mirror of
https://github.com/gravitational/teleport.git
synced 2026-10-12 02:15:01 +00:00
Remove painful crdgen snapshot tests (#55159)
This commit is contained in:
Hugo Shaka
@@ -1601,7 +1601,7 @@ must-start-clean/host:
|
||||
# crds-up-to-date checks if the generated CRDs from the protobuf stubs are up to date.
|
||||
.PHONY: crds-up-to-date
|
||||
crds-up-to-date: must-start-clean/host
|
||||
$(MAKE) -C integrations/operator manifests
|
||||
$(MAKE) -C integrations/operator crd-manifests
|
||||
@if ! git diff --quiet; then \
|
||||
./build.assets/please-run.sh "operator CRD manifests" "make -C integrations/operator crd"; \
|
||||
exit 1; \
|
||||
|
||||
@@ -8,9 +8,7 @@ The steps to add support for new Teleport types to the operator are as follows:
|
||||
|
||||
In a clean repo before making any changes:
|
||||
|
||||
1. Run `make manifests`.
|
||||
2. Run `make -C crdgen update-protos`.
|
||||
3. Run `make -C crdgen update-snapshot`.
|
||||
1. Run `make generate`.
|
||||
|
||||
Make sure everything looks sane and commit any changes (there will be some if
|
||||
other .proto files used to generate the CRDs have changed).
|
||||
@@ -19,10 +17,9 @@ other .proto files used to generate the CRDs have changed).
|
||||
|
||||
1. Add the type name to the `resources` list in `crdgen/handlerequest.go`.
|
||||
2. Add the proto file to the `PROTOS` list in `Makefile` if it is not
|
||||
already present. Also add it to the `PROTOS` list in `crdgen/Makefile`.
|
||||
3. Run `make manifests` to generate the CRD.
|
||||
4. Run `make crdgen-test`. This will should fail if your new CRD is generated.
|
||||
Update the test snapshots with `make -C crdgen update-snapshot`
|
||||
already present.
|
||||
4. Run `make crd-manifest-diff`. This will should output the new CRD file or the diff, and fail.
|
||||
3. Run `make crd` to generate the CRD and its documentation.
|
||||
|
||||
#### Create a "scheme" defining Go types to match the CRD
|
||||
|
||||
|
||||
@@ -72,13 +72,27 @@ help: ## Display this help.
|
||||
|
||||
##@ Development
|
||||
|
||||
|
||||
.PHONY: crd ## Single command to generate anything CRD-related (manifests and docs)
|
||||
crd: crdgen crd-docs manifests
|
||||
crd: crd-docs crd-manifests
|
||||
|
||||
.PHONY: crdgen
|
||||
crdgen: ## Generate CRDs
|
||||
make -C crdgen
|
||||
.PHONY: generate
|
||||
generate: generate-types crd ## Generate code containing DeepCopy, DeepCopyInto, and DeepCopyObject method implementations.
|
||||
|
||||
generate-types: controller-gen
|
||||
$(CONTROLLER_GEN) object:headerFile="hack/boilerplate.go.txt" paths="./..."
|
||||
|
||||
crdgenfiles := $(wildcard crdgen/*.go)
|
||||
|
||||
.PHONY: crdgen ## Builds both crd and crd documentation protoc plugins.
|
||||
crdgen: crdgen/build/protoc-gen-crd crdgen/build/protoc-gen-crd-docs
|
||||
|
||||
crdgen/build/%: crdgen/cmd/%/main.go crdgen/cmd/%/debug.go $(crdgenfiles)
|
||||
mkdir -p crdgen/build
|
||||
go build -o $@ github.com/gravitational/teleport/integrations/operator/crdgen/cmd/$*
|
||||
|
||||
# List of protos used for CRD generation.
|
||||
# If you are adding a new resource, you will want to add your proto file here.
|
||||
PROTOS = \
|
||||
teleport/loginrule/v1/loginrule.proto \
|
||||
teleport/accesslist/v1/accesslist.proto \
|
||||
@@ -86,10 +100,10 @@ PROTOS = \
|
||||
teleport/machineid/v1/bot.proto \
|
||||
teleport/workloadidentity/v1/resource.proto
|
||||
|
||||
.PHONY: manifests
|
||||
manifests: crdgen controller-gen ## Generate WebhookConfiguration, ClusterRole and CustomResourceDefinition objects.
|
||||
# Generate CRDs for apis/resources (custom generation through protoc plugin).
|
||||
|
||||
.PHONY: crd-manifests
|
||||
crd-manifests: crdgen ## Generates CRD manifests using crdgen.
|
||||
@echo "## Generating CRD manifests"
|
||||
# The wrappers.proto file needed for this generator exist only inside the go mod cache,
|
||||
# so we retrieve the file path for the cached proto files with go mod tools.
|
||||
$(eval PROTOBUF_MOD_PATH := $(shell go mod download --json github.com/gogo/protobuf | awk -F: '/"Dir"/ { print $$2 }' | tr -d ' ",'))
|
||||
@@ -106,13 +120,9 @@ manifests: crdgen controller-gen ## Generate WebhookConfiguration, ClusterRole a
|
||||
rm -r ../../examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/
|
||||
cp -r ./config/crd/bases/ ../../examples/chart/teleport-cluster/charts/teleport-operator/operator-crds
|
||||
|
||||
.PHONY: build-docs-plugin
|
||||
build-docs-plugin: ## Build the protoc plugin for generating docs
|
||||
make -C crdgen build-docs
|
||||
|
||||
.PHONY: crd-docs
|
||||
crd-docs: build-docs-plugin ## Generate CRD reference docs.
|
||||
|
||||
crd-docs: crdgen/build/protoc-gen-crd-docs ## Generate CRD reference docs.
|
||||
@echo "## Generating CRD documentation"
|
||||
# The wrappers.proto file needed for this generator exist only inside the go mod cache,
|
||||
# so we retrieve the file path for the cached proto files with go mod tools.
|
||||
$(eval PROTOBUF_MOD_PATH := $(shell go mod download --json github.com/gogo/protobuf | awk -F: '/"Dir"/ { print $$2 }' | tr -d ' ",'))
|
||||
@@ -126,20 +136,44 @@ crd-docs: build-docs-plugin ## Generate CRD reference docs.
|
||||
"$${proto}"; \
|
||||
done
|
||||
|
||||
.PHONY: generate
|
||||
generate: controller-gen ## Generate code containing DeepCopy, DeepCopyInto, and DeepCopyObject method implementations.
|
||||
$(CONTROLLER_GEN) object:headerFile="hack/boilerplate.go.txt" paths="./..."
|
||||
# crd-manifests-diff renders CRDs using crdgen in a temporary directory, then compares the rendered CRDs
|
||||
# with the ones from the config/crd/base directory. Any difference causes a non-zero return code.
|
||||
.PHONY: crd-manifests-diff
|
||||
crd-manifests-diff: crdgen
|
||||
@echo "## Checking if CRD manifests changed"
|
||||
$(eval PROTOBUF_MOD_PATH := $(shell go mod download --json github.com/gogo/protobuf | awk -F: '/"Dir"/ { print $$2 }' | tr -d ' ",'))
|
||||
$(eval CRD_OUT_PATH := $(shell mktemp -d))
|
||||
|
||||
.PHONY: fmt
|
||||
fmt: ## Run go fmt against code.
|
||||
go fmt ./...
|
||||
for proto in $(PROTOS); do \
|
||||
protoc \
|
||||
-I=../../api/proto/ \
|
||||
-I=$(PROTOBUF_MOD_PATH) \
|
||||
--plugin=./build/protoc-gen-crd \
|
||||
--crd_out=$(CRD_OUT_PATH) \
|
||||
"$${proto}"; \
|
||||
done
|
||||
|
||||
.PHONY: vet
|
||||
vet: ## Run go vet against code.
|
||||
go vet ./...
|
||||
diff config/crd/bases $(CRD_OUT_PATH);\
|
||||
EXIT_CODE=$$?;\
|
||||
rm -rf $(CRD_OUT_PATH) $(CUSTOM_IMPORTS_TMP_DIR);\
|
||||
exit $$EXIT_CODE
|
||||
|
||||
# This is a helper to dump a request sent to crdgen.
|
||||
# See crdgen/DEBUG.md for instruction on how to use this target to replay crdgen with a debugger attached.
|
||||
.PHONY: crdgen-debug-dump-request
|
||||
debug-dump-request:
|
||||
$(eval PROTOBUF_MOD_PATH := $(shell go mod download --json github.com/gogo/protobuf | awk -F: '/"Dir"/ { print $$2 }' | tr -d ' ",'))
|
||||
for proto in $(PROTOS); do \
|
||||
protoc \
|
||||
-I=../../../api/proto/ \
|
||||
-I=$(PROTOBUF_MOD_PATH) \
|
||||
--plugin=./crdgen/hack/protoc-gen-dump \
|
||||
--dump_out="." \
|
||||
"$${proto}"; \
|
||||
done
|
||||
|
||||
.PHONY: test
|
||||
test: manifests generate fmt vet $(ENVTEST) crdgen-test ## Run tests.
