Documentation
¶
Index ¶
- Constants
- func AttachWorkerIdToState(ctx context.Context, workerId string) (*structpb.Struct, error)
- func RotateRoots(ctx context.Context, workerAuthRepo *WorkerAuthRepositoryStorage, ...) error
- func StoreNodeInformationTx(ctx context.Context, writer db.Writer, databaseWrapper wrapping.Wrapper, ...) error
- func TestKmsKey(ctx context.Context, t *testing.T, conn *db.DB, wrapper wrapping.Wrapper) string
- type CertificateAuthority
- type CertificateState
- type Nonce
- type Option
- func WithAddress(address string) Option
- func WithControllerEncryptionPrivateKey(controllerKey []byte) Option
- func WithDescription(desc string) Option
- func WithFetchNodeCredentialsRequest(req *types.FetchNodeCredentialsRequest) Option
- func WithKeyId(keyId string) Option
- func WithLimit(limit int) Option
- func WithLiveness(liveness time.Duration) Option
- func WithName(name string) Option
- func WithNewIdFunc(fn func(context.Context) (string, error)) Option
- func WithNonce(nonce []byte) Option
- func WithPublicId(id string) Option
- func WithTestPkiWorkerAuthorizedKeyId(id *string) Option
- func WithUpdateTags(updateTags bool) Option
- func WithWorkerKeyIdentifier(workerKeyIdentifier string) Option
- func WithWorkerKeys(workerKeys WorkerKeys) Option
- func WithWorkerTags(tags ...*Tag) Option
- type Repository
- func (r *Repository) AddNonce(ctx context.Context, nonce, purpose string, opt ...Option) error
- func (r *Repository) AddWorkerTags(ctx context.Context, workerId string, workerVersion uint32, tags []*Tag, ...) ([]*Tag, error)
- func (r *Repository) CleanupNonces(ctx context.Context, opt ...Option) (int, error)
- func (r *Repository) CreateWorker(ctx context.Context, worker *Worker, opt ...Option) (*Worker, error)
- func (r *Repository) DeleteWorker(ctx context.Context, publicId string, _ ...Option) (int, error)
- func (r *Repository) DeleteWorkerTags(ctx context.Context, workerId string, workerVersion uint32, tags []*Tag, ...) (int, error)
- func (r *Repository) ListControllers(ctx context.Context, opt ...Option) ([]*store.Controller, error)
- func (r *Repository) ListNonces(ctx context.Context, purpose string, opt ...Option) ([]*Nonce, error)
- func (r *Repository) ListWorkers(ctx context.Context, scopeIds []string, opt ...Option) ([]*Worker, error)
- func (r *Repository) LookupWorker(ctx context.Context, publicId string, _ ...Option) (*Worker, error)
- func (r *Repository) LookupWorkerByName(ctx context.Context, name string) (*Worker, error)
- func (r *Repository) LookupWorkerIdByKeyId(ctx context.Context, keyId string) (string, error)
- func (r *Repository) SetWorkerTags(ctx context.Context, workerId string, workerVersion uint32, tags []*Tag, ...) ([]*Tag, error)
- func (r *Repository) UpdateWorker(ctx context.Context, worker *Worker, version uint32, fieldMaskPaths []string, ...) (*Worker, int, error)
- func (r *Repository) UpsertController(ctx context.Context, controller *store.Controller) (int, error)
- func (r *Repository) UpsertWorkerStatus(ctx context.Context, worker *Worker, opt ...Option) (*Worker, error)
- type RootCertificate
- type RootCertificateKeys
- type Tag
- type TagSource
- type Worker
- type WorkerAuth
- type WorkerAuthRepositoryStorage
- func (r *WorkerAuthRepositoryStorage) List(ctx context.Context, msg proto.Message) ([]string, error)
- func (r *WorkerAuthRepositoryStorage) Load(ctx context.Context, msg nodee.MessageWithId) error
- func (r *WorkerAuthRepositoryStorage) Remove(ctx context.Context, msg nodee.MessageWithId) error
- func (r *WorkerAuthRepositoryStorage) Store(ctx context.Context, msg nodee.MessageWithId) error
- type WorkerCertBundle
- type WorkerKeys
- type WorkerType
Constants ¶
const ( NoncePurposeRecovery = "recovery" NoncePurposeWorkerAuth = "worker-auth" )
const ( // DefaultLiveness is the setting that controls the server "liveness" time, // or the maximum allowable time that a worker can't send a status update to // the controller for. After this, the server is considered dead, and it will // be taken out of the rotation for allowable workers for connections, and // connections will possibly start to be terminated and marked as closed // depending on the grace period setting (see // base.Server.StatusGracePeriodDuration). This value serves as the default // and minimum allowable setting for the grace period. DefaultLiveness = 15 * time.Second )
const (
WorkerPrefix = "w"
)
PublicId prefixes for the resources in the server package.
