3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-04-29 02:16:28 +02:00
Code Issues Projects Releases Packages Wiki Activity
3595 commits 156 branches 125 tags 103 MiB
Commit graph

420 commits

Author SHA1 Message Date
Denis Mishin
2bb70258c3
authorize/log: remove audit logging (#5369) 2024-11-22 14:32:52 -05:00
Caleb Doxsey
3a8bdde211
authorize: remove wait for ready (#5376) 2024-11-22 10:17:00 -07:00
Caleb Doxsey
ef12fda55c
authorize: additional header evaluator tests (#5363) 
* authorize: additional header evaluator tests

* add groups to jwt test
 2024-11-07 09:22:35 -07:00
Joe Kralicky
526e2a58d6
New integration test fixtures (#5233) 
* Initial test environment implementation

* linter pass

* wip: update request latency test

* bugfixes

* Fix logic race in envoy process monitor when canceling context

* skip tests using test environment on non-linux
 2024-11-05 14:31:40 -05:00
Caleb Doxsey
8935ed17fa
tests: use testcontainers (#5341) 
* tests: use testcontainers for postgres

* tests: use testcontainers for minio

* remove gcs test

* try installing docker

* skip docker on macos
 2024-10-30 13:33:30 -06:00
Caleb Doxsey
0e6294d650
ppl: support additional types for string matchers (#5348) 2024-10-30 13:16:03 -06:00
Joe Kralicky
fe31799eb5
Fix many instances of contexts and loggers not being propagated (#5340) 
This also replaces instances where we manually write "return ctx.Err()"
with "return context.Cause(ctx)" which is functionally identical, but
will also correctly propagate cause errors if present.
 2024-10-25 14:50:56 -04:00
Joe Kralicky
a42e286637
Add new jwt issuer format route option (#5338) 2024-10-25 13:07:47 -04:00
Caleb Doxsey
9e9ed8853f
ppl: more flexible matchers (#5336) 
* ppl: more flexible matchers

* make the string list matcher "is" match arrays with only a single item

* re-use has

* default list matcher to has
 2024-10-25 07:56:57 -06:00
Caleb Doxsey
d2c14cd6d2
logging: remove ctx from global log methods (#5337) 
* log: remove warn

* log: update debug

* log: update info

* remove level, log

* remove contextLogger function
 2024-10-23 14:18:52 -06:00
Kenneth Jenkins
298a5a94a5
inmemory: add a test for the ListTypes race fix (#5327) 
Add a test that interleaves calls to Put() (with different type strings)
and ListTypes(). At least on my machine, this appears to reliably detect
the data race fixed in commit 2f8743522d
when run with the Go race detector. (The 'make test' and 'make cover'
targets run with the Go race detector enabled.)
 2024-10-15 15:32:29 -07:00
Caleb Doxsey
27947b19cb
core/config: add kubernetes_service_account_token_file (#5322) 
* core/config: add kubernetes_service_account_token_file

* fix loading of token file
 2024-10-10 14:53:45 -06:00
Joe Kralicky
0e13248685
Core-Zero Import (#5288) 
* initial core-zero import implementation

