Commit graph

77 commits

Author SHA1 Message Date
Caleb Doxsey
cc85ea601d
policy: add new certificate-authority option for downstream mTLS client certificates (#1835)
* policy: add new certificate-authority option for downstream mTLS client certificates

* update proto, docs
2021-02-01 08:10:32 -07:00
wasaga
67f6030e1e
upstream endpoints load balancer weights (#1830) 2021-01-28 09:11:14 -05:00
Caleb Doxsey
bec98051ae
config: return errors on invalid URLs, fix linting (#1829) 2021-01-27 07:58:30 -07:00
Caleb Doxsey
84e8f6cc05
config: fix databroker policies (#1821) 2021-01-25 17:18:50 -07:00
wasaga
3a505d5573
expose envoy cluster options in policy (#1804) 2021-01-25 09:49:03 -05:00
Travis Groth
f946d940f5
config: require shared key if using redis backed databroker (#1801) 2021-01-22 16:28:18 -05:00
wasaga
4017e0681a
upstream health check config (#1796) 2021-01-21 15:23:06 -05:00
Caleb Doxsey
70b4497595
databroker: rename cache service (#1790)
* rename cache folder

* rename cache service everywhere

* skip yaml in examples

* Update docs/docs/topics/data-storage.md

Co-authored-by: Travis Groth <travisgroth@users.noreply.github.com>

Co-authored-by: Travis Groth <travisgroth@users.noreply.github.com>
2021-01-21 08:41:22 -07:00
Caleb Doxsey
a4c7381eba
config: support multiple destination addresses (#1789)
* config: support multiple destination addresses

* use constructor for string slice

* add docs

* add test for multiple destinations

* fix name
2021-01-20 15:18:24 -07:00
wasaga
c6b6141d12
new skip_xff_append option (#1788)
Added `skip_xff_append` configuration option. When set, proxy would not append it's IP address to `x-forwarded-for` HTTP header.
2021-01-20 10:56:29 -05:00
Caleb Doxsey
09747aa3ba
add support for proxy protocol on HTTP listener (#1777)
* add support for proxy protocol on HTTP listener

* rename option, add doc
2021-01-19 05:56:58 -07:00
Caleb Doxsey
ab4a68f56f
remove user impersonation and service account cli (#1768)
* remove user impersonation and service account cli

* update doc

* remove user impersonation url query params

* fix flaky test
2021-01-12 09:28:29 -07:00
Caleb Doxsey
00734243b3
telemetry: add support for datadog tracing (#1743)
* add support for datadog tracing

* omitempty on datadog address

* envoy: add datadog exporter for tracing
2021-01-06 12:27:23 -07:00
bobby
f837c92741
dev: update linter (#1728)
- gofumpt everything
- fix TLS MinVersion to be at least 1.2
- add octal syntax
- remove newlines
- fix potential decompression bomb in ecjson
- remove implicit memory aliasing in for loops.

Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2020-12-30 09:02:57 -08:00
Travis Groth
4fbbf28a16
config: fix ignored yaml fields (#1698) 2020-12-17 11:13:09 -05:00
bobby
5bbd745934
authorize: add signature algo support (RSA / EdDSA) (#1631)
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2020-11-30 17:14:41 -08:00
bobby
652e8bb3d3
deps: update hashstructure v2 (#1632)
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2020-11-30 16:53:21 -08:00
Caleb Doxsey
2d5690dde6
remove deprecated cache_service_url config option (#1614)
* remove deprecated cache_service_url config option

* remove broken test

* update integration test config

* update nginx example

Co-authored-by: Travis Groth <travisgroth@users.noreply.github.com>
2020-11-23 14:57:29 -07:00
Caleb Doxsey
04c582121d
add flag to enable user impersonation (#1514)
* add flag to enable user impersonation

* fix typo
2020-10-14 08:17:59 -06:00
Caleb Doxsey
54d37e62e8
config: add dns_lookup_family option to customize DNS IP resolution (#1436) 2020-09-21 15:32:37 -06:00
Cuong Manh Le
9de99d0211
all: add signout redirect url (#1324)
Fixes #1213
2020-08-25 01:23:58 +07:00
Caleb Doxsey
c4c8ef8e53
azure: support deriving credentials from client id, client secret and provider url (#1300) 2020-08-18 10:17:28 -06:00
Cuong Manh Le
f356ff5581 config: add idp qps config 2020-08-14 09:50:49 +07:00
Caleb Doxsey
fbf5b403b9
config: allow dynamic configuration of cookie settings (#1267) 2020-08-13 08:11:34 -06:00
Caleb Doxsey
f822c9a5d2
config: allow reloading of telemetry settings (#1255)
* metrics: support dynamic configuration settings