|
||||
test: generate $(ENVTEST) ## Run tests.
|
||||
test: export KUBEBUILDER_ASSETS=$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) -p path)
|
||||
test:
|
||||
go test ./... -coverprofile cover.out
|
||||
@@ -148,20 +182,13 @@ test:
|
||||
echo-kubebuilder-assets:
|
||||
@echo KUBEBUILDER_ASSETS=$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) -p path)
|
||||
|
||||
.PHONY: crdgen-test
|
||||
crdgen-test: ## Run crdgen tests.
|
||||
make -C crdgen test
|
||||
|
||||
##@ Build
|
||||
|
||||
.PHONY: build
|
||||
build: generate fmt vet ## Build manager binary.
|
||||
build: generate ## Build manager binary.
|
||||
go build -trimpath -tags "kustomize_disable_go_plugin_support" -o bin/manager main.go namespace.go config.go
|
||||
|
||||
.PHONY: run
|
||||
run: manifests generate fmt vet ## Run a controller from your host.
|
||||
go run ./main.go ./namespace.go
|
||||
|
||||
.PHONY: docker-build
|
||||
docker-build: ## Build docker image with the manager.
|
||||
docker buildx build --platform="$(OS)/$(ARCH)" \
|
||||
|
||||
@@ -11,6 +11,7 @@ helpful if you want to attach a debugger.
|
||||
proto file:
|
||||
|
||||
```shell
|
||||
# in operator/
|
||||
$ make debug-dump-request
|
||||
|
||||
for proto in teleport/loginrule/v1/loginrule.proto teleport/legacy/types/types.proto; do \
|
||||
|
||||
@@ -1,75 +0,0 @@
|
||||
PROTOS = \
|
||||
teleport/loginrule/v1/loginrule.proto \
|
||||
teleport/accesslist/v1/accesslist.proto \
|
||||
teleport/legacy/types/types.proto \
|
||||
teleport/machineid/v1/bot.proto \
|
||||
teleport/workloadidentity/v1/resource.proto
|
||||
|
||||
libfiles := $(wildcard *.go)
|
||||
|
||||
build: build/protoc-gen-crd
|
||||
build-docs: build/protoc-gen-crd-docs
|
||||
|
||||
build/%: cmd/%/main.go cmd/%/debug.go $(libfiles)
|
||||
mkdir -p build
|
||||
go build -o $@ github.com/gravitational/teleport/integrations/operator/crdgen/cmd/$*
|
||||
|
||||
.PHONY: test
|
||||
test: build
|
||||
# The wrappers.proto file needed for this generator exist only inside the go mod cache,
|
||||
# so we retrieve the file path for the cached proto files with go mod tools.
|
||||
$(eval PROTOBUF_MOD_PATH := $(shell go mod download --json github.com/gogo/protobuf | awk -F: '/"Dir"/ { print $$2 }' | tr -d ' ",'))
|
||||
$(eval CRD_OUT_PATH := $(shell mktemp -d))
|
||||
|
||||
for proto in $(PROTOS); do \
|
||||
protoc \
|
||||
-I=testdata/protofiles \
|
||||
-I=$(PROTOBUF_MOD_PATH) \
|
||||
--plugin=./build/protoc-gen-crd \
|
||||
--crd_out=$(CRD_OUT_PATH) \
|
||||
"$${proto}"; \
|
||||
done
|
||||
|
||||
diff testdata/golden/ $(CRD_OUT_PATH);\
|
||||
EXIT_CODE=$$?;\
|
||||
rm -rf $(CRD_OUT_PATH) $(CUSTOM_IMPORTS_TMP_DIR);\
|
||||
exit $$EXIT_CODE
|
||||
|
||||
# Updates the input protos used for the crdgen tests. The protos are copied
|
||||
# instead of imported directly avoid breaking these tests every time a proto is
|
||||
# updated. The CRDs only actually change when someone manually updates them.
|
||||
.PHONY: update-protos
|
||||
update-protos:
|
||||
cp -r ../../../api/proto/teleport ./testdata/protofiles/
|
||||
|
||||
# Updates CRD snapshots used for `protoc-gen-crd` tests, they are stored in `testdata/golden`
|
||||
.PHONY: update-snapshot
|
||||
update-snapshot: build
|
||||
$(eval PROTOBUF_MOD_PATH := $(shell go mod download --json github.com/gogo/protobuf | awk -F: '/"Dir"/ { print $$2 }' | tr -d ' ",'))
|
||||
$(eval CRD_OUT_PATH := $(shell mktemp -d))
|
||||
|
||||
for proto in $(PROTOS); do \
|
||||
protoc \
|
||||
-I=testdata/protofiles \
|
||||
-I=$(PROTOBUF_MOD_PATH) \
|
||||
--plugin=./build/protoc-gen-crd \
|
||||
--crd_out=$(CRD_OUT_PATH) \
|
||||
"$${proto}"; \
|
||||
done
|
||||
|
||||
rm -rf testdata/golden
|
||||
cp -r $(CRD_OUT_PATH) testdata/golden
|
||||
rm -rf $(CRD_OUT_PATH)
|
||||
|
||||
.PHONY: debug-dump-request
|
||||
debug-dump-request:
|
||||
$(eval PROTOBUF_MOD_PATH := $(shell go mod download --json github.com/gogo/protobuf | awk -F: '/"Dir"/ { print $$2 }' | tr -d ' ",'))
|
||||
for proto in $(PROTOS); do \
|
||||
protoc \
|
||||
-I=testdata/protofiles \
|
||||
-I=$(PROTOBUF_MOD_PATH) \
|
||||
--plugin=./hack/protoc-gen-dump \
|
||||
--dump_out="." \
|
||||
"$${proto}"; \
|
||||
done
|
||||
|
||||
-269
@@ -1,269 +0,0 @@
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: teleportaccesslists.resources.teleport.dev
|
||||
spec:
|
||||
group: resources.teleport.dev
|
||||
names:
|
||||
kind: TeleportAccessList
|
||||
listKind: TeleportAccessListList
|
||||
plural: teleportaccesslists
|
||||
shortNames:
|
||||
- accesslist
|
||||
- accesslists
|
||||
singular: teleportaccesslist
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: AccessList is the Schema for the accesslists API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: AccessList resource definition v1 from Teleport
|
||||
properties:
|
||||
audit:
|
||||
description: audit describes the frequency that this Access List must
|
||||
be audited.
|
||||
nullable: true
|
||||
properties:
|
||||
next_audit_date:
|
||||
description: next_audit_date is when the next audit date should
|
||||
be done by.
|
||||
format: date-time
|
||||
type: string
|
||||
notifications:
|
||||
description: notifications is the configuration for notifying
|
||||
users.
|
||||
nullable: true
|
||||
properties:
|
||||
start:
|
||||
description: start specifies when to start notifying users
|
||||
that the next audit date is coming up.
|
||||
format: duration
|
||||
type: string
|
||||
type: object
|
||||
recurrence:
|
||||
description: recurrence is the recurrence definition
|
||||
nullable: true
|
||||
properties:
|
||||
day_of_month:
|
||||
description: day_of_month is the day of month that reviews
|
||||
will be scheduled on. Supported values are 0, 1, 15, and
|
||||
31.
|
||||
x-kubernetes-int-or-string: true
|
||||
frequency:
|
||||
description: frequency is the frequency of reviews. This represents
|
||||
the period in months between two reviews. Supported values
|
||||
are 0, 1, 3, 6, and 12.
|
||||
x-kubernetes-int-or-string: true
|
||||
type: object
|
||||
type: object
|
||||
description:
|
||||
description: description is an optional plaintext description of the
|
||||
Access List.
|
||||
type: string
|
||||
grants:
|
||||
description: grants describes the access granted by membership to
|
||||
this Access List.
|
||||
nullable: true
|
||||
properties:
|
||||
roles:
|
||||
description: roles are the roles that are granted to users who
|
||||
are members of the Access List.
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
traits:
|
||||
additionalProperties:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
description: traits are the traits that are granted to users who
|
||||
are members of the Access List.
|
||||
type: object
|
||||
type: object
|
||||
membership_requires:
|
||||
description: membership_requires describes the requirements for a
|
||||
user to be a member of the Access List. For a membership to an Access
|
||||
List to be effective, the user must meet the requirements of Membership_requires
|
||||
and must be in the members list.
|
||||
nullable: true
|
||||
properties:
|
||||
roles:
|
||||
description: roles are the user roles that must be present for
|
||||
the user to obtain access.
