* fix (events): convert multierror to stdlib error
multierror errors will be converted to a stdlib error (because
multierror doesn't support json marshaling).
* refact (errors): convert from multierror to stdlib errors.Join(...)
* refact: convert from pkg/errors to stdlib error wrapping
* fix (auth/ldap): fix which DEK is used for oplog during authenticate
* chore: update go-kms-wrapping dep for new extras/kms changes
The latest version supports setting a table name prefix for a kms
which is needed to fix our oplog DEK problem
* chore: update extras/kms dep
This latest version supports an optional TableNamePrefix which is
required to fix our existing oplog DEK issue.
* fix (oplog): schema oplog DEK fix
These changes will allow use to store the oplog DEK in it's own
set of tables, so they won't get deleted when a scope is deleted
* fix (kms): move oplog DEK into its own internal kms
* tests: update tests to be compatible with oplog fix
* tests: remove migration tests which are incompatible with oplog fix
These tests no longer work because they are missing the required
schema changes for the oplog fix
* feat (auth/ldap): add Repo support for max page size and deref aliases (#3670)
* chore: update cap/ldap dependency
This latest version of cap/ldap adds support for MaxPageSize and
DerefAliases
* feat (auth/ldap): add MaxPageSize and DerefAliases to storage proto
* feat (api/authmethods): add new ldap fields.
Add support for maximum_page_size and dereference_aliases
* feat (auth/ldap): schema changes to support new LDAP attributes
* feat (auth/ldap): add Repo support for max page size and deref aliases
* feat (handlers/ldap): add support for new fields (#3674)
Added API support for new ldap fields: MaximumPageSize and
DereferenceAliases
* chore: add CHANGELOG entry for new api auth ldap fields
* Adding explicit MPL license for sub-package.
This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository.
* Adding explicit MPL license for sub-package
This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository.
* Updating the license from MPL to Business Source License
Going forward, this project will be licensed under the Business Source License v1.1. Please see our blog post for more details at https://hashi.co/bsl-blog, FAQ at www.hashicorp.com/licensing-faq, and details of the license at www.hashicorp.com/bsl.
* Update copyright file headers to BUS-1.1
* Rerun make gen
This will pick up the last of the license changes
* Revert "Rerun make gen"
This reverts commit dbe0968bffd92745d8663c6940debae098395a6b.
* Remove copywrite from generation script
The current version of copywrite is not sophisticated enough
to only apply the copywrite changes to certain subdirectories,
so to avoid accidentally relicensing our api and sdk modules,
we will stop running the copywrite script until such time
that it can do the right thing.
* License protobuf API as MPL
The protobuf API files are used to generate the SDK,
since we want the SDK to be MPL, the protobuf files
must also be MPL. This extends to all protobuf files
whose sources end up in the SDK directory, including:
- internal/proto/controller/api
- internal/proto/controller/custom_options
- internal/proto/plugin
It also includes the generated service directory in
internal/gen/controller/api/services, since they are
generated from the protobuf sources used for the SDK.
* Change website license file name
This makes the naming scheme consistent with the rest
of the repository.
* Add note on licensing to README
* Set copywrite license to BUSL
* Revert "Add note on licensing to README"
This reverts commit 4d865a91a7a4f11605f0dc4609355d7e3c3cfffe.
---------
Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com>
Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
* fix issue where conflicts weren't being handled
* Instead of using on collision, alter the daily_range
* move tests to appropriate file
* Apply suggestions from code review
Co-authored-by: Michael Gaffney <mike@gaffney.cc>
---------
Co-authored-by: Michael Gaffney <mike@gaffney.cc>
* update census to run less frequently
* Update internal/census/census_job.go
Co-authored-by: Michael Gaffney <mike@gaffney.cc>
* change nextrunin duration
---------
Co-authored-by: Michael Gaffney <mike@gaffney.cc>
As part of the performance improvements for listing sessions for v0.9.0,
the view used to retrieve sessions for listing was updated to no longer
include a join on session_connection. However, a later migration that
was adding additional columns to this view inadvertently re-added the
join and session_connection columns. This resulted in requests to list
sessions performing this join, and returning additional rows for each
connection in a session. The application would ignore this additional
data, since it is no longer returned via the API. This would be
particularly impactful in cases where there are a large number of
connections per session, as this would greatly increase the amount of
data returned by the database.
