-
Notifications
You must be signed in to change notification settings - Fork 277
/
CHANGELOG
1626 lines (1377 loc) · 74 KB
/
CHANGELOG
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
Athenz v1.11.66 Release / Sep 28, 2024
--------------------------------------
#2724 do not exit when token refresh fails while pod is running
#2725 UI: Bump body-parser from 1.20.0 to 1.20.3 in /ui
#2726 UI: Bump send and express in /ui
#2728 UI: Bump serve-static and express in /ui
#2733 UI: disable advanced settings for delegated roles during role creation or editing
#2737 send notification for put role membership decision
#2740 Adding support to GCE SIA multiple service
#2742 send notification for put group membership decision
#2743 during delete tenancy check the primary db instance
#2744 Adding resource ownership support for MSD API
#2745 update java and go dependencies to their latest releases
Athenz v1.11.65 Release / Sep 09, 2024
--------------------------------------
#2700 UI: add role member UI enhancement
#2701 allow adding authorization header on msd-agent calls
#2702 not allow principal to approve/reject own requests for audit enabled roles/groups
#2703 UI: fix tests failing to run due to babel node sytax conflicts
#2705 UI: add group review icon, it becomes red when group review required
#2706 buildkite athenz identity provider integration
#2708 enforce resource ownership for delete role member operation
#2709 enforce resource ownership for delete group member operation
#2710 enforce resource ownership for delete assertion operation
#2712 UI: fix added tag is displayed in UI, fix delete last tag
#2716 UI: Bump micromatch from 4.0.7 to 4.0.8 in /ui
#2718 UI: open role and group members in new tab
#2719 UI: email notifications improvements with notify roles and groups
#2722 update zms go client with latest rdl changes
Athenz v1.11.64 Release / Aug 19, 2024
--------------------------------------
#2668 UI: display warning for expired and disabled members in Roles and Groups
#2672 provide java api for gcp workloads to refresh their identity certificates
#2680 fix skip non revocable attribute logic
#2681 [documentation/github actions provider] Fix service name for prs
#2682 minor update to the key refresher unit test
#2683 more specific error message for user authority filter checks
#2684 UI: fix red role review icon conditions
#2687 Adding the Otel Implementation
#2690 Bump axios from 1.6.0 to 1.7.4 in /clients/nodejs/zts
#2693 SIA (Service Identity Agent for GCP Runs
#2694 update java and go dependencies to their latest releases
Athenz v1.11.63 Release / Aug 01, 2024
--------------------------------------
#2660 Discover additional instances to MSD, with dynamic/static workloads
#2663 Extend support for authority filter for roles/groups to skip unnecessary checks
#2664 include recently added fields in domain audit log
#2665 expose github provider specific error back to client for debugging
#2666 UI: update dependencies and unit tests
Athenz v1.11.62 Release / Jul 18, 2024
--------------------------------------
#2650 Omit specifying trust store or CA cert when generating KeyRefresher
#2652 add x509-cert-signer-keyid and ssh-cert-signer-keyid fields to domain meta
#2654 update ZTS to honor domain's x509/ssh signer key ids
#2655 UI fix: group review submitted for wrong domain
#2656 update test cases to use valid keystore
#2658 add new option for id token request to require all scope items to be present
#2659 update go and java dependencies to their latest releases
This release includes a required schema update:
https://github.com/AthenZ/athenz/blob/master/servers/zms/schema/updates/update-20240708.sql
Athenz v1.11.61 Release / Jul 04, 2024
--------------------------------------
#2634 assume azure services
#2635 Enable SSH Host certificate for AWS EC2 instances
#2637 update error messages/formatting + fix zts property name in docs
#2639 UI: Bump braces from 3.0.2 to 3.0.3 in /ui
#2641 implement domain group members api
#2642 /oauth2/keys Specify the service to obtain the public key
#2643 UI: fix not able to update POC in domain
#2644 support refreshing provider ip blocks every hour
#2645 change order of signature validation for zpu policies
#2646 separate key algorithm setting for instance provider
#2648 extend the logic to set the preferred expiry time for service certificates
#2649 update java and go dependencies to their latest releases
This release includes a required schema update:
https://github.com/AthenZ/athenz/blob/master/servers/zms/schema/updates/update-20240523.sql
Athenz v1.11.60 Release / May 31, 2024
--------------------------------------
#2622 address CodeQL warning about safe int32 conversion and insecure cipher
#2623 keep state when key/cert were backed up for restore in case of failure
#2624 update schema for azure support
#2625 for role/group member expiry support all restrictions
#2626 support system allowed roles in id tokens by skipping limit check
#2627 remove dependency on jetty from client libraries
#2629 support principal domain filter for role/group members
#2630 fix comparing ecdsa key/cert public key match
#2631 aws parameter store implementation for PrivateKeyStore interface
#2632 server k8s common module
#2633 update java and go dependencies to their latest releases
This release includes a required schema update:
https://github.com/AthenZ/athenz/blob/master/servers/zms/schema/updates/update-20240525.sql
Athenz v1.11.59 Release / May 16, 2024
--------------------------------------
#2613 in jws domain object return service resource ownership
#2614 use issuer aws account or gcp project for launch authorization
#2615 update interface to use both enterprise and cloud hostname resolvers
#2616 provide capability to enable/disable principals
#2618 provide capability for system admins to use zms-cli to set business service
#2619 remove dups from role/group review list
#2620 updated go and java dependencies to their latest releases