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
traits:
|
||||
additionalProperties:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
description: traits are the traits that must be present for the
|
||||
user to obtain access.
|
||||
type: object
|
||||
type: object
|
||||
owner_grants:
|
||||
description: owner_grants describes the access granted by owners to
|
||||
this Access List.
|
||||
nullable: true
|
||||
properties:
|
||||
roles:
|
||||
description: roles are the roles that are granted to users who
|
||||
are members of the Access List.
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
traits:
|
||||
additionalProperties:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
description: traits are the traits that are granted to users who
|
||||
are members of the Access List.
|
||||
type: object
|
||||
type: object
|
||||
owners:
|
||||
description: owners is a list of owners of the Access List.
|
||||
items:
|
||||
properties:
|
||||
description:
|
||||
description: description is the plaintext description of the
|
||||
owner and why they are an owner.
|
||||
type: string
|
||||
ineligible_status:
|
||||
description: ineligible_status describes if this owner is eligible
|
||||
or not and if not, describes how they're lacking eligibility.
|
||||
x-kubernetes-int-or-string: true
|
||||
membership_kind:
|
||||
description: membership_kind describes the type of membership,
|
||||
either `MEMBERSHIP_KIND_USER` or `MEMBERSHIP_KIND_LIST`.
|
||||
x-kubernetes-int-or-string: true
|
||||
name:
|
||||
description: name is the username of the owner.
|
||||
type: string
|
||||
type: object
|
||||
nullable: true
|
||||
type: array
|
||||
ownership_requires:
|
||||
description: ownership_requires describes the requirements for a user
|
||||
to be an owner of the Access List. For ownership of an Access List
|
||||
to be effective, the user must meet the requirements of ownership_requires
|
||||
and must be in the owners list.
|
||||
nullable: true
|
||||
properties:
|
||||
roles:
|
||||
description: roles are the user roles that must be present for
|
||||
the user to obtain access.
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
traits:
|
||||
additionalProperties:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
description: traits are the traits that must be present for the
|
||||
user to obtain access.
|
||||
type: object
|
||||
type: object
|
||||
title:
|
||||
description: title is a plaintext short description of the Access
|
||||
List.
|
||||
type: string
|
||||
type: object
|
||||
status:
|
||||
description: Status defines the observed state of the Teleport resource
|
||||
properties:
|
||||
conditions:
|
||||
description: Conditions represent the latest available observations
|
||||
of an object's state
|
||||
items:
|
||||
description: Condition contains details for one aspect of the current
|
||||
state of this API Resource.
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: |-
|
||||
lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: |-
|
||||
message is a human readable message indicating details about the transition.
|
||||
This may be an empty string.
|
||||
maxLength: 32768
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: |-
|
||||
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
||||
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
||||
with respect to the current state of the instance.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
reason:
|
||||
description: |-
|
||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||
Producers of specific condition types may define expected values and meanings for this field,
|
||||
and whether the values are considered a guaranteed API.
|
||||
The value should be a CamelCase string.
|
||||
This field may not be empty.
|
||||
maxLength: 1024
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||
type: string
|
||||
status:
|
||||
description: status of the condition, one of True, False, Unknown.
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||
maxLength: 316
|
||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||
type: string
|
||||
required:
|
||||
- lastTransitionTime
|
||||
- message
|
||||
- reason
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
teleportResourceID:
|
||||
format: int64
|
||||
type: integer
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: null
|
||||
storedVersions: null
|
||||
-146
@@ -1,146 +0,0 @@
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: teleportbotsv1.resources.teleport.dev
|
||||
spec:
|
||||
group: resources.teleport.dev
|
||||
names:
|
||||
kind: TeleportBotV1
|
||||
listKind: TeleportBotV1List
|
||||
plural: teleportbotsv1
|
||||
shortNames:
|
||||
- botv1
|
||||
- botsv1
|
||||
singular: teleportbotv1
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: BotV1 is the Schema for the botsv1 API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Bot resource definition v1 from Teleport
|
||||
properties:
|
||||
max_session_ttl:
|
||||
description: The max session TTL value for the bot's internal role.
|
||||
Unless specified, bots may not request a value beyond the default
|
||||
maximum TTL of 12 hours. This value may not be larger than 7 days
|
||||
(168 hours).
|
||||
format: duration
|
||||
type: string
|
||||
roles:
|
||||
description: The roles that the bot should be able to impersonate.
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
traits:
|
||||
description: The traits that will be associated with the bot for the
|
||||
purposes of role templating. Where multiple specified with the
|
||||
same name, these will be merged by the server.
|
||||
items:
|
||||
properties:
|
||||
name:
|
||||
description: The name of the trait. This is what allows the
|
||||
trait to be queried in role templates.
|
||||
type: string
|
||||
values:
|
||||
description: The values associated with the named trait.
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
type: object
|
||||
nullable: true
|
||||
type: array
|
||||
type: object
|
||||
status:
|
||||
description: Status defines the observed state of the Teleport resource
|
||||
properties:
|
||||
conditions:
|
||||
description: Conditions represent the latest available observations
|
||||
of an object's state
|
||||
items:
|
||||
description: Condition contains details for one aspect of the current
|
||||
state of this API Resource.
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: |-
|
||||
lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: |-
|
||||
message is a human readable message indicating details about the transition.
|
||||
This may be an empty string.
|
||||
maxLength: 32768
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: |-
|
||||
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
||||
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
||||
with respect to the current state of the instance.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
reason:
|
||||
description: |-
|
||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||
Producers of specific condition types may define expected values and meanings for this field,
|
||||
and whether the values are considered a guaranteed API.
|
||||
The value should be a CamelCase string.
|
||||
This field may not be empty.
|
||||
maxLength: 1024
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||
type: string
|
||||
status:
|
||||
description: status of the condition, one of True, False, Unknown.
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||
maxLength: 316
|
||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||
type: string
|
||||
required:
|
||||
- lastTransitionTime
|
||||
- message
|
||||
- reason
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
teleportResourceID:
|
||||
format: int64
|
||||
type: integer
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: null
|
||||
storedVersions: null
|
||||
-178
@@ -1,178 +0,0 @@
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: teleportgithubconnectors.resources.teleport.dev
|
||||
spec:
|
||||
group: resources.teleport.dev
|
||||
names:
|
||||
kind: TeleportGithubConnector
|
||||
listKind: TeleportGithubConnectorList
|
||||
plural: teleportgithubconnectors
|
||||
shortNames:
|
||||
- githubconnector
|
||||
- githubconnectors
|
||||
singular: teleportgithubconnector
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v3
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: GithubConnector is the Schema for the githubconnectors API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: GithubConnector resource definition v3 from Teleport
|
||||
properties:
|
||||
api_endpoint_url:
|
||||
description: APIEndpointURL is the URL of the API endpoint of the
|
||||
Github instance this connector is for.
|
||||
type: string
|
||||
client_id:
|
||||
description: ClientID is the Github OAuth app client ID.
|
||||
type: string
|
||||
client_redirect_settings:
|
||||
description: ClientRedirectSettings defines which client redirect
|
||||
URLs are allowed for non-browser SSO logins other than the standard
|
||||
localhost ones.
|
||||
nullable: true
|
||||
properties:
|
||||
allowed_https_hostnames:
|
||||
description: a list of hostnames allowed for https client redirect
|
||||
URLs
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
insecure_allowed_cidr_ranges:
|
||||
description: a list of CIDRs allowed for HTTP or HTTPS client
|
||||
redirect URLs
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
type: object
|
||||
client_secret:
|
||||
description: ClientSecret is the Github OAuth app client secret. This
|
||||
field supports secret lookup. See the operator documentation for
|
||||
more details.
|
||||
type: string
|
||||
display:
|
||||
description: Display is the connector display name.
|
||||
type: string
|
||||
endpoint_url:
|
||||
description: EndpointURL is the URL of the GitHub instance this connector
|
||||
is for.
|
||||
type: string
|
||||
redirect_url:
|
||||
description: RedirectURL is the authorization callback URL.
|
||||
type: string
|
||||
teams_to_roles:
|
||||
description: TeamsToRoles maps Github team memberships onto allowed
|
||||
roles.
|
||||
items:
|
||||
properties:
|
||||
organization:
|
||||
description: Organization is a Github organization a user belongs
|
||||
to.
|
||||
type: string
|
||||
roles:
|
||||
description: Roles is a list of allowed logins for this org/team.
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
team:
|
||||
description: Team is a team within the organization a user belongs
|
||||
to.
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
status:
|
||||
description: Status defines the observed state of the Teleport resource
|
||||
properties:
|
||||
conditions:
|
||||
description: Conditions represent the latest available observations
|
||||
of an object's state
|
||||
items:
|
||||
description: Condition contains details for one aspect of the current
|
||||
state of this API Resource.
