Skip to content

Commit 6502c44

Browse files
smkleinsmklein
committed
Merge branch 'main' into x509-again
2 parents 95c10a0 + 5b59af2 commit 6502c44

File tree

38 files changed

+2759
-214
lines changed

38 files changed

+2759
-214
lines changed

‎.github/buildomat/jobs/build-and-test-linux.sh‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
#!/bin/bash
2+
#:
3+
#: name = "build-and-test (ubuntu-20.04)"
4+
#: variety = "basic"
5+
#: target = "ubuntu-20.04"
6+
#: rust_toolchain = "nightly-2022-04-27"
7+
#: output_rules = [
8+
#: "/var/tmp/omicron_tmp/*",
9+
#: "!/var/tmp/omicron_tmp/crdb-base*",
10+
#: "!/var/tmp/omicron_tmp/rustc*",
11+
#: ]
12+
#:
13+
14+
set -o errexit
15+
set -o pipefail
16+
set -o xtrace
17+
18+
cargo --version
19+
rustc --version
20+
21+
#
22+
# Set up a custom temporary directory within whatever one we were given so that
23+
# we can check later whether we left detritus around.
24+
#
25+
TEST_TMPDIR='/var/tmp/omicron_tmp'
26+
echo "tests will store output in $TEST_TMPDIR" >&2
27+
mkdir "$TEST_TMPDIR"
28+
29+
#
30+
# Put "./cockroachdb/bin" and "./clickhouse" on the PATH for the test
31+
# suite.
32+
#
33+
export PATH="$PATH:$PWD/out/cockroachdb/bin:$PWD/out/clickhouse"
34+
35+
banner prerequisites
36+
ptime -m bash ./tools/install_builder_prerequisites.sh -y
37+
38+
#
39+
# We build with:
40+
#
41+
# - RUSTFLAGS="-D warnings" RUSTDOCFLAGS="-D warnings": disallow warnings
42+
# in CI builds. This can result in breakage when the toolchain is
43+
# updated, but that should only happen with a change to the repo, which
44+
# gives us an opportunity to find and fix any newly-introduced warnings.
45+
#
46+
# - `--locked`: do not update Cargo.lock when building. Checking in
47+
# Cargo.lock ensures that everyone is using the same dependencies and
48+
# also gives us a record of which dependencies were used for each CI
49+
# run. Building with `--locked` ensures that the checked-in Cargo.lock
50+
# is up to date.
51+
#
52+
banner build
53+
export RUSTFLAGS="-D warnings"
54+
export RUSTDOCFLAGS="-D warnings"
55+
export TMPDIR=$TEST_TMPDIR
56+
ptime -m cargo +'nightly-2022-04-27' build --locked --all-targets --verbose
57+
58+
#
59+
# NOTE: We're using using the same RUSTFLAGS and RUSTDOCFLAGS as above to avoid
60+
# having to rebuild here.
61+
#
62+
banner test
63+
ptime -m cargo +'nightly-2022-04-27' test --workspace --locked --verbose \
64+
--no-fail-fast
65+
66+
#
67+
# Make sure that we have left nothing around in $TEST_TMPDIR. The easiest way
68+
# to check is to try to remove it with `rmdir`.
69+
#
70+
unset TMPDIR
71+
echo "files in $TEST_TMPDIR (none expected on success):" >&2
72+
find "$TEST_TMPDIR" -ls
73+
rmdir "$TEST_TMPDIR"

‎.github/buildomat/jobs/build-and-test.sh‎

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,11 @@
44
#: variety = "basic"
55
#: target = "helios-latest"
66
#: rust_toolchain = "nightly-2022-04-27"
7-
#: output_rules = []
7+
#: output_rules = [
8+
#: "/var/tmp/omicron_tmp/*",
9+
#: "!/var/tmp/omicron_tmp/crdb-base*",
10+
#: "!/var/tmp/omicron_tmp/rustc*",
11+
#: ]
812
#:
913

1014
set -o errexit
@@ -18,9 +22,9 @@ rustc --version
1822
# Set up a custom temporary directory within whatever one we were given so that
1923
# we can check later whether we left detritus around.
2024
#
21-
TEST_TMPDIR="${TMPDIR:-/var/tmp}/omicron_tmp"
22-
echo "tests will store output in $TEST_TMPDIR"
23-
mkdir $TEST_TMPDIR
25+
TEST_TMPDIR='/var/tmp/omicron_tmp'
26+
echo "tests will store output in $TEST_TMPDIR" >&2
27+
mkdir "$TEST_TMPDIR"
2428