#2621 bcprov-ext does not have 1.78.1 version
Athenz v1.11.58 Release / May 07, 2024
--------------------------------------
#2598 support trust domains in spiffe uri in role certificates
#2599 systemd-notify-all option to notify systemd after role certificates
#2601 explicit launch authorization for k8s provider multi-tenancy use cases
#2602 UI: Bump ejs from 3.1.9 to 3.1.10 in /ui
#2603 extended notification support
#2604 for sia settings from env, set the config service field
#2605 extend gcp functions identity method to be generic for vm workloads
#2606 switch to using mysql 8.0 image from 5.7 for unit tests
#2607 automatically skip empty roles/group from review list
#2608 include additional sandns entry for pod ip
#2609 allow groups in admin role based on config setting
#2610 update role/service/group last modified time on tag update
#2611 updated go (1.22.3) and java dependencies to their latest releases
Athenz v1.11.57 Release / Apr 24, 2024
--------------------------------------
#2589 allow attribute validator for K8SProvider issuer validation
#2591 spiffe trust domain in role certificates
#2593 support for systemd notify option for sia agents
#2595 extend update_members action for role/group review api
#2596 Add identifier in transport policy response
#2597 UI: Bump formidable and supertest in /ui
Athenz v1.11.56 Release / Apr 16, 2024
--------------------------------------
#2581 set resource ownership commands in zms-cli
#2582 provide option to disable resource ownership server-side
#2583 Perform a retry when error code 3101 is returned from the MySQL DB
#2585 add close method to zpe
#2586 generate notifications 3 days before expiry
#2587 update java dependencies
#2588 migrate from gopkg.in/square/go-jose.v2 to github.com/go-jose/go-jose/v4
Athenz v1.11.55 Release / Apr 02, 2024
--------------------------------------
#2556 Fixed ZMSUtils to correctly determine PrincipalType
#2565 Group MSD transport policy conditions
#2568 correct handling of audit enabled flag in zms-cli import
#2569 Update README.md
#2571 Option to build GCPZTSCredentials using a pre-existing SSLContext
#2572 initial changes for resource owner feature
#2574 UI: add new environment field to domain details
#2575 UI: Bump express from 4.18.1 to 4.19.2 in /ui
#2576 resource ownership feature: part 2
#2578 verification and validation of resource ownership
#2580 provide sia config option to exit process if run_after script fails
This release includes a required schema update:
https://github.com/AthenZ/athenz/blob/master/servers/zms/schema/updates/update-20240325.sql
Athenz v1.11.54 Release / Mar 15, 2024
--------------------------------------
#2527 fetch verification key from server via proxy during accesstoken and roletoken verification
#2541 aws role session name can include _'s
#2543 improve role/group review list based on creation time
#2544 limit jest max workers to 8 for SD
#2546 correct handling for put system meta with invalid service name
#2547 use spiffe namespace of default
#2549 Option to include public IP in ssh host certificate requests
#2550 add support for -spiffe-trust-domain to zts-svccert utility
#2551 validate principals during role/group review api
#2552 do not allow deletion of domain is it's associated with aws/gcp/azure
#2553 Adding provider interface for fetching public keys of a service
#2554 Bump google.golang.org/protobuf from 1.32.0 to 1.33.0
#2555 update provider interface impl in sia agents
#2557 sia-aws: set service cert and key in role option
#2558 sia: set service cert and key in role option
#2560 correct handling of review-enabled roles/groups during review api
#2561 update java and go dependencies to their latest releases
#2563 Allowing SSH certificates for secureboot
#2564 Bump follow-redirects from 1.15.4 to 1.15.6 in /ui
Athenz v1.11.53 Release / Mar 04, 2024
--------------------------------------
#2521 UI: support domain (security) point of contact fields
#2522 update action during domain template request
#2523 extend subdomain delete capability to domain admins
#2524 optional argument to skip errors during sia init
#2529 sia run-after-scripts for cmd line options must be in blocking mode
#2530 log authz failure for github action provider
#2531 UI: fix direct link service tabs bug
#2532 UI: fix to not omit the user domain when completion search result is empty
#2533 set role/group last review date check differently for new and updated objects
#2534 UI: minor lowercase of a word
#2535 minor update to zts java client unit test
#2536 replace aws role session name from hardcoded to principal name
#2537 extend instance id for github actions identity to include repo details
#2538 delete user groups before deleting user from system
#2539 update java/go dependencies to their latest releases
Athenz v1.11.52 Release / Feb 21, 2024
--------------------------------------
#2498 include instance-id as a principal in ssh host certificates on aws ec2
#2500 UI: upgrade nextjs major version
#2501 UI: upgrade babel related packages
#2502 UI: upgrade jest related pkgs
#2503 UI: upgrade jest related pkgs and package-lock.json
#2504 UI: upgrade saucelabs and webdriver pkgs
#2505 update entityName in audit logs for role/group meta calls
#2507 UI: fix filter by role in domain history
#2508 UI: upgrade axios and jsdom
#2509 update tagKey and tagValue type for all ZMS roles
#2510 GitHub actions service identity provider
#2511 allow param values to include any string
#2513 use correct algorithm when generating csr
#2514 update jetty and go/java dependencies
#2515 fix rdl for meta string fields so they can be unset
#2516 update role certificate handling in sia agents
#2519 store operation type as part of the auth history record
#2520 UI: Bump ip from 1.1.8 to 1.1.9 in /ui
Athenz v1.11.51 Release / Jan 30, 2024
--------------------------------------
#2485 UI: remove gcp related changes
#2487 introduce environment metadata field for domains