Variables ¶
This section is empty.
Functions ¶
func AttachWorkerIdToState ¶
AttachWorkerIdToState accepts a workerId and creates a struct for use with the Nodeenrollment lib This is intended for use in worker authorization; AuthorizeNode in the lib accepts the option WithState so that the workerId is passed through to storage and associated with a WorkerAuth record
func RotateRoots ¶
func RotateRoots(ctx context.Context, workerAuthRepo *WorkerAuthRepositoryStorage, opt ...nodeenrollment.Option) error
RotateRoots is a domain service function that initiates a rotation of root certificates via a call to the nodenenrollment RotateRootCertificates function Accepts the nodeenrollment option, WithCertificateLifetime(time.Duration) to specify the lifetime of the generated cert(s)
func StoreNodeInformationTx ¶
func StoreNodeInformationTx(ctx context.Context, writer db.Writer, databaseWrapper wrapping.Wrapper, node *types.NodeInformation, _ ...Option) error
StoreNodeInformationTx stores NodeInformation. No options are currently supported.
This function encapsulates all the work required within a dbw.TxHandler and allows this capability to be shared with other repositories or just called within a transaction. To be clear, this repository function doesn't include its own transaction and is intended to be used within a transaction provided by the caller.
Node information is stored in two parts: * the workerAuth record is stored with a reference to a worker * certificate bundles are stored with a reference to the workerAuth record and issuing root certificate
Types ¶
type CertificateAuthority ¶
type CertificateAuthority struct { *store.CertificateAuthority // contains filtered or unexported fields }
CertificateAuthority is a versioned entity used to lock the database when rotation RootCertificates
func (*CertificateAuthority) SetTableName ¶
func (r *CertificateAuthority) SetTableName(n string)
SetTableName sets the table name.
func (*CertificateAuthority) TableName ¶
func (r *CertificateAuthority) TableName() string
TableName returns the table name.
type CertificateState ¶
type CertificateState string
CertificateState defines the possible states for a workerauth certificate
const ( UnknownState CertificateState = "unknown" CurrentState CertificateState = "current" NextState CertificateState = "next" )
type Option ¶
type Option func(*options)
Option - how Options are passed as arguments
func WithAddress ¶
WithAddress provides an optional address.
func WithDescription ¶
WithDescription provides an optional description.
func WithFetchNodeCredentialsRequest ¶
func WithFetchNodeCredentialsRequest(req *types.FetchNodeCredentialsRequest) Option
WithFetchNodeCredentialsRequest allows an optional FetchNodeCredentialsRequest to be specified.
func WithLimit ¶
WithLimit provides an option to provide a limit. Intentionally allowing negative integers. If WithLimit < 0, then unlimited results are returned. If WithLimit == 0, then default limits are used for results.
func WithLiveness ¶
WithLiveness indicates how far back we want to search for server entries. Use 0 for the default liveness (15 seconds). A liveness value of -1 removes the liveliness condition.