This fix removes the session_connection join from this view, which
should restore the original performance improvements even in cases where
there is a large number of session connections per session.
See: https://github.com/hashicorp/boundary/pull/2160
Ref: 32070678dc
Fixes: 1e3c941be1
(cherry picked from commit 7aef341682e65b42c1b919e03936bdf81e26e87c)
As part of the performance improvements for listing sessions for v0.9.0,
the view used to retrieve sessions for listing was updated to no longer
include a join on session_connection. However, a later migration that
was adding additional columns to this view inadvertently re-added the
join and session_connection columns. This resulted in requests to list
sessions performing this join, and returning additional rows for each
connection in a session. The application would ignore this additional
data, since it is no longer returned via the API. This would be
particularly impactful in cases where there are a large number of
connections per session, as this would greatly increase the amount of
data returned by the database.
This fix removes the session_connection join from this view, which
should restore the original performance improvements even in cases where
there is a large number of session connections per session.
See: https://github.com/hashicorp/boundary/pull/2160
Ref: 32070678dc
Fixes: 1e3c941be1
This adds the `update_sessions_pending_daily_snapshot` SQL function
which updates the `sessions_pending_daily_snapshot` table by inserting
values for any days missing from the table.
This also adds a check constraint to the
`sessions_pending_daily_snapshot` table along with a `comment on table`.
This also removes the hcp daily billing views since they are no longer
needed.
Ref: ace2def49d
The hcp monthly billing views build a range of buckets using the
`generate_series` and the `now()` functions along with relative offsets
like `+ 1 month`. The calculated start and end times for these views can
vary depending on the time zone setting of the PostgreSQL server.
This adds 3 table functions that call their respective views with the
time zone set to UTC. Calling these functions instead of their
underlying views directly prevents the returned values from varying when
the server's time zone is not set to UTC.
This also drops support for PostgreSQL 11. The included tests use the
`date_trunc(field, source [, time_zone ])` function added in PostgreSQL
12.
Fixes: 41b1b5b4b7
The hcp billing `_all` views built a range of buckets using the
`generate_series` function using the minimum value of the
`session_pending_time` column from the `wh_session_accumulating_fact`
table as the start time and `now()` as the end time. It then truncated
values in the series using the `date_trunc` function. This allowed the
generated series of buckets returned to vary and could result in one
additional bucket being included in the series depending on the current
time and the start time.
As an illustrative example, the `hourly_all` query used:
select date_trunc('hour',time)
from generate_series(
(select min(session_pending_time) -- start time
from wh_session_accumulating_fact),
now(),
'1 hour'::interval
) as time;
Substituting the start time with a hard coded value to show the issue:
-- Show current time, where the minutes portion is 55
select now();
now
-------------------------------
2023-05-22 14:55:40.567605+00
(1 row)
-- generate series with start time's minutes portion at 57
select date_trunc('hour',time)
from generate_series(
'2023-05-22 01:57:00'::timestamptz,
now(),
'1 hour'::interval
) as time;
date_trunc
------------------------
2023-05-22 01:00:00+00
2023-05-22 02:00:00+00
2023-05-22 03:00:00+00
2023-05-22 04:00:00+00
2023-05-22 05:00:00+00
2023-05-22 06:00:00+00
2023-05-22 07:00:00+00
2023-05-22 08:00:00+00
2023-05-22 09:00:00+00
2023-05-22 10:00:00+00
2023-05-22 11:00:00+00
2023-05-22 12:00:00+00
2023-05-22 13:00:00+00
(13 rows)
-- Wait a few minutes
select now();
now
------------------------------
2023-05-22 14:58:48.75287+00
(1 row)
-- Now run again and get an extra result, even though still
-- within the same hour
select date_trunc('hour',time)
from generate_series(
'2023-05-22 01:57:00'::timestamptz,
now(),
'1 hour'::interval
) as time;
date_trunc
------------------------
2023-05-22 01:00:00+00
2023-05-22 02:00:00+00
2023-05-22 03:00:00+00
2023-05-22 04:00:00+00
2023-05-22 05:00:00+00
2023-05-22 06:00:00+00
2023-05-22 07:00:00+00
2023-05-22 08:00:00+00
2023-05-22 09:00:00+00
2023-05-22 10:00:00+00
2023-05-22 11:00:00+00
2023-05-22 12:00:00+00
2023-05-22 13:00:00+00
2023-05-22 14:00:00+00
(14 rows)
To fix this, we call the `generate_series` function truncating the start
time argument to the bucket size:
-- Hourly
select bucket
from generate_series(
date_trunc('hour', select min(session_pending_time)
from wh_session_accumulating_fact)),
now(),
'1 hour'::interval
) as bucket;
-- Monthly
select bucket
from generate_series(
date_trunc('month', select min(session_pending_time)
from wh_session_accumulating_fact)),
now(),
'1 month'::interval
) as bucket;
Fixes: 41b1b5b4b7
Certain tests fail when run on the first day of the month because of
edge cases in the setup of test data. This adds conditional logic to
skip those tests when run on the first day of a month.