* add test

* trace: update configuration when settings change

* config: allow logging options to be configured when settings change

* envoy: allow changing log settings

* fix unexpected doc change

* fix tests

* pick a port at random

* update based on review
2020-08-12 08:14:15 -06:00
Cuong Manh Le
0d611c2a40
config: warn if custom scopes set for builtin providers (#1252)
* config: warn if custom scopes set for builtin providers

Fixes #1144

* config: make warn msg constant
2020-08-11 23:23:34 +07:00
Caleb Doxsey
1285a9d91d
databroker: add support for config settings (#1253) 2020-08-11 07:50:19 -06:00
Travis Groth
6df65fe197
config: fix loading storage client cert from wrong location (#1212) 2020-08-05 12:50:10 -04:00
Cuong Manh Le
73abed0d21
all: update outdated comments about OptionsUpdater interface (#1207)
In #1088, OptionsUpdater was removed, but current code still mention it.
This commit updates all comments which still mention about that
interface (authorize is exlcuded, and will be updated in #1206).
2020-08-05 21:39:24 +07:00
Cuong Manh Le
bc61206b78
pkg/storage/redis: add redis TLS support (#1163)
Fixes #1156
2020-07-31 19:37:23 +07:00
Travis Groth
aa8ba35332
config: default to google idp credentials for serverless (#1170) 2020-07-30 20:21:41 -04:00
Travis Groth
3c4513a91e
telmetry: add databroker storage metrics and tracing (#1161)
* telmetry: add databroker storage metrics and tracing
2020-07-30 18:19:23 -04:00
Cuong Manh Le
1640151bc1
databroker server backend config (#1127)
* config,docs: add databroker storage backend configuration

* cache: allow configuring which backend storage to use

Currently supported types are "memory", "redis".
2020-07-23 10:42:43 +07:00
Travis Groth
75f2ed93ea
Set loopback address by ipv4 IP (#1116) 2020-07-20 22:31:48 -04:00
Cuong Manh Le
821f2e9000
config: allow setting directory sync interval and timeout (#1098)
Updates #567
2020-07-17 23:11:27 +07:00
Caleb Doxsey
d3a7ee38be
options refactor (#1088)
* refactor config loading

* wip

* move autocert to its own config source

* refactor options updaters

* fix stuttering

* fix autocert validate check
2020-07-16 14:30:15 -06:00
Caleb Doxsey
96424dac0f
implement google cloud serverless authentication (#1080)
* add google cloud serverless support

* force ipv4 for google cloud serverless

* disable long line linting

* fix destination hostname

* add test

* add support for service accounts

* fix utc time in test
2020-07-16 08:25:14 -06:00
Dmitri Farkov
253addcad6
config: change certificates config key parsing to attempt Base64 decoding first. (#1055) 2020-07-15 21:15:57 +07:00
Caleb Doxsey
fae02791f5
cryptutil: move to pkg dir, add token generator (#1029)
* cryptutil: move to pkg dir, add token generator

* add gitignored files

* add tests
2020-06-30 15:55:33 -06:00
bobby
dbd1eac97f
identity: support custom code flow request params (#998)
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2020-06-25 08:28:46 -07:00
Bobby DeSimone
1d1311a240 config: error if groups are used without service account
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2020-06-24 16:01:08 -07:00
bobby
452c9be06d
cache: remove unused metrics and options (#957)
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2020-06-22 06:59:04 -07:00
Caleb Doxsey
dbd7f55b20
feature/databroker: user data and session refactor project (#926)
* databroker: add databroker, identity manager, update cache (#864)

* databroker: add databroker, identity manager, update cache

* fix cache tests

* directory service (#885)

* directory: add google and okta

* add onelogin

* add directory provider

* initialize before sync, upate google provider, remove dead code

* add azure provider

* fix azure provider

* fix gitlab

* add gitlab test, fix azure test

* hook up okta

* remove dead code

* fix tests

* fix flaky test

* authorize: use databroker data for rego policy (#904)

* wip

* add directory provider

* initialize before sync, upate google provider, remove dead code

* fix flaky test

* update authorize to use databroker data

* implement signed jwt

* wait for session and user to appear

* fix test

* directory service (#885)

