threshold/CHANGELOG.md

Boundary CHANGELOG

Canonical reference for changes, improvements, and bugfixes for Boundary.

Next

Security

• Boundary now uses Go's new execabs package for execution of binaries in boundary connect. This is for defense-in-depth rather than a specific issue. See the Go blog post for more details. (PR)

Changes/Deprecations

• controller/worker: Require names to be all lowercase. This removes ambiguity or accidental mismatching when using upcoming filtering features.

New and Improved

• targets: You can now specify a Boolean-expression filter against worker tags to control which workers are allowed to handle any given target's sessions (PR)
• api/cli: On listing/reading, return a list of actions the user is authorized to perform on the identified resources or their associated collections (PR)

Bug Fixes

• cli: When output-curl-string is used with update or add-/remove-/set- commands and automatic versioning is being used (that is, no -version flag is given), it will now display the final call instead of the GET that fetches the current version (Issue) (PR)
• db: Fix panic in database init when controller config block is missing (Issue) (PR)

0.1.4 (2021/01/05)

New and Improved

• controller: Improved error handling in iam repo (PR)
• controller: Improved error handling in db (PR)

Bug Fixes

• servers: Fix erronious global unicast check that disallowed valid addresses from being assigned (PR)
• cli: Fix (hopefully) panic some users experience depending on their Linux setup when running the binary (Issue) (PR)

0.1.3 (2020/12/18)

Changes/Deprecations

• controller: Switch the session connection limit for dev mode and the initial target when doing database initialization to -1. This makes it easier for people to start understanding Boundary while not hitting issues related to some programs/protocols needing multiple connections as they may not be easy for new users to understand. (PR)

New and Improved

• controller, worker, cli: When the client quits before the session time is over, but in a manner where the TOFU token will be locked, attempt canceling the session rather than leaving it open to time out (PR)
• controller: Improved error handling in hosts, host catalog and host set (PR)
• controller: Relax account login name constraints to allow dash as valid character (Issue) (PR)
• cli/connect/http: Pass endpoint address through to allow setting TLS server name directly in most cases (PR)
• cli/connect/kube: New kube subcommand for boundary connect that makes it easy to route kubectl commands through Boundary, including when using kubectl proxy (PR)
• cli/server: Add some extra checks around valid/invalid combinations of addresses to avoid hard-to-understand runtime issues (PR)

Bug Fixes

• cli: Ensure errors print to stderr when token is not found (Issue) (PR)
• controller: Fix grant IDs being lowercased when being read back (and when being used for permission evaluation) (Issue) (PR)

0.1.2 (2020/11/17)

New and Improved

• docker: Official Docker image for hashicorp/boundary (PR)
• controller: Add ability to set public address for cluster purposes (Issue) (PR)
• ui: Improve scope awareness and navigation, including IAM for global scope (PR)
• ui: Add dark mode toggle (Issue) (PR)
• ui: Add scope grants to roles (PR)
• ui: Add IAM resources to global scope (PR)

Bug Fixes

• controller, worker: Fix IPv4-only check so 0.0.0.0 specified without a port only listens on IPv4 (PR)
• ui: Fix grant string corruption on updates (Issue) (PR)
• controller, cli: Fix mutual exclusivity bug with using -authz-token on boundary connect (PR)

0.1.1 (2020/10/22)

Changes/Deprecations

Note: in addition to changes marked below in this section, be aware that currently names of resources are case-sensitive, but in a future update they will become case-preserving but case-insensitive for comparisons (e.g. if using them to access targets).

• cli: There are two changes to token storage handling:
  • Specifying none for the -token-name parameter has been deprecated in favor of specifying none for the new -keyring-type parameter.
  • pass is now the default keyring type on non-Windows/non-macOS platforms. See the CLI docs page for more information.

New and Improved

• cli: New -keyring-type option and pass keyring type for token storage (Issue) (PR)
• connect: Allow using -target-name in conjunction with either -target-scope-id or -target-scope-name to connect to targets, rather than the target's ID (PR)
• controller: Allow API/Cluster listeners to be Unix domain sockets (Issue) (PR)
• ui: Allow creating and assigning a host to a host set directly from the host set view (Issue) (PR)

Bug Fixes

• cli: Fix database init when locale isn't English (Issue) (PR)
• cli: Fix hyphenation in help output for resources with compound names (Issue) (PR)
• controller: Allow connecting to Postgres when using remote Docker in dev mode (Issue (PR)
• controller, worker: Fix listening on IPv6 addresses (Issue) (PR)
• worker: Fix setting controller address for worker in dev mode (Issue) (PR)

0.1.0 (2020/10/14)

v0.1.0 is the first release of Boundary. As a result there are no changes, improvements, or bugfixes from past versions.