* feat: add a new daily billing view
* update views and table based on early feedback
* address review comments
* update CTE to be an accurate result of what we expect
* remove 'with time zone' from daily range
* remove timezone
* Update internal/db/schema/migrations/oss/postgres/70/01_hcp_billing_daily.up.sql
Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>
* Apply suggestions from code review
Co-authored-by: Timothy Messier <tim.messier@gmail.com>
* go mod updates
* fix tests
---------
Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>
Co-authored-by: Timothy Messier <tim.messier@gmail.com>
* Add more logging to worker auth rotation and test flags
This makes it much easier to figure out when and why rotation is
happening and control it for tests/debugging.
* Update auth rotation logic
Because we were looking at validity period of client certs, which may
not have matched the actual rotation interval, it was possible (mostly
in test scenarios) for the rotation to happen multiple times on the
roots before we actually hit the worker rotation interval.
This changes how the interval is calculated by looking at the difference
between not-after values on the certs to understand the rotation
interval being used by the controller. We then use that as the starting
point for calculating a next-rotation time.
This makes it much easier to figure out when and why rotation is
happening and control it for tests/debugging.
Remove cert skew
Cherry-picked from release/0.12.x
This allows for a greater delta between the period returned by vault and
they expected value to account for some delay due to load on the test
runners.
This option did not respect whether or not versioning was enabled when
writing it out during generation.
This does mean that there is a breaking change for auth tokens, but as
it was a no-op anyways it's easy to fix and not something I want to /v2
about.
* programatically rename unique and foreign key constraints to enforce 'tablename_uq' and 'reftable_fkey' patterns
* manually rename unique constraints for names over 63 characters
* update changed constraint names in db update testcases
* chore (dev/ldap): update gldap dependency
This update fixes the dup entries returned when searching for users
and/or groups
* feat (boundary/dev): add connection info for dev ldap server
`action.List` is a collection action, that is, it is not part of the set
of actions that can be executed against a single instance of any given
resource.
As part of the `ListPermissions` call, `idActions` is expected, that is,
all the actions that can be executed against a resource instance.
`action.List` will never be part of this. This commit updates the tests
to reflect this fact.
This makes two changes:
1. ListPermissions assumed every grant string had a type field, which
does not match all grant formats. It now infers type from ID for
formats which do not specify type.
2. Allow ID-only grant strings to be valid so long as the type specified
matches the type of the specified ID.
* internal/tests/cluster: switch flaky test to polling
Also extend deadline from 10 seconds to 1 minute, hopefully
this should fix any flakiness in this test.
* fixup! internal/tests/cluster: switch flaky test to polling
The sessions aggregate was inserting host_id and host_set_id,
columns which are no longer present on the session table. Also
fix the test that guards against regressions like this in the future.
The new `ExternalName` field is an optional field that is used to store
the cloud providers' human-identifiable name for a given compute
instance. This field is not user-editable, but it is kept in sync with
the cloud provider's through Boundary's `SetSyncJob`.
Do not allow PKI-KMS workers to have names updated via API
This would cause their public IDs to change, which we do not want.
Descriptions are also disallowed, since those come from the config file.
This also adds logic to allow upgrading from old KMS method to new, with
a test.
Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com>
This adds a new mechanism for worker authentication that uses the
third-party arbitration of the original KMS flow by leveraging
recently-added capabilities in nodeenrollment to support a registration
wrapper. This allows for workers to be registered to the system with
just a name and a matching wrapper, while at the same time allowing
these workers to be used for private Vault access and multi-hop as they
contain per-worker encryption keys and support rotation.
Nodes using this mode will generate and rotate credentials in-memory
(using another recently added nodeenrollment capability) so will have a
new set of keys on every startup. This has the side effect of ensuring
that there is never a conflict or re-use of these credentials.
Note that the normal test worker flow was using the now-deprecated KMS
method; there is still a test that uses this (explicitly) but all other
tests using test workers that did not specify a specific PKI flow now
actually use this mechanism. This means there is fairly decent test
coverage in a general sense, plus the specific tests updated/added for
this feature.
This also adds a new KMS type that can be used to have
distinct KMSes for upstream authentication vs. accepting from
downstream.
- Refactor the Target domain repository functions so that they no longer return 4 different types.
`Target` struct now contains `HostSource` & `CredentialSources` with Getters & Setters
- Extending `Target` to contain `HostSource` & `CredentialSources` enables `funcs` to just return `Target` instead of multiple return types.
This also allows easy future refactors and extensions of `Target`
* internal/db: add set_once_columns function
Also replace existing before_soft_delete_credential_vault_store
function and trigger with the new function.
* internal/db/schema: add note to replaced definitions
* Bats Tests: Target Host Sources
- Add bats test coverage for adding a Host Source to a Target
- Create `target_host_sources.bash` file with helper functions for bats test file
## Considerations
Created new resources like a target & host catalog instead of using already created resources because the changes could affect existing tests and it made it easy to change the newly created resources
This adds several relationships into the resource package that are then
made use of to improve the grant validation that runs during Parse. By
understanding mappings between ID and resource type the validation
checks can far better align with actual allowed grant formats so we can
find several common misunderstandings before they simply result in an
authorization failure.
In the future some of these functions could be used in the logic in the
actual ACL checks but it's not currently necessary and I don't want to
lump that change in with this.
Note that the tests have not meaningfully changed, but they _have_ had
to be updated because the stricter validation is actually catching
issues.
Jeff Mitchell
Michael Li
Haotian
Chris van Meer
Elim Tsiagbey
Johan Brandhorst-Satzkorn
XingLu Wang
Jim
Hugo
Zhihe Li
Damian Debkowski
