Commit graph

894 commits

Author SHA1 Message Date
Renovate Bot
04696daff2 chore(deps): update module contrib.go.opencensus.io/exporter/jaeger to v0.2.1 2020-08-03 03:25:21 +00:00
Renovate Bot
ea99b71de7 chore(deps): update golang.org/x/crypto commit hash to 123391f 2020-08-03 02:02:07 +00:00
Cuong Manh Le
c910196364
docs/docs: update upgrading to mention redis storage backend (#1172)
Co-authored-by: bobby <1544881+desimone@users.noreply.github.com>
2020-08-01 11:20:07 -07:00
bobby
8b68079488
docs: rename docs/reference to docs/topics (#1182)
* docs: rename docs/reference to docs/topics
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2020-08-01 10:00:14 -07:00
Cuong Manh Le
4f0d6bee68
internal/urlutil: add tests for GetDomainsForURL (#1183)
Updates #959
2020-08-01 09:59:40 -07:00
Caleb Doxsey
4115c67d93
pomerium-cli: kubernetes fixes (#1176)
* pomerium-cli: fix kubernetes token caching

* pomerium-cli: fix error hanging

* add options for TLS
2020-07-31 13:51:48 -06:00
Travis Groth
c8d3baccff
ci: pass release secret to goreleaser (#1181) 2020-07-31 15:35:37 -04:00
Travis Groth
f1934969fb
deploy: ensure pomerium-cli is built correctly (#1180) 2020-07-31 14:38:03 -04:00
Travis Groth
a81b3a4353
deploy: add pomerium/homebrew-tap publishing (#1179) 2020-07-31 14:32:19 -04:00
bobby
8c9ca05209
deployment: cut separate archive for cli (#1177)
* deployment: cut separate archive for cli
* enable pre-release detection

Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2020-07-31 10:12:23 -07:00
Travis Groth
aa0352d1b6
ci: re-add arm64 docker image builds (#1178) 2020-07-31 12:36:39 -04:00
Travis Groth
417c2f4890
docs: Redis and stateful storage docs (#1173) 2020-07-31 11:56:01 -04:00
Caleb Doxsey
b1d72c829b
pomerium-cli: fix kubernetes token caching (#1169)
* pomerium-cli: fix kubernetes token caching

* switch to jose v2
2020-07-31 09:50:06 -06:00
Cuong Manh Le
fabf773e8b
pkg/storage/redis: handling connection to redis backend failure (#1174)
In case of connection to backend failure, we try reconnecting with
backoff, to re-subscribe to the notification channel.

Fixes #1167
2020-07-31 22:17:11 +07:00
Cuong Manh Le
f7ebf54305
authorize: strip port from host header if necessary (#1175)
After #1153, envoy can handle routes for `example.com` and `example.com:443`.
Authorize service should be updated to handle this case, too.

Fixes #959
2020-07-31 21:41:58 +07:00
Cuong Manh Le
bc61206b78
pkg/storage/redis: add redis TLS support (#1163)
Fixes #1156
2020-07-31 19:37:23 +07:00
Travis Groth
aab9ec413e
fix lint errors (#1171) 2020-07-31 00:00:06 -04:00
Travis Groth
aa8ba35332
config: default to google idp credentials for serverless (#1170) 2020-07-30 20:21:41 -04:00
Travis Groth
3c4513a91e
telmetry: add databroker storage metrics and tracing (#1161)
* telmetry: add databroker storage metrics and tracing
2020-07-30 18:19:23 -04:00
Caleb Doxsey
29fb96a955
databroker: add encryption for records (#1168) 2020-07-30 14:04:31 -06:00
bobby
8cae3f27bb
docs: refactor sections, consolidate examples (#1164) 2020-07-30 11:02:14 -07:00
Diep Pham
f41eeaf138
docs: add recipe for TiddlyWiki on Node.js (#1143) 2020-07-30 08:59:04 -07:00
Caleb Doxsey
97f85481f8
fix redirect loop, remove user/session services, remove duplicate deleted_at fields (#1162)
* fix redirect loop, remove user/session services, remove duplicate deleted_at fields

* change loop

* reuse err variable

* wrap errors, use cookie timeout

* wrap error, duplicate if
2020-07-30 09:41:57 -06:00
Caleb Doxsey
714363fb07
grpcutil: add functions for JWTs in gRPC metadata (#1165) 2020-07-30 09:40:55 -06:00
Cuong Manh Le
3039407597
pkg/storage/redis: add authentication support (#1159)
Fixes #1157
2020-07-29 23:08:38 +07:00
Cuong Manh Le
05545b3e1d
pkg/storage/redis: do not use timeout to signal redis conn to stop (#1155)
Instead, we run the loop in goroutine, and when context was done,
closing the underlying connection of PubSubConn, so the Receive will
return.

Fixes #1154
2020-07-29 21:48:50 +07:00
Caleb Doxsey
557aef2a33
fix databroker restart versioning, handle missing sessions (#1145)
* fix databroker restart versioning, handle missing sessions

* send empty server version to detect change

* only rebuild if there are updated records
2020-07-29 08:45:41 -06:00
Caleb Doxsey
a5e8abd6af
handle example.com and example.com:443 (#1153)
* handle example.com and example.com:443

* fix domain comparisons
2020-07-28 15:30:41 -06:00
Travis Groth
996f0251b2
Add kubectl config commands (#1152) 2020-07-28 17:14:22 -04:00
Cuong Manh Le
fd544b7072
authenticate: fix wrong condition checking in VerifySession (#1146)
The code checks session client not nil, but using databroker client in
the body instead.
2020-07-28 21:18:39 +07:00
Cuong Manh Le
bec908b9af
docs/.vuepress: fix missing local-oidc recipes section (#1147) 2020-07-28 19:51:17 +07:00
Miguel
72b6347886
docs: Add required in cookie_secret (#1142) 2020-07-27 22:59:54 +07:00
Cuong Manh Le
a7bd2caae9
pkg/storage: introduce storage.Backend Watch method (#1135)
Currently, we're doing "sync" in databroker server. If we're going to
support multiple databroker servers instance, this mechanism won't work.