#2489 Update go clients to support additional request headers
#2490 Adding Vespa.ai as an adopter
#2491 update developer documentation
#2492 mark athenz directory as a safe
#2494 support internal authz check with roles specified
#2495 improve interoperability between self-signer in dev environments with openssl generated certs
#2496 increase width for email notification body to full page
#2497 update java/go dependencies to their latest releases
This release includes required schema updates:
https://github.com/AthenZ/athenz/blob/master/servers/zms/schema/updates/update-20240121.sql
Athenz v1.11.50 Release / Jan 16, 2024
--------------------------------------
#2471 UI: add scope field to micro-segmentation table
#2472 use relocated mysql artifact id
#2474 support for IMSDv2 when reading AWS metadata
#2475 delete transport policies api, optional attribute for existing api
#2476 maintain a static map of trusted roles for resource list lookup api
#2477 don't use --user flag for local
#2478 mark trust role vars as volatile
#2479 remove sia run-after script path starting with / on windows
#2481 Change transport policy delete endpoint to match with create
#2480 UI: Add GCP scope for micro-segmentation policy
#2482 UI: Bump follow-redirects from 1.15.1 to 1.15.4 in /ui
Athenz v1.11.49 Release / Jan 03, 2024
--------------------------------------
#2455 UI: add logic to handle submit of role/group review
#2456 UI: fix first time user error
#2457 support proxyForPrincipal parameter in GenerateAccessTokenRequestString
#2458 UI: add missing props timeZone for policy versions
#2459 fix zms-cli calls for get role/group for review
#2461 make role/group review days limit configurable
#2463 UI: fix functional tests pt1
#2465 UI: Add functional test support for role and group review
#2466 UI: fix functional test sd job
#2467 UI: add maxmembers and self renew fields
#2468 UI: attempt to fix functional test
#2469 UI: fix functional test, tested and works
#2470 update java and go dependencies to their latest releases
Athenz v1.11.48 Release / Dec 06, 2023
--------------------------------------
#2414 Bump axios from 1.4.0 to 1.6.0 in /clients/nodejs/zts
#2423 libs/go/sia/access/tokens: fix dropped test errors
#2424 support max member limit on roles and groups
#2425 show notification bell icon more obviously with role/group to review
#2426 fix unbound variable errors in deploy-scripts
#2428 fix invalid audit log json on adding /deleting a template
#2431 support domain contacts
#2434 self-renew option for roles/groups
#2435 Bump ch.qos.logback:logback-classic from 1.4.11 to 1.4.12 in gcp_zts_creds
#2439 simplify expiry notification lookups
#2440 update java dependencies to their latest releases
#2443 extend schema for contact type to string
#2445 sia init/rolecert command line option - report error code for failures
#2446 add role and group review tabs
#2447 enhance zms-cli update-domain to handle assertions in existing policies
#2448 extend schema to allow : (colon) in Tag keys
#2449 missing tags from policy/service requests
#2450 unique error message for invalid/reserved service names
#2451 UI: fix bug when viewing roles, group is part of with expiry
#2452 new get transport policies for a domain and service api
#2453 zms-cli: add -audit-enabled flag for role/group add operations
#2454 update java and go dependencies
This release includes required schema updates:
https://github.com/AthenZ/athenz/blob/master/servers/zms/schema/updates/update-20231120.sql
https://github.com/AthenZ/athenz/blob/master/servers/zms/schema/updates/update-20231122.sql
https://github.com/AthenZ/athenz/blob/master/servers/zms/schema/updates/update-20231127.sql
Athenz v1.11.47 Release / Nov 20, 2023
--------------------------------------
#2398 UI: add GCP project ID in manage domains
#2399 update service provider manager test case
#2400 UI: upgrade prettier and run fix-lint
#2403 Enable use of locally built components in local Docker environment
#2405 Fix the server side authorization for the msd api to return kubernetes network policy object
#2406 UI: centre align business service column
#2408 provide Roles/ExternalCredentials interfaces for instance providers
#2409 zts gcp dns client example
#2410 UI: pull in the latest and greatest rdl endpoints
#2411 expose sandns_x509_cnames field in sia config file
#2415 simplify error messages for access tokens to avoid confusion
#2416 new role/group/domain attributes - no implementation
#2418 provide option to request issuer based on external creds attributes
#2419 update go host ip check test case to ignore docker/bridge interface
#2421 update java and go dependencies to their latest releases
#2422 new msd api to create transport policy
Athenz v1.11.46 Release / Nov 07, 2023
--------------------------------------
#2324 Extract and reuse duplicate helper function ExtractSignerInfo
#2388 for notification emails expand groups and delegated role membership
#2391 replace interface{} with string for zms-cli import operations
#2392 support proxy principal spiffe uri in access token requests
#2393 new bit to disable notifications over a week away
#2396 msd api to return kubernetes network policy object
#2397 for groups to disable expiry notfs look for both expiration/reminder tags
Athenz v1.11.45 Release / Oct 30, 2023
--------------------------------------
#2358 UI: fix add/edit tags for policy and service
#2361 Fix service tags tab hiding other tabs
#2365 failure with insert principal where 2 roles are created simultaneously with the same new member
#2366 Add GetZone from meta endpoint for gcp
#2367 oidc response - make redirect uri optional if json output is requested
#2368 failure with insert principal where 2 roles are created simultaneously with the same new member
#2370 double encoding name parameter for deleteStaticWorkload
#2372 bump awssdk from 2.20.162 to 2.21.6 for netty vuln