2529
#
2630
# Put "./cockroachdb/bin" and "./clickhouse" on the PATH for the test
@@ -56,13 +60,14 @@ ptime -m cargo +'nightly-2022-04-27' build --locked --all-targets --verbose
5660
# having to rebuild here.
5761
#
5862
banner test
59-
ptime -m cargo +'nightly-2022-04-27' test --workspace --locked --verbose
63+
ptime -m cargo +'nightly-2022-04-27' test --workspace --locked --verbose \
64+
--no-fail-fast
6065

6166
#
6267
# Make sure that we have left nothing around in $TEST_TMPDIR. The easiest way
6368
# to check is to try to remove it with `rmdir`.
6469
#
6570
unset TMPDIR
66-
echo "files in $TEST_TMPDIR (none expected on success):"
67-
find $TEST_TMPDIR -ls
68-
rmdir $TEST_TMPDIR
71+
echo "files in $TEST_TMPDIR (none expected on success):" >&2
72+
find "$TEST_TMPDIR" -ls
73+
rmdir "$TEST_TMPDIR"

‎.github/workflows/rust.yml‎

Lines changed: 0 additions & 85 deletions
Original file line numberDiff line numberDiff line change
@@ -78,88 +78,3 @@ jobs:
7878
run: ./tools/install_builder_prerequisites.sh -y
7979
- name: Test build documentation
8080
run: RUSTDOCFLAGS="-Dwarnings" cargo doc
81-
82-
build-and-test:
83-
env:
84-
OMICRON_TMP: /tmp/omicron_tmp
85-
runs-on: ${{ matrix.os }}
86-
strategy:
87-
fail-fast: false
88-
matrix:
89-
os: [ ubuntu-18.04 ]
90-
steps:
91-
# actions/checkout@v2
92-
- uses: actions/checkout@28c7f3d2b5162b5ddd3dfd9a45aa55eaf396478b
93-
- uses: Swatinem/rust-cache@v1
94-
if: ${{ github.ref != 'refs/heads/main' }}
95-
- name: Report cargo version
96-
run: cargo --version
97-
- name: Remove unnecessary software
98-
run: |
99-
echo "Disk space:"
100-
df -h
101-
102-
if [ -d "/usr/share/dotnet" ]; then
103-
echo "Removing dotnet"
104-
sudo rm -rf /usr/share/dotnet
105-
fi
106-
if [ -d "/usr/local/lib/android" ]; then
107-
echo "Removing android"
108-
sudo rm -rf /usr/local/lib/android
109-
fi
110-
if [ -d "/usr/local/.ghcup" ]; then
111-
echo "Removing haskell"
112-
sudo rm -rf /usr/local/.ghcup
113-
fi
114-
if [ -d "/opt/hostedtoolcache/CodeQL" ]; then
115-
echo "Removing CodeQL"
116-
sudo rm -rf /opt/hostedtoolcache/CodeQL
117-
fi
118-
if [ -d "/usr/share/swift" ]; then
119-
echo "Removing swift"
120-
sudo rm -rf /usr/share/swift
121-
fi
122-
123-
echo "Disk space:"
124-
df -h
125-
- name: Update PATH
126-
run: echo "$PWD/out/cockroachdb/bin:$PWD/out/clickhouse" >> "$GITHUB_PATH"
127-
- name: Install Pre-Requisites
128-
run: ./tools/install_builder_prerequisites.sh -y
129-
- name: Create temporary directory for test outputs
130-
run: mkdir -p $OMICRON_TMP
131-
- name: Build
132-
# We build with:
133-
# - RUSTFLAGS="-D warnings" RUSTDOCFLAGS="-D warnings": disallow warnings
134-
# in CI builds. This can result in breakage when the toolchain is
135-
# updated, but that should only happen with a change to the repo, which
136-
# gives us an opportunity to find and fix any newly-introduced warnings.
137-
# - `--locked`: do not update Cargo.lock when building. Checking in
138-
# Cargo.lock ensures that everyone is using the same dependencies and
139-
# also gives us a record of which dependencies were used for each CI
140-
# run. Building with `--locked` ensures that the checked-in Cargo.lock
141-
# is up to date.
142-
# - TMPDIR=$OMICRON_TMP: we specify a specific temporary directory so that
143-
# failed test outputs will be in a known place that we can grab at the
144-
# end without also grabbing random other temporary files.
145-
run: TMPDIR=$OMICRON_TMP RUSTFLAGS="-D warnings" RUSTDOCFLAGS="-D warnings" cargo build --locked --all-targets --verbose
146-
- name: Run tests
147-
# Use the same RUSTFLAGS and RUSTDOCFLAGS as above to avoid having to
148-
# rebuild here.
149-
run: TMPDIR=$OMICRON_TMP RUSTFLAGS="-D warnings" RUSTDOCFLAGS="-D warnings" cargo test --no-fail-fast --workspace --locked --verbose
150-
- name: Archive results left by tests
151-
# actions/[email protected]
152-
uses: actions/upload-artifact@82c141cc518b40d92cc801eee768e7aafc9c2fa2
153-
with:
154-
name: failed_test_outputs_${{ runner.os }}
155-
retention-days: 7
156-
path: |
157-
${{ env.OMICRON_TMP }}
158-
!${{ env.OMICRON_TMP }}/crdb-base
159-
!${{ env.OMICRON_TMP }}/rustc*
160-
# Fail the build if successful tests leave detritus in $TMPDIR. The easiest
161-
# way to check if the directory is empty is to try to remove it with
162-
# `rmdir`.
163-
- name: Remove temporary directory on success (if this fails, tests leaked files in TMPDIR)
164-
if: ${{ success() }}
165-
run: rmdir $OMICRON_TMP

