github.com/infrahq/infra

Upgrade Notes

Important self-hosted Infra server changes

As of 0.21.0, Infra's server no longer accepts providers or grants as part of the configuration. Users, providers, and grants currently configured through the YAML will remain in the deployment but new users, providers, and grants will not be configurable. Instead, the Terraform provider should be used to configure Infra post-install. For more information on setting Infra with Terraform, see the provider documentation.

For a guide on how to see the self-hosted documentation.

Bug fixes and improvements

• When removing a destination cluster, any access grants assigned to that cluster are now also removed
• Fixed an issue where switching between clusters with infra use would not preserve the current namespace
• Fixed issue where user would get logged out from their current account when failing to log into a separate account
• Improved validation rules for user passwords
• Improved error messages when changing a user’s password
• Fixed broken navigation link in the settings page
• Fixed issue where the dashboard wouldn’t display more than 100 role assignments
• Fixed an issue where changing a user’s password would require refreshing the page before it could be changed again
• Fixed issues with config loading for the Infra connector
• Fixed an issue where syncing a user’s groups would fail if they were a member of two groups with the same name
• Fixed an issue where signing up for an organization would result in redirecting to that organization when trying to log in to another one.
• Fixed minor inconsistencies in Infra's Dashboard
• Improved error messages when running infra keys remove
• Multiple users can now be added and removed from a group at a time.
• Invited users can now be removed
• Fixed minor flashes of content when logging in with Google or an identity provider
• Fixed missing newline in some CLI command output
• Fixed issue where logging out wouldn’t redirect users to the login page

Dashboard access keys

Infra now supports managing access keys in the dashboard. Access keys are the credential format used to authenticate with Infra while performing automated tasks such as:

• Connecting Kubernetes clusters to Infra
• Logging in via the infra CLI to automate access in scripts (e.g. GitHub actions)
• Managing users, groups and their access with Infra’s Terraform provider

This new update makes it easy to create, list and revoke access keys when they are no longer needed. To manage access keys via the dashboard, log in and click on Settings. When creating an access key, an expiration window must be selected. By default access keys expire in 30 days, and this expiration time can be customized.

Once created, access keys will be available to copy. Note: this access key will not be visible again, and must be stored securely using a secret or password manager.

Bug fixes and improvements

• Infra CLI will now output more details when logging in
• Improved the formatting of error messages when logging in
• Access keys created by admins can now be used to create connector keys. This making it easier to automate connecting Kubernetes clusters to Infra.
• Destinations can no longer be named infra
• Fixed an issue where running infra grants list would show an "unknown user" error
• Fixed an issue where a user being removed from an identity provider would revoke all access keys for that user, even personal access keys used in automation.
• Fixed an issue where logging in with the browser would require creating an additional access key on behalf of the user
• Fixed issue where rate limiting errors would show milliseconds when notifying the user how long to wait before retrying their request
• Fixed an issue where CLI incompatibility errors would show the incorrect version
• [API] Creating an access grant via POST /api/grants can now be done by providing a username instead of a user ID, making it easier to call this endpoint
• [API] Updated the created_by field in various endpoints to be createdBy for consistency

Full Changelog: v0.19.0...v0.20.0

A better infra login

infra login now uses the web browser to authenticate by default. After logging in to the web dashboard, logging in via the CLI requires no new additional information. This also means infra login will work in all environments, including "headless" environments that cannot open a browser on your behalf.

To log in with the browser, simply run infra login as usual:

infra login example.infrahq.com

To log in without opening a browser, log in by specifying a user email and Infra will prompt for a password:

infra login example.infrahq.com --user [email protected]

Logging in with access keys continues to work, allowing you to log in for automation:

INFRA_ACCESS_KEY=2vrEbqFEUr.jtTlxkgYdvghJNdEa8YoUxN0
infra login example.infrahq.com

CLI compatibility

The infra CLI now requires a server version that is equal or higher than the CLI's version. If using Infra's cloud-hosted service, no action is required. If self-hosting Infra, please upgrade the Infra server.