func WithNewIdFunc ¶
WithNewIdFunc allows an optional factory function for new worker IDs to be specified (this option is likely only useful for tests).
func WithPublicId ¶
WithPublicId provides an optional public Id used for skipping one db call.
func WithTestPkiWorkerAuthorizedKeyId ¶
WithTestPkiWorkerAuthorizedKeyId should only be used in tests. It specifies that the test worker should be authorized when returned and assigns the key id for that worker to the string pointer in this option.
func WithUpdateTags ¶
WithUpdateTags indicates that we should perform tag updates in the DB. This would happen on first sync from a worker after startup or (eventually, perhaps), after a SIGHUP.
func WithWorkerKeyIdentifier ¶
func WithWorkerKeys ¶
func WithWorkerKeys(workerKeys WorkerKeys) Option
type Repository ¶
type Repository struct {
// contains filtered or unexported fields
}
Repository is the server database repository
func NewRepository ¶
NewRepository creates a new server Repository. Supports the options: WithLimit which sets a default limit on results returned by repo operations.
func (*Repository) AddWorkerTags ¶
func (r *Repository) AddWorkerTags(ctx context.Context, workerId string, workerVersion uint32, tags []*Tag, _ ...Option) ([]*Tag, error)
AddWorkerTags adds specified api tags to the repo worker and returns its new tags. No options are currently supported.
func (*Repository) CleanupNonces ¶
CleanupNonces removes nonces that no longer need to be stored
func (*Repository) CreateWorker ¶
func (r *Repository) CreateWorker(ctx context.Context, worker *Worker, opt ...Option) (*Worker, error)
CreateWorker will create a worker in the repository and return the written worker. Creating a worker is not intentionally oplogged. A worker's ReportedStatus and Tags are intentionally ignored when creating a worker (not included). Currently, a worker can only be created in the global scope
Options supported: WithFetchNodeCredentialsRequest and WithNewIdFunc (this option is likely only useful for tests)
func (*Repository) DeleteWorker ¶
DeleteWorker will delete a worker from the repository.
func (*Repository) DeleteWorkerTags ¶
func (r *Repository) DeleteWorkerTags(ctx context.Context, workerId string, workerVersion uint32, tags []*Tag, _ ...Option) (int, error)
DeleteWorkerTags deletes specified api worker tags from the repo. Returns the number of rows deleted. No options are currently supported.
func (*Repository) ListControllers ¶
func (r *Repository) ListControllers(ctx context.Context, opt ...Option) ([]*store.Controller, error)
func (*Repository) ListNonces ¶
func (r *Repository) ListNonces(ctx context.Context, purpose string, opt ...Option) ([]*Nonce, error)
ListNonces lists nonces. Used only for tests at the moment.
func (*Repository) ListWorkers ¶
func (r *Repository) ListWorkers(ctx context.Context, scopeIds []string, opt ...Option) ([]*Worker, error)
ListWorkers will return a listing of Workers and honor the WithLimit option. If WithLiveness is zero the default liveness value is used, if it is negative then the last status update time is ignored. If WithLimit < 0, then unlimited results are returned. If WithLimit == 0, then default limits are used for results.
func (*Repository) LookupWorker ¶
func (r *Repository) LookupWorker(ctx context.Context, publicId string, _ ...Option) (*Worker, error)
LookupWorker returns the worker for the provided publicId. This returns nil nil in the situation where no worker can be found with that public id.
func (*Repository) LookupWorkerByName ¶
LookupWorkerByName returns the worker with the provided name. In the event that no worker is found that matches then nil, nil will be returned.
func (*Repository) LookupWorkerIdByKeyId ¶
func (*Repository) SetWorkerTags ¶
func (r *Repository) SetWorkerTags(ctx context.Context, workerId string, workerVersion uint32, tags []*Tag, _ ...Option) ([]*Tag, error)
SetWorkerTags clears the current repo worker's api tags and sets them from the input parameters. Returns the current repo worker tags. No options are currently supported.
