heath <76443935+Dan-Heath@users.noreply.github.com>
---------
Co-authored-by: Dan Heath <76443935+Dan-Heath@users.noreply.github.com>
* docs/client-agent: clarify configuration reload on MacOS
The previous configuration was known to confuse at least one reader.
It's easy to just copy the first command you see and run it, so
make that the non-destructive reload command.
* docs/client-agent: correct log level config example
* Update website/content/docs/api-clients/client-agent.mdx
Co-authored-by: Dan Heath <76443935+Dan-Heath@users.noreply.github.com>
---------
Co-authored-by: Dan Heath <76443935+Dan-Heath@users.noreply.github.com>
* docs/client-agent: indent PAN docs correctly
Identifying the primary network interface is a sub-heading under the
PAN troubleshooting section.
* docs/transparent-sessions: add known issue around containers/VMs
VMs/containers that do not have access to the local network cannot
use aliases through transparent sessions.
* Add semgrep rules
Instrument our security scanner with the ability to use custom semgrep
rules. This is inspired by the HVS teams use of semgrep.
* semgrep: add rule to detect string interpolation in WithInfoMsg
The event.WithInfoMsg function expects a set of key value tuples,
but it can easily be misunderstood to accept string interpolation
arguments. This check will error if any string interpolation verbs are
used in calls to event.WithInfoMsg
Propagate the downstream worker timeout into the
downstream receiver and downstream ticker
so we have a configurable consistent timeout
value to use for worker to worker interactions.
Also change the atomic.Pointer to an atomic.Int64
for consistency with other values.
* internal/session: update variable name in test
This was missed in #5071
* internal/tests/cluster: skip failing tests
These tests will need to be fixed or removed. It is not
clear why they are failing, but they are always failing.
* Makefile: try upgrading golangci-lint
* internal/host/plugin: fix flaky test
Hosts contain IP addresses in string form, whose
order is not defined.
The API automatically paginates to the end of a pagination,
and would take into account any items updated and subsequently
removed since the last pagination. It now also removes any items
removed during the current pagination.
* api: remove deprecated grant_scope_id field
The grant_scope_id field was deprecated in 0.15.0, so we can remove
it for 0.17.0.
* Fix tests
* Fix more tests
* Remove an option and some related code that stuck around
* Fix bats tests
---------
Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
The client agent serves on "localhost:9300" by default. It appears
on some systems this resolves to ::1:9300 and on some systems
127.0.0.1:9300. We should use the same address on the client
as the server to avoid any incompatibilities between systems.
* internal/cmd/wrapper: add deprecation wrapper
The deprecation wrapper can be used to display a warning to callers
when a command is deprecated.
* all: rename daemon to cache
Rename the boundary daemon command to boundary cache. This
avoids confusion with future client/daemons.
* changes daemon to cache in nav
---------
Co-authored-by: Robin Beck <stellarsquall@protonmail.ch>
* internal/gen: better API docs
Add various pieces of metadata that can be used by the API docs renderer.
Improve the service labels by specifying explicit tags.
Specify error responses. Specify version at generation time.
* internal/gen: add better errors
The default error entry is now used to cover all errors, as
adding a new error for every possible status code was a bit much.
This also properly includes the real error type now!
* Add various pieces of metadata that can be used by the API docs renderer. Improve the service labels by specifying explicit tags.
* make auth method API docs
* make API docs better
* make auth methods API docs nicer
* internal/gen: better attribute examples
Replace Output Only comments with a field behavior annotation in accounts.
Mark some fields as required.
Add elaborate description for attributes.
* Make API docs better
* Make API docs better
* Make API docs better
* internal/proto: regenerate files
* internal/proto: finish off account service
* Make API docs better
* internal/proto: add better API docs for aliases
* Tidy up service descriptions
* Added description for Boundary controller API doc
* internal/gen: add better API intro
Copy parts of the API docs into the description
* sdk: add openapi dependency
* internal/gen: move global API doc to separate file
* internal/gen: remove required annotations
Unfortunately, while these help with the creating of resources, they still
appear required in contexts where they are not, such as when
updating a resource.
* Review comments
---------
Co-authored-by: jigar-hashicorp <jigar.shah@hashicorp.com>
Co-authored-by: Isaac Christian (he/him) <112639904+isaacchristian@users.noreply.github.com>
* handlers/targets: always return pagination parameters in list
* handlers/authmethods: test for pagination parameters
Note that this already always returned the pagination parameters,
but now we have a test that it does so.
* handlers/accounts: test for pagination parameters
Note that this already always returned the pagination parameters,
but now we have a test that it does so.
* handlers/authtokens: test for pagination parameters
Note that this already always returned the pagination parameters,
but now we have a test that it does so.
* handlers/credentiallibraries: test for pagination parameters
Note that this already always returned the pagination parameters,
but now we have a test that it does so.
* handlers/credentials: test for pagination parameters
Note that this already always returned the pagination parameters,
but now we have a test that it does so.
* handlers/credentialstores: test for pagination parameters
Note that this already always returned the pagination parameters,
but now we have a test that it does so.
* handlers/groups: test for pagination parameters
Note that this already always returned the pagination parameters,
but now we have a test that it does so.
* handlers/host_catalogs: test for pagination parameters
Note that this already always returned the pagination parameters,
but now we have a test that it does so.
* handlers/host_sets: test for pagination parameters
Note that this already always returned the pagination parameters,
but now we have a test that it does so.
* handlers/hosts: test for pagination parameters
Note that this already always returned the pagination parameters,
but now we have a test that it does so.
* handlers/managed_groups: test for pagination parameters
Note that this already always returned the pagination parameters,
but now we have a test that it does so.
* handlers/roles: test for pagination parameters
Note that this already always returned the pagination parameters,
but now we have a test that it does so.
* handlers/scopes: test for pagination parameters
Note that this already always returned the pagination parameters,
but now we have a test that it does so.
* handlers/sessions: test for pagination parameters
Note that this already always returned the pagination parameters,
but now we have a test that it does so.
* handlers/users: test for pagination parameters
Note that this already always returned the pagination parameters,
but now we have a test that it does so.
Use the existing auth token account view for listing
instead of a custom query. Testing shows that the
performance difference is negligible, and this is simpler.