#2375 remove redirect-uri from fetch id token call since it's optional for json output
#2376 new zms-cli option show-domain-attrs to display domain attributes
#2377 fix membership approval email view in gmail
#2378 adding support for service_name.service_namespace.svc in K8S san dns
#2379 Temporary network issue causes aws temp creds stop refreshing
#2381 allow updating the last_reviewed_date for role/group through meta api
#2382 clean-up hostname verifier support in zts java client
#2384 replacing wix-embedded-mysql with testcontainers-java
#2386 update jetty/java/go deps to their latest releases
Athenz v1.11.44 Release / Oct 20, 2023
--------------------------------------
#2323 fetch verification key from server during access token validation
#2342 UI: Add microsegmentation to services table
#2344 Creating a PR Template file
#2345 Bump golang.org/x/net from 0.16.0 to 0.17.0
#2346 Make KeyRefresher's background thread more efficient
#2347 UI: add fetcherError null check, debug only if there is error
#2348 fix 'make deploy-local'
#2349 change the athenz-zpe-java-client jacoco coverage threshold from 0.8711 to 0.8702
#2350 Fix pr template
#2351 provide domain authz for expanded role lookup
#2352 Introduce new endpoint to search workloads by domain and services
#2355 provide zms endpoint to return list of roles and groups for review
#2356 Update go zpe README.md
#2357 updated go/grpc and java dependencies
#2360 Update LY Corporation name (formerly known as Yahoo! Japan)
#2362 msd go client sync up with rdl
Athenz v1.11.43 Release / Oct 10, 2023
--------------------------------------
#2304 UI: add role description tooltip
#2315 UI: Fix delete static workload
#2317 UI: Show msd error
#2318 DB names are lower case for last notification time check
#2319 UI: fix user service users map
#2320 UI: Make project labels selectable on GCP login page
#2321 Extract and export ClientTLSConfigFromPEM
#2322 UI: skip loading on parent component for msd edit
#2325 log x509 cert serial number in the access log files
#2326 UI: updated rdl schemas
#2327 UI: Add support for CIDR blocks and fix search for static instances
#2328 UI: When user selects scope aws, disable report mode
#2329 unit test for jwt with none algorithm by @havetisyan in #2329
#2330 UI: Fix gcp login initially loading error no roles incorrectly
#2333 UI: sanitize error logs
#2336 support omit-domain flag in sia through ATHENZ_SIA_OMIT_DOMAIN env variable
#2337 add logic to skip packages during publish
#2338 using a dedicated regex for msd static workload name validation
#2339 fix test access token signing key to 2048bit+ for valid testing
#2341 update java/go dependencies to their latest releases
Athenz v1.11.42 Release / Sep 13, 2023
--------------------------------------
#2210 UI: add support for policy tags
#2237 UI: add support for service tag
#2294 zts server code cleanup - replace deprecated calls, etc
#2295 zms server code cleanup - replace deprecated calls, etc
#2296 container library code cleanup - replace deprecated calls, etc
#2297 auth-core library code cleanup - replace deprecated calls, etc
#2298 common libraries code cleanup - replace deprecated calls, etc
#2299 server common library code cleanup - replace deprecated calls, etc
#2300 handle assertion conditions in putPolicy api
#2301 libs/go/zmscli: fix dropped errors
#2303 update jacoco code coverage percentages
#2305 make sure only one notification run per-day
#2307 new static instance type - service_subnet
#2309 Add accountId, projectNumber, launchTime in raw.Doc
#2311 Add new fields to hostdoc.Doc
#2312 utils/zts-svccert: fix dropped errors
#2313 new store-token-option to store access token without quotes
Athenz v1.11.41 Release / Sep 01, 2023
--------------------------------------
#2284 add constructor to allow proxy configuration
#2285 include assertion conditions in get policy response
#2286 use better env variable to get just the tag name
#2287 create sbom for athenz components
#2288 consolidate all email notifications so the user gets only one email per notification type
#2289 fix review group page error with expiry settings
#2290 support getting SIA access token config from env variable
#2291 new buildSSLContext method based on ca/cert/key pem strings
#2292 update jetty/java/go dependencies to their latest releases
#2293 dump description in zms-cli show-role command
Athenz v1.11.40 Release / Aug 25, 2023
--------------------------------------
#2272 UI: ability to add members by searching for their names
#2278 add a new static validator type in msd
#2279 improve error logging when validating role cert csr
#2280 UI: Add search capability for Add Group component
#2283 libs/go/sia/agent/devel/ztsmock: fix dropped error
Athenz v1.11.39 Release / Aug 18, 2023
--------------------------------------
#2270 include gcp instance name in identity cert uri
#2271 UI - Update product Id link
#2273 allow aws attestation role only include service name
#2274 [skip ci] docker build using actions
#2275 provide config option to specify external creds providers
#2276 remove item from fetch queue if zts reports bad request
#2277 avoid ConcurrentModificationExceptions when processing domain updates
Athenz v1.11.38 Release / Aug 08, 2023
--------------------------------------
#2262 new optional attribute in instance identity register/refresh request
#2263 skip tests if -DskipTests=true is provided
#2264 support adding cert to secret manager
#2265 Generic Kubernetes provider for Athenz
#2266 support external gcp access token support from registered projects
#2267 add wildcard support for ServiceSkipDomains
#2268 fix for deploying Athenz UI container locally
Athenz v1.11.37 Release / Jul 28, 2023
--------------------------------------
#2248 fix policy tags fetch + increase unit test coverage
#2249 introduce shutdown method for connection logger
#2250 introduce feature-flags system attribute for domains
#2251 support new allow service underscore feature flag
