Caleb Doxsey
8fc5dbf4c5
grpc: regenerate protobuf code ( #3208 )
2022-03-29 15:18:10 -06:00
Caleb Doxsey
efd609f6ce
config: add idp_client_id and idp_client_secret to protobuf ( #3060 )
2022-02-18 08:55:31 -07:00
Caleb Doxsey
99b9a3ee12
authorize: add support for passing access or id token upstream ( #3047 )
...
* authorize: add support for passing access or id token upstream
* use an enum
2022-02-17 09:28:31 -07:00
Caleb Doxsey
5a858f5d48
config: add internal service URLs ( #2801 )
...
* config: add internal service URLs
* maybe fix integration tests
* add docs
* fix integration tests
* for databroker connect to external name, but listen on internal name
* Update docs/reference/readme.md
Co-authored-by: Travis Groth <travisgroth@users.noreply.github.com>
* Update docs/reference/readme.md
Co-authored-by: Travis Groth <travisgroth@users.noreply.github.com>
* Update docs/reference/readme.md
Co-authored-by: Travis Groth <travisgroth@users.noreply.github.com>
* Update docs/reference/settings.yaml
Co-authored-by: Travis Groth <travisgroth@users.noreply.github.com>
* Update docs/reference/settings.yaml
Co-authored-by: Travis Groth <travisgroth@users.noreply.github.com>
* Update docs/reference/settings.yaml
Co-authored-by: Travis Groth <travisgroth@users.noreply.github.com>
Co-authored-by: Travis Groth <travisgroth@users.noreply.github.com>
2021-12-10 14:04:37 -05:00
Herman Slatman
7812c6985d
Add additional ACME options ( #2695 )
...
The `autocert_ca` and `autocert_email` options have been added to be
able to configure CAs that support the ACME protocol as an alternative
to Let's Encrypt.
Fix ProtoBuf definition for additional autocert options
Fix PR comments and add ACME EAB configuration
Add configuration option for trusted CAs when talking ACME
Fix linter issues
copy edits
render updated reference to docs
Add test for autocert manager configuration
Add tests for autocert configuration options
Fix CI build issues
Don't set empty acme.EAB struct if configuration not set
Remove required email when setting custom CA
When using a non-default CA it's no longer required
to specify an email address. I required this before,
because it seemed to cause an issue in which no certificate
was issued. The root cause was something different,
rendering the hard email requirement pointless. It's
still beneficial to specify an email, though. I changed
the text in the docs to explain that.
Update generated docs
Fix failing tests by recreation of a new ACMEManager
The default ACMEManager object was reused in multiple tests,
resulting in unexpected states when tests run in parallel.
By using a new instance for every test, this is no longer
an issue.
2021-11-02 14:44:27 -07:00
Denis Mishin
55fec9b51b
add host-rewrite options to config.proto ( #2668 )
2021-10-08 11:50:56 -04:00
Denis Mishin
0878315d60
bump protoc-validate ( #2606 )
2021-09-16 12:02:55 -04:00
Caleb Doxsey
33f5190572
config: remove signature_key_algorithm ( #2557 )
...
* config: remove signature_key_algorithm
* typo
* add more tests
2021-09-02 11:36:43 -06:00
Caleb Doxsey
63ee30d69c
options: remove refresh_cooldown, add allow_spdy to proto ( #2446 )
2021-08-06 10:06:57 -06:00
Caleb Doxsey
94eb3c1149
config: remove grpc server max connection age options ( #2427 )
...
* config: remove grpc server max connection age options
* remove docs
2021-08-03 09:39:48 -06:00
Caleb Doxsey
cef08a1c2d
authorize: remove service account impersonate user id, email and groups ( #2365 )
2021-07-15 09:31:45 -06:00
wasaga
134ca74ec9
proxy: add idle timeout ( #2319 )
2021-07-02 10:29:53 -04:00
Caleb Doxsey
fcb33966e2
config: add enable_google_cloud_serverless_authentication to config protobuf ( #2306 )
...
* config: add enable_google_cloud_serverless_authentication to config protobuf
* use dependency injection for embedded envoy provider
* Revert "use dependency injection for embedded envoy provider"
This reverts commit 5c08990501
2021-06-21 18:00:29 -06:00
Caleb Doxsey
69576cffe4
config: add support for set_response_headers in a policy ( #2171 )
...