* Update /config/import openapi description and use PUT instead of POST

* update import ui tests

* Add 413 as a possible response for /config/import

* Options/Settings type conversion tests and related bugfixes

* Fixes for proto type conversion and tests

* Update core-zero import client

* Update core-zero import client

* Update import api and environment detection

* update go.mod

* remove old testdata

* Remove usage of deleted setting after merge

* remove extra newline from --version output
 2024-10-09 18:51:56 -04:00
Joe Kralicky
2f8743522d
storage: fix possible race condition with maps.Keys iterator (#5321) 2024-10-07 18:45:23 -04:00
Caleb Doxsey
410354bc00
core/go: use hashicorp/go-set (#5278) 2024-10-03 12:59:11 -06:00
Kenneth Jenkins
01d375f0bc
config: remove unused gRPC setting (#5308) 
Remove the grpc_client_dns_roundrobin option as it appears to be unused
since commit bbec2cae9f.
 2024-10-03 10:14:54 -07:00
Kenneth Jenkins
c011957389
grpcutil: additional JWT validation (#5303) 
Add additional validation to the grpcutil.RequireSignedJWT method. Log
any validation error, instead of returning error details in the gRPC
status message.
 2024-09-23 13:17:03 -07:00
Caleb Doxsey
bfc782ff06
core/zero: add pseudonymization key (#5290) 2024-09-19 14:43:01 -06:00
Caleb Doxsey
9d6b656fbe
core/proxy: fix is-enterprise check (#5295) 2024-09-19 13:10:45 -06:00
Kenneth Jenkins
6171c09596
config: remove unused databroker storage settings (#5285) 
Config options concerning the TLS connection from databroker to storage
backend are now unused. TLS options for this connection can instead be
set directly in the databroker storage connection string.
 2024-09-16 11:58:57 -07:00
Caleb Doxsey
146efc1b13
core/zero: add usage reporter (#5281) 
* wip

* add response

* handle empty email

* use set, update log

* add test

* add coalesce, comments, test

* add test, fix bug

* use builtin cmp.Or

* remove wait ready call

* use api error
 2024-09-12 15:45:54 -06:00
Caleb Doxsey
1e5f623c0e
core/zero: add report-usage API (#5276) 2024-09-11 08:52:56 -06:00
Caleb Doxsey
790c11b368
core/zero: add organization id and cluster id to bootstrap config (#5275) 2024-09-10 11:31:45 -06:00
Caleb Doxsey
dad954ae16
core/logging: change log.Error function (#5251) 
* core/logging: change log.Error function

* use request id
 2024-09-05 15:42:46 -06:00
Kenneth Jenkins
2b84111058
config: sort runtime flags, name consistency (#5255) 
Sort the runtime flag definitions alphabetically. Rename
envoy_resource_manager_enabled to just envoy_resource_manager for
consistency with the other flag names. (This flag hasn't been released
yet, so it should be OK to rename it.) Also add a doc comment.
 2024-09-03 13:37:19 -07:00
Denis Mishin
ce12e51cf5
zero/api: reset token and url cache if 401 is received (#5256) 
zero/api: reset token cache if 401 is received
 2024-09-03 15:40:28 -04:00
Joe Kralicky
d149b2d178
zero: generate error methods for response types (#5252) 2024-08-30 16:21:43 -04:00
Caleb Doxsey
d062f9d68d
core/logs: remove warnings (#5235) 
* core/logs: remove warnings

* switch to error
 2024-08-27 09:38:50 -06:00
Caleb Doxsey
556b2e0d73
core/grpc: add mock for registry service (#5243) 2024-08-26 11:30:17 -06:00
Caleb Doxsey
98cea10421
Revert "core/grpc: add IterateAll method" (#5234) 
Revert "core/grpc: add IterateAll method (#5227)"

This reverts commit 3961098681.
 2024-08-23 10:35:46 -06:00
Denis Mishin
0503b41108
zero/connect: add re-run health checks command (#5219) 
* zero/connect: add run health checks and shutdown commands

* fix proto

* trigger re-run on command

* add handler

* rename runPeriodicHealthChecksLeased
 2024-08-22 16:17:53 -04:00
Denis Mishin
6e766233c7
zero/health-checks: fix early checks sometimes missing (#5229) 
* zero/health-checks: fix early checks sometimes missing

* rm closure

* fix test
 2024-08-20 22:13:45 -04:00
Caleb Doxsey
3961098681
core/grpc: add IterateAll method (#5227) 
* core/grpc: add IterateAll method