Important upgrade notes

A new Redirect URI must be added to your identity provider to enable Headless Login: https://<your org>.infrahq.com/login/callback. For more information see the docs

Bugs fixes & improvements

• infra keys add has improved flag names:
  • The --ttl flag has now been replaced with --expires when running infra keys add
  • The --extension-deadline flag has now been renamed to --inactivity-timeout
• The Dashboard will now show an error if logging in via OIDC does not work for any reason. Previously it would show a loading spinner
• Fix connector endpoint query to always return the HTTPS port number which it was previously only returning when the service type was not NodePort.
• Infra CLI will now provide better error messages for incompatible versions
• Fixed an issue where the Infra Connector would not report a port number when using the NodePort service type

Full Changelog: v0.18.1...v0.19.0

Bug fixes & improvements

• Fixed bug where the login page would show organization names in the wrong format
• Access keys created via infra keys add now default to a one year expiry and a 30 day inactivity timeout

Bug fixes

• Fixed an issue where a loading spinner would continue to render even once loading was done in the Dashboard
• Fixed a rare issue where the Infra server would fail to start

Instant Sync

🏎️ ​​Syncing between Infra and its connectors now happen near ​instantly. This means as users/groups' roles or permissions change, Infra can update it in near real-time.

Bug fixes & Improvements

• Use SQL for credential queries by @dnephin in #3539
• Return 304 on blocking request timeout, and add label for blocking request by @dnephin in #3545
• Use SQL for organizations queries by @dnephin in #3540
• Use SQL for settings queries by @dnephin in #3541
• fix: add http connector service to serve health check by @mxyng in #3543
• Revert "Merge pull request #3543 from infrahq/mxyng/http-connector" by @mxyng in #3554
• fix: postgres data mountpoint by @mxyng in #3556
• Fix openapi doc by @dnephin in #3551
• Convert count queries to SQL by @dnephin in #3552
• maintain: cluster namespace improvements by @hoyyeva in #3534
• Use 499 status code for context cancelled. by @dnephin in #3560
• Enable debug log to track down test flakes in TestConnector_Run by @dnephin in #3566
• fix: use httptest.NewRequest where appropriate by @mxyng in #3550
• Fix response body for unknown paths by @dnephin in #3567
• maintain: UI refactor by @hoyyeva in #3559
• Use SQL for password reset token queries by @dnephin in #3546
• maintain: automatically add grant when cluster added by @BruceMacD in #3531
• device flow cleanup by @ssoroka in #3542
• improve: add GetGrant api by @mxyng in #3596
• fix: add http connector service by @mxyng in #3563
• Update tests that use gorm to use the stdlib interface by @dnephin in #3583
• Add endpoint-specific fields to API request log by @dnephin in #3528
• maintain: make userid field for access keys consistent by @pdevine in #3590
• Add kind field to destinations by @dnephin in #3591
• Remove gorm from models by @dnephin in #3584
• feature: grants by name by @pdevine in #3549
• fix: replace CREATE OR REPLACE TRIGGER syntax with a prior DROP TRIGGER clause by @jmorganca in #3602
• maintain: exit tests if the postgres_connection string isn't specified by @pdevine in #3605
• maintain: update api version by @pdevine in #3606
• Fix update destination by @dnephin in #3604
• feat: allow specifying email domains that can login with provider by @BruceMacD in #3553
• fix: go test ci by @mxyng in #3608

Dependency updates

• maintain(deps-dev): bump tailwindcss from 3.2.1 to 3.2.2 in /website by @dependabot in #3582
• maintain(deps-dev): bump @types/react from 18.0.24 to 18.0.25 in /ui by @dependabot in #3569
• maintain(deps): bump github.com/prometheus/client_golang from 1.13.0 to 1.13.1 by @dependabot in #3572
• maintain(deps-dev): bump tailwindcss from 3.2.1 to 3.2.2 in /ui by @dependabot in #3571
• maintain(deps): bump github.com/shirou/gopsutil/v3 from 3.22.9 to 3.22.10 by @dependabot in #3574
• maintain(deps): bump google.golang.org/api from 0.101.0 to 0.102.0 by @dependabot in #3576
• maintain(deps-dev): bump eslint from 8.26.0 to 8.27.0 in /website by @dependabot in #3581
• maintain(deps): bump react-router-dom from 6.4.2 to 6.4.3 in /ui by @dependabot in #3575
• maintain(deps): bump @headlessui/react from 1.7.3 to 1.7.4 in /website by @dependabot in #3580
• maintain(deps-dev): bump jest from 29.2.1 to 29.2.2 in /ui by @dependabot in #3573
• maintain(deps): bump github.com/aws/aws-sdk-go from 1.44.126 to 1.44.131 by @dependabot in #3578
• maintain(deps-dev): bump next-sitemap from 3.1.29 to 3.1.30 in /website by @dependabot in #3579
• maintain: bump Azure/setup-helm to v3 by @mxyng in #3544

