* Adds WorkerAuthStorage wrapper for worker credential encryption using nodeenrollment library.
* Adds AuthStoragePath field in worker config and dev mode to specify directory to store credentials.
* Remove the server_id from session table, change it to worker_id on session_connection
This is step 1 in updating the worker table. The worker is becoming a public resource so it must have
a public id. We drop the server_id column on the session_connection table and add the worker_id column
so we can use the wt_public_key type. Since db migrations are applied while the controller is offline,
it should be safe to assume all session connections are not in a running state, thus allowing us to null
out all the worker ids in the session_connection table.
For now we don't have very good enforcement of the wt_public_id constraints, since the id is currently
defined in the worker config, but this will soon change and the worker's id will be generated by the
controller.
* feat(controller): New health service and server
This change also implements a new listener purpose, `ops`.
`ops` (short for operations) is a new listener purpose that is
responsible for serving Boundary's operations endpoints, like health
and possibly metrics.
At Startup: `ops` listeners get configured as late as possible to catch
any errors with the startup process;
At Shutdown: If the health endpoint has been set-up, we introduce a
configurable delay in the process. This is to enable the health endpoint
to report unhealthy for that amount of time. `ops` listeners are also
the last listeners to be shutdown.
This feature allows the user to set the `controllers` field to a string
that points to either an environment variable or file.
We then dynamically pull out the value and parse it into the config.
This feature allows the user to set the `tags` field to a string
that points to either an environment variable or file.
We then dynamically pull out the value and parse it into the config.
This can also be done at the keys level, where you set your keys
directly in Boundary's config file, but point the values to env/file.
* feat (events): Add new options needed for AuditConfig
WithAuditWrapper and WithFilterOperations all for optional paramters
when creating AuditConfig types.
* refactor (event): Change EventerConfig.Sinks to a ptr
We need to modify the SinkConfig.AuditConfig during the NewEventer factory, so we have to use a ptr not a ref.
* feat (events): Add audit configuration types
* feat (events): add audit config to sink configuration.
* feat (events): add redact/encrypt node for audit events to Eventer
Integrate the encrypt.Filter node from the eventlogger into the
event.Eventer, so audit events can be redacted/encrypted based
on data classifications.
* test (events) Add test protobufs for events
Add test protobufs along with a test service for testing
the audit event encrypt node
* Normalize event configuration
This updates event configuration stanzas to more closely match behavior
for listeners and kmses:
* Singular "sink" instead of "sinks" (probably not the most correct
option, but a consistent option, and one that makes sense for HCL)
* Allows sinks to have the type defined at the start of the block
* Moves type-specific configuration to a specific named block
Co-authored-by: Jim <jlambert@hashicorp.com>
This ensures that cors_allowed_origins can be set when cors_enabled is
not explicitly specified and allowed to be its default (currently true).
The current behavior is to clobber this value when cors_enabled is not
explicitly set, ultimately setting it to the default of
"serve://boundary" only.
Jeff Mitchell
Haotian
Todd
Timothy Messier
Hugo
Irena Rindos
Irena Rindos
Irena Rindos
Jim
Louis Ruch
Chris Marchesi
Jeff Malnick