* config: add support for set_response_headers in a policy
* docs: add note about precedence
2021-05-04 09:43:52 -06:00
wasaga
129df47f9c
xds extended event ( #2158 )
2021-05-03 12:28:11 -04:00
Caleb Doxsey
b5b1013947
config: add client_crl ( #2157 )
...
* config: add client_crl
* address comments
* add ignored file
2021-04-30 14:36:32 -06:00
Caleb Doxsey
699ebf061a
config: add support for codec_type ( #2156 )
...
* config: add support for codec_type
* add comma
* fix warning block
* fix docs
2021-04-30 07:21:40 -06:00
Caleb Doxsey
0adbf4f24c
controlplane: save configuration events to databroker ( #2153 )
...
* envoy: save events to databroker
* controlplane: add tests for envoy configuration events
* format imports
2021-04-29 15:51:46 -06:00
Caleb Doxsey
636b3d6846
databroker: add options for maximum capacity ( #2095 )
...
* databroker: add options
* implement redis
* add trace for enforce options
2021-04-26 17:14:54 -06:00
Caleb Doxsey
116805acb3
config: rename headers to set_response_headers ( #2081 )
...
* config: rename headers to set_response_headers
* Update config/options.go
Co-authored-by: bobby <1544881+desimone@users.noreply.github.com>
Co-authored-by: bobby <1544881+desimone@users.noreply.github.com>
2021-04-14 11:22:21 -07:00
wasaga
0e66619081
do not require project be in GOPATH/src ( #2078 )
2021-04-12 09:43:05 -04:00
Caleb Doxsey
f4c4fe314a
authorize: audit logging ( #2050 )
...
* authorize: add databroker server and record version to result, force sync via polling
* authorize: audit logging
2021-04-05 09:58:55 -06:00
Travis Groth
c7d243d742
proxy: restrict programmatic URLs to localhost ( #2049 )
...
Co-authored-by: Caleb Doxsey <cdoxsey@pomerium.com>
2021-04-01 10:04:49 -04:00
Caleb Doxsey
e2ebef44ef
telemetry: add installation id ( #2017 )
...
* telemetry: add installation id
* set installation id globally
* remove unneeded changes
2021-03-24 07:22:54 -06:00
ntoofu
fee4979246
Add xff_num_trusted_hops config option ( #2003 )
...
* Add `xff_num_trusted_hops` config option
* Fix code formatting with gofmt
* Update docs for `xff_num_trusted_hops`
2021-03-22 10:30:20 -06:00
Caleb Doxsey
23bc3f979f
config: add headers to config proto ( #1996 )
2021-03-19 08:06:01 -06:00
Caleb Doxsey
46ae3cf358
add rewrite_response_headers to protobuf ( #1962 )
2021-03-05 13:57:27 -07:00
Caleb Doxsey
664358dfad
config: multiple endpoints for authorize and databroker ( #1957 )
...
* wip
* update docs
* remove dead code
2021-03-03 09:53:19 -07:00
Caleb Doxsey
a825b06014
metrics: add TLS options ( #1939 )
...
* move metrics listener to envoy
* add metrics tls options
* add test
* update docs
* update config proto
* add function to validate metric addr
* fix validation
2021-02-24 09:42:53 -07:00
Caleb Doxsey
8b42eb5ebd
config: add metrics_basic_auth option ( #1917 )
...
* config: add metrics_basic_auth option
* remove println
* use constant time compare
2021-02-22 13:37:18 -07:00
Caleb Doxsey
5d60cff21e
databroker: refactor databroker to sync all changes ( #1879 )
...
* refactor backend, implement encrypted store
* refactor in-memory store
* wip
* wip
* wip
* add syncer test
* fix redis expiry
* fix linting issues
* fix test by skipping non-config records
* fix backoff import
* fix init issues
* fix query
* wait for initial sync before starting directory sync
* add type to SyncLatest
* add more log messages, fix deadlock in in-memory store, always return server version from SyncLatest
* update sync types and tests
* add redis tests
* skip macos in github actions
* add comments to proto
* split getBackend into separate methods
* handle errors in initVersion
* return different error for not found vs other errors in get
* use exponential backoff for redis transaction retry
* rename raw to result
* use context instead of close channel
* store type urls as constants in databroker
* use timestampb instead of ptypes
* fix group merging not waiting
* change locked names
* update GetAll to return latest record version
* add method to grpcutil to get the type url for a protobuf type
2021-02-18 15:24:33 -07:00
Caleb Doxsey
1a1cc30c67
config: support map of jwt claim headers ( #1906 )
...
