* Clean up some dev config kms code
Although it didn't matter in the combined state, the KMS for auth
storage was not actually being set properly if only a worker was being
instantiated.
* feat(credentials): Refactor credential purposes
* Application credentials have been refactored to Brokered credentials
* Egress credentials have been refactored to Injected Application
credentials
Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
* Add support for ssh_private_key credential type in Vault libraries
* Add support for ssh_private_key credential type
* Support jsonpointer for Vault library mapping overrides
Right now there is a bit of a race condition in that a status call that
indirectly tells the controller that a worker is ready to accept
sessions can have its response unable to be processed in time for an
actual session to come in from a client. It's very unlikely but
technically there.
This changes where we check if we have ever successfully authenticated
from the function called by the ticker to the ticker itself, allowing us
to reset the timer to a very short time if we have not yet
authenticated. We already have the initial timer set to 0 for "as soon
as possible" behavior, but if that initial status failed we'd wait for
the normal interval. Now we will instead continue with the "as soon as
possible" behavior, and reduce the very unlikely race condition to
extremely unlikely.
(There are more permanent fixes but those are bigger and can come
later.)
If a worker starts up and tries to connect to a controller before the
controller has a chance for its rotate roots job to run, it'll spit out
a nasty-looking error. It's harmless (things just retry and then work)
but scary (`tls: internal error`).
Rotating at creation time ensures that it's ready by the time a worker
is able to perform any connection against the cluster port.
* (refactor) change all sql references of user_password to username_password
* refactor(pkg) renamed pkg userpassword to usernamepassword
* refactor(proto) updated protocol buffers to use UsernamePassword
* refactor(code) updated references from UserPassword to UsernamePassword in golang files
* refactor(test) updated unit tests to reference UsernamePassword changes
* refactor(ddtest) updated references in dbtests to use UsernamePassword
* chore(sql-test) fixed spelling issue
* chore(sql) added and updated comments in migartion & tables. fixed indentations
* chore(proto) updated comments to reflect username_password changes
* refactor(tests) updated unit tests to replace user-password with username-password
* refactor(cmd) updated cmd help text to use username
* chore(tests) update test name & comments
* fix(cmd) fixed cmd usage definition for credentials update
* refactor(tests) removed out of scope changes
* fix(sql) incremented sql migration id & updated migration comments
* fix (worker): send workerId when authorizing session
Send the workerId returned from the last success worker status
when authorizing a session.
* fixup! fix (worker): send workerId when authorizing session
* fixup! fix (worker): send workerId when authorizing session
* refactor (worker): deprecate workerId in ActivateSessionRequest
It wasn't being used anywho
* fixup! fix (worker): send workerId when authorizing session
* Update LookupSessionRequest
Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
This essentially worked for non-dev mode before but would create storage
directories that weren't actually used or needed, and it didn't work in
dev mode because it made assumptions about the presence of a worker auth
kms or not. This fixes those behaviors.
* Don't automatically create worker names, as this is now invalid for
PKI workers
* Fix a check in dev that clears out name/description in exactly the
wrong cases
* Change eventing setup to use a hostname-based ID instead of the name
(which could change on every start anyways)
* fix: Propagate plugin options to CreatePlugin
Plugin options were previously only applied to the
BuildPluginMap call, resulting in the plugin
execution_dir variable being ineffective.
Also add a test to verify functionality
* fix: Support plugin execution_dir for all plugins
Previously, only external host plugins would respect
the plugin execution dir. Now, all uses of the embedded
plugins respect the configuration.
Jeff Mitchell
Damian Debkowski
Todd
irenarindos
Louis Ruch
Haotian
Jeff Malnick
Jim
Johan Brandhorst-Satzkorn