The removeDups template function converts a slice into a map and
back into a slice in order to leverage the map keys to remove
duplicates. However, since the iteration order over a map is not
specified it would be possible to get different orders for multiple runs
of `make api`. While this would not have an impact on any functionality,
it is causing sporadic failures for the new make-gen-deltas CI job.
See: https://go.dev/ref/spec#For_statements
Ref: d57603022a
Passthrough args looks for the an instance of -- and re-slices the arg
list to pass through those args to the underlying connect exec command.
However such commands may also need to parse their own '--', such as
kubectl exec.
This change updates the logic so that boundary arg parser only considers
the first instance of '--' when deciding which args to pass to the
-exec= commands.
Fixes: #1857
* fix(controller/targets): authorize-session should allow h_ ids
The targets controller previously only allowed hosts from a static catalog
since it checked for the ID subtype from the static package.
This change validates host ids with the plugin.Subtype as well
Fixes: #1850
* test: cover authorize-session with host id
Add a regression test to cover the case where an explicit host ID was
given when calling AuthorizeSession
When creating the options for the preferencer, this used WithIpAddrs for both the host addresses and also DNS names. This causes errors when a host contains DNS names that are not IP addresses (ie: whenever dns names are present).
This change will:
- Replace WithIpAddrs with WithDNSNames option for DNS Names when constructing options for the preferencer.
- Add a test which includes a DNS name to prevent regressions
Fixes#1848
* feat(host): Add host set information to static host
Updates LookupHost and ListHost API to include sets a static host is part of, as like with plugin hosts.
* test: updated TestList_Plugin and TestCrud to be more consistent under race conditions
* Make it clear in the subcommands that the given strings are examples
* Add an OIDC example to show that there are different types
* Remove password flag from examples
This addresses the issue of a user being created in a normal or
dev environment that is given access to authorize sessions against
specific targets but the permission hasn't been configured for the UI
clients to actually list them.
Resolves#1791
* chore: Add new dbw dependency
* refactor: Convert to use dbw.DB
* refactor (db): Change GetTicket(...) signature
* feature (db tests): Added TestDeleteWhere(...)
Adding this allows us to eliminate a leak of the gorm library
* refactor: Add ctx to ScanRows(...) signature
This is required to refactor all the deprecated errors pkg calls.
This refactor required adding a context to quite a few call chains
and in particular the job scheduler bits
* feature (db/tests): Add support for test opt: WithTestLogLevel(...)
This test only option allows callers to specify a log level for the
underlying db package (where supported/applicable) when calling
TestSetup(...)
* refactor (db): Simplify Db type
Only store the underlying *DB and create the *RW on demand when
needed.
* refactor (oplog): Port to using dbw pkg for db operations
* refactor (db): Remove gormDB(...) func
* tests (db): Add unit tests for TestDeleteWhere(...)
* chore: make fmt changes to formatting
Egress credentials Issued during AuthorizeSession are stored in the
session repo. These credentials are retrieved and stored in-memory on the
worker during the LookupSession call. Each proxy handler will need to
handle the credentials as required.
Creates a new session_credential table and repository functions
to add and list credentials attached to a session. All credentials
are encrypted using the session scope id.
This allows users to set the type of credential that a credential
library will provide.
A User Password credential type and an Unspecified credential type are included
with the expectation that additional credential types will be added in the
future. This change also adds the credential type attribute to existing
credential libraries and sets it to Unspecified. The credential type can
only be set when a credential library is created.
The vault credential library includes functionality for converting a
Vault Secret into a User Password Credential. This mapping is enabled by
default, however, the user can override the attributes used for this
mapping.
* feat(sdk): Add fields to credential library proto
Adds CredentialType and CredentialMappingOverrides to credential
library SDK.
* feat(api): Add fields to credenttial library service
Adds support for CredentialType and CredentialMappingOverrides
to the credential library service (API)
* feat(cli): Add feilds for credential library cmd
Adds support for CredentialType and CredentialMappingOverrides to the
credential library cmd command.
This change adds a credential type attribute to credential library and
allows it to be set when creating a credential library.
Specifying the type of credential returned from a library allows for new
features and additional error checking to be added over time. A
User Password credential type and an Unspecified credential type are
included with the expectation that additional credential types will be
added in the future. This change also adds the credential type attribute
to existing credential libraries and sets it to Unspecified.
Known Limitations:
- Credential type is only supported on the repository create method.
Support for the other CRUD methods will be added in the future.
Louis Ruch
Irena Rindos
Timothy Messier
Justen Walker
Carlos Alcaide Corvo
Todd
Irena Rindos
Haotian
Jeff Mitchell
Jim
Michael Gaffney