* internal/handlers/managed_groups: ensure membership lookup is unlimited
Previously, we would only show the first 10,000 members in the group,
giving the impression that a complete list was performed. Now we
list all members.
* internal/handlers/accounts: ensure group lookup is unlimited
Previously, we would only show the first 10,000 managed group
memberships. Now we list all group memberships of an account.
Previously, we would list the managed groups with an implied
filter of db.DefaultLimit (10,000), which would incorrectly remove
a user from managed group memberships if there were more
than 10,000 managed groups in an auth method. Explicitly
set the list limit to unlimited to ensure all managed groups are
updated appropriately.
This commit changes the logic around selecting jobs to run. Before this,
Boundary used a view "job_jobs_to_run" which was a collation of all jobs
that were not running and scheduled to run. When jobs were requested to
run, Boundary would look at this view, grab a certain amount of jobs and
insert them into the "job_run" table. Importantly, while the amount of
jobs to be scheduled at once defaulted to 1 in the scheduler package,
this was entirely overriden in the controller package to -1 (no limit,
run all jobs that the query would return).
With this commit, Boundary now looks at the "job" table directly for
jobs to run, regardless of job run status. This was done to improve DB
performance as the view (which queried all "job_run" rows) was causing
significant DB contention.
Additionally, the option to limit job runs is now removed since it was
already hardcoded to -1 and not user-configurable anyways.
Should the need arise to implement this limit again, this will have to
be done in a different way since the new query does not account for
running jobs and limiting the rows returned after jobs are already
running would yield a no-op (the new query inserts nothing into
"job_run" if any given job is already running).
Before this change, upon the completion of a job run, the scheduler
would update a job_run entry with the completed status as well as the
number of objects affected by the run. Additionally, we then had a
cleaner job whose scope was deleting these completed entries from
job_run.
This commit changes this design to drop the cleaner job the and rolls
its functionality directly into the scheduler. Now, when any given job
run is complete, the scheduler will automatically delete it from the
job_run table itself.
In addition, the completed status has been removed as a valid status as
it is not set anymore.
This change follows a decision that given the data in these job_run
entries is already being deleted by the cleaner job, updating its state
when a job completes just to have it deleted is not efficient.
Additionally, no use-case for this data was surfaced.
* docs/client-agent: clarify use of override_upstream_dns_servers
The override_upstream_dns_servers option is recommended whenever
a user needs to override the DNS servers discovered from the system.
However, if a user supplies a DNS server that is only useable while
connected to a specific network, it will break the internet in
cases where it is not able to resolve these DNS servers.
Encourage users to supply both the VPN servers and the default
DNS servers.
* Update website/content/docs/api-clients/client-agent.mdx
Co-authored-by: Dan Heath <76443935+Dan-Heath@users.noreply.github.com>
* Update website/content/docs/api-clients/client-agent.mdx
Co-authored-by: Dan Heath <76443935+Dan-Heath@users.noreply.github.com>
---------
Co-authored-by: Dan Heath <76443935+Dan-Heath@users.noreply.github.com>
* docs/client-agent: clarify configuration reload on MacOS
The previous configuration was known to confuse at least one reader.
It's easy to just copy the first command you see and run it, so
make that the non-destructive reload command.
* docs/client-agent: correct log level config example
* Update website/content/docs/api-clients/client-agent.mdx
Co-authored-by: Dan Heath <76443935+Dan-Heath@users.noreply.github.com>
---------
Co-authored-by: Dan Heath <76443935+Dan-Heath@users.noreply.github.com>
This changes the periodic job that deletes terminated sessions to delete
the those sessions in batches. Prior to this, a single SQL DELETE
command was used to delete all qualifying terminated sessions. In
systems under heavy load, the statement could timeout leading to a
situation where no qualifying terminated sessions were ever being
deleted.
This adds retries as an attribute to JobStatus allowing a job to
indicate liveness to the scheduler when work has not progressed.
A job could use this and the statusThreshold passed into the Run method
to break work up into batches that would otherwise timeout if all the
work was attempted at once, for example a long running SQL delete
command.
The scheduler monitors running jobs to make sure they are not hung. If
the status of a running job does not change after a duration (the
interruptThreshold in the scheduler), the scheduler kills the job. This
change passes the scheduler's interruptThreshold to the job when it
calls Run() on the job.
* docs/client-agent: indent PAN docs correctly
Identifying the primary network interface is a sub-heading under the
PAN troubleshooting section.
* docs/transparent-sessions: add known issue around containers/VMs
VMs/containers that do not have access to the local network cannot
use aliases through transparent sessions.