What's Changed

• Infra's Kubernetes connector now updates access permissions immediately, instead of every 30 seconds
• Fixed an issue where logging in via browser from the CLI would direct a user to an invalid page

🔥 What's new

• New Infra Dashboard
  
• 🖥 Headless login through Infra (Device flow)
  To enable Headless login, additional configuration is required in your identity provider. A new Redirect URI with the value https://<your org>.infrahq.com must be added. For more info see https://infrahq.com/docs/identity/okta#configure-your-new-okta-app
• 🗽 User syncing (provisioning) from identity providers (SCIM) - group support coming soon
• 🗄 Cluster-admin role can be applied to individual namespaces
  🐛 Bug fixes & Improvements
• Identity providers can now be edited
• improve: use variable weight fonts on website by @jmorganca in #3292
• improve: copy button for password after adding a user by @kimskimchi in #3288
• improve: security headers for website & ui by @jmorganca in #3287
• improve: add tab sync to website by @jmorganca in #3275
• fix: allow users to issue access keys to themselves by @ssoroka in #3271
• fix: typo in web signup error handling by @jmorganca in #3289
• fix(website): use env for public write keys by @jmorganca in #3285
• fix: better errors on bad email by @ssoroka in #3208
• fix: scope group names by @BruceMacD in #3290
• fix: sorting bugs by @hoyyeva in #3283
• fix: select same user to grant access with different roles on destination page by @hoyyeva in #3295
• identity provider name is optional by @kimskimchi in #3296
• Fix gofmt by @dnephin in #3331
• fix: reduce request transaction lifetime by @dnephin in #3299
• fix: do not load client secret from infra secrets by @BruceMacD in #3334
• fix: signup user gets create access key scope by @ssoroka in #3337
• fix: cli redirect by @jmorganca in #3340
• improve: move database dialector to data package by @mxyng in #3300
• improve: make learn more help link consistent by @kimskimchi in #3336
• Refactor request authentication to remove duplication by @dnephin in #3302
• Add TxOptions to txn.Begin by @dnephin in #3327
• Add a check to the data migration test by @dnephin in #3338
• improve: add tests for timeouts by @ssoroka in #3339
• fix: signup analytics and csp policies by @jmorganca in #3341
• Use a different port for dev postgres by @dnephin in #3346
• fix: allow users to delete their own access keys from cli by @ssoroka in #3297
• Use a transaction to run data migrations by @dnephin in #3157
• fix: update secrets with better error message by @ssoroka in #3286
• maintain: set dev version by @mxyng in #3294
• improve: add configurable db connection options by @mxyng in #3301
• Use a transaction in the migration test by @dnephin in #3329
• Added rate limiting on the number of requests that can be sent to Infra server by @mxyng in #3231
• fix: use correct case when sending forgot domain email by @pdevine in #3349
• maintain: migrate provider user data to direct sql by @BruceMacD in #3345
• Allow routes to specify transaction options by @dnephin in #3328
• fix: use the correct field name in org conflict error by @dnephin in #3355
• Fix order of provider_user index by @dnephin in #3347
• Remove secret storage from connector by @dnephin in #3220
• feat(agent): add retries to tolerate minor interruptions by @mxyng in #3352
• Allow the connector to run outside of a kube pod by @dnephin in #2613
• Allow the connector to run outside of a kube pod (part 2) by @dnephin in #3350
• fix: minor ui bugs by @hoyyeva in #3376
• improve(ui): simpler auth and admin checks by @jmorganca in #3387
• Add a test for running the connector by @dnephin in #3377
• Use SQL for Destination{Create,Update,Delete} by @dnephin in #3356
• fix(ui): do not use decoded next parameter if unset by @jmorganca in #3388
• improve: table revisit by @hoyyeva in #3385
• fix(ui): minor flashes of content when logging in by @jmorganca in #3389
• fix: improve error message on login page by @hoyyeva in #3354