* Update pkg/grpc/databroker/generic.go

Co-authored-by: Denis Mishin <dmishin@pomerium.com>

---------

Co-authored-by: Denis Mishin <dmishin@pomerium.com>
 2024-08-20 09:34:26 -06:00
Caleb Doxsey
2925447d35
zero/api: switch to github.com/oapi-codegen/oapi-codegen (#5226) 2024-08-19 12:00:48 -06:00
Joe Kralicky
332932b7a8
Replace usages of x/exp/maps + bump golang.org/x/exp (#5221) 
Bump golang.org/x/exp; replace usages of x/exp/maps with stdlib equivalents
 2024-08-15 17:49:24 -04:00
Caleb Doxsey
0cfb1025db
core/proto: update protoc dependencies (#5218) 
* core/proto: update protoc dependencies

* cleanup

* disable unimplemented forward compatibility check

* fix mock

* add generate make command

* add .0
 2024-08-15 11:12:05 -06:00
Denis Mishin
3483447c37
ci: do not include timestamp into buildmeta (#5215) 2024-08-15 10:57:10 -04:00
Denis Mishin
e2251b2d57
databroker/leaser: set timeout on ReleaseLease (#5208) 2024-08-06 14:47:59 -04:00
Kenneth Jenkins
418ee79e1a
authenticate: rework session ID token handling (#5178) 
Currently, the Session proto id_token field is populated with Pomerium
session data during initial login, but with IdP ID token data after an
IdP session refresh.

Instead, store only IdP ID token data in this field.

Update the existing SetRawIDToken method to populate the structured data
fields based on the contents of the raw ID token. Remove the other code
that sets these fields (in the authenticateflow package and in
manager.sessionUnmarshaler).

Add a test for the identity manager, exercising the combined effect of
session claims unmarshaling and SetRawIDToken(), to verify that the
combined behavior is preserved unchanged.
 2024-07-29 12:43:50 -07:00
Kenneth Jenkins
b0606d9283
envoy: upgrade to v1.31.0 (#5183) 2024-07-23 10:06:03 -07:00
Kenneth Jenkins
14c0c5abd0
oidc: add more unit tests (#5174) 
Add tests for all of the oidc.Provider methods not currently covered.
Remove the GetSubject() method as it appears to be unused.
 2024-07-22 14:28:39 -07:00
Kenneth Jenkins
9fe646f25a
session: do not invalidate based on ID token (#5182) 
Per the OIDC spec, section 2:

> NOTE: The ID Token expiration time is unrelated [to] the lifetime of
> the authenticated session between the RP and the OP.

A Pomerium session should remain valid for as long as the underlying
OAuth2 session.
 2024-07-19 16:29:06 -07:00
Caleb Doxsey
e5e6558de6
core/authorize: require new login when authenticate url changes (#5165) 2024-07-12 10:57:41 -06:00
dependabot[bot]
8f8c66e9fd
chore(deps): bump the go group with 21 updates (#5162) 
* chore(deps): bump the go group with 21 updates

Bumps the go group with 21 updates:

| Package | From | To |
| --- | --- | --- |
| [cloud.google.com/go/storage](https://github.com/googleapis/google-cloud-go) | `1.41.0` | `1.42.0` |
| [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) | `1.27.0` | `1.30.1` |
| [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) | `1.27.16` | `1.27.23` |
| [github.com/aws/aws-sdk-go-v2/service/s3](https://github.com/aws/aws-sdk-go-v2) | `1.54.3` | `1.57.1` |
| [github.com/caddyserver/certmagic](https://github.com/caddyserver/certmagic) | `0.21.2` | `0.21.3` |
| [github.com/cloudflare/circl](https://github.com/cloudflare/circl) | `1.3.8` | `1.3.9` |
| [github.com/docker/docker](https://github.com/docker/docker) | `26.1.3+incompatible` | `27.0.3+incompatible` |
| [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) | `5.0.12` | `5.1.0` |
| [github.com/gorilla/websocket](https://github.com/gorilla/websocket) | `1.5.1` | `1.5.3` |
| [github.com/klauspost/compress](https://github.com/klauspost/compress) | `1.17.8` | `1.17.9` |
| [github.com/minio/minio-go/v7](https://github.com/minio/minio-go) | `7.0.70` | `7.0.72` |
| [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) | `0.65.0` | `0.66.0` |
| [github.com/prometheus/common](https://github.com/prometheus/common) | `0.53.0` | `0.55.0` |
| [github.com/spf13/viper](https://github.com/spf13/viper) | `1.18.2` | `1.19.0` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.23.0` | `0.24.0` |
| [golang.org/x/net](https://github.com/golang/net) | `0.25.0` | `0.26.0` |
| [golang.org/x/oauth2](https://github.com/golang/oauth2) | `0.20.0` | `0.21.0` |
| [golang.org/x/sys](https://github.com/golang/sys) | `0.20.0` | `0.21.0` |
| [google.golang.org/api](https://github.com/googleapis/google-api-go-client) | `0.178.0` | `0.183.0` |
| [google.golang.org/genproto/googleapis/rpc](https://github.com/googleapis/go-genproto) | `0.0.0-20240515191416-fc5f0ca64291` | `0.0.0-20240528184218-531527333157` |
| google.golang.org/protobuf | `1.34.1` | `1.34.2` |


Updates `cloud.google.com/go/storage` from 1.41.0 to 1.42.0
- [Release notes](https://github.com/googleapis/google-cloud-go/releases)
- [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/CHANGES.md)
- [Commits](https://github.com/googleapis/google-cloud-go/compare/spanner/v1.41.0...spanner/v1.42.0)

Updates `github.com/aws/aws-sdk-go-v2` from 1.27.0 to 1.30.1
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/v1.27.0...v1.30.1)

Updates `github.com/aws/aws-sdk-go-v2/config` from 1.27.16 to 1.27.23
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/config/v1.27.16...config/v1.27.23)

Updates `github.com/aws/aws-sdk-go-v2/service/s3` from 1.54.3 to 1.57.1
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/service/s3/v1.54.3...service/s3/v1.57.1)

Updates `github.com/caddyserver/certmagic` from 0.21.2 to 0.21.3
- [Release notes](https://github.com/caddyserver/certmagic/releases)
- [Commits](https://github.com/caddyserver/certmagic/compare/v0.21.2...v0.21.3)

Updates `github.com/cloudflare/circl` from 1.3.8 to 1.3.9
- [Release notes](https://github.com/cloudflare/circl/releases)
- [Commits](https://github.com/cloudflare/circl/compare/v1.3.8...v1.3.9)

Updates `github.com/docker/docker` from 26.1.3+incompatible to 27.0.3+incompatible
- [Release notes](https://github.com/docker/docker/releases)
- [Commits](https://github.com/docker/docker/compare/v26.1.3...v27.0.3)

Updates `github.com/go-chi/chi/v5` from 5.0.12 to 5.1.0
- [Release notes](https://github.com/go-chi/chi/releases)
- [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md)
- [Commits](https://github.com/go-chi/chi/compare/v5.0.12...v5.1.0)

Updates `github.com/gorilla/websocket` from 1.5.1 to 1.5.3
- [Release notes](https://github.com/gorilla/websocket/releases)
- [Commits](https://github.com/gorilla/websocket/compare/v1.5.1...v1.5.3)

Updates `github.com/klauspost/compress` from 1.17.8 to 1.17.9
- [Release notes](https://github.com/klauspost/compress/releases)
- [Changelog](https://github.com/klauspost/compress/blob/master/.goreleaser.yml)
- [Commits](https://github.com/klauspost/compress/compare/v1.17.8...v1.17.9)

Updates `github.com/minio/minio-go/v7` from 7.0.70 to 7.0.72
- [Release notes](https://github.com/minio/minio-go/releases)
- [Commits](https://github.com/minio/minio-go/compare/v7.0.70...v7.0.72)