* config: support map of jwt claim headers
* fix array handling, add test
* update docs
* use separate hook, add tests
2021-02-17 13:43:18 -07:00
Caleb Doxsey
25b697a13d
authorize: allow access by user id ( #1850 )
2021-02-03 07:15:44 -07:00
Caleb Doxsey
b7f0242090
authorize: remove admin ( #1833 )
...
* authorize: remove admin
* regen rego
* add note to upgrading
2021-02-01 15:22:02 -07:00
Caleb Doxsey
cc85ea601d
policy: add new certificate-authority option for downstream mTLS client certificates ( #1835 )
...
* policy: add new certificate-authority option for downstream mTLS client certificates
* update proto, docs
2021-02-01 08:10:32 -07:00
wasaga
67f6030e1e
upstream endpoints load balancer weights ( #1830 )
2021-01-28 09:11:14 -05:00
Caleb Doxsey
9c34fcbf29
protobuf: upgrade protoc to 3.14 ( #1832 )
2021-01-27 10:06:40 -07:00
wasaga
19d78cb844
include envoy's proto specs into config.proto ( #1817 )
2021-01-25 13:15:50 -05:00
Caleb Doxsey
a4c7381eba
config: support multiple destination addresses ( #1789 )
...
* config: support multiple destination addresses
* use constructor for string slice
* add docs
* add test for multiple destinations
* fix name
2021-01-20 15:18:24 -07:00
wasaga
c6b6141d12
new skip_xff_append option ( #1788 )
...
Added `skip_xff_append` configuration option. When set, proxy would not append it's IP address to `x-forwarded-for` HTTP header.
2021-01-20 10:56:29 -05:00
Caleb Doxsey
d9699cbcb9
policy: add outlier_detection ( #1786 )
...
* add support for cluster outlier detection
* add docs
2021-01-20 08:33:48 -07:00
Caleb Doxsey
c99994bed8
config: support redirect actions ( #1776 )
...
* add route redirect options
* add xds support for redirect
* add test
* handle nil destinations
* remove unchanged statik files
* remove unchanged statik files
* update docs
* Update docs/reference/settings.yaml
Co-authored-by: Travis Groth <travisgroth@users.noreply.github.com>
Co-authored-by: Travis Groth <travisgroth@users.noreply.github.com>
2021-01-14 16:18:27 -07:00
Caleb Doxsey
ab4a68f56f
remove user impersonation and service account cli ( #1768 )
...
* remove user impersonation and service account cli
* update doc
* remove user impersonation url query params
* fix flaky test
2021-01-12 09:28:29 -07:00
bobby
5bbd745934
authorize: add signature algo support (RSA / EdDSA) ( #1631 )
...
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2020-11-30 17:14:41 -08:00
Caleb Doxsey
2d5690dde6
remove deprecated cache_service_url config option ( #1614 )
...
* remove deprecated cache_service_url config option
* remove broken test
* update integration test config
* update nginx example
Co-authored-by: Travis Groth <travisgroth@users.noreply.github.com>
2020-11-23 14:57:29 -07:00
Philip Wassermann
85a5961e5e
authorize: add allow_any_authenticated_user policy ( #1515 )
2020-11-05 11:20:50 -07:00
Caleb Doxsey
153e438eb6
authorize: implement allowed_idp_claims ( #1542 )
...
* add arbitrary claims to session
* add support for maps
* update flattened claims
* fix eol
* fix trailing whitespace
* fix tests
2020-10-23 14:05:37 -06:00
Caleb Doxsey
04c582121d
add flag to enable user impersonation ( #1514 )
...
* add flag to enable user impersonation
* fix typo
2020-10-14 08:17:59 -06:00
Caleb Doxsey
54d37e62e8
config: add dns_lookup_family option to customize DNS IP resolution ( #1436 )
2020-09-21 15:32:37 -06:00
Caleb Doxsey
4fb90fabe8
config: support explicit prefix and regex path rewriting ( #1363 )
...
* config: support explicity prefix and regex path rewriting
* add rewrite tests
2020-09-02 13:48:19 -06:00
