v0.9.0

0.9.0 (2022/06/20)

New and Improved

• PKI Workers: This release introduces a new worker type pki which
  authenticates to Boundary using a new certificate-based method, allowing for
  worker deployment without using a shared KMS.
• Credentials: This release introduces a new credential store type static,
  which simply takes in a user-supplied credential and stores it (encrypted)
  directly in Boundary. Currently, the static credential store can hold
  credentials of type username_password. These credentials can act as
  credential sources for targets, similar to credential libraries from the
  vault credential store, and thus can be brokered to users at session
  authorization time. PR
• boundary connect Credential Brokering Integration: we have extended integration
  into the boundary connect helpers. A new sshpass style has been added to the
  ssh helper, when used, if the credential contains a username/password and sshpass
  is installed, the command will automatically pass the credentials to the ssh process.
  Additionally, the default ssh helper will now use the username of the brokered credential.
  PR.
• controller: Improve response time for listing sessions.
  This also creates a new periodic job that will delete terminated
  sessions after 1 hour.
  See Deprecations/Changes for some additional details.
  PR.
• event filtering: Change event filters to use lowercase and snake case for data
  elements like the rest of Boundary filters do.
• ui: Use include_terminated flag for listing sessions.
  PR.
• ui: Add Quick Setup onboarding guide.
  PR.

Bug Fixes

• The plugin execution_dir configuration parameter is now respected.
  PR.
• ui: Fix Users page not updating fields correctly.
  PR.

Deprecations/Changes

• Targets: Removes support for credential libraries with respect to Target resources.
  The library fields and actions were deprecated in Boundary 0.5.0,
  please use credential sources instead. See changelog referenced above for
  more details (PR).
• Credential Libraries: The user_password credential type has been renamed to
  username_password to remove any inconsistency over what the credential type is.
  All existing user_password typed credential libraries will be migrated to
  username_password (PR).
• controller: Change the default behavior of the session list endpoint
  to no longer include sessions in a terminated state and introduces
  a new query parameter/cli flag to include the terminated sessions.
  This also removes the connection information from the list response.
  PR.
• Anonymous user permissions: In order to reduce the risk of accidental and
  unintended granting of permissions to anonymous users, the permissions system
  now only allows certain actions on certain resources to be assigned to the
  anonymous user; currently these are the same permissions as assigned in
  Boundary's default role permissions. If other use-cases arise this list can be
  expanded. See the
  documentation
  for more details.

v0.8.1

0.8.1 (2022/05/13)

Bug Fixes

• controller: Do not shut down cluster listener when it receives an invalid
  packet (Issue,
  PR)
• session: update cancel_session() function to check for terminated state (Issue,
  PR)

v0.8.0

0.8.0 (2022/05/03)

New and Improved

• metrics: provide metrics for controllers and workers
• controller: new health endpoint (PR).
• Improve response time for listing sessions and targets.
  PR
• ui: Add support for worker filters in targets.
• ui: Add manual refresh button in sessions list.

Bug Fixes

• worker: create new error to prevent event.newError: missing error: invalid parameter and handle session cancel
  with no TOFU token (Issue,
  PR)
• controller: Reconcile DEKs with existing scopes (Issue,
  PR)
• Fix for retrieving sessions that could result in incomplete results when
  there is a large number (10k+) of sessions.
  PR
• session: update session state trigger to prevent transitions to invalid states (Issue,
  PR)

v0.7.6

0.7.6 (2022/03/15)

Bug Fixes

• sessions: Sessions and session connections have been refactored
  to better isolate transactions and prevent resource contention that caused deadlocks.
  (Issue,
  PR)
• scheduler: Fix bug that causes erroneous logs when racing controllers
  attempted to run jobs
  (Issue,
  PR).

v0.7.5

0.7.5 (2022/02/17)

New and Improved

• cli: Update authentication examples to remove password flag and make
  subcommend selection a bit clearer
  (PR)
• Data Warehouse: Add addresses on plugin based hosts to the database warehouse.
  3 new dimension tables have been added including wh_network_address_group
  (which is now referenced by wh_host_dimension),
  wh_network_address_dimension, and wh_network_address_group_membership.
  (PR)
• ui: Add support for dynamic host catalog. AWS and Azure plugin-based CRUD operations.

