* bug(vault): Correctly handle credential stores with expired tokens
Boundary makes use of a database view to perform CRUD operations on
Vault credential stores and libraries. This view did not include
credential stores with tokens that have expired in Vault, causing
errors when attempting to perform any action against them.
This adds an action to the API that allows pulling out an activation
token that can be given to a worker in its config (directly or via env
or file). The worker can pass this along with its normal request in
place of its normal nonce and the server will automatically accept it.
Co-authored-by: Irena Rindos <irenarindos@users.noreply.github.com>
Disable the fail-fast feature for the matrix strategy. This prevents a
single failure to cascade to all jobs in the matrix. This prevents cases
where other jobs fail before they're able to clean up resources.
Signed-off-by: Ryan Cragun <me@ryan.ec>
On a SIGHUP, if the worker's `initial_upstreams` config option has
changed, it will use the new values as the address to send its status.
Any previously discovered upstream addresses from previous status
requests are dropped. Once a successful status request is made to the
new addresses, the worker will resume its normal behavior of using the
addresses from the response to the status request.
This allows a worker to be deployed in a more stable way in a dynamic
environment where controller IPs could change. In particular this helps
with a case where all controllers are replaced with new controllers
running on new IPs.
To illustrate with an example, suppose there is an instance group of
controllers instances. And there are worker instances that have their
config rendered from consul-template that sets `initial_upstreams` to
the IPs of the controller instances. If all controller instances are
restarted or replaced at the same time and assigned new IPs, a new
config will be rendered for the worker. Previously the only way for the
worker to use the new value would be for the worker process to be
restarted. Otherwise the worker would only know about the previous IPs
and would fail to connect to the new controllers. However, a restart
would mean any active sessions and session connections on the worker
instance would be terminated. With this update, consul-template can send
a SIGHUP to the worker, the worker will connect to the new controllers
and resume normal status reporting, allowing the sessions and session
connections to remain.
The same principles would apply for other examples of dynamic
environments such as nomad and kubernetes.
See:
https://github.com/hashicorp/consul-templatehttps://www.nomadproject.io/docs/job-specification/template
* feat(sql): Fork pgtap to support arm64
This forks pgtap-docker and builds the image locally,
and updates our references to use our forked image.
* fixup! feat(sql): Fork pgtap to support arm64
Although there is a compile time check on the type, it will always
succeed due to the Unimplemented embedding requirement.
As a result, this PR also changes Unimplemented calls to Unsafe calls,
which were added later "for those that prefer their code to break"; the
comments on these state:
// UnsafeXServiceServer may be embedded to opt out of forward compatibility for this service.
// Use of this interface is not recommended, as added methods to XServiceServer will
// result in compilation errors.
See https://github.com/grpc/grpc-go/issues/4500#issuecomment-852597871
for some more context.
I think we're fine with compilation errors though; we own both the
server and client side of things and generally are going to add new
methods only when we intend to also add them on the client side.
Notably, what the comment does not indicate is that it will break at
runtime; already it should return a suitable (404 or 405) error if the
client requests a method that does not exist.
* adds CLI commands for add/set/removing worker tags, and respective tests
* adds StringSliceMapVar Flag to convert a string from the CLI to a map[string][]string value
This fixes occurences of a loop variable being captured in parallel
tests. With the previous code, only the last test case is actually
exercised. To work around this problem, we create a local copy of the
range variable before the parallel test, as suggested in the
documentation for the `testing` package:
https://pkg.go.dev/testing#hdr-Subtests_and_Sub_benchmarks
Issues were found automatically using the `loopvarcapture` linter.
* Enos: add additional guards before authentication
Previously, we would see failures when the ALB in front of a
cluster was alive and passing healthchecks, but the database behind
had not been initialized yet. This adds a check with an unauth'd
call to `auth-methods list` to validate the DB is up before auth.
This adds the ability to define hooks that will run prior to a schema
migration. The hooks should only be used when a migration would fail due
to data being in an invalid state, likely due to a bug in the previous
schema definition. For example if a column was missing a constraint, and
a new migration is attempting to add the constraint, there might already
be values that violate the new constraint. In such cases, we would want
the user to make a decision to address the data, and need to provide
them with details about what data is problematic in case they want to
manually address the problem. To help the user, if there is a sane way
to address the data, we should provide an option to automatically
"repair" the data, allowing the migration to continue. However, this
still should be an explicit opt-in from the user, and we need to clearly
describe what the repair option would do to the user so they understand
the consequences of opting in.
To accomplish this each migration can be provided a hook that contains a
CheckFunc, RepairFunc, and RepairDescription. These functions must
operate at the point-in-time of the migration immediately preceding the
current migration, as as such they should not use and domain packages or
repositories, instead they should use direct sql with the sql library.
The description is used to explain what the RepairFunc will do.
Hooks should be defined in `internal/db/schema/migrations/oss/oss.go`
and registered with the schema edition.
See the example in `internal/db/schema/manager_example_test.go` for more
details.
This allows a check function to be set to determine whether it is
allowed to be set. This also ensures that if null is allowed it is
either the only value or not set.
* Add mechanism for plugin to normalize attributes
This introduces a new normalization call to the plugin RPC service. If
implemented, the plugin will be given the attributes prior to saving
them in a create/update call, and can perform any normalization needed,
e.g. ensuring that a parameter passed in is represented in a canonical
way. As an example, the CLI allows a user of the AWS plugin to pass in a
string, but canonically it is a string slice, and should be returned
that way as well. Not by chance, this is the exact behavior of the
testing implementation of this function.
This does not update any individual plugin, but rather sets the
controller-side logic up for plugins to support this functionality.
Enos jobs are still a bit unstable, we should use them as
advisory for now. When they have gained more stability,
we can let them fail pipelines again.
* 0.10 release notes
This PR proposes the addition of the 0.10.0 release notes to the Boundary Docs page
* update nav structure to include 0.10.0
* Update v0_10_0.mdx
Added link to HCPb Credential Injection Tutorial
* chore(deps): Update grpc-gateway dependency
This fixes an issue which would allow an attacker to trigger a
(recovered) panic in the gateway handler.
* fix(server): Use cmp.Diff instead of assert.Equal
Testify is not great at handling protobuf types, and
was for some reason returning a diff here when in
reality there is none. Switch to go-cmp for the
comparison to remove the error.
For a flag type used for attributes/secrets, values have always been
able to be used with env:// or file:// format, but the error check to
see whether the value was successfully parsed was doing a simple string
equality rather than `errors.Is`. As a result a value containing a colon
would trip up this check and cause an error, rather than allowing it to
be used as a bare value.
Louis Ruch
Jeff Mitchell
Ryan Cragun
Timothy Messier
Johan Brandhorst-Satzkorn
Zhihe Li
Damian Debkowski
Haotian
Danielle
Renato Costa
Jim
Josh Brand
Damian Debkowski
Michael Gaffney
Jaymala
Adam Bouhmad