func (*Repository) UpdateWorker ¶
func (r *Repository) UpdateWorker(ctx context.Context, worker *Worker, version uint32, fieldMaskPaths []string, opt ...Option) (*Worker, int, error)
UpdateWorker will update a worker in the repository and return the resulting worker. fieldMaskPaths provides field_mask.proto paths for fields that should be updated. Fields will be set to NULL if the field is a zero value and included in fieldMask. Name, Description, and Address are the only updatable fields, if no updatable fields are included in the fieldMaskPaths, then an error is returned. If any paths besides those listed above are included in the path then an error is returned.
func (*Repository) UpsertController ¶
func (r *Repository) UpsertController(ctx context.Context, controller *store.Controller) (int, error)
func (*Repository) UpsertWorkerStatus ¶
func (r *Repository) UpsertWorkerStatus(ctx context.Context, worker *Worker, opt ...Option) (*Worker, error)
UpsertWorkerStatus will update the address and last status time for a worker. If the worker is a kms worker that hasn't been seen yet, it'll attempt to create a new one, but will return an error if another worker (kms or other) has the same name. This returns the Worker object with the changes applied. The WithPublicId, WithKeyId, and WithUpdateTags options are the only ones used. All others are ignored. Workers are intentionally not oplogged.
type RootCertificate ¶
type RootCertificate struct { *store.RootCertificate // contains filtered or unexported fields }
RootCertificate contains fields related to a RootCertificate resource This includes public/ private keys, the PEM encoded certificate, and the certificate validity period
func TestRootCertificate ¶
func (*RootCertificate) SetTableName ¶
func (r *RootCertificate) SetTableName(n string)
SetTableName sets the table name.
func (*RootCertificate) TableName ¶
func (r *RootCertificate) TableName() string
TableName returns the table name.
func (*RootCertificate) ValidateNewRootCertificate ¶
func (r *RootCertificate) ValidateNewRootCertificate(ctx context.Context) error
Validate the RootCertificate. On success, return nil
type RootCertificateKeys ¶
type RootCertificateKeys struct {
// contains filtered or unexported fields
}
RootCertificateKeys contains the public and private keys for use in constructing a RootCertificate
type Tag ¶
A Tag is a custom key/value pair which can be attached to a Worker. Multiple Tags may contain the same key and different values in which case both key/value pairs are valid. Tags can be sourced from either the worker's configuration or the api. key/value pairs can be the same from different sources.
type Worker ¶
A Worker is a server that provides an address which can be used to proxy session connections. It can be tagged with custom tags and is used when authorizing and establishing a session. It is owned by a scope.
func NewWorker ¶
NewWorker returns a new Worker. Valid options are WithName, WithDescription WithAddress, and WithWorkerTags. All other options are ignored. This does not set any of the worker reported values.
func TestKmsWorker ¶
TestKmsWorker inserts a worker into the db to satisfy foreign key constraints. The worker provided fields are auto generated. if WithName is not present a random name will be generated and assigned to the worker.
func TestPkiWorker ¶
TestPkiWorker inserts a worker into the db to satisfy foreign key constraints. The worker provided fields are auto generated. WithName and WithDescription, are applied to the resource name, description if present. WithTestPkiWorkerAuthorizedKeyId can be used to make the PkiWorker authorized in which case the string pointer passed to WithTestPkiWorkerAuthorizedKeyId is set to the key id.
func (*Worker) ActiveConnectionCount ¶
ActiveConnectionCount is the current number of sessions this worker is handling according to the controllers.
func (*Worker) CanonicalTags ¶
CanonicalTags is the deduplicated set of tags contained on both the resource set over the API as well as the tags reported by the worker itself.
func (*Worker) GetConfigTags ¶
GetConfigTags returns the tags for this worker which has been set through the worker daemon's configuration file.