#2252 allow specifying cipher suites for the ui server via config
#2254 Add test for get policy
#2255 add set-role-description option in zms-cli
#2256 use read replica when fetching domain change list in read-only mode
#2261 support proxy auth with gcp http transport
This release includes a required schema update:
https://github.com/AthenZ/athenz/blob/master/servers/zms/schema/updates/update-20230724.sql
Athenz v1.11.36 Release / Jul 21, 2023
--------------------------------------
#2195 Add support in service tags
#2219 Adding policy tags
#2240 update deps and move from sun.jakarta.mail to angus-mail
#2243 Bump word-wrap from 1.2.3 to 1.2.4 in /ui
#2244 for go gcp function sia - provide method to store identity in secret manager
#2246 add support for new spiffe format in gcp java cloud function support
This release includes a required schema update:
https://github.com/AthenZ/athenz/blob/master/servers/zms/schema/updates/update-20230606.sql
https://github.com/AthenZ/athenz/blob/master/servers/zms/schema/updates/update-20230717.sql
Athenz v1.11.35 Release / Jul 15, 2023
--------------------------------------
#2230 update zms-cli getDomain call to use JWS domain
#2232 extend principal role lookup api with expand option
#2233 Bump semver from 5.7.1 to 5.7.2 in /ui
#2234 extend GetSanUri method to take spiffe trust domain/namespace arguments
#2235 Initiate AthenzSslContextFactory as part of AthenzJettyContainer
#2236 Make the properties of functions.SiaCertData public (Capitalized)
#2239 support numeric and string product ids in zms-cli
Athenz v1.11.34 Release / Jul 07, 2023
--------------------------------------
#2220 Go code to get SIA certs from a CGF (Google Cloud Function)
#2221 exclude bc jdk15on from pom in favor of jdk18on
#2222 config options to specify preferred key algorithms for zts sign operations
#2223 Support PKCS#8-formatted private key in zts go tools
#2224 improve error reporting from gcp identity provider
#2228 introduce trust-domain/namespace components into service spiffe uri
Athenz v1.11.33 Release / Jun 28, 2023
--------------------------------------
#2124 UI: apply timezone settings
#2202 add wildcard support for ServiceMemberSkipDomains
#2203 increased/configure json string limit for jackson
#2204 Generic way to handle tags
#2207 log Athenz principal as part of the JettyConnectionLogger
#2209 GCP functions identity support for Java
#2211 refactor out request pkg in zts client
#2212 Prevent int/long buffer overflow returning false always
#2213 correct handling of role cert key path when service key filename is user-specified
#2214 provide capability to provide proxy host details for gcp-zts-creds
#2215 update dependency libraries to their latest releases
#2216 add license headers + full code coverage
Athenz v1.11.32 Release / Jun 05, 2023
--------------------------------------
#2197 support headless user type - managed by user authority but treated like service
#2198 disable wadl output
#2199 update java and go dependencies to their latest releases
Athenz v1.11.31 Release / May 30, 2023
--------------------------------------
#2173 Disable Microsegmentation validation checkbox for AWS env
#2177 Deriving ssh cert principals from the GCP provider attestation data to validate the incoming sshrequest
#2178 add principals from metadata in ssh cert request
#2179 add overwrite option for zms-cli
#2180 UI: replace deprecated request pkg
#2185 fix role update on expiration and review dates
#2189 UI: checked in package-lock.json was generated with old npm version
#2190 support athenz as oidc provider for aws iam
#2191 disallow by default services with _ in their names
#2193 support product id (string) format association with domains
This release includes a required schema update:
https://github.com/AthenZ/athenz/blob/master/servers/zms/schema/updates/update-20230528.sql
Athenz v1.11.30 Release / May 16, 2023
--------------------------------------
#2166 option to return id token in json output instead of redirect uri
#2167 for oidc redirect uri check both configured endpoint and auto-generated value
#2168 new athenz-gcp-zts-creds library to simplify fetching Google credentials based on ZTS ID Tokens
#2169 option to continuously update zts domain cache files
#2170 single command line argument for sia called init
#2174 provide run-after (cert/tokens) capability for sia
Athenz v1.11.29 Release / May 06, 2023
--------------------------------------
#2143 UI: Ensure metastore error does not interfere with UI usability
#2150 return dns suffix through method so the AWS Provider can be extended
#2151 correct handling of java client code generation for status 302
#2157 for id tokens with group scope always use full arns
#2161 sia copy if source file exists, gcp meta functions to get instance ip
#2163 expose getIdToken methods in ZTS Java Client
#2164 Update dynamodbMaxRetries to avoid Integer Overflow
#2165 better attribute name for Athenz domain in GCP project metadata
Athenz v1.11.28 Release / Apr 28, 2023
--------------------------------------
#2141 feat: code signing provider
#2142 fix NPE while setting User Authority Expiration for role without members
#2144 Set a connect timeout when fetching JWT signing keys
#2145 limit the number of entries in the zpe client library token cache
#2146 allow use of cluster names in san dns entries for eks
#2147 config setting for reserved top level domains
#2148 sia agent - exit when refresh fails after configured number of attempts
#2149 gce fix for host cert principals and x509 cert expiry
Athenz v1.11.27 Release / Apr 22, 2023
--------------------------------------
#2133 msd static services by type api
#2134 fix k8s dns svc.cluster.local entry use of spec.hostname
#2135 update jetty to latest 11.0.15 + other dependencies
#2137 remove default 120 min token expiry from access/role-token tools
#2138 if direct update option is set for go util.Update, file must be writeable by owner