‎Cargo.lock‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎common/src/api/external/mod.rs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -528,6 +528,7 @@ pub enum ResourceType {
528528
Fleet,
529529
Silo,
530530
SiloUser,
531+
SiloGroup,
531532
IdentityProvider,
532533
SamlIdentityProvider,
533534
SshKey,

‎common/src/sql/dbinit.sql‎

Lines changed: 44 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -277,13 +277,50 @@ CREATE UNIQUE INDEX ON omicron.public.silo_user (
277277
) WHERE
278278
time_deleted IS NULL;
279279

280-
CREATE TYPE omicron.public.provider_type AS ENUM (
281-
'saml'
280+
/*
281+
* Silo groups
282+
*/
283+
284+
CREATE TABLE omicron.public.silo_group (
285+
id UUID PRIMARY KEY,
286+
time_created TIMESTAMPTZ NOT NULL,
287+
time_modified TIMESTAMPTZ NOT NULL,
288+
time_deleted TIMESTAMPTZ,
289+
290+
silo_id UUID NOT NULL,
291+
external_id TEXT NOT NULL
292+
);
293+
294+
CREATE UNIQUE INDEX ON omicron.public.silo_group (
295+
silo_id,
296+
external_id
297+
) WHERE
298+
time_deleted IS NULL;
299+
300+
/*
301+
* Silo group membership
302+
*/
303+
304+
CREATE TABLE omicron.public.silo_group_membership (
305+
silo_group_id UUID NOT NULL,
306+
silo_user_id UUID NOT NULL,
307+
308+
PRIMARY KEY (silo_group_id, silo_user_id)
309+
);
310+
311+
CREATE INDEX ON omicron.public.silo_group_membership (
312+
silo_user_id,
313+
silo_group_id
282314
);
283315

284316
/*
285317
* Silo identity provider list
286318
*/
319+
320+
CREATE TYPE omicron.public.provider_type AS ENUM (
321+
'saml'
322+
);
323+
287324
CREATE TABLE omicron.public.identity_provider (
288325
/* Identity metadata */
289326
id UUID PRIMARY KEY,
@@ -332,7 +369,9 @@ CREATE TABLE omicron.public.saml_identity_provider (
332369
technical_contact_email TEXT NOT NULL,
333370

334371
public_cert TEXT,
335-
private_key TEXT
372+
private_key TEXT,
373+
374+
group_attribute_name TEXT
336375
);
337376

338377
CREATE INDEX ON omicron.public.saml_identity_provider (
@@ -1442,7 +1481,8 @@ CREATE TABLE omicron.public.role_builtin (
14421481

14431482
CREATE TYPE omicron.public.identity_type AS ENUM (
14441483
'user_builtin',
1445-
'silo_user'
1484+
'silo_user',
1485+
'silo_group'
14461486
);
14471487

14481488
CREATE TABLE omicron.public.role_assignment (

0 commit comments

Comments
 (0)