func (*Worker) GetLastStatusTime ¶
GetLastStatusTime contains the last time the worker has reported to the controller its connection status. If the worker has never reported to a controller then nil is returned.
type WorkerAuth ¶
type WorkerAuth struct { *store.WorkerAuth // contains filtered or unexported fields }
WorkerAuth contains all fields related to an authorized Worker resource This includes worker public keys, the controller encryption key, and certificate bundles issued by the Boundary CA
func TestWorkerAuth ¶
func (*WorkerAuth) SetTableName ¶
func (w *WorkerAuth) SetTableName(n string)
SetTableName sets the table name.
func (*WorkerAuth) TableName ¶
func (w *WorkerAuth) TableName() string
TableName returns the table name.
func (*WorkerAuth) ValidateNewWorkerAuth ¶
func (w *WorkerAuth) ValidateNewWorkerAuth(ctx context.Context) error
Validate is called before storing a WorkerAuth in the db
type WorkerAuthRepositoryStorage ¶
type WorkerAuthRepositoryStorage struct {
// contains filtered or unexported fields
}
WorkerAuthRepositoryStorage is the Worker Auth database repository
func NewRepositoryStorage ¶
func NewRepositoryStorage(ctx context.Context, r db.Reader, w db.Writer, kms *kms.Kms) (*WorkerAuthRepositoryStorage, error)
NewRepositoryStorage creates a new WorkerAuthRepositoryStorage that implements the Storage interface
func (*WorkerAuthRepositoryStorage) List ¶
func (r *WorkerAuthRepositoryStorage) List(ctx context.Context, msg proto.Message) ([]string, error)
List implements the Storage interface. List returns a list of IDs; the type of the message is used to disambiguate what to list.
func (*WorkerAuthRepositoryStorage) Load ¶
func (r *WorkerAuthRepositoryStorage) Load(ctx context.Context, msg nodee.MessageWithId) error
Load implements the Storage interface. Load loads values into the given message. The message must be populated with the ID value. If not found, the returned error should be ErrNotFound.
func (*WorkerAuthRepositoryStorage) Remove ¶
func (r *WorkerAuthRepositoryStorage) Remove(ctx context.Context, msg nodee.MessageWithId) error
Remove implements the Storage interface. Remove removes the given message. Only the ID field of the message is considered.
func (*WorkerAuthRepositoryStorage) Store ¶
func (r *WorkerAuthRepositoryStorage) Store(ctx context.Context, msg nodee.MessageWithId) error
Store implements the Storage interface
type WorkerCertBundle ¶
type WorkerCertBundle struct { *store.WorkerCertBundle // contains filtered or unexported fields }
WorkerCertBundle contains all fields related to a WorkerCertBundle resource This includes the serial number of the issuing CA, the worker id, and the certificate bundles issued by the CA
func (*WorkerCertBundle) SetTableName ¶
func (w *WorkerCertBundle) SetTableName(n string)
SetTableName sets the table name.
func (*WorkerCertBundle) TableName ¶
func (w *WorkerCertBundle) TableName() string
TableName returns the table name.
func (*WorkerCertBundle) ValidateNewWorkerCertBundle ¶
func (w *WorkerCertBundle) ValidateNewWorkerCertBundle(ctx context.Context) error
Validate is called before storing a WorkerCertBundle in the db
type WorkerKeys ¶
type WorkerKeys struct {
// contains filtered or unexported fields
}
WorkerKeys contain the signing and encryption keys for a WorkerAuth resource
type WorkerType ¶
type WorkerType string
const ( UnknownWorkerType WorkerType = "unknown" KmsWorkerType WorkerType = "kms" PkiWorkerType WorkerType = "pki" )
func (WorkerType) String ¶
func (t WorkerType) String() string
func (WorkerType) Valid ¶
func (t WorkerType) Valid() bool