* Add generic read/update/delete commands
This adds three generic commands that use the resource prefix to
determine the subcommand to run and pass through args over to that
subcommand. Since this occurs very early on and to avoid loading
essentially every internal resource package, I moved subtype definitions
to globals.
This replaces #3967
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* De-duplicate Subtype code (#4031)
Co-authored-by: Timothy Messier <tim.messier@gmail.com>
---------
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
Co-authored-by: Timothy Messier <tim.messier@gmail.com>
* If passing a private key without specifying it in URL syntax, give a
proper error message (previously we were only making sure it was a
scheme we knew how to handle, but we need to also be more informative
if it's not a URL at all)
* If the handshake from the proxy fails, don't hang, just exit
* Update some error messages to use capitalization in line with our
standard CLI error format
* Minor test fixes
The auth rotation test fix allows us to keep checking if we did not yet
see the expected bytes in case the call to lookup succeeds but we are
late in rotating due to parallelism.
The api credentials test fix allows us to check if at _least_ one
rotation has happened. That way if two rotations happen before we check
again due to parallelism, this is deemed a successful result.
* Add timeout to auth rotation test
The nhooyr/websocket library now has a release with the new default
behavior that removes the message size limit. This allows us to switch
off of the fork and back to the upstream.
In the same release that includes the fix we need for the boundary
client, the wspb helper package was removed from websocket. This package
contained some functions to read and write protobuf messages. However,
it was using the deprecated github.com/golang/protobuf/proto library. To
avoid this dependancy in the library they opted to just remove wspb.
Thus this provides a replacement implementation that uses
google.golang.org/protobuf/proto. Notably the newer proto library seems
to lack an equivalent of proto.NewBuffer so writes to the websocket and
not able to leverage a sync.Pool of byte.Buffers to reduce allocations.
Refs: 88bb253554
See: https://github.com/nhooyr/websocket/commit/ac385120c6e34fa6584f3856d5db949a21bbb65e
Two Vault client settings were not being properly used when constructing
a Vault client.
The `TLS Skip Verify` setting was only being set if a `CA Cert` was also
configured. This fix sets the `TLS Skip Verify` when configured
regardless of other settings. Closes#3961.
The `TLS Server Name` setting was never being set. Bad programmers. This
fix now sets it on the Vault client if the Vault Credential Store has
been configured to use a value for this setting. Closes#3962.
* Add generic read/update/delete commands
This adds three generic commands that use the resource prefix to
determine the subcommand to run and pass through args over to that
subcommand. Since this occurs very early on and to avoid loading
essentially every internal resource package, I moved subtype definitions
to globals.
* Update main.go
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* Update changelog and remove another deprecated command
---------
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
The Vault Credential Store only accepts Vault tokens that have a TTL
greater than the internal job scheduler's run frequency. This prevents a
Vault Credential Store from being created with a Vault token that will
expire before Boundary can renew it.
The Vault test server, by default, creates Vault tokens with a TTL equal
to the duration of time remaining until `t.Deadline()` is reached.
This change sets the test controller's default job scheduler duration to
be half of time remaining until `t.Deadline()`. The default job
scheduler duration can still be overridden by setting a duration on
`TestConrollerOpts.SchedulerRunJobInterval`.
This change fixes the error received when running:
go test -timeout 30s \
-tags devlicense \
-run '^TestList$' \
github.com/hashicorp/boundary/internal/tests/api/credentialstores
Which returned this error:
{"kind":"Internal",
"message":"credentialstores.(Service).createInRepo: unable to create
credential store: vault.(Repository).CreateCredentialStore: unknown,
unknown: error #0: scheduler interval must be greater than token
ttl. scheduler jobs interval value: 1m0s"}
In #2076 the refactor changed the position of a parenthesis, causing
the dev key to truncate the base64 representation instead of specifying
which bytes to base64 encode.
We don't need this slicing anymore anyways since we now do individual
key generation calls so just remove it.
The TestObject test helper previously returned an error,
but it's easier to have it perform the error check itself,
as it conventionally done with test helpers.
This is a lint error but wasn't caught because it was a
historic problem. It's appearing again now because we're
adding another method to this type as part of the
pagination workflow.
* fix: monitorUpstreamConnectionState CPU consumption
`monitorUpstreamConnectionState()` is a goroutine that listens for GRPC client connection changes using GRPC's `WaitForStateChange` method. `monitorUpstreamConnectionState()` was consuming the a lot of CPU. It was continuously running and not actually waiting for state changes. The `state` for `monitorUpstreamConnectionState()` was not getting correctly updated which caused the loop to continuously run instead of waiting for new state changes.
Update GRPC `WaitForStateChange` method to use the same `state` that gets updated.
We inadvertently used
kms.GetWrapper(ctx, am.ScopeId, kms.KeyPurposeDatabase)
which resulted in the use of a database key for an oplog entry.
See:
https://github.com/hashicorp/boundary/pull/3665/files#diff-bcf83b5283886c98fc45b6435fdc94d87d545b2768c6beac8acd14eb9d6b13f1
This fixes the issue with the missing "Database" purpose key when
we converted the oplog keys into their own tables.
We chosen to truncate the existing oplog entries to eliminate any
references to a Database kms key in existing oplog entries.
In preparation for putting proxy code in the api package this creates some necessary fields in the target output and it pre-moves credential parsing and proxy handshake code to their new places. This will make the diff for the actual proxy code move quite a bit smaller.
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
With a suitably slow system -- say, if you're waiting on a Windows
Terminal to output text inside a virtual machine -- the expected order
of things can be thrown off. One specific way this can happen is that
the worker can attempt to dial and have its dial fail because of the
slowness causing the dial context to time out. If, because of the
slowness, we also haven't released the log gate yet, then the event with
the failure information will be queued, along with the context that was
used.
Unfortunately, in some of these error cases, the context that was used
was the dial context instead of the system base context. In many other
places in the function it was the system base context so this is just a
mismatch, probably from code written at different times.
Normally this wouldn't be a problem as we'd fall back to the underlying
logger, but when we release the log gate, things happen differently:
it's a synchronous function and on error it causes us to abandon
system startup entirely.
This commit fixes the issue with using the incorrect context. It's an
open question whether we should change the behavior around errors when
replaying queued events, falling back to the underlying logger instead
of erroring.
* chore: Fix comment typo
* test(e2e): Update to use new credential library type
* test(e2e): Update to use new field name
* test(bats): Remove tests that use deprecated subcommand
* chore: Update to 0.14.0
* test(credentiallibraries): Update to use new credential library type
* doc: Add deprecation notices for 0.14.0
* fixup! doc: Add deprecation notices for 0.14.0
Sepehr
Michael Li
Damian Debkowski
Michael Gaffney
guangwu
Sorawis Nilparuk (Bo)
Jim
dani
Elim Tsiagbey
Devon Anderson
Devon Anderson
April Ayres
Sepehr
April Ayres