• improve: buttons behaviour and colours by @hoyyeva in #3390
• fix(ui): fix page loading flickers and redirects by @jmorganca in #3393
• feat(connector): create destination as soon as possible by @mxyng in #3384
• fix: some minor ui bugs by @hoyyeva in #3394
• Revert "feat: SCIM list provider users (#3379)" by @BruceMacD in #3395
• fix: minor ui bugs and improvements by @hoyyeva in #3401
• feat: add endpoint to get a user's own organization by @pdevine in #3402
• fix: remove server lookup by @mxyng in #3383
• fix: do not allow dots in destination names by @dnephin in #3382
• fix: group trait telemetry by @jmorganca in #3381
• Add unique constraint to destination name by @dnephin in #3392
• Use SQL for GetDestination and ListDestination by @dnephin in #3357
• fix: edit provider only update changed fields by @mxyng in #3406
• connector: Use a separate goroutine for update destination by @dnephin in #3391
• data: generate methods for data models by @dnephin in #2761
• improve: org name and notification by @hoyyeva in #3404
• fix: broken doc link in readme by @jmorganca in #3411
• api: add support to list grants by destination by @dnephin in #3396
• fix: delete users from specific identity provider by @BruceMacD in #3398
• fix: remove provider users for deleted identities by @BruceMacD in #3399
• fix postgres-dev to only listen on localhost by @dnephin in #3403
• data: add helper for scanning rows into a slice by @dnephin in #3412
• maintain: clean up architecture...and the rest by @technovangelist in #3413
• fix: only remove password reset scope on cred update by @BruceMacD in #3429
• fix: postgres-dev container listen address by @dnephin in #3430
• fix(ui): crash on users page by @jmorganca in #3433
• maintain: cli docgen fixes to clean up the resulting file by @technovangelist in #3431
• maintain: add redirect for cli-reference to docs by @technovangelist in #3432
• feat: SCIM list provider users by @BruceMacD in #3405
• Require oldpassword by @pdevine in #3434
• Remove transaction TableName method by @dnephin in #3440
• fix: include organization_id in where clause of update queries by @dnephin in #3439
• fix: dont require server config base url on login by @BruceMacD in #3375
• Add test coverage of email templates by @dnephin in #3414
• Remove getDB and hasAuthorization by @dnephin in #3437
• Listen and notify for grants by @dnephin in #3400
• fix: migration for update_index by @dnephin in #3464
• improve: add signup to website by @jmorganca in #3447
• fix(website): signup api properties by @jmorganca in #3467
• fix(website): fix button rendering on landing page by @jmorganca in #3468
• fix: minor ui bugs by @hoyyeva in #3465
• fix: remove authinfo for context by @mxyng in #3470
• maintain: convert identities to direct sql by @BruceMacD in #3471
• Add API handler support for ListGrants blocking request by @dnephin in #3436
• Improve blocking requests and add more test coverage by @dnephin in #3443
• feat: device flow by @ssoroka in #3446
• Fix context cancellation in blocking requests by @dnephin in #3477
• Throttle database updates for LastSeenAt and ExtensionDeadline by @dnephin in #3478
• feat: destination table by @hoyyeva in #3473
• fix: minor bugs on infrastructure table by @hoyyeva in #3485
• fix: minor bugs on infrastructure page by @jmorganca in #3486
• Tooltip by @hoyyeva in #3469
• feat: create access keys for idp scim by @BruceMacD in #3407
• feat: parse scim query filters by @BruceMacD in #3408
• fix: color style for connection status by @jmorganca in #3487
• fix: style improvements to destinations page by @jmorganca in #3488
• feat: users scim by @BruceMacD in #3442
• Make pprof endpoint a blocking request by @dnephin in #3484
• Use the same pattern for repeating operations in agent, server, and connector by @dnephin in #3472
• improve: change device flow input and layout to separate boxes with no sidebar by @ssoroka in #3482
• feat: ui generate scim access key for provider by @BruceMacD in #3483
• maintain: remove commitlint by @mxyng in #3505