This commit moves the "sync" to storage backend, by adding new Watch
method. The Watch method will return a channel for the caller. Everytime
something happens inside the storage, we notify the caller by sending a
message to this channel.
2020-07-27 21:10:47 +07:00
Renovate Bot
d9711c8055 Update module google/go-cmp to v0.5.1 2020-07-27 05:28:15 +00:00
Renovate Bot
94c4db3eb2 Update google.golang.org/genproto commit hash to da3ae01 2020-07-27 04:56:06 +00:00
Cuong Manh Le
a8fd23a2be
pkg/storage/redis: move last version to redis (#1134)
So we can support multiple databroker servers, we can't do it if we
store last version inside Server struct.
2020-07-24 11:27:11 +07:00
Cuong Manh Le
aedfbc4c71
pkg/storage: change backend interface to return error (#1131)
Since when storage backend like redis can be fault in many cases, the
interface should return error for the caller to handle.
2020-07-24 09:02:37 +07:00
Travis Groth
90d95b8c10
Set ExtAuthz Cluster name to URL Host (#1132) 2020-07-23 14:10:16 -04:00
Cuong Manh Le
1867feb5b9
internal/databroker: handle new db error (#1129)
Since when we now support other storage, not only memory storage, we
need to handle the error when we can't connect to storage.
2020-07-23 22:48:34 +07:00
Cuong Manh Le
1640151bc1
databroker server backend config (#1127)
* config,docs: add databroker storage backend configuration

* cache: allow configuring which backend storage to use

Currently supported types are "memory", "redis".
2020-07-23 10:42:43 +07:00
Travis Groth
c9182f757e
docs: Fix incorrect example middleware (#1128)
* Fix incorrect example middleware
2020-07-22 14:33:45 -04:00
Caleb Doxsey
1ad243dfd1
directory.Group entry for groups (#1118)
* store directory groups separate from directory users

* fix group lookup, azure display name

* remove fields restriction

* fix test

* also support email

* use Email as name for google'

* remove changed file

* show groups on dashboard

* fix test

* re-add accidentally removed code
2020-07-22 11:28:53 -06:00
Cuong Manh Le
489cdd8b63
internal/controlplane: using envoy strip host port matching (#1126)
* internal/controlplane: using envoy strip host port matching

With envoy 1.15.0 release, strip host port matching setting allows
incoming request with Host "example:443" will match again route with
domains match set to "example".

Not that this is not standard HTTP behavior, but it's more convenient
for users.

Fixes #959

* docs/docs: add note about enable envoy strip host port matching
2020-07-22 23:51:57 +07:00
Caleb Doxsey
504197d83b
custom rego in databroker (#1124)
* add support for sub policies

* add support for sub policies

* update authz rego policy to support sub policies
2020-07-22 10:44:05 -06:00
Cuong Manh Le
1d82be2c0e
internal/databroker: fix wrong server version init (#1125) 2020-07-22 04:32:44 +07:00
Cuong Manh Le
99785cbb5b
internal/databroker: store server version (#1121)
Storing server version when creating new server. After then, we can
retrieve the version from backend when server restart.

With storage backend which supports persistent, the server version
won't change after restarting.
2020-07-22 03:50:22 +07:00
Cuong Manh Le
26f099b49d
redis storage backend (#1082)
* pkg/storage: add redis storage backend

* pkg/storage/redis: set record create time correctly

* pkg/storage/redis: add docs

* pkg/storage/redis: run test with redis tag only

* pkg/storage/redis: use localhost

* pkg/storage/redis: use 127.0.0.1

* pkg/storage/redis: honor REDIS_URL env

* .github/workflows: add missing config for redis service

* .github/workflows: map redis ports to host

* pkg/storage/redis: use proto marshaler instead of json one

* pkg/storage/redis: use better implementation

By using redis supported datastructure:

 - Hash for storing record
 - Sorted set for storing by version
 - Set for storing deleted ids

List operation will be now performed in O(log(N)+M) instead of O(N) like
previous implementation.

* pkg/storage/redis: add tx to wrap redis transaction

* pkg/storage/redis: set record type in New

* pkg/storage/redis: make sure tx commands appear in right order

* pkg/storage/redis: make deletePermanentAfter as argument

* pkg/storage/redis: make sure version is incremented when deleting

* pkg/storage/redis: fix linter

* pkg/storage/redis: fix cmd construction
2020-07-22 03:07:20 +07:00
Caleb Doxsey
858077b3b6
authorize: custom rego policies (#1123)
* add support for custom rego policies

* add support for passing custom policies
2020-07-21 12:09:26 -06:00
bobby
d5433f8431
depedency: bump envoy to 1.15.0 (#1119)
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2020-07-21 08:25:37 -07:00
bobby
1912e32927
deps: update envoy to 1.14.4 (#1076)
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2020-07-20 21:12:44 -07:00