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: |-
|
||||
lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: |-
|
||||
message is a human readable message indicating details about the transition.
|
||||
This may be an empty string.
|
||||
maxLength: 32768
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: |-
|
||||
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
||||
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
||||
with respect to the current state of the instance.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
reason:
|
||||
description: |-
|
||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||
Producers of specific condition types may define expected values and meanings for this field,
|
||||
and whether the values are considered a guaranteed API.
|
||||
The value should be a CamelCase string.
|
||||
This field may not be empty.
|
||||
maxLength: 1024
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||
type: string
|
||||
status:
|
||||
description: status of the condition, one of True, False, Unknown.
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||
maxLength: 316
|
||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||
type: string
|
||||
required:
|
||||
- lastTransitionTime
|
||||
- message
|
||||
- reason
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
teleportResourceID:
|
||||
format: int64
|
||||
type: integer
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: null
|
||||
storedVersions: null
|
||||
-134
@@ -1,134 +0,0 @@
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: teleportloginrules.resources.teleport.dev
|
||||
spec:
|
||||
group: resources.teleport.dev
|
||||
names:
|
||||
kind: TeleportLoginRule
|
||||
listKind: TeleportLoginRuleList
|
||||
plural: teleportloginrules
|
||||
shortNames:
|
||||
- loginrule
|
||||
- loginrules
|
||||
singular: teleportloginrule
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: LoginRule is the Schema for the loginrules API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: LoginRule resource definition v1 from Teleport
|
||||
properties:
|
||||
priority:
|
||||
description: Priority is the priority of the login rule relative to
|
||||
other login rules in the same cluster. Login rules with a lower
|
||||
numbered priority will be evaluated first.
|
||||
format: int32
|
||||
type: integer
|
||||
traits_expression:
|
||||
description: TraitsExpression is a predicate expression which should
|
||||
return the desired traits for the user upon login.
|
||||
type: string
|
||||
traits_map:
|
||||
additionalProperties:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
description: TraitsMap is a map of trait keys to lists of predicate
|
||||
expressions which should evaluate to the desired values for that
|
||||
trait.
|
||||
nullable: true
|
||||
type: object
|
||||
type: object
|
||||
status:
|
||||
description: Status defines the observed state of the Teleport resource
|
||||
properties:
|
||||
conditions:
|
||||
description: Conditions represent the latest available observations
|
||||
of an object's state
|
||||
items:
|
||||
description: Condition contains details for one aspect of the current
|
||||
state of this API Resource.
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: |-
|
||||
lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: |-
|
||||
message is a human readable message indicating details about the transition.
|
||||
This may be an empty string.
|
||||
maxLength: 32768
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: |-
|
||||
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
||||
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
||||
with respect to the current state of the instance.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
reason:
|
||||
description: |-
|
||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||
Producers of specific condition types may define expected values and meanings for this field,
|
||||
and whether the values are considered a guaranteed API.
|
||||
The value should be a CamelCase string.
|
||||
This field may not be empty.
|
||||
maxLength: 1024
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||
type: string
|
||||
status:
|
||||
description: status of the condition, one of True, False, Unknown.
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||
maxLength: 316
|
||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||
type: string
|
||||
required:
|
||||
- lastTransitionTime
|
||||
- message
|
||||
- reason
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
teleportResourceID:
|
||||
format: int64
|
||||
type: integer
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: null
|
||||
storedVersions: null
|
||||
-259
@@ -1,259 +0,0 @@
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: teleportoidcconnectors.resources.teleport.dev
|
||||
spec:
|
||||
group: resources.teleport.dev
|
||||
names:
|
||||
kind: TeleportOIDCConnector
|
||||
listKind: TeleportOIDCConnectorList
|
||||
plural: teleportoidcconnectors
|
||||
shortNames:
|
||||
- oidcconnector
|
||||
- oidcconnectors
|
||||
singular: teleportoidcconnector
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v3
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: OIDCConnector is the Schema for the oidcconnectors API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: OIDCConnector resource definition v3 from Teleport
|
||||
properties:
|
||||
acr_values:
|
||||
description: ACR is an Authentication Context Class Reference value.
|
||||
The meaning of the ACR value is context-specific and varies for
|
||||
identity providers.
|
||||
type: string
|
||||
allow_unverified_email:
|
||||
description: AllowUnverifiedEmail tells the connector to accept OIDC
|
||||
users with unverified emails.
|
||||
type: boolean
|
||||
claims_to_roles:
|
||||
description: ClaimsToRoles specifies a dynamic mapping from claims
|
||||
to roles.
|
||||
items:
|
||||
properties:
|
||||
claim:
|
||||
description: Claim is a claim name.
|
||||
type: string
|
||||
roles:
|
||||
description: Roles is a list of static teleport roles to match.
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
value:
|
||||
description: Value is a claim value to match.
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
client_id:
|
||||
description: ClientID is the id of the authentication client (Teleport
|
||||
Auth Service).
|
||||
type: string
|
||||
client_redirect_settings:
|
||||
description: ClientRedirectSettings defines which client redirect
|
||||
URLs are allowed for non-browser SSO logins other than the standard
|
||||
localhost ones.
|
||||
nullable: true
|
||||
properties:
|
||||
allowed_https_hostnames:
|
||||
description: a list of hostnames allowed for https client redirect
|
||||
URLs
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
insecure_allowed_cidr_ranges:
|
||||
description: a list of CIDRs allowed for HTTP or HTTPS client
|
||||
redirect URLs
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
type: object
|
||||
client_secret:
|
||||
description: ClientSecret is used to authenticate the client. This
|
||||
field supports secret lookup. See the operator documentation for
|
||||
more details.
|
||||
type: string
|
||||
display:
|
||||
description: Display is the friendly name for this provider.
|
||||
type: string
|
||||
google_admin_email:
|
||||
description: GoogleAdminEmail is the email of a google admin to impersonate.
|
||||
type: string
|
||||
google_service_account:
|
||||
description: GoogleServiceAccount is a string containing google service
|
||||
account credentials.
|
||||
type: string
|
||||
google_service_account_uri:
|
||||
description: GoogleServiceAccountURI is a path to a google service
|
||||
account uri.
|
||||
type: string
|
||||
issuer_url:
|
||||
description: IssuerURL is the endpoint of the provider, e.g. https://accounts.google.com.
|
||||
type: string
|
||||
max_age:
|
||||
description: MaxAge is the amount of time that user logins are valid
|
||||
for. If a user logs in, but then does not login again within this
|
||||
time period, they will be forced to re-authenticate.
|
||||
format: duration
|
||||
type: string
|
||||
mfa:
|
||||
description: MFASettings contains settings to enable SSO MFA checks
|
||||
through this auth connector.
|
||||
nullable: true
|
||||
properties:
|
||||
acr_values:
|
||||
description: AcrValues are Authentication Context Class Reference
|
||||
values. The meaning of the ACR value is context-specific and
|
||||
varies for identity providers. Some identity providers support
|
||||
MFA specific contexts, such Okta with its "phr" (phishing-resistant)
|
||||
ACR.
|
||||
type: string
|
||||
client_id:
|
||||
description: ClientID is the OIDC OAuth app client ID.
|
||||
type: string
|
||||
client_secret:
|
||||
description: ClientSecret is the OIDC OAuth app client secret.
|
||||
type: string
|
||||
enabled:
|
||||
description: Enabled specified whether this OIDC connector supports
|
||||
MFA checks. Defaults to false.
|
||||
type: boolean
|
||||
max_age:
|
||||
description: MaxAge is the amount of time in nanoseconds that
|
||||
an IdP session is valid for. Defaults to 0 to always force re-authentication
|
||||
for MFA checks. This should only be set to a non-zero value
|
||||
if the IdP is setup to perform MFA checks on top of active user
|
||||
sessions.
|
||||
format: duration
|
||||
type: string
|
||||
prompt:
|
||||
description: Prompt is an optional OIDC prompt. An empty string
|
||||
omits prompt. If not specified, it defaults to select_account
|
||||
for backwards compatibility.
|
||||
type: string
|
||||
type: object
|
||||
prompt:
|
||||
description: Prompt is an optional OIDC prompt. An empty string omits
|
||||
prompt. If not specified, it defaults to select_account for backwards
|
||||
compatibility.
|
||||
type: string
|
||||
provider:
|
||||
description: Provider is the external identity provider.
|
||||
type: string
|
||||
redirect_url:
|
||||
description: RedirectURLs is a list of callback URLs which the identity
|
||||
provider can use to redirect the client back to the Teleport Proxy
|
||||
to complete authentication. This list should match the URLs on the
|
||||
provider's side. The URL used for a given auth request will be chosen
|
||||
to match the requesting Proxy's public address. If there is no match,
|
||||
the first url in the list will be used.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
scope:
|
||||
description: Scope specifies additional scopes set by provider.