* directory: add google and okta

* add onelogin

* add directory provider

* initialize before sync, upate google provider, remove dead code

* add azure provider

* fix azure provider

* fix gitlab

* add gitlab test, fix azure test

* hook up okta

* remove dead code

* fix tests

* fix flaky test

* remove log line

* only redirect when no session id exists

* prepare rego query as part of create

* return on ctx done

* retry on disconnect for sync

* move jwt signing

* use !=

* use parent ctx for wait

* remove session state, remove logs

* rename function

* add log message

* pre-allocate slice

* use errgroup

* return nil on eof for sync

* move check

* disable timeout on gRPC requests in envoy

* fix gitlab test

* use v4 backoff

* authenticate: databroker changes (#914)

* wip

* add directory provider

* initialize before sync, upate google provider, remove dead code

* fix flaky test

* update authorize to use databroker data

* implement signed jwt

* wait for session and user to appear

* fix test

* directory service (#885)

* directory: add google and okta

* add onelogin

* add directory provider

* initialize before sync, upate google provider, remove dead code

* add azure provider

* fix azure provider

* fix gitlab

* add gitlab test, fix azure test

* hook up okta

* remove dead code

* fix tests

* fix flaky test

* remove log line

* only redirect when no session id exists

* prepare rego query as part of create

* return on ctx done

* retry on disconnect for sync

* move jwt signing

* use !=

* use parent ctx for wait

* remove session state, remove logs

* rename function

* add log message

* pre-allocate slice

* use errgroup

* return nil on eof for sync

* move check

* disable timeout on gRPC requests in envoy

* fix dashboard

* delete session on logout

* permanently delete sessions once they are marked as deleted

* remove permanent delete

* fix tests

* remove groups and refresh test

* databroker: remove dead code, rename cache url, move dashboard (#925)

* wip

* add directory provider

* initialize before sync, upate google provider, remove dead code

* fix flaky test

* update authorize to use databroker data

* implement signed jwt

* wait for session and user to appear

* fix test

* directory service (#885)

* directory: add google and okta

* add onelogin

* add directory provider

* initialize before sync, upate google provider, remove dead code

* add azure provider

* fix azure provider

* fix gitlab

* add gitlab test, fix azure test

* hook up okta

* remove dead code

* fix tests

* fix flaky test

* remove log line

* only redirect when no session id exists

* prepare rego query as part of create

* return on ctx done

* retry on disconnect for sync

* move jwt signing

* use !=

* use parent ctx for wait

* remove session state, remove logs

* rename function

* add log message

* pre-allocate slice

* use errgroup

* return nil on eof for sync

* move check

* disable timeout on gRPC requests in envoy

* fix dashboard

* delete session on logout

* permanently delete sessions once they are marked as deleted

* remove permanent delete

* fix tests

* remove cache service

* remove kv

* remove refresh docs

* remove obsolete cache docs

* add databroker url option

* cache: use memberlist to detect multiple instances

* add databroker service url

* remove cache service

* remove kv

* remove refresh docs

* remove obsolete cache docs

* add databroker url option

* cache: use memberlist to detect multiple instances

* add databroker service url

* wip

* remove groups and refresh test

* fix redirect, signout

* remove databroker client from proxy

* remove unused method

* remove user dashboard test

* handle missing session ids

* session: reject sessions with no id

* sessions: invalidate old sessions via databroker server version (#930)

* session: add a version field tied to the databroker server version that can be used to invalidate sessions

* fix tests

* add log

* authenticate: create user record immediately, call "get" directly in authorize (#931)
2020-06-19 07:52:44 -06:00
Yuchen Ying
8fc1e9cca8
Add an option to request certificate with Must-Staple. (#697) 2020-06-17 08:29:34 -07:00
Cuong Manh Le
e0bdd906f9
config: change the default logging level to INFO (#902)
config: change the default logging level to INFO

DEBUG logging level is very verbose and potentially logs sensitive data.
We should set default log level to INFO.

Updates #895
Fixes #896
2020-06-15 22:55:18 +07:00
Travis Groth
42966ab39b
options: ensure viper ignores certificates config field (#876) 2020-06-11 16:38:13 -04:00
Yuchen Ying
b000930914
Remove unnecessary viper.New() (#849) 2020-06-11 10:26:42 -04:00
Yuchen Ying
7abe3a3b02
Remove additional indirection. (#848)
o is already a pointer to Options struct.
2020-06-08 07:36:24 -06:00
Caleb Doxsey
12e373249b
config: strip quotes from http redirect addr (#818) 2020-06-01 08:51:56 -06:00
Travis Groth
6761cc7a14
telemetry: service label updates (#802) 2020-05-29 15:16:22 -04:00