* all: Upgrade listenerutil dependency
The new listenerutil implements http.Flusher, which is necessary
for streaming responses from the grpc-gateway to work.
* daemon/controller: Remove newline delimiter in streaming responses
The default gRPC-Gateway HTTPBody marshaler uses newlines
as a delimiter. This introduces newlines in our streamed responses.
Wrapping the default marshaler lets us define a nil delimiter, which
ensures our streaming responses are unaffected by the server side
chunking.
When possible downstream workers will include their worker id information in
the connections they establish with the upstream using the nodeenrollment
library. The tracking listener now tracks connections that are connected in
this same way instead of just connections of type *tls.Conn.
* chore: Upgrade Go version
* fix: Upgrade golangci-lint to support 1.20
* fix: Don't use t.SetEnv in parallel tests
This is a panic in Go 1.20 and it sounds like a recipe
for distaster in general.
This commit replaces `os.MkdirTemp` with `t.TempDir` in tests. The
directory created by `t.TempDir` is automatically removed when the test
and all its subtests [complete.
Prior to this commit, temporary directory created using `os.MkdirTemp`
needs to be removed manually by calling `os.RemoveAll`, which is omitted
in some tests. The error handling boilerplate e.g.
defer func() {
if err := os.RemoveAll(dir); err != nil {
t.Fatal(err)
}
}
is also tedious, but `t.TempDir` handles this for us nicely.
Reference: https://pkg.go.dev/testing#T.TempDir
Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
* fix(enos): Make sure enos reports test as failure
After updating this command to save off the output from running `go test`, enos would not report when tests failed. This was due to the extra pipe hiding the exit status of the prior commands. Adding this option should return the status of the last command to exit with a non-zero status.
* doc(e2e): Fix comments
* refact(e2e): Update AuthenticateCli to accept auth method id
* refact(e2e/migration): Use docker to set up vault instead of enos
* refact(e2e/migration): Adjust where environment variables are set
* docs: update deploy-and-login getting started guide with new authenticate usage
* docs: update api-clients/cli.mdx to remove login-name flag when using authenticate
* docs: update common-workflows/manage-users-groups.mdx to remove login-name flag when using authenticate
* docs: update common-workflows/workflow-ssh-proxycommand.mdx with new short form usage of authenticate command when using the primary auth method in the global scope
* docs: update oss/installing/no-gen-resources.mdx to remove login-name usage in authenticate command
* docs: update oss/installing/run-and-login.mdx with short form usage of boundary authenticate
* docs: fix tabs
* docs: fix numbering
* Apply batch of suggestions from code review
Co-authored-by: Robin Beck <stellarsquall@users.noreply.github.com>
* docs: fix code blocks
* fixes code blocks
---------
Co-authored-by: Dan Heath <76443935+Dan-Heath@users.noreply.github.com>
Co-authored-by: Robin Beck <stellarsquall@users.noreply.github.com>
Co-authored-by: stellarsquall <stellarsquall@protonmail.ch>
When using the json output of the cli (`-format=json`), a successful
call to the controller API would place the HTTP status code in the JSON
as `status_code`. However, if there was an error from the API the status
code would be placed in the JSON as `status`. In order to be consistent,
this adds a `status_code` field to the error response case. For
backwards compatibility it still populates `status` in the error case.
This inconsistency was missed partially due to a bug in the CLI tests.
The assertion on status code was not valid and would always be
successful. Thus this also fixes the assertions and tests.
This ensures that checks for features should work, and bails early if
that is not the case, since if this fails the binary is essentially
broken. This also simplifies code that performs these checks, ie instead
of:
binaryVersion, err := version.GetReleaseVersion()
if err != nil {
// handle error? panic?
}
if version.SupportsFeature(binaryVersion, version.FeatureA) {
// code for FeatureA
} else {
// without FeatureA
}
Implementations can do:
if version.SupportsFeature(version.Binary, version.FeatureA) {
// code for FeatureA
} else {
// without FeatureA
}
Add vault ssh certificate credential library
This adds a new credential library type, `vault-ssh-certificate`, which
can be used with vault's ssh secret engine to generate certificates to
use as credentials for ssh. This new credential library can be created
using:
boundary credential-libraries create vault-ssh-certificate
See the help output for a full list of the options supported.
This also renames the `vault` credential library subtype to
`vault-generic`. The previous subtype of `vault` will continue to work,
thus the following commands are equivalent:
boundary credential-libraries create vault-generic
boundary credential-libraries create vault
See: https://developer.hashicorp.com/vault/docs/secrets/ssh
When issuing credentials from vault credential libraries, only persist
the vault credential if it is revokable. A credential that is revokable
has a valid lease id that can be used to revoke the lease in vault. If
the credential is not revokable it is also not renewable since renewing
also requires a lease id.
See: https://developer.hashicorp.com/vault/docs/concepts/lease
Johan Brandhorst-Satzkorn
Michael Li
Mark Collao
Todd
claire labry
Jeff Mitchell
Mike Baum
Irena Rindos
Robin Beck
Eng Zer Jun
Damian Debkowski
Haotian
Timothy Messier
Cameron Perera
Hugo