This adds the `recording_dynamic_credential` join table and a trigger
that runs as an after insert on the `recording_session` table. The join
table joins the `recording_session`, `credential_vault_store_hst`,
`credential_library_history_base`, and the `credential_purpose_enm`
tables.
This changes multiple IDs in the colors persona to be 12 characters. It
also renames some IDs in an attempt to make them more consistent. This
also changes the order of the columns in some insert statements to
follow the pattern of the other insert statements.
This also adds documentation to the top of colors persona file in an
attempt to explain the general patterns being followed in the file.
This adds history tables for `credential_vault_store`,
`credential_vault_library`, and `credential_vault_ssh_cert_library`.
This also adds a base table for the credential library history tables.
This adds an `endpoint` column to the `recording_session` table and
updates the session recording insert trigger to copy the value of
`endpoint` from the `session` table to the `recording_session` table.
This adds the `recording_static_credential` join table and a trigger
that runs as an after insert on the `recording_session` table. The join
table joins the `recording_session`, `credential_static_store_hst`,
`credential_static_history_base`, and the `credential_purpose_enm`
tables.
This adds history tables for `credential_static_store`,
`credential_static_json_credential`,
`credential_static_username_password_credential`, and
`credential_static_ssh_private_key_credential`. This also adds a base
table for the static credential history tables.
This adds four columns to the `recording_session` table which are
foreign keys to the `iam_scope_hst`, `target_ssh_hst`,
`host_history_base`, and `host_catalog_history_base` tables. The foreign
key to the `iam_scope_hst` table references the project scope of the
target at the time of the recording.
This renames the migration with the session recording table to come
after the history table migrations. This allows the session recording
table to have foreign key references to the history tables without using
alter table statements.
This adds history tables for `static_host` and `host_plugin_host`. This
also adds a base table for the host history tables.
This also adds a new test to the history table test suite. The new test
verifies the contents of each history table against the contents of
their operational table.
This adds history tables for `static_host_catalog` and
`host_plugin_catalog`. This also adds a base table for the host catalog
history tables and an immutable table with one row for when a target has
a direct address assigned to it.
This also adds a reusable trigger function for tables that are
immutable.
This adds a history table for `target_ssh`.
This also fixes a bug in the history table test suite. Prior to this
change, the operational table name was calculated from the history table
name using the SQL trim() function. The SQL trim function as used
returned 'targe' for 'target_ssh_hst' instead of the expected value
'target_ssh'.
This adds two columns to the `recording_session` table. One column is a
foreign key to the `iam_user_hst` table and the other is a foreign key
to the `iam_scope_hst` table. The foreign key to the `iam_scope_hst`
table reference the IAM scope the user belongs to at the time of the
recording.
This moves and renames the migration with the session recording table to
come after the history table migrations. This allows the session
recording table to have foreign key references to the history tables
without using alter table statements.
Jim
Irena Rindos
Michael Gaffney
hashicorp-copywrite[bot]andJohan Brandhorst-Satzkorn
Damian Debkowski
Michael MiltonandMichael Gaffney
Jeff Mitchell
Timothy Messier
Todd
Louis Ruch