Skip to content
This repository was archived by the owner on Jul 12, 2023. It is now read-only.

v0.27.0
Compare
Choose a tag to compare
@sethvargo sethvargo released this 26 Apr 14:43
v0.27.0
c84cafb
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.

Changes since v0.26.0

Upgrade notes

  • Automated secrets rotation - this release introduces automated secrets rotation for improved security. See the updated production.md for a list of secrets that still require manual rotation. This also introduces a new monitoring metric for forward-progress on secrets rotation. The initial terraform apply may fail on the en-alerting module due to the missing metric. You can proceed with the deploy, manually invoke the rotation-secrets worker, and then re-run Terraform to pick up the changes.

    As part of this upgrade, you may encounter errors like the following while running Terraform:

    The metric referenced by the provided filter is unknown.

    You can safely ignore this error for now. Continue with the deploy and then, after the service has been deployed, wait 15 minutes and re-run Terraform to create the metrics and alerts.

  • Terraform 0.15 - the Terraform configurations are only tested against Terraform v0.15+. If you are using Terraform 0.14+, please upgrade. While we don't intentionally depend on 0.15-only features, we are no longer testing the 0.14 series.

  • Missing random provider - If you encounter the following error when applying Terraform:

    │ Error: Provider configuration not present
│
│ To work with module.en.THING (orphan) its original provider configuration at module.en.provider["registry.terraform.io/hashicorp/random"] is required, but it has been removed. This occurs when a provider
│ configuration is removed while objects created by that provider still exist in the state. Re-add the provider configuration to destroy module.en.THING (orphan), after which you can remove the provider
│ configuration again.

    You can safely remove the item from the state:

    terraform state rm module.en.THING

  • Temporarily failing e2e-user-report. During the initial deployment, you may see errors in the logs that the e2e-user-report is failing. You can ignore these logs during the deployment. The worker should begin functioning as-expected within 5 minutes of the complete deploy.

Enhancement

  • Add automated secrets rotation.- This introduces automated rotation for most application-level secrets. Whereas previously it was the responsibility of server administrators to rotate secrets, the application will now rotate a variety of secrets on regular intervals for improved security. (#2039, @sethvargo)
  • Add custom cookiestore codec for dynamically resolving secrets. (#2034, @sethvargo)
  • Add secret models and structure to info page. (#2031, @sethvargo)
  • Add secret resolver. (#2033, @sethvargo)
  • Display feature statuses on system admin info page. (#2056, @sethvargo)
  • Do not store firebase cookie and verify ID token is < 5min old. (#2024, @sethvargo)
  • Extract key/secret bootstrapping from rotation controller into functions for seeding. (#2032, @sethvargo)
  • Remove unused csrf token from Terraform. (#2025, @sethvargo)
  • System admins can allow for a domain to have longer short code expiration times (up to 2 hours) and for that realm to edit their short code expiration time even if ENX is enabled (#2047, @mikehelmick)
  • The configurable timing for NBF is also applied to IAT, accounting for clock skew between key and verification servers. (#2049, @mikehelmick)
  • The not before (nbf) time on certificates is no configurable to account for clock skew between verification and key servers. (#2048, @mikehelmick)
  • Unescape mobile app paths in UI. (#2036, @sethvargo)
  • User-report types are part of the default accept list on the verify API now. (#2043, @mikehelmick)
  • Begin tracking API key "last used" (#2022, @sethvargo)

Operations

Infrastructure

  • Adds end to end test runner for user-report if that feature is enabled. (#2040, @mikehelmick)
  • Lower Cloud KMS database-encrypter rotation to 90d (#2019, @sethvargo)
  • Use a wildcard for redirect domains. This fixes an issue for installations with more than 50 realms exceeding the limit on the URL map. (#2029, @sethvargo)

Docs

Bug or Regression

  • Do not run email verification javascript until after load. This fixes an issue where users may be unable to verify their email address. (#2037, @sethvargo)

Misc

  • Introduce function for getting the e2e-realm (if one exists). (#2020, @sethvargo)

Dependencies

Added

Nothing has changed.

Changed

Removed

Nothing has changed.

Assets 2
Loading