Bug Fixes

• targets: Specifying a plugin based host id when authorizing a session
  now works. (PR)
• targets: DNS names are now properly parsed when selecting an endpoint
  for authorizing a session.
  (PR)
• hosts: Static hosts now include the host sets they are in.
  (PR)

v0.7.4

0.7.4 (2022/01/18)

Deprecations/Changes

• In newly-created scopes, if default role creation is not disabled, the roles
  will now contain a grant to allow listing targets. This will still be subject
  to listing visibility rules, so only targets the user is granted some action
  on (such as authorize-session) will be returned.

New and Improved

• config: The description field for workers now supports being set
  from environment variables or a file on disk
  (PR)
• config: The max_open_connections field for the database field in controllers now supports being set
  from environment variables or a file on disk
  (PR)
• config: The execution_dir field for plugins now supports being set from environment variables
  or a file on disk.(PR)
• config: Add support for reading worker controllers off of environment
  variables as well as files. (PR)
• config: The description field for controllers now supports being set
  from environment variables or a file on disk
  (PR)
• config: Add support for reading worker tags off of environment variables
  as well as files. (PR)
• config: Add support for go-sockaddr templates to Worker and Controller
  addresses. (PR)
• controllers/workers: Add client IP to inbound request information which is included in
  Boundary events (PR)
• host: Plugin-based host catalogs will now schedule updates for all
  of its host sets when its attributes are updated.
  (PR)
• scopes: Default roles in newly-created scopes now contain a grant to allow
  listing targets. (PR)
• plugins/aws: AWS plugin based hosts now include DNS names in addition to the
  IP addresses they already provide.

Bug Fixes

• session: Fix duplicate sessions and invalid session state transitions. (PR)

v0.7.3

0.7.3 (2021/12/16)

Bug Fixes

• target: Fix permission bug which prevents the UI from being able to add and remove
  host sources on a target. (PR)
• credential: Fix panic during credential issue when a nil secret is received. This can
  occur when using the Vault KV backend which returns a nil secret and no error if the
  secret does not exist. (PR)

v0.7.2

0.7.2 (2021/12/14)

Security

• Boundary now uses Go 1.17.5 to address a security vulnerability (CVE-2021-44716) where
  an attacker can cause unbounded memory growth in a Go server accepting HTTP/2 requests.
  See the Go announcement for
  more details. (PR)

v0.7.1

0.7.1 (2021/11/18)

Bug Fixes

• db: Fix panic invoking the CLI on Windows. Some changes to how the binary is
  initialized resulted in running some functions on every startup that looked
  for some embedded files. However, Go's embed package does not use OS-specific
  path separators, so a mismatch between path separators caused a failure in the
  function. (PR)

v0.7.0

0.7.0 (2021/11/17)

Deprecations/Changes

• tls: Boundary's support for TLS 1.0/1.1 on the API listener was broken. Rather
  than fix this, we are simply not supporting TLS 1.0/1.1 as they are insecure.

New and Improved

• Boundary now supports dynamic discovery of host resources using our (currently
  internal) new plugin system. See the
  documentation for configuration
  instructions. Currently, only Azure and AWS are supported, but more providers
  will be following in future releases.
• workers: The existing worker connection replay prevention logic has been
  enhanced to be more robust against attackers that have decryption access to
  the shared worker-auth KMS key
  (PR)

Bug Fixes

• tls: Support TLS 1.2 for more clients. This was broken for some clients due to
  a missing mandated cipher suite of the HTTP/2 (h2) specification that could
  result in no shared cipher suites between the Boundary API listener and those
  clients. (PR)
• vault: Fix credential store support when using Vault namespaces
  (Issue,
  PR)