* Update golang.org deps and Go version
* Upgrade golangci-lint
* all: fix new vet warnings
https://github.com/golang/go/issues/60529 introduced a new
vet warning for when format strings are used without arguments,
which is technically a bug since it shouldn't be using the functions
taking format string arguments in those cases.
* mod: remove unnecessary import groupings
Move all imports into one of two groupings:
1. Direct dependencies
2. Indirect dependencies
This is the standard used by the go tool. The old groupings
seemed very random.
* mod: update go-plugin dependency
* internal/auth/password: add resizable pool
The resizable pool wraps the permit pool with a mutex
to allow it to be resized at runtime.
* internal/auth/password: add concurrency limit
The default concurrency limit is 1, and it can be
set using the SetHashingPermits function.
* internal/cmd/config: allow configuring hashing limits
The new concurrent_password_hash_workers configuration
value can be used to loosen the constraints on the
userpass auth method hashing operation.
* internal/cmd: set password hashing constraints
Sets the password hashing concurrency constraints on
startup and config reload.
* CHANGELOG: add notice about password concurrency limit
This removes the Cartesian product in the DB for GrantsForUser in favor
of returning the actual grant scope information and dealing with it in
application code.
(cherry picked from commit 913cd536823d73994acc4f4d833208c1cc05f91b)
By default, we will use a persistent cache for the
client cache. This will allow us to keep the cache
across restarts of the server and it will also
reduce the amount of time it takes to start the
server while reducing the amount of memory used.
This change also includes a validation of the cache
schema version. If the schema version is different
from the one expected, the cache will be
reset/recreated.
(cherry picked from commit cf8a51f3834033b7f986a9a7e091ab31c4328415)
Go 1.23.1 includes security fixes to the encoding/gob,
go/build/constraint, and go/parser packages, as well as bug fixes to the
compiler, the go command, the runtime, and the database/sql, go/types,
os, runtime/trace, and unique packages.
See: https://groups.google.com/g/golang-announce/c/K-cEzDeCtpc
* refact: to use go-dbw CreateItems, DeleteItems
Latest version of go-dbw updated the signature of
CreateItems(...) and DeleteItems(...) on a happy
note this latest version of go-dbw actually does
batch inserts and updates for this functions.
* all: regenerate protos with new protoc-gen-go version
* chore: update deps
* tests: update sqlmock tests for breaking chg
* tests (handlers): sort grants in checkEqualGrants(...)
sort the expected and got grants in
checkEqualGrants(...) to make the test more
deterministic.
* tests (asciicast): update backspace enc in TestEventMarshal(...)
This allows arbitrary programs to have an easy mechanism to make
connections through Boundary using Go. Internal cluster tests and test
helpers have been migrated to use this package, as well as the `connect`
command.
---------
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
This has been superceded by the nodeenrollment-based KMS worker auth
mechanism. This commit only removes the ability to connect with this
mechanism; some upgrade logic will remain intact for a bit and
can be removed later.
The commands added are:
boundary daemon start
boundary daemon stop
boundary daemon add-token
boundary daemon status
boundary search
If these actions are performed on a platform that doesn't support sqlite
natively in go an error is returned.
Besides some hooks into the cmd package all the significant logic
resides in internal/clientcache
feat (cmds/authenticate): output the token name when storing token
feat: update go-dbw which now uses pure go sqlite driver
refact (base.Command): export FlagOutputCurlString
Exporting FlagOutputCurlString allows other commands that embed
the base.Command to access the flag as needed
feat: add a cache Repository to manage cache storage
feat: add a "cache" CLI command
This new command will support both managing and searching the
local CLI cache daemon.
feat: start cache daemon as needed when issue CLI commands
Move files to new directories and add persona table (#3526)
* Add persona table and move files to new directories
Client daemon now uses unix sockets and update pathing (#3535)
* Add unix socket listen and dialers with file permissions applied
* Update the pathing to match RFC
Cache refreshing now uses all stored personas. (#3545)
Updating headers for LLB files
Decouple daemon and cache server (#3566)
* Separate daemon from server
* Add persona handler to daemon server (#3579)
Moved search to use mql and added tests for the search command (#3589)
* search uses hashicorp/mql
Windows support for client side daemon (#3618)
* exec.Command for background process
* Log to stderr when in foreground and file always
* Use pid files across platform for start and stop
Requests with version info must match the daemon's version (#3640)
* requests with version info must match daemons
Update dependencies and breakout cgo/pure go sqlite drivers (#3657)
upgrade go-dbw deps and add cgo build tags
Enable graceful shutdown in windows (#3695)
* Enable graceful shutdown in windows
Co-authored-by: Jim <jlambert@hashicorp.com>
Targets delete when a persona changes address or user id (#3673)
* Handle cache refresh in repo
Add sessions to the client side cache (#3682)
* Add sessions to repository
* Search command supports sessions
* adding session related tests to db and refresh
Change cache schema from personas to tokens+users (#3737)
* Change from personas to tokens+users
* Separate keyring tokens from auth tokens
Add support for keyringless auth tokens (#3765)
* Add support for keyringless auth tokens
Remove expired auth tokens from cache (#3768)
* Remove expired auth tokens from cache
Complete the TODO of checking for inflight tx (#3779)
Delete tokens that the controller says are invalid (#3782)
fix search test with boundary token check (#3799)
Collect resource info in repository_<resource>s.go (#3769)
* Collect resource info in repository_<resource>s.go
* Move search logic into the domain (#3794)
Daemon and search restricted to supported platforms (#3801)
* Daemon and search restricted to supported platforms
Reorganize the clientcache packages (#3814)
* Refactor for self contained domain logic
* Put clientcache stuff under internal
Previously this would truncate to the nearest integer, which could
result in clients retrying before the quota has reset, and getting rate
limited again. This also includes an update from go-rate that will round
up when reporting the reset time for the RateLimit header.
Note that in the case of a 503, the Retry-After header was already being
set correctly.
See: https://github.com/hashicorp/go-rate/pull/8
Johan Brandhorst-Satzkorn
dani
dependabot[bot]
Elim Tsiagbey
Damian Debkowski
Louis Ruch
Jeff Mitchell
Jim
Michael Gaffney
Irena Rindos
Michael Li
Todd
Timothy Messier