#2139 update svc/role cert tests cases for macos
#2140 update zms expiry notification unit test
Athenz v1.11.26 Release / Apr 17, 2023
--------------------------------------
#2125 relax san dns check rules for k8s suffixes - svc.cluster.local/pod.cluster.local
#2126 zms/utils helper methods in athenzutils go library
#2127 designate separate action for assertions when assuming gcp service accounts
#2128 sia: use hostname -f if os.Hostname does not return fqdn
#2130 making access_management optional based on a config for EKS
#2131 for eks/gke generate san dns entries based on k8s dns spec
#2132 same openjdk version in doc as ci/cd
Athenz v1.11.25 Release / Apr 06, 2023
--------------------------------------
#2107 UI: Add support delete static instance
#2116 UI: fix static instance view
#2117 Log notification email sent details - subject and recipients
#2118 UI: Fix UI MSD policy validation
#2119 Update DB Dockerfile to fix deploy-dev
#2120 relax sandns check for aws instances to require configured suffix with domain/service values
#2121 support ssh_principals field in sia_config with cert_request object for ecdsa
#2122 allow ssh-principals with service name based dns cnames
#2123 gcp sia
Athenz v1.11.24 Release / Mar 27, 2023
--------------------------------------
#2095 UI: add related changes for gcp support
#2097 Add support for loading unencrypted pkcs8 keys
#2106 define ipv4Prefix (gcp) as alias for ip_prefix (aws) for ip documents
#2108 update ddb-local version. 1.20.0 in maven is missing classes
#2109 UI: hide the link to INSTANCES when featureFlag is set to false
#2110 Rename variables and include project id in view
#2113 store GCP project number along with project id in athenz domain metadata
#2114 convert boot timestamp from seconds to milliseconds
#2115 special resource for gcp starting with services/
This release includes a required schema update:
https://github.com/AthenZ/athenz/blob/master/servers/zms/schema/updates/update-20230326.sql
Athenz v1.11.23 Release / Mar 21, 2023
--------------------------------------
#2056 pending request for delete member from protected role
#2064 UI: Add scope to MSD policies
#2087 set the locale to be used for log testing
#2090 make aws/gcp assume role action values configurable
#2091 Add optional 'description' to role
#2092 rename profile_tag to profile_restrict_to
#2094 update zms server schema to set tag key column with utf8-bin collation
#2102 for id token requests, carry out full role name match and not suffix
#2103 GCP GCE & GKE provider
#2104 zms-cli online help - correctly identify gcp project id and not name
This release includes a required schema update:
https://github.com/AthenZ/athenz/blob/master/servers/zms/schema/updates/update-20230308.sql
Athenz v1.11.22 Release / Feb 28, 2023
--------------------------------------
#2079 set GOPATH from 'go env GOPATH' if not set
#2080 correct handling of group members that are system disabled and then enabled
#2081 UI: use user domain of config value when making requests to zms
#2082 Add profileTag support to sia-aws
#2083 add delete-protection commands to help list
#2084 allow services to get id token with max 12 hr expiry
#2085 UI: handle case where details.ipAddresses is undefined
#2086 update jetty and other java dependencies to their latest release
Athenz v1.11.21 Release / Feb 18, 2023
--------------------------------------
#2055 UI: add audit enabled setting to role
#2062 update rdl install step for latest go
#2063 add scope to the AssertionCondition for MSD
#2065 UI: add gcp project id to domain ui
#2066 UI: override the nested dependencies got and qs
#2067 extends group with deleteProtection attribute and pending group membership
#2068 extend zms-cli to set delete-protection flag for roles
#2070 UI: fix ScrollWatch test
#2071 UI: Add delete role functional tests
#2074 change zpe log level to warn when it fails to get keys from preconfigured sources
#2076 update go dependencies to their latest releases
#2077 UI: update dev jest dependency version
#2078 clarify the deprecation of role members attribute in rdl
This release includes a required schema update:
https://github.com/AthenZ/athenz/blob/master/servers/zms/schema/updates/update-20230207.sql
Athenz v1.11.20 Release / Feb 03, 2023
--------------------------------------
#2052 update maven plugin versions
#2053 Add a requirement for admin approval to delete members in review-enabled roles
#2054 support multiple domains when requesting oidc id tokens
#2057 correct handling of token/role cert if dirs are not default
#2061 missing primary key definition from principal_group_member table
This release includes a required schema update:
https://github.com/AthenZ/athenz/blob/master/servers/zms/schema/updates/update-20230124.sql
https://github.com/AthenZ/athenz/blob/master/servers/zms/schema/updates/update-20230203.sql
Athenz v1.11.19 Release / Jan 27, 2023
--------------------------------------
#2043 move cloud provider role generation logic out of dbstore library to dbservice
#2044 separate agent dir/process setup into a separate method
#2046 UI: Bump cookiejar from 2.1.3 to 2.1.4 in /ui
#2047 UI: Bump ua-parser-js from 1.0.32 to 1.0.33 in /ui
#2048 replace zmsTestInitializer references with local variables
#2049 adding support for user access management profile option in sia eks
#2050 support pod based dns hostname for eks
#2051 update package dependencies
Athenz v1.11.18 Release / Jan 20, 2023
--------------------------------------
#2028 UI: setup functional test with webdriverio
#2037 use correct role prefix when filtering tenant resource group roles
#2038 support role audit enabled set for domain admins using zms-cli
#2039 sia config option to update key/cert file directly instead of using rename
#2040 provide configuration options for sia key/cert/token/backup directories
#2041 Add build version to sia-ec2
#2042 update package-lock.json to match package dependencies