What's Changed

• improve: fix typo by @mxyng in #3119
• Add user to context after login and signup by @dnephin in #3088
• Move pagination struct to data by @dnephin in #3093
• fix(build): need fetch-depth:0 for git tags by @mxyng in #3120
• maintain: move the human formatter out to its own package by @pdevine in #3123
• Replace NewTransaction with a real db transaction by @dnephin in #3028
• Fix request scoped transactions by @dnephin in #3103
• Make data.Transaction.Rollback a noop if the transaction was already committed by @dnephin in #3104
• Remove sqlite support by @dnephin in #3084
• improve server db connection string options by @dnephin in #3085
• Replace delete and insert access key functions with sql by @dnephin in #3029
• Replace get, list, and update access key queries with sql by @dnephin in #3094
• Remove GormDB from query functions that already used SQL by @dnephin in #3097
• improve: add terms of service and privacy policy at signup by @jmorganca in #3143
• fix: use correct link in signup by @jmorganca in #3145
• feat: prelogin page that lists orgs that were logged into, using cookies by @kimskimchi in #3142
• bug: fixing slashes for login/org.. redirect by @kimskimchi in #3148
• fix: list access keys query by @dnephin in #3151
• improve: replace quickstart plaintext password with secret - combine quickstart and install by @jmorganca in #3122
• maintain: use the same encrypted at rest type for both strings and bytes by @dnephin in #3140
• Move CreateProviderUser into credential operations by @dnephin in #3141
• fix: password reset sending multiple requests by @mxyng in #3139
• Forgot Domains by @pdevine in #3106
• feat: update destination add to use api endpoint by @mxyng in #3058
• maintain: remove two access helper functions by @dnephin in #3144
• Use SQL for CreateGrant by @dnephin in #3149
• Add a linter for the new SQL query builder by @dnephin in #3060
• feat: toggle log sampling by @mxyng in #3163
• fix: readme doc link by @jmorganca in #3179
• Use SQL for GetGrant and DeleteGrants by @dnephin in #3155
• Use SQL for list grants by @dnephin in #3162
• Reduce verbosity in GenerateRoutes by @dnephin in #3175
• Remove deprecated identity value from gin.Context by @dnephin in #3177
• Support querying for multiple privileges by @dnephin in #3176
• Updated go linter to v1.49.0 by @dnephin in #3198
• Add a scipt to sync linter deps before running lint by @dnephin in #3201
• fix: extend list of reserved domains in signup by @ssoroka in #3152
• Add more tests for well known jwks by @dnephin in #3203
• feat: transparent email verification by @ssoroka in #3202
• fix: transactional emails should skip marketing list unsubscribes by @ssoroka in #3166
• feat: improved ui look and feel by @hoyyeva in #3160
• fix: resolve the access key to the secret value by @dnephin in #3207
• fix: make sure the value is not undefined by @hoyyeva in #3212
• fix: detecting confetti taking 5s longer than expected by @jmorganca in #3213
• fix: styling on accept invite page by @jmorganca in #3214
• fix: use subdomain as connector server name for now by @jmorganca in #3215
• fix: signup border style by @jmorganca in #3216
• fix: add input type to avoid 1password by @hoyyeva in #3217
• fix: slight tweaks to find org page by @jmorganca in #3218
• Fix infra list with destinations named with a prefix of infra by @dnephin in #3221
• maintain: remove server script from ui package.json by @jmorganca in #3223
• maintain: add other ways to abort the about command by @pdevine in #3228
• feat: connector service.type NodePort by @mxyng in #3209
• feat: signup also saves into list of previous logged in orgs by @kimskimchi in #3165
• maintain: fix errors with forgot domain by @pdevine in #3227
• fix: web category links by @jmorganca in #3230
• fix: flicker when clicking logo by @jmorganca in #3225
• fix: consistent breadcrumbs on infrastructure page by @jmorganca in #3226
• improve: trim whitespace when entering server from cli by @kimskimchi in #3235
• fix: add page position and dashboard html bug by @hoyyeva in #3229
• improve: add standard display, sans and monospace fonts to ui by @jmorganca in #3264
• maintain: reduce internal node address log noise by @mxyng in #3265
• maintain: update documentation by @technovangelist in #3233
• fix: website dropdown being cutoff by @jmorganca in #3266
• fix: rename texts and add modal by @hoyyeva in #3263
• feat: add prom metrics for connector->server requests by @mxyng in #3200
• fix: docs toc formatting by @jmorganca in #3267
• Add some multi-org cases for the grants API endpoints by @dnephin in #3219
• Add a bit more validation on create and update by @dnephin in #3222
• maintain: add version cli test + remove server version w/ saas by @pdevine in #3269
• feat: display organization names in previously logged in list by @kimskimchi in #3234
• Use SQL for encryption keys table by @dnephin in #3167
• maintain: updated docs as per jeffs comments by @technovangelist in #3270
• ci: run core ci workflow on more paths by @dnephin in #3204
• fix: broken links on github readme by @jmorganca in #3278
• fix: few more bugs on new ui by @hoyyeva in #3274
• fix: idp docs redirects by @jmorganca in #3279
• Move db encryption key loading to data package by @dnephin in #3168
• Use SQL for Create, Update, and Delete groups by @dnephin in #3199

New Contributors

• @cr1cr1 made their first contribution in #3153

Full Changelog: v0.15.1...v0.15.2