mirror of
https://github.com/coder/coder.git
synced 2026-09-22 05:05:20 +08:00
Sas Swart
fc188fdaee
## Overview Part of the **boundary correlation** feature. Fixes lazy creation of `boundary_sessions` rows so it works within the agent's RBAC constraints, and consumes the new `ConfinedProcessName` field reported by boundary. Pairs with coder/boundary#206, which adds `ConfinedProcessName` to `ReportBoundaryLogsRequest`. This branch bumps the `github.com/coder/boundary` module to pick up that work. ## Problem `ensureSession` did a pre-insert existence check via `GetBoundarySessionByID`. Agents are **not permitted to read boundary sessions**, so that read path is not viable when the session is created from an agent-reported log batch. ## Changes - **Remove the pre-insert read.** `ensureSession` now inserts directly and treats a primary-key unique violation as success, covering sessions already created by a prior batch, a reconnection, or another coderd replica — without requiring read access. - **Per-connection guard.** Add a mutex-protected `ensuredSessions` set so repeated log batches on the same connection skip the existence check and insert entirely, touching the database only for the logs. On a transient insert failure the session is left unmarked so the next batch retries. - **Consume `ConfinedProcessName`.** Pass `req.GetConfinedProcessName()` through to the session insert. - **Bump boundary module** from `v0.9.0` to `v0.9.1-0.20260706095856-35ba90f9e8b2`. - **Tests.** - Add `TestReportBoundaryLogsAgentRBAC` (`coderd/boundary_logs_test.go`), an integration test that connects as a real workspace agent, verifies the session and log are persisted under agent RBAC, and asserts the agent subject cannot read boundary sessions — guarding against reintroducing a pre-insert read. - Add `TestReportBoundaryLogsSessionGuard` (session inserted once across two batches, logs inserted per batch) and `TestReportBoundaryLogsSessionRetriedOnError` (insert retried after a transient error). - Regenerate `agent-firewall` CLI docs/golden files and adjust the clidocgen template to render the YAML path when a flag has no long name. > 🤖 This PR was opened by Coder Agents on behalf of @SasSwart.
168 lines
5.8 KiB
Markdown
Generated
168 lines
5.8 KiB
Markdown
Generated
<!-- DO NOT EDIT | GENERATED CONTENT -->
|
|
# agent-firewall
|
|
|
|
Network isolation tool for monitoring and restricting HTTP/HTTPS requests
|
|
|
|
## Usage
|
|
|
|
```console
|
|
coder agent-firewall [flags] [args...]
|
|
```
|
|
|
|
## Description
|
|
|
|
```console
|
|
boundary creates an isolated network environment for target processes, intercepting HTTP/HTTPS traffic through a transparent proxy that enforces user-defined allow rules.
|
|
```
|
|
|
|
## Options
|
|
|
|
### --config
|
|
|
|
| | |
|
|
|-------------|-------------------------------|
|
|
| Type | <code>yaml-config-path</code> |
|
|
| Environment | <code>$BOUNDARY_CONFIG</code> |
|
|
|
|
Path to YAML config file.
|
|
|
|
### --allow
|
|
|
|
| | |
|
|
|-------------|------------------------------|
|
|
| Type | <code>string</code> |
|
|
| Environment | <code>$BOUNDARY_ALLOW</code> |
|
|
|
|
Allow rule (repeatable). These are merged with allowlist from config file. Format: "pattern" or "METHOD[,METHOD] pattern".
|
|
|
|
### --log-level
|
|
|
|
| | |
|
|
|-------------|----------------------------------|
|
|
| Type | <code>string</code> |
|
|
| Environment | <code>$BOUNDARY_LOG_LEVEL</code> |
|
|
| YAML | <code>log_level</code> |
|
|
| Default | <code>warn</code> |
|
|
|
|
Set log level (error, warn, info, debug).
|
|
|
|
### --log-dir
|
|
|
|
| | |
|
|
|-------------|--------------------------------|
|
|
| Type | <code>string</code> |
|
|
| Environment | <code>$BOUNDARY_LOG_DIR</code> |
|
|
| YAML | <code>log_dir</code> |
|
|
|
|
Set a directory to write logs to rather than stderr.
|
|
|
|
### --proxy-port
|
|
|
|
| | |
|
|
|-------------|--------------------------|
|
|
| Type | <code>int</code> |
|
|
| Environment | <code>$PROXY_PORT</code> |
|
|
| YAML | <code>proxy_port</code> |
|
|
| Default | <code>8080</code> |
|
|
|
|
Set a port for HTTP proxy.
