v0.15.0

0.15.0 (2024/01/30)

Deprecations/Changes

• Per the note in Boundary 0.13.0, the previous kms worker method has been removed. Since 0.13.0, unless the use_deprecated_kms_auth_method value was set on the worker config, the new kms mechanism was already being used; this is simply no longer an available option.
• Per the notes in Boundary 0.12.0 and 0.14.0, it is now an error if an address on a host or target contains a port. As of this release, this restriction also affects existing addresses (not just creation/updating via the API) so any existing addresses containing a port will not be able to be used as part of a target's session authorization call.
• The grant_scope_id field on roles is now deprecated in favor of the multiple grant scope support.
• Per the note in Boundary 0.13.1, the id field in grants has changed to ids which allows multiple ids to be included; existing grants submitted to Boundary will continue to work, but grants using "id" can no longer be added to or set on a role.
• All list endpoints except workers now return the first 1000 items instead of all items if no parameters are provided. The number of items returned can be configured through the new controller configuration value max_page_size. The Admin UI, CLI and api package automatically paginate results.

New and Improved

• Multiple grant scopes in roles: Roles now support multiple grant scopes, along with the special values this, children (global/org only) to apply to all direct children of a scope, and descendants (global only) to apply to all descendants of a scope. These use the new actions add-grant-scopes, set-grant-scopes, and remove-grant-scopes on roles. For now the grant_scope_id field on roles will continue to be able to be set, which will set a single grant scope, but this capability is now deprecated.
• Policies (Enterprise and HCP Boundary only): This release introduces Policies, a Boundary resource that represents a Governance Policy to enforce. The first implementation targets Storage Policies, which enables administrators to automate the process of retention and deletion of Session Recordings, ensuring that they're only retaining data that is explicitly required from a security/compliance perspective.
  • ui: Add full UI support for Storage Policies managing the lifecycle of Session Recordings. (PR)
• New generic commands read, update, and delete have been added. These allow operating on resources by directly specifying the ID of the resource as the next parameter (e.g. boundary update ttcp_1234567890). Subtypes do not need to be specified (e.g. that command is equivalent to boundary targets update tcp -id ttcp_1234567890), and any flags given after the ID are passed through to the type-specific subcommand. Once the ID has been entered, autocomplete is also supported. (PR)
• The key_id parameter within SSH Certificate Credential Libraries now accepts the use of templated parameters (PR)
• List endpoint pagination: All list endpoints except workers now support pagination.
  • api: All list endpoints except workers have added support for pagination. The api package automatically paginates until the end of the results. The new `WithListToken`` option can be used to request a list of updated and deleted resources relative to the last result received.
  • config: add new controller field max_page_size for controlling the default and max size of pages when paginating through results.
• New command search has been added allowing quick searching of targets or sessions. It utilizes a client side cache also added in this release. The client side cache starts itself automatically in the background when successfully executing any command that communicates with a Boundary controller. To disable the client cache from starting automatically set the BOUNDARY_SKIP_CACHE_DAEMON environment variable or pass the -skip-cache-daemon flag when running a command that may start it. Commands daemon start, daemon stop, daemon status, and daemon add-token were added to help manage the cache. The cache does not currently work with Boundary instances that require the use of client side certs.