Athenz v1.11.17 Release / Jan 11, 2023
--------------------------------------
#1984 UI: Delete Instance from UI
#2026 validate ssh host certificate line including cert filename
#2029 support sandns_hostname for aws ec2
#2030 UI: just run the fix_lint
#2031 UI: Bump json5 from 2.2.1 to 2.2.3 in /ui
#2032 allow domain admins to enable audit flag for new roles/groups
#2033 update pkg dependencies to their latest releases
#2035 Add SIA AWS option for certificate expiry threshold check
#2036 update zms go auto-generated code for audit enabled flag
Athenz v1.11.16 Release / Dec 19, 2022
--------------------------------------
#2006 UI: fix review tab for roles to correctly handle default options
#2007 improve messaging for groups in admin roles and detect error sooner
#2011 UI: simplify way to change user's expiry/reminder dates
#2015 UI: bump decode-uri-component from 0.2.0 to 0.2.2 in /ui
#2016 fix the table overflow in the email notification's body
#2017 UI: Bump qs from 6.5.2 to 6.5.3 in /ui
#2018 remove netty override version from syncer pom.xml
#2020 UI: Separate members and pending members into 2 different maps in the view
#2021 update jetty + deps to their latest release
#2023 Return the correct response from putMembership/putGroupMembership on pending members
#2025 support ssh host key type attribute in sia config options
Athenz v1.11.15 Release / Dec 5, 2022
-------------------------------------
#1971 UI: Upgrade node from 14 to 18
#1974 UI: Bump d3-color from 3.0.1 to 3.1.0 in /ui
#2000 upgrade examples to use the latest athenz libs
#2001 ignore errors when adding a new user to an empty admin role
#2002 UI: Bump @xmldom/xmldom from 0.7.5 to 0.7.9 in /ui
#2003 Fix showing in role users page the full role name
#2004 replace golang ioutil deprecated calls
#2005 add gcp project attribute for domains
#2009 Upgrade protobuf java to fix vulnerabilities warning
#2010 UI: Bump minimatch and recursive-readdir in /ui
#2012 UI: Display input for entering justification when needed
#2013 switch from keep_privileges to drop_privileges for service identity agents
#2014 update dependency packages
Schema Update: https://github.com/AthenZ/athenz/blob/master/servers/zms/schema/updates/update-20221122.sql
Athenz v1.11.14 Release / Nov 3, 2022
-------------------------------------
#1991 UI: change the api file
#1996 aws sia: pass correct key flags to the save key method
#1997 update go dependencies to their latest releases
#1999 during role delete check policy usage against primary db
Athenz v1.11.13 Release / Oct 19, 2022
--------------------------------------
#1993 fix role key filemode in sia
#1994 deps update - address jackson databind and protobuf CVEs
Athenz v1.11.12 Release / Oct 17, 2022
--------------------------------------
#1972 Delete static workload expects resource name and not instanceId
#1985 UI: Fix pipeline
#1986 UI: Change the api file
#1987 extend role support in identity agent to specify service ownership
#1988 support new expiry threshold setting for access token refresh
#1990 expose getRdlSchema api endpoint in clients
Athenz v1.11.11 Release / Oct 10, 2022
--------------------------------------
#1973 UI: Fix spec file
#1976 UI: upgrade multer version
#1977 UI: fix integration test cases
#1978 fix putServiceIdentity logic to allow update of exising pubKey
#1980 UI: fix integration test cases
#1981 Use correct object type for role member delete notifications
#1982 fix zms-cli online help for adding temporary members
#1983 update sia-ec2 access profile logic
Athenz v1.11.10 Release / Sep 26, 2022
--------------------------------------
#1949 UI: Bump moment-timezone from 0.5.34 to 0.5.35 in /ui
#1961 Returning uniq ips from network interfaces found on the host
#1964 enable readWrite db connection for delete expired members
#1965 UI: redux support
#1966 consistent formatting of mysql commands
#1967 consistent use of The Athenz Authors copyright in all files
#1968 make server purge expiry member day configurable
#1969 update jetty and other deps to their latest release
#1970 support fetching zts/zms/key/cert values form ~/.athenz/config file
Athenz v1.11.9 Release / Sep 15, 2022
-------------------------------------
#1953 docker build upkeep
#1954 In tokens lib - return successfully refreshed tokens
#1956 use full path for id/system commands in service identity agents
#1957 fix put policy zms client api with return object argument
#1958 update dependency packages to their latest releases
#1960 Update sia-libs to fetch access profile information for EC2
Athenz v1.11.8 Release / Sep 5, 2022
------------------------------------
#1941 auto purge expired role/group members based on server/domain config
#1950 include optional attestation data string for ssh cert requests
#1951 move aws document validation into a utils class
#1952 In athenz-auth-core skip tests for arm architecture
Athenz v1.11.7 Release / Aug 28, 2022
-------------------------------------
#1945 fix returning role/group objects when requested by ui
#1946 update aws sdk + slf4j
#1947 remove unused dependencies/imports + constructor
#1948 update model generation for go 1.19
Athenz v1.11.6 Release / Aug 16, 2022
-------------------------------------
#1928 allow management of domain memberPurgeExpiryDays setting value
#1929 use auto-generated redirect uri for oidc requests
#1932 Fixes for auth history
#1936 Update log4j version in zms_syncer
#1937 Add delete MSD workload interface
#1938 update swagger-ui to 4.x
#1939 For sia access tokens - check expiry in claims
#1940 zts-rolecert: fix error message to include role key path
#1942 provide header option to return updated object in response
#1943 updated package dependencies
#1944 sort rdl headers for go client generation for defined order
Athenz v1.11.5 Release / Jul 19, 2022
-------------------------------------
#1910 Publish athenz-syncer-common package
#1911 Fixed auth history syncer + properties
#1912 report conf not found messages at info and not error level