Updates `github.com/open-policy-agent/opa` from 0.65.0 to 0.66.0
- [Release notes](https://github.com/open-policy-agent/opa/releases)
- [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-policy-agent/opa/compare/v0.65.0...v0.66.0)

Updates `github.com/prometheus/common` from 0.53.0 to 0.55.0
- [Release notes](https://github.com/prometheus/common/releases)
- [Changelog](https://github.com/prometheus/common/blob/main/RELEASE.md)
- [Commits](https://github.com/prometheus/common/compare/v0.53.0...v0.55.0)

Updates `github.com/spf13/viper` from 1.18.2 to 1.19.0
- [Release notes](https://github.com/spf13/viper/releases)
- [Commits](https://github.com/spf13/viper/compare/v1.18.2...v1.19.0)

Updates `golang.org/x/crypto` from 0.23.0 to 0.24.0
- [Commits](https://github.com/golang/crypto/compare/v0.23.0...v0.24.0)

Updates `golang.org/x/net` from 0.25.0 to 0.26.0
- [Commits](https://github.com/golang/net/compare/v0.25.0...v0.26.0)

Updates `golang.org/x/oauth2` from 0.20.0 to 0.21.0
- [Commits](https://github.com/golang/oauth2/compare/v0.20.0...v0.21.0)

Updates `golang.org/x/sys` from 0.20.0 to 0.21.0
- [Commits](https://github.com/golang/sys/compare/v0.20.0...v0.21.0)

Updates `google.golang.org/api` from 0.178.0 to 0.183.0
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](https://github.com/googleapis/google-api-go-client/compare/v0.178.0...v0.183.0)

Updates `google.golang.org/genproto/googleapis/rpc` from 0.0.0-20240515191416-fc5f0ca64291 to 0.0.0-20240528184218-531527333157
- [Commits](https://github.com/googleapis/go-genproto/commits)

Updates `google.golang.org/protobuf` from 1.34.1 to 1.34.2

---
updated-dependencies:
- dependency-name: cloud.google.com/go/storage
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/aws/aws-sdk-go-v2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/aws/aws-sdk-go-v2/config
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/aws/aws-sdk-go-v2/service/s3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/caddyserver/certmagic
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/cloudflare/circl
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/docker/docker
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: go
- dependency-name: github.com/go-chi/chi/v5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/gorilla/websocket
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/klauspost/compress
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/minio/minio-go/v7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/open-policy-agent/opa
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/prometheus/common
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/spf13/viper
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: golang.org/x/net
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: golang.org/x/oauth2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: golang.org/x/sys
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: google.golang.org/api
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: google.golang.org/genproto/googleapis/rpc
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: google.golang.org/protobuf
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix test

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Caleb Doxsey <cdoxsey@pomerium.com>
 2024-07-05 13:26:47 -06:00
Kenneth Jenkins
6ee9e5238c
envoy: upgrade to v1.30.3 (#5152) 2024-06-26 17:20:42 -07:00
Caleb Doxsey
d9c6afc168
core/envoy: add mode to download only the current binary (#5149) 2024-06-25 14:35:55 -06:00
Denis Mishin
a7dd30ad29
zero/telemetry: add hostname and version (#5146) 2024-06-24 21:33:37 -04:00
Caleb Doxsey
7eca911292
core/envoy: add command to download envoy binaries (#5133) 
* core/envoy: add command to download envoy binaries

* use internal log

* remove original get-envoy script
 2024-06-18 20:00:55 -06:00
Denis Mishin
8d206e0087
zero/telemetry: collect limited core metrics (#5142) 2024-06-18 19:15:11 -04:00
Denis Mishin
114f730dba
zero: refactor telemetry and controller (#5135) 
* zero: refactor controller

* refactor zero telemetry and controller

* wire with connect handler

* cr
 2024-06-12 21:59:25 -04:00