* docs: TS public beta docs
* docs: Updates
* docs: Move Client Agent sections
* docs: Updates
* docs: Fix typo
* docs: Remove x86
* docs: Add lead in sentence for links
* docs: FAQ updates
* docs: Edits and file name fixes
* Update website/content/docs/api-clients/client-agent.mdx
Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com>
* docs: Add alias refresh interval
* docs: Remove recurse only option
* Update website/content/docs/api-clients/client-agent.mdx
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* Update website/content/docs/api-clients/client-agent.mdx
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* Update website/content/docs/api-clients/client-agent.mdx
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* Update website/content/docs/api-clients/client-agent.mdx
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* Update website/content/docs/api-clients/client-agent.mdx
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* Update website/content/docs/api-clients/client-agent.mdx
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* Update website/content/docs/api-clients/client-agent.mdx
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* Update website/content/docs/api-clients/client-agent.mdx
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* Update website/content/docs/api-clients/client-agent.mdx
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* Update website/content/docs/concepts/transparent-sessions.mdx
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* Update website/content/docs/concepts/transparent-sessions.mdx
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* Update website/content/docs/concepts/transparent-sessions.mdx
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* Update website/content/docs/concepts/transparent-sessions.mdx
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* Update website/content/docs/concepts/transparent-sessions.mdx
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* docs: Updates from code review
* docs: Update support request
* docs: Fix a typo
* Update website/content/docs/api-clients/client-agent.mdx
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* docs: Delete log example, create tabs
* client-agent: rework configuration docs
The section in the configuration talking about reloading the config
was repetitive and verbose. Combine the different sections into
two separate sections, one for updating general values and
one for reloading values, on MacOS only.
This also removes the specific Log section.
* docs: Minor rewrites
* client-agent: consistently use $ for shell sessions
* aliases: discourage single-word aliases
The use of single-word aliases breaks Transparent Sessions
on Windows, so we should discourage it. See ICU-15255 for more information.
* transparent-sessions: add known issues
Add two new known issues.
* client-agent: add troubleshooting section
* transparent-sessions: emphasize troubleshooting guide
* correct links
I haven't actually validated these links, but they
are now consistent with the rest of the links.
* Review comments
* client-agent: clarify that not all sessions are listed by command
* transparent-session: add known issue regarding Windows installer
* docs: Minor rewrites
* docs: Fix a typo
* docs: Add AssumeRole support
* docs: Add Backblaze support
* docs: Minor revision
* docs: Update MinIO reqs
* docs: Add supported Hitachi version
* docs: Trigger a new build
* docs: Clarify Desktop compatibility with control plane
* Update website/content/docs/enterprise/supported-versions.mdx
Co-authored-by: Robin Beck <stellarsquall@users.noreply.github.com>
* docs: Release notes 0.18.0
* docs: Add link to Client Agent docs
* docs: Update ts definition
* docs: Remove stray line
* docs: Fix minor issues with the assembly branch
* docs: Move section
* docs: Add section
* docs: Remove duplicate section
---------
Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com>
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
Co-authored-by: Robin Beck <stellarsquall@users.noreply.github.com>
* Update controller.mdx - public_cluster_addr
Updating public_cluster_addr to indicate that it is used if a load balancer is used for controllers. Also added a note about not including https:// and http:// in the address
* docs: Minor rewrite
* docs: Minor rewrite
---------
Co-authored-by: Dan Heath <76443935+Dan-Heath@users.noreply.github.com>
When a resource relating to a session is deleted,
notably a target, host, or auth_token, the corresponding sessions are
marked as canceled via a database trigger that calls the cancel_session
function. This function was performing a select as part of the insert
call to ensure that it would not attempt to insert a session_sate of
canceled if it was an invalid state transition. However, since this
function was first introduced, there has been additional constraints
added that would prevent an invalid state transition. In addition,
performing a select as part of an insert increases the chances for
contention with other queries that interact with the session_state
table, especially since a large number of sessions and session_state
rows can be included in a single transaction when things like
auth_tokens or targets get deleted.
Now, the cancel_function will perform the insert, and catch any of the
potential violations, allowing the query to continue without needing to
perform the select, thus reduction the potential for contention.
Johan Brandhorst-Satzkorn
Dan HeathandYoko Hyakuna
Michael Li
Elim Tsiagbey
Hugo
daniandDamian Debkowski
Michael Gaffney
Irena Rindos
Jim
hashicorp-tsccr[bot]andhashicorp-tsccr[bot]
Cameron Perera
Lisbet Alvarez
Danny KnightsandDan Heath
vanphan24andDan Heath
Timothy Messier