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
username_claim:
|
||||
description: UsernameClaim specifies the name of the claim from the
|
||||
OIDC connector to be used as the user's username.
|
||||
type: string
|
||||
type: object
|
||||
status:
|
||||
description: Status defines the observed state of the Teleport resource
|
||||
properties:
|
||||
conditions:
|
||||
description: Conditions represent the latest available observations
|
||||
of an object's state
|
||||
items:
|
||||
description: Condition contains details for one aspect of the current
|
||||
state of this API Resource.
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: |-
|
||||
lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: |-
|
||||
message is a human readable message indicating details about the transition.
|
||||
This may be an empty string.
|
||||
maxLength: 32768
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: |-
|
||||
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
||||
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
||||
with respect to the current state of the instance.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
reason:
|
||||
description: |-
|
||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||
Producers of specific condition types may define expected values and meanings for this field,
|
||||
and whether the values are considered a guaranteed API.
|
||||
The value should be a CamelCase string.
|
||||
This field may not be empty.
|
||||
maxLength: 1024
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||
type: string
|
||||
status:
|
||||
description: status of the condition, one of True, False, Unknown.
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||
maxLength: 316
|
||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||
type: string
|
||||
required:
|
||||
- lastTransitionTime
|
||||
- message
|
||||
- reason
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
teleportResourceID:
|
||||
format: int64
|
||||
type: integer
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: null
|
||||
storedVersions: null
|
||||
-172
@@ -1,172 +0,0 @@
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: teleportoktaimportrules.resources.teleport.dev
|
||||
spec:
|
||||
group: resources.teleport.dev
|
||||
names:
|
||||
kind: TeleportOktaImportRule
|
||||
listKind: TeleportOktaImportRuleList
|
||||
plural: teleportoktaimportrules
|
||||
shortNames:
|
||||
- oktaimportrule
|
||||
- oktaimportrules
|
||||
singular: teleportoktaimportrule
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: OktaImportRule is the Schema for the oktaimportrules API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: OktaImportRule resource definition v1 from Teleport
|
||||
properties:
|
||||
mappings:
|
||||
description: Mappings is a list of matches that will map match conditions
|
||||
to labels.
|
||||
items:
|
||||
properties:
|
||||
add_labels:
|
||||
description: AddLabels specifies which labels to add if any
|
||||
of the previous matches match.
|
||||
nullable: true
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
value:
|
||||
type: string
|
||||
type: object
|
||||
match:
|
||||
description: Match is a set of matching rules for this mapping.
|
||||
If any of these match, then the mapping will be applied.
|
||||
items:
|
||||
properties:
|
||||
app_ids:
|
||||
description: AppIDs is a list of app IDs to match against.
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
app_name_regexes:
|
||||
description: AppNameRegexes is a list of regexes to match
|
||||
against app names.
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
group_ids:
|
||||
description: GroupIDs is a list of group IDs to match
|
||||
against.
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
group_name_regexes:
|
||||
description: GroupNameRegexes is a list of regexes to
|
||||
match against group names.
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
type: object
|
||||
nullable: true
|
||||
type: array
|
||||
type: object
|
||||
nullable: true
|
||||
type: array
|
||||
priority:
|
||||
description: Priority represents the priority of the rule application.
|
||||
Lower numbered rules will be applied first.
|
||||
format: int32
|
||||
type: integer
|
||||
type: object
|
||||
status:
|
||||
description: Status defines the observed state of the Teleport resource
|
||||
properties:
|
||||
conditions:
|
||||
description: Conditions represent the latest available observations
|
||||
of an object's state
|
||||
items:
|
||||
description: Condition contains details for one aspect of the current
|
||||
state of this API Resource.
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: |-
|
||||
lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: |-
|
||||
message is a human readable message indicating details about the transition.
|
||||
This may be an empty string.
|
||||
maxLength: 32768
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: |-
|
||||
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
||||
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
||||
with respect to the current state of the instance.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
reason:
|
||||
description: |-
|
||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||
Producers of specific condition types may define expected values and meanings for this field,
|
||||
and whether the values are considered a guaranteed API.
|
||||
The value should be a CamelCase string.
|
||||
This field may not be empty.
|
||||
maxLength: 1024
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||
type: string
|
||||
status:
|
||||
description: status of the condition, one of True, False, Unknown.
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||
maxLength: 316
|
||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||
type: string
|
||||
required:
|
||||
- lastTransitionTime
|
||||
- message
|
||||
- reason
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
teleportResourceID:
|
||||
format: int64
|
||||
type: integer
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: null
|
||||
storedVersions: null
|
||||
Vendored
-263
@@ -1,263 +0,0 @@
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: teleportopenssheiceserversv2.resources.teleport.dev
|
||||
spec:
|
||||
group: resources.teleport.dev
|
||||
names:
|
||||
kind: TeleportOpenSSHEICEServerV2
|
||||
listKind: TeleportOpenSSHEICEServerV2List
|
||||
plural: teleportopenssheiceserversv2
|
||||
shortNames:
|
||||
- openssheiceserverv2
|
||||
- openssheiceserversv2
|
||||
singular: teleportopenssheiceserverv2
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- description: Server hostname
|
||||
jsonPath: .spec.hostname
|
||||
name: Hostname
|
||||
type: string
|
||||
- description: Server address, with SSH port.
|
||||
jsonPath: .spec.addr
|
||||
name: Address
|
||||
type: string
|
||||
- description: The age of this resource
|
||||
jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: OpenSSHEICEServerV2 is the Schema for the openssheiceserversv2
|
||||
API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: OpenSSHEICEServer resource definition v2 from Teleport
|
||||
properties:
|
||||
addr:
|
||||
description: Addr is a host:port address where this server can be
|
||||
reached.
|
||||
type: string
|
||||
cloud_metadata:
|
||||
description: CloudMetadata contains info about the cloud instance
|
||||
the server is running on, if any.
|
||||
nullable: true
|
||||
properties:
|
||||
aws:
|
||||
description: AWSInfo contains attributes to match to an EC2 instance.
|
||||
nullable: true
|
||||
properties:
|
||||
account_id:
|
||||
description: AccountID is an AWS account ID.
|
||||
type: string
|
||||
instance_id:
|
||||
description: InstanceID is an EC2 instance ID.
|
||||
type: string
|
||||
integration:
|
||||
description: Integration is the integration name that added
|
||||
this Node. When connecting to it, it will use this integration
|
||||
to issue AWS API calls in order to set up the connection.
|
||||
This includes sending an SSH Key and then opening a tunnel
|
||||
(EC2 Instance Connect Endpoint) so Teleport can connect
|
||||
to it.
|
||||
type: string
|
||||
region:
|
||||
description: Region is the AWS EC2 Instance Region.
|
||||
type: string
|
||||
subnet_id:
|
||||
description: SubnetID is the Subnet ID in use by the instance.
|
||||
type: string
|
||||
vpc_id:
|
||||
description: VPCID is the AWS VPC ID where the Instance is
|
||||
running.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
github:
|
||||
description: GitHub contains info about GitHub proxies where each
|
||||
server represents a GitHub organization.
|
||||
nullable: true
|
||||
properties:
|
||||
integration:
|
||||
description: Integration is the integration that is associated
|
||||
with this Server.
|
||||
type: string
|
||||
organization:
|
||||
description: Organization specifies the name of the organization
|
||||
for the GitHub integration.
|
||||
type: string
|
||||
type: object
|
||||
hostname:
|
||||
description: Hostname is server hostname
|
||||
type: string
|
||||
peer_addr:
|
||||
description: PeerAddr is the address a proxy server is reachable at
|
||||
by its peer proxies.
|
||||
type: string
|
||||
proxy_ids:
|
||||
description: ProxyIDs is a list of proxy IDs this server is expected
|
||||
to be connected to.
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
public_addrs:
|
||||
description: PublicAddrs is a list of public addresses where this
|
||||
server can be reached.
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
rotation:
|
||||
description: Rotation specifies server rotation
|
||||
properties:
|
||||
current_id:
|
||||
description: CurrentID is the ID of the rotation operation to
|
||||
differentiate between rotation attempts.
|
||||
type: string
|
||||
grace_period:
|
||||
description: GracePeriod is a period during which old and new
|
||||
CA are valid for checking purposes, but only new CA is issuing
|
||||
certificates.
|
||||
format: duration
|
||||
type: string
|
||||
last_rotated:
|
||||
description: LastRotated specifies the last time of the completed
|
||||
rotation.
|
||||
format: date-time
|
||||
type: string
|
||||
mode:
|
||||
description: Mode sets manual or automatic rotation mode.
|
||||
type: string
|
||||
phase:
|
||||
description: Phase is the current rotation phase.
|
||||
type: string
|
||||
schedule:
|
||||
description: Schedule is a rotation schedule - used in automatic
|
||||
mode to switch between phases.
|
||||
properties:
|
||||
standby:
|
||||
description: Standby specifies time to switch to the "Standby"
|
||||
phase.
|
||||
format: date-time
|
||||
type: string
|
||||
update_clients:
|
||||
description: UpdateClients specifies time to switch to the
|
||||
"Update clients" phase
|
||||
format: date-time
|
||||
type: string
|
||||
update_servers:
|
||||
description: UpdateServers specifies time to switch to the
|
||||
"Update servers" phase.
|
||||
format: date-time
|
||||
type: string
|
||||
type: object
|
||||
started:
|
||||
description: Started is set to the time when rotation has been
|
||||
started in case if the state of the rotation is "in_progress".
|
||||
format: date-time
|
||||
type: string
|
||||
state:
|
||||
description: State could be one of "init" or "in_progress".
|
||||
type: string
|
||||
type: object
|
||||
use_tunnel:
|
||||
description: UseTunnel indicates that connections to this server should
|
||||
occur over a reverse tunnel.
|
||||
type: boolean
|
||||
version:
|
||||
description: TeleportVersion is the teleport version that the server
|
||||
is running on
|
||||
type: string
|
||||
type: object
|
||||
status:
|
||||
description: Status defines the observed state of the Teleport resource
|
||||
properties:
|
||||
conditions:
|
||||
description: Conditions represent the latest available observations
|
||||
of an object's state
|
||||
items:
|
||||
description: Condition contains details for one aspect of the current
|
||||
state of this API Resource.