|
|
|
|
### --pprof
|
|
|
|
| | |
|
|
|-------------|------------------------------|
|
|
| Type | <code>bool</code> |
|
|
| Environment | <code>$BOUNDARY_PPROF</code> |
|
|
| YAML | <code>pprof_enabled</code> |
|
|
|
|
Enable pprof profiling server.
|
|
|
|
### --pprof-port
|
|
|
|
| | |
|
|
|-------------|-----------------------------------|
|
|
| Type | <code>int</code> |
|
|
| Environment | <code>$BOUNDARY_PPROF_PORT</code> |
|
|
| YAML | <code>pprof_port</code> |
|
|
| Default | <code>6060</code> |
|
|
|
|
Set port for pprof profiling server.
|
|
|
|
### --jail-type
|
|
|
|
| | |
|
|
|-------------|----------------------------------|
|
|
| Type | <code>string</code> |
|
|
| Environment | <code>$BOUNDARY_JAIL_TYPE</code> |
|
|
| YAML | <code>jail_type</code> |
|
|
| Default | <code>nsjail</code> |
|
|
|
|
Jail type to use for network isolation. Options: nsjail (default), landjail.
|
|
|
|
### --use-real-dns
|
|
|
|
| | |
|
|
|-------------|-------------------------------------|
|
|
| Type | <code>bool</code> |
|
|
| Environment | <code>$BOUNDARY_USE_REAL_DNS</code> |
|
|
| YAML | <code>use_real_dns</code> |
|
|
|
|
Use real DNS in the jail instead of the dummy DNS (allows DNS exfiltration). Default: false.
|
|
|
|
### --no-user-namespace
|
|
|
|
| | |
|
|
|-------------|------------------------------------------|
|
|
| Type | <code>bool</code> |
|
|
| Environment | <code>$BOUNDARY_NO_USER_NAMESPACE</code> |
|
|
| YAML | <code>no_user_namespace</code> |
|
|
|
|
Do not create a user namespace. Use in restricted environments that disallow user NS (e.g. Bottlerocket in EKS auto-mode).
|
|
|
|
### --disable-audit-logs
|
|
|
|
| | |
|
|
|-------------|----------------------------------|
|
|
| Type | <code>bool</code> |
|
|
| Environment | <code>$DISABLE_AUDIT_LOGS</code> |
|
|
| YAML | <code>disable_audit_logs</code> |
|
|
|
|
Disable sending of audit logs to the workspace agent when set to true.
|
|
|
|
### --log-proxy-socket-path
|
|
|
|
| | |
|
|
|-------------|----------------------------------------------------------|
|
|
| Type | <code>string</code> |
|
|
| Environment | <code>$CODER_AGENT_BOUNDARY_LOG_PROXY_SOCKET_PATH</code> |
|
|
| Default | <code>/tmp/boundary-audit.sock</code> |
|
|
|
|
Path to the socket where the boundary log proxy server listens for audit logs.
|
|
|
|
### --version
|
|
|
|
| | |
|
|
|------|-------------------|
|
|
| Type | <code>bool</code> |
|
|
|
|
Print version information and exit.
|
|
|
|
### --enable-session-correlation
|
|
|
|
| | |
|
|
|-------------|----------------------------------------------------|
|
|
| Type | <code>bool</code> |
|
|
| Environment | <code>$BOUNDARY_SESSION_CORRELATION_ENABLED</code> |
|
|
| YAML | <code>session_correlation_enabled</code> |
|
|
|
|
Enable session correlation header injection. When no inject targets are configured, the target is auto-derived from CODER_AGENT_URL (set automatically inside Coder workspaces). Disable for deployments without Coder AI Gateway in front.
|
|
|
|
### --session-id-inject-target
|
|
|
|
| | |
|
|
|-------------|-------------------------------------------------|
|
|
| Type | <code>string</code> |
|
|
| Environment | <code>$BOUNDARY_SESSION_ID_INJECT_TARGET</code> |
|
|
|
|
Inject target for session correlation headers. Repeat the flag once per target; each value describes exactly one target. Format: "domain=<host> [path=<glob>]". Example: --session-id-inject-target "domain=prod.coder.com path=/api/v2/aibridge/*".
|