Router state used to be stored and accessed in a thread unsafe way.
State is now locks on a mutex for setting values and values are copied
out for referencing.
- edge router sync is now modular and can have different strategies
- plans to make this configurabe in the future with multiple strat
- legacy strategy is called "instant" and is the only option
- instant strat now supports control signaling and resync requests
- edge routers now do not remove connections till after a full sync
- added the ability for the controller to report the er sync status
- added er syn status to GET /edge-routers list and detail
- improved log output in sync logic
This move isolates the cost of hasApiSession to the identity endpoint
lookups in the REST API. Being in the model caused this cost to be
shared on all identity lookups for internal logic.
Limit 1 is an attempt to reduce the cost of searching over a large set.
API Sessions do not have an index on identity id so there is still some
cost.
- adds ability for any authenticated API Session to create ephemeral
certificates
- allows UPDB session connection
- adds create/delete/read of current api session certificates
- add session cert pem result on create and detail
- fixes ER not updating sessions with new certs from API session
- fixes naming of session vs apiSession on members, functions, etc
- organizes ER state manager functions into apiSession vs session
- adds api session ids to api sessions and sessions sent from the
controller to ERs
- ensure api and ns fingerprints are the same
- filter api session certs by valid periods
- clarify fingerprint func naming
- fix testing bugs
- remove testing timout function setters
- fixes deadlock due to posture data timeouts
- fix replace statements
- use map for posture data change tracking
- remove unused property: type
- add service policy plumbing for postureCheck roles
- add denomralization for posture check roles
- make encryptionRequired flag reqquired
- cert auth module caches static and dynamic (3rd party) CA chains
- all cert auths validated against active chains
- deleted/disabled 3rd party CAs no longer validate
Andrew Martinez