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: |-
|
||||
lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: |-
|
||||
message is a human readable message indicating details about the transition.
|
||||
This may be an empty string.
|
||||
maxLength: 32768
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: |-
|
||||
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
||||
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
||||
with respect to the current state of the instance.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
reason:
|
||||
description: |-
|
||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||
Producers of specific condition types may define expected values and meanings for this field,
|
||||
and whether the values are considered a guaranteed API.
|
||||
The value should be a CamelCase string.
|
||||
This field may not be empty.
|
||||
maxLength: 1024
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||
type: string
|
||||
status:
|
||||
description: status of the condition, one of True, False, Unknown.
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||
maxLength: 316
|
||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||
type: string
|
||||
required:
|
||||
- lastTransitionTime
|
||||
- message
|
||||
- reason
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
teleportResourceID:
|
||||
format: int64
|
||||
type: integer
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: null
|
||||
storedVersions: null
|
||||
-262
@@ -1,262 +0,0 @@
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: teleportopensshserversv2.resources.teleport.dev
|
||||
spec:
|
||||
group: resources.teleport.dev
|
||||
names:
|
||||
kind: TeleportOpenSSHServerV2
|
||||
listKind: TeleportOpenSSHServerV2List
|
||||
plural: teleportopensshserversv2
|
||||
shortNames:
|
||||
- opensshserverv2
|
||||
- opensshserversv2
|
||||
singular: teleportopensshserverv2
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- description: Server hostname
|
||||
jsonPath: .spec.hostname
|
||||
name: Hostname
|
||||
type: string
|
||||
- description: Server address, with SSH port.
|
||||
jsonPath: .spec.addr
|
||||
name: Address
|
||||
type: string
|
||||
- description: The age of this resource
|
||||
jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: OpenSSHServerV2 is the Schema for the opensshserversv2 API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: OpenSSHServer resource definition v2 from Teleport
|
||||
properties:
|
||||
addr:
|
||||
description: Addr is a host:port address where this server can be
|
||||
reached.
|
||||
type: string
|
||||
cloud_metadata:
|
||||
description: CloudMetadata contains info about the cloud instance
|
||||
the server is running on, if any.
|
||||
nullable: true
|
||||
properties:
|
||||
aws:
|
||||
description: AWSInfo contains attributes to match to an EC2 instance.
|
||||
nullable: true
|
||||
properties:
|
||||
account_id:
|
||||
description: AccountID is an AWS account ID.
|
||||
type: string
|
||||
instance_id:
|
||||
description: InstanceID is an EC2 instance ID.
|
||||
type: string
|
||||
integration:
|
||||
description: Integration is the integration name that added
|
||||
this Node. When connecting to it, it will use this integration
|
||||
to issue AWS API calls in order to set up the connection.
|
||||
This includes sending an SSH Key and then opening a tunnel
|
||||
(EC2 Instance Connect Endpoint) so Teleport can connect
|
||||
to it.
|
||||
type: string
|
||||
region:
|
||||
description: Region is the AWS EC2 Instance Region.
|
||||
type: string
|
||||
subnet_id:
|
||||
description: SubnetID is the Subnet ID in use by the instance.
|
||||
type: string
|
||||
vpc_id:
|
||||
description: VPCID is the AWS VPC ID where the Instance is
|
||||
running.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
github:
|
||||
description: GitHub contains info about GitHub proxies where each
|
||||
server represents a GitHub organization.
|
||||
nullable: true
|
||||
properties:
|
||||
integration:
|
||||
description: Integration is the integration that is associated
|
||||
with this Server.
|
||||
type: string
|
||||
organization:
|
||||
description: Organization specifies the name of the organization
|
||||
for the GitHub integration.
|
||||
type: string
|
||||
type: object
|
||||
hostname:
|
||||
description: Hostname is server hostname
|
||||
type: string
|
||||
peer_addr:
|
||||
description: PeerAddr is the address a proxy server is reachable at
|
||||
by its peer proxies.
|
||||
type: string
|
||||
proxy_ids:
|
||||
description: ProxyIDs is a list of proxy IDs this server is expected
|
||||
to be connected to.
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
public_addrs:
|
||||
description: PublicAddrs is a list of public addresses where this
|
||||
server can be reached.
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
rotation:
|
||||
description: Rotation specifies server rotation
|
||||
properties:
|
||||
current_id:
|
||||
description: CurrentID is the ID of the rotation operation to
|
||||
differentiate between rotation attempts.
|
||||
type: string
|
||||
grace_period:
|
||||
description: GracePeriod is a period during which old and new
|
||||
CA are valid for checking purposes, but only new CA is issuing
|
||||
certificates.
|
||||
format: duration
|
||||
type: string
|
||||
last_rotated:
|
||||
description: LastRotated specifies the last time of the completed
|
||||
rotation.
|
||||
format: date-time
|
||||
type: string
|
||||
mode:
|
||||
description: Mode sets manual or automatic rotation mode.
|
||||
type: string
|
||||
phase:
|
||||
description: Phase is the current rotation phase.
|
||||
type: string
|
||||
schedule:
|
||||
description: Schedule is a rotation schedule - used in automatic
|
||||
mode to switch between phases.
|
||||
properties:
|
||||
standby:
|
||||
description: Standby specifies time to switch to the "Standby"
|
||||
phase.
|
||||
format: date-time
|
||||
type: string
|
||||
update_clients:
|
||||
description: UpdateClients specifies time to switch to the
|
||||
"Update clients" phase
|
||||
format: date-time
|
||||
type: string
|
||||
update_servers:
|
||||
description: UpdateServers specifies time to switch to the
|
||||
"Update servers" phase.
|
||||
format: date-time
|
||||
type: string
|
||||
type: object
|
||||
started:
|
||||
description: Started is set to the time when rotation has been
|
||||
started in case if the state of the rotation is "in_progress".
|
||||
format: date-time
|
||||
type: string
|
||||
state:
|
||||
description: State could be one of "init" or "in_progress".
|
||||
type: string
|
||||
type: object
|
||||
use_tunnel:
|
||||
description: UseTunnel indicates that connections to this server should
|
||||
occur over a reverse tunnel.
|
||||
type: boolean
|
||||
version:
|
||||
description: TeleportVersion is the teleport version that the server
|
||||
is running on
|
||||
type: string
|
||||
type: object
|
||||
status:
|
||||
description: Status defines the observed state of the Teleport resource
|
||||
properties:
|
||||
conditions:
|
||||
description: Conditions represent the latest available observations
|
||||
of an object's state
|
||||
items:
|
||||
description: Condition contains details for one aspect of the current
|
||||
state of this API Resource.
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: |-
|
||||
lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: |-
|
||||
message is a human readable message indicating details about the transition.
|
||||
This may be an empty string.
|
||||
maxLength: 32768
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: |-
|
||||
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
||||
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
||||
with respect to the current state of the instance.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
reason:
|
||||
description: |-
|
||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||
Producers of specific condition types may define expected values and meanings for this field,
|
||||
and whether the values are considered a guaranteed API.
|
||||
The value should be a CamelCase string.
|
||||
This field may not be empty.
|
||||
maxLength: 1024
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||
type: string
|
||||
status:
|
||||
description: status of the condition, one of True, False, Unknown.