#1913 allow users to remove themselves from roles/groups
#1914 Auth_history_syncer - prevent table creation by default
#1915 Add zms aws jws domain syncer
#1916 add zms aws json domain syncer to archive
#1917 Bump moment from 2.29.2 to 2.29.4 in /ui
#1918 update go library dependencies to their latest releases
#1919 schema update: role/policy - description, domain - purge expiry days
#1920 update dependency packages to their latest releases
#1921 update put static workload from zms to msd
#1924 Add URI parsing in createHttpClient
Athenz v1.11.4 Release / Jul 1, 2022
------------------------------------
#1889 zpu use jwk keys from sia
#1891 Implement auth_history_syncer
#1903 Disable client TLS renegotiation in UI and added strict policy header
#1904 Bump netty-codec-http from 4.1.72.Final to 4.1.77.Final in /syncers/auth_history_syncer
#1905 update zpe java library to use jwk conf file + api
#1906 fix support for aws assume roles with / in the name
#1907 Authentication History UI
#1909 verify key/cert public keys + use BC Provider for EC support
Athenz v1.11.3 Release / Jun 24, 2022
-------------------------------------
#1863 Add athenz service access token support to SIA EKS sidecar
#1892 provide option to specify a retainable byte buffer pool for jetty
#1893 UI: fix tab redirect from settings to visibility
#1894 updating go crypto version to latest
#1895 Update nodejs package winstonjs
#1896 when athenz jwk conf file does not exist we should return zero time instead current time
#1898 avoid spamming server logs with attribute not available messages
#1899 update jetty and other dependencies to latest release
#1900 make crypki connection pool settings configurable
Athenz v1.11.2 Release / Jun 3, 2022
------------------------------------
#1876 Athens JWK config
#1880 Fix for role member expiry notifications
#1881 Exposed authentication history in zms-cli and ZMS Java / go clients
#1882 support getting id tokens for tenant domains
#1883 increase test coverage and fix copyrights
#1884 athenz jwk config for sia agent
#1885 return specific error message instead of generic dns suffix failure
#1886 review all api possible resource exceptions in rdl
#1887 updated dependencies to their latest releases
#1888 AuthHistory - Return dependencies instead of list
#1890 allow config of request log retain days
Athenz v1.11.1 Release / May 19, 2022
-------------------------------------
#1866 Bump ejs from 3.1.6 to 3.1.7 in /ui
#1868 use 1.7 slf4j for clients, while 2.x for servers
#1869 validate spiffe uri for zts-svccert requests
#1870 Adding an api method to MsdStoreConnection to help in building caches
#1872 Generic metric implementation with increment change value
#1873 small timeout after starting mock meta/zts servers with unique port numbers
#1874 expose servlet context to web application
#1875 Get Auth History implementation
#1877 add /info endpoint for zms/zts servers
#1879 unit tests for the /info endpoints
Athenz v1.11.0 Release / May 11, 2022
-------------------------------------
Due to the upcoming End of Community Support for Eclipse Jetty 9.4.x on June 1st, 2022,
starting with the 1.11.0 release, Athenz services and libraries are being upgraded to
use the latest Jetty 11.x release. This release also requires the use of JDK 11.x with
the jakarta namespace and jersey 3.x instead of JDK 8.x with javax namespace and jersey 2.x.
To avoid compatibility issues with jersey 3.x and applications already running with
jersey 2.x, Athenz team has decided to rewrite our java client code generators to
remove dependency on jax-rs and jersey. Instead, the ZMS and ZTS java clients now
have a direct dependency on Apache Http Client (in the 1.10.x the clients were still
using the Jersey Apache Connectors). Unfortunately, these changes introduce a couple
of backward incompatible changes in the 1.11.x release so when upgrading your clients
to the latest release, make sure to review your code and make the necessary changes.
The following is the list of all changes that are introduced in the 1.11.x release:
- The ZMS, ZTS and ZPE java clients are built and require JDK 11. JDK 8.x is only
supported in the 1.10.x release which will continue to be supported. However,
new versions of the 1.10.x will only be released to address bug fixes or security issues.
- ZTS java client (artifact id: athenz-zts-java-client) is NO longer a shaded library.
If you’re deploying the ZTS java client as part of your application, make sure you
deploy all of its required dependencies.
- ZTS java core/non-shaded client (artifact id: athenz-zts-java-client-core) has been
removed. You can just replace your dependency with the standard ZTS client library
(artifact id: athenz-zts-java-client) since it’s no longer a shaded package and
provides the same functionality as the core package.
- The setProperty() and getClientBuilder() methods in both ZMS and ZTS client libraries
have been removed since they were used to set the javax.ws.rs.client.Client properties
and the clients no longer use the jax-rs clients.
#1857 UI: validate source/destination service in microsegmentation
#1858 Provide support to write host document in sia libs
#1859 test: use T.TempDir to create temporary test directory
#1861 fix logic in go IsExpiryAfterThreshold method
#1865 update to jetty 11, remove jersey from client impl
Athenz v1.10.54 Release / Apr 19, 2022
--------------------------------------
#1847 UI: set csp defaults to false and add form action from config
#1848 Bump moment from 2.29.1 to 2.29.2 in /ui
#1849 Make aws email provider public
#1850 When deleting tenant resource group roles, delete dependency if the only admin role left
#1851 UI: update selectAll enum and don't validate date for reject request
#1852 UI: allow adding multiple csp formAction and imgSrc
#1853 add group and membership support for zms-cli update-domain command
#1854 remove unused method arguments