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||
maxLength: 316
|
||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||
type: string
|
||||
required:
|
||||
- lastTransitionTime
|
||||
- message
|
||||
- reason
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
teleportResourceID:
|
||||
format: int64
|
||||
type: integer
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: null
|
||||
storedVersions: null
|
||||
-568
@@ -1,568 +0,0 @@
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: teleportprovisiontokens.resources.teleport.dev
|
||||
spec:
|
||||
group: resources.teleport.dev
|
||||
names:
|
||||
kind: TeleportProvisionToken
|
||||
listKind: TeleportProvisionTokenList
|
||||
plural: teleportprovisiontokens
|
||||
shortNames:
|
||||
- provisiontoken
|
||||
- provisiontokens
|
||||
singular: teleportprovisiontoken
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- description: Token join method.
|
||||
jsonPath: .spec.join_method
|
||||
name: Join Method
|
||||
type: string
|
||||
- description: System roles granted by this token.
|
||||
jsonPath: .spec.roles
|
||||
name: System Roles
|
||||
type: string
|
||||
- description: The age of this resource
|
||||
jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v2
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: ProvisionToken is the Schema for the provisiontokens API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: ProvisionToken resource definition v2 from Teleport
|
||||
properties:
|
||||
allow:
|
||||
description: Allow is a list of TokenRules, nodes using this token
|
||||
must match one allow rule to use this token.
|
||||
items:
|
||||
properties:
|
||||
aws_account:
|
||||
description: AWSAccount is the AWS account ID.
|
||||
type: string
|
||||
aws_arn:
|
||||
description: AWSARN is used for the IAM join method, the AWS
|
||||
identity of joining nodes must match this ARN. Supports wildcards
|
||||
"*" and "?".
|
||||
type: string
|
||||
aws_regions:
|
||||
description: AWSRegions is used for the EC2 join method and
|
||||
is a list of AWS regions a node is allowed to join from.
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
aws_role:
|
||||
description: AWSRole is used for the EC2 join method and is
|
||||
the ARN of the AWS role that the Auth Service will assume
|
||||
in order to call the ec2 API.
|
||||
type: string
|
||||
type: object
|
||||
nullable: true
|
||||
type: array
|
||||
aws_iid_ttl:
|
||||
description: AWSIIDTTL is the TTL to use for AWS EC2 Instance Identity
|
||||
Documents used to join the cluster with this token.
|
||||
format: duration
|
||||
type: string
|
||||
azure:
|
||||
description: Azure allows the configuration of options specific to
|
||||
the "azure" join method.
|
||||
nullable: true
|
||||
properties:
|
||||
allow:
|
||||
description: Allow is a list of Rules, nodes using this token
|
||||
must match one allow rule to use this token.
|
||||
items:
|
||||
properties:
|
||||
resource_groups:
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
subscription:
|
||||
type: string
|
||||
type: object
|
||||
nullable: true
|
||||
type: array
|
||||
type: object
|
||||
bitbucket:
|
||||
description: Bitbucket allows the configuration of options specific
|
||||
to the "bitbucket" join method.
|
||||
nullable: true
|
||||
properties:
|
||||
allow:
|
||||
description: Allow is a list of Rules, nodes using this token
|
||||
must match one allow rule to use this token.
|
||||
items:
|
||||
properties:
|
||||
branch_name:
|
||||
type: string
|
||||
deployment_environment_uuid:
|
||||
type: string
|
||||
repository_uuid:
|
||||
type: string
|
||||
workspace_uuid:
|
||||
type: string
|
||||
type: object
|
||||
nullable: true
|
||||
type: array
|
||||
audience:
|
||||
description: Audience is a Bitbucket-specified audience value
|
||||
for this token. It is unique to each Bitbucket repository, and
|
||||
must be set to the value as written in the Pipelines -> OpenID
|
||||
Connect section of the repository settings.
|
||||
type: string
|
||||
identity_provider_url:
|
||||
description: IdentityProviderURL is a Bitbucket-specified issuer
|
||||
URL for incoming OIDC tokens. It is unique to each Bitbucket
|
||||
repository, and must be set to the value as written in the Pipelines
|
||||
-> OpenID Connect section of the repository settings.
|
||||
type: string
|
||||
type: object
|
||||
bot_name:
|
||||
description: BotName is the name of the bot this token grants access
|
||||
to, if any
|
||||
type: string
|
||||
circleci:
|
||||
description: CircleCI allows the configuration of options specific
|
||||
to the "circleci" join method.
|
||||
nullable: true
|
||||
properties:
|
||||
allow:
|
||||
description: Allow is a list of TokenRules, nodes using this token
|
||||
must match one allow rule to use this token.
|
||||
items:
|
||||
properties:
|
||||
context_id:
|
||||
type: string
|
||||
project_id:
|
||||
type: string
|
||||
type: object
|
||||
nullable: true
|
||||
type: array
|
||||
organization_id:
|
||||
type: string
|
||||
type: object
|
||||
gcp:
|
||||
description: GCP allows the configuration of options specific to the
|
||||
"gcp" join method.
|
||||
nullable: true
|
||||
properties:
|
||||
allow:
|
||||
description: Allow is a list of Rules, nodes using this token
|
||||
must match one allow rule to use this token.
|
||||
items:
|
||||
properties:
|
||||
locations:
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
project_ids:
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
service_accounts:
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
type: object
|
||||
nullable: true
|
||||
type: array
|
||||
type: object
|
||||
github:
|
||||
description: GitHub allows the configuration of options specific to
|
||||
the "github" join method.
|
||||
nullable: true
|
||||
properties:
|
||||
allow:
|
||||
description: Allow is a list of TokenRules, nodes using this token
|
||||
must match one allow rule to use this token.
|
||||
items:
|
||||
properties:
|
||||
actor:
|
||||
type: string
|
||||
environment:
|
||||
type: string
|
||||
ref:
|
||||
type: string
|
||||
ref_type:
|
||||
type: string
|
||||
repository:
|
||||
type: string
|
||||
repository_owner:
|
||||
type: string
|
||||
sub:
|
||||
type: string
|
||||
workflow:
|
||||
type: string
|
||||
type: object
|
||||
nullable: true
|
||||
type: array
|
||||
enterprise_server_host:
|
||||
description: EnterpriseServerHost allows joining from runners
|
||||
associated with a GitHub Enterprise Server instance. When unconfigured,
|
||||
tokens will be validated against github.com, but when configured
|
||||
to the host of a GHES instance, then the tokens will be validated
|
||||
against host. This value should be the hostname of the GHES
|
||||
instance, and should not include the scheme or a path. The instance
|
||||
must be accessible over HTTPS at this hostname and the certificate
|
||||
must be trusted by the Auth Service.
|
||||
type: string
|
||||
enterprise_slug:
|
||||
description: EnterpriseSlug allows the slug of a GitHub Enterprise
|
||||
organisation to be included in the expected issuer of the OIDC
|
||||
tokens. This is for compatibility with the `include_enterprise_slug`
|
||||
option in GHE. This field should be set to the slug of your
|
||||
enterprise if this is enabled. If this is not enabled, then
|
||||
this field must be left empty. This field cannot be specified
|
||||
if `enterprise_server_host` is specified. See https://docs.github.com/en/enterprise-cloud@latest/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#customizing-the-issuer-value-for-an-enterprise
|
||||
for more information about customized issuer values.
|
||||
type: string
|
||||
static_jwks:
|
||||
description: StaticJWKS disables fetching of the GHES signing
|
||||
keys via the JWKS/OIDC endpoints, and allows them to be directly
|
||||
specified. This allows joining from GitHub Actions in GHES instances
|
||||
that are not reachable by the Teleport Auth Service.
|
||||
type: string
|
||||
type: object
|
||||
gitlab:
|
||||
description: GitLab allows the configuration of options specific to
|
||||
the "gitlab" join method.
|
||||
nullable: true
|
||||
properties:
|
||||
allow:
|
||||
description: Allow is a list of TokenRules, nodes using this token
|
||||
must match one allow rule to use this token.
|
||||
items:
|
||||
properties:
|
||||
ci_config_ref_uri:
|
||||
type: string
|
||||
ci_config_sha:
|
||||
type: string
|
||||
deployment_tier:
|
||||
type: string
|
||||
environment:
|
||||
type: string
|
||||
environment_protected:
|
||||
type: boolean
|
||||
namespace_path:
|
||||
type: string
|
||||
pipeline_source:
|
||||
type: string
|
||||
project_path:
|
||||
type: string
|
||||
project_visibility:
|
||||
type: string
|
||||
ref:
|
||||
type: string
|
||||
ref_protected:
|
||||
type: boolean
|
||||
ref_type:
|
||||
type: string
|
||||
sub:
|
||||
type: string
|
||||
user_email:
|
||||
type: string
|
||||
user_id:
|
||||
type: string
|
||||
user_login:
|
||||
type: string
|
||||
type: object
|
||||
nullable: true
|
||||
type: array
|
||||
domain:
|
||||
description: Domain is the domain of your GitLab instance. This
|
||||
will default to `gitlab.com` - but can be set to the domain
|
||||
of your self-hosted GitLab e.g `gitlab.example.com`.
|
||||
type: string
|
||||
static_jwks:
|
||||
description: StaticJWKS disables fetching of the GitLab signing
|
||||
keys via the JWKS/OIDC endpoints, and allows them to be directly
|
||||
specified. This allows joining from GitLab CI instances that
|
||||
are not reachable by the Teleport Auth Service.
|
||||
type: string
|
||||
type: object
|
||||
join_method:
|
||||
description: 'JoinMethod is the joining method required in order to
|
||||
use this token. Supported joining methods include: azure, circleci,
|
||||
ec2, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm'
|
||||
type: string
|
||||
kubernetes:
|
||||
description: Kubernetes allows the configuration of options specific
|
||||
to the "kubernetes" join method.
|
||||
nullable: true
|
||||
properties:
|
||||
allow:
|
||||
description: Allow is a list of Rules, nodes using this token
|
||||
must match one allow rule to use this token.
|
||||
items:
|
||||
properties:
|
||||
service_account:
|
||||
type: string
|
||||
type: object
|
||||
nullable: true
|
||||
type: array
|
||||
static_jwks:
|
||||
description: StaticJWKS is the configuration specific to the `static_jwks`
|
||||
type.
|
||||
nullable: true
|
||||
properties:
|
||||
jwks:
|
||||
type: string
|
||||
type: object
|
||||
type:
|
||||
description: 'Type controls which behavior should be used for
|
||||
validating the Kubernetes Service Account token. Support values:
|
||||
- `in_cluster` - `static_jwks` If unset, this defaults to `in_cluster`.'
|
||||
type: string
|
||||
type: object
|
||||
oracle:
|
||||
description: Oracle allows the configuration of options specific to
|
||||
the "oracle" join method.
|
||||
nullable: true
|
||||
properties:
|
||||
allow:
|
||||
description: Allow is a list of Rules, nodes using this token
|
||||
must match one allow rule to use this token.
|
||||
items:
|
||||
properties:
|
||||
parent_compartments:
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
regions:
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
tenancy:
|
||||
type: string
|
||||
type: object
|
||||
nullable: true
|
||||
type: array
|
||||
type: object
|
||||
roles:
|
||||
description: Roles is a list of roles associated with the token, that
|
||||
will be converted to metadata in the SSH and X509 certificates issued
|
||||
to the user of the token
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
spacelift:
|
||||
description: Spacelift allows the configuration of options specific
|
||||
to the "spacelift" join method.
|
||||
nullable: true
|
||||
properties:
|
||||
allow:
|
||||
description: Allow is a list of Rules, nodes using this token
|
||||
must match one allow rule to use this token.
|
||||
items:
|
||||
properties:
|
||||
caller_id:
|
||||
type: string
|
||||
caller_type:
|
||||
type: string
|
||||
scope:
|
||||
type: string
|
||||
space_id:
|
||||
type: string
|
||||
type: object
|
||||
nullable: true
|
||||
type: array
|
||||
hostname:
|
||||
description: Hostname is the hostname of the Spacelift tenant
|
||||
that tokens will originate from. E.g `example.app.spacelift.io`
|
||||
type: string
|
||||
type: object
|
||||
suggested_agent_matcher_labels:
|
||||
additionalProperties:
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
description: SuggestedAgentMatcherLabels is a set of labels to be
|
||||
used by agents to match on resources. When an agent uses this token,
|
||||
the agent should monitor resources that match those labels. For
|
||||
databases, this means adding the labels to `db_service.resources.labels`.
|
||||
Currently, only node-join scripts create a configuration according
|
||||
to the suggestion.
|
||||
type: object
|
||||
suggested_labels:
|
||||
additionalProperties:
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
description: SuggestedLabels is a set of labels that resources should
|
||||
set when using this token to enroll themselves in the cluster. Currently,
|
||||
only node-join scripts create a configuration according to the suggestion.
|
||||
type: object
|
||||
terraform_cloud:
|
||||
description: TerraformCloud allows the configuration of options specific
|
||||
to the "terraform_cloud" join method.
|
||||
nullable: true
|
||||
properties:
|
||||
allow:
|
||||
description: Allow is a list of Rules, nodes using this token
|
||||
must match one allow rule to use this token.
|
||||
items:
|
||||
properties:
|
||||
organization_id:
|
||||
type: string
|
||||
organization_name:
|
||||
type: string
|
||||
project_id:
|
||||
type: string
|
||||
project_name:
|
||||
type: string
|
||||
run_phase:
|
||||
type: string
|
||||
workspace_id:
|
||||
type: string
|
||||
workspace_name:
|
||||
type: string
|
||||
type: object
|
||||
nullable: true
|
||||
type: array
|
||||
audience:
|
||||
description: Audience is the JWT audience as configured in the
|
||||
TFC_WORKLOAD_IDENTITY_AUDIENCE(_$TAG) variable in Terraform
|
||||
Cloud. If unset, defaults to the Teleport cluster name. For
|
||||
example, if `TFC_WORKLOAD_IDENTITY_AUDIENCE_TELEPORT=foo` is
|
||||
set in Terraform Cloud, this value should be `foo`. If the variable
|
||||
is set to match the cluster name, it does not need to be set
|
||||
here.
|
||||
type: string
|
||||
hostname:
|
||||
description: Hostname is the hostname of the Terraform Enterprise
|
||||
instance expected to issue JWTs allowed by this token. This
|
||||
may be unset for regular Terraform Cloud use, in which case
|
||||
it will be assumed to be `app.terraform.io`. Otherwise, it must
|
||||
both match the `iss` (issuer) field included in JWTs, and provide
|
||||
standard JWKS endpoints.
|
||||
type: string
|
||||
type: object
|
||||
tpm:
|
||||
description: TPM allows the configuration of options specific to the
|
||||
"tpm" join method.
|
||||
nullable: true
|
||||
properties:
|
||||
allow:
|
||||
description: Allow is a list of Rules, the presented delegated
|
||||
identity must match one allow rule to permit joining.
|
||||
items:
|
||||
properties:
|
||||
description:
|
||||
type: string
|
||||
ek_certificate_serial:
|
||||
type: string
|
||||
ek_public_hash:
|
||||
type: string
|
||||
type: object
|
||||
nullable: true
|
||||
type: array
|
||||
ekcert_allowed_cas:
|
||||
description: EKCertAllowedCAs is a list of CA certificates that
|
||||
will be used to validate TPM EKCerts. When specified, joining
|
||||
TPMs must present an EKCert signed by one of the specified CAs.
|
||||
TPMs that do not present an EKCert will be not permitted to
|
||||
join. When unspecified, TPMs will be allowed to join with either
|
||||
an EKCert or an EKPubHash.
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
type: object
|
||||
type: object
|
||||
status:
|
||||
description: Status defines the observed state of the Teleport resource
|
||||
properties:
|
||||
conditions:
|
||||
description: Conditions represent the latest available observations
|
||||
of an object's state
|
||||
items:
|
||||
description: Condition contains details for one aspect of the current
|
||||
state of this API Resource.
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: |-
|
||||
lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: |-
|
||||
message is a human readable message indicating details about the transition.
|
||||
This may be an empty string.
|
||||
maxLength: 32768
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: |-
|
||||
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
||||
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
||||
with respect to the current state of the instance.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
reason:
|
||||
description: |-
|
||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||
Producers of specific condition types may define expected values and meanings for this field,
|
||||
and whether the values are considered a guaranteed API.
|
||||
The value should be a CamelCase string.
|
||||
This field may not be empty.
|
||||
maxLength: 1024
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||
type: string
|
||||
status:
|
||||
description: status of the condition, one of True, False, Unknown.
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||
maxLength: 316
|
||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||
type: string
|
||||
required:
|
||||
- lastTransitionTime
|
||||
- message
|
||||
- reason
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
teleportResourceID:
|
||||
format: int64
|
||||
type: integer
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: null
|
||||
storedVersions: null
|
||||
-2966
File diff suppressed because it is too large
Load Diff
-1496
File diff suppressed because it is too large
Load Diff
-1496
File diff suppressed because it is too large
Load Diff
-1496
File diff suppressed because it is too large
Load Diff
-265
@@ -1,265 +0,0 @@
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: teleportsamlconnectors.resources.teleport.dev
|
||||
spec:
|
||||
group: resources.teleport.dev
|
||||
names:
|
||||
kind: TeleportSAMLConnector
|
||||
listKind: TeleportSAMLConnectorList
|
||||
plural: teleportsamlconnectors
|
||||
shortNames:
|
||||
- samlconnector
|
||||
- samlconnectors
|
||||
singular: teleportsamlconnector
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v2
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: SAMLConnector is the Schema for the samlconnectors API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: SAMLConnector resource definition v2 from Teleport
|
||||
properties:
|
||||
acs:
|
||||
description: AssertionConsumerService is a URL for assertion consumer
|
||||
service on the service provider (Teleport's side).
|
||||
type: string
|
||||
allow_idp_initiated:
|
||||
description: AllowIDPInitiated is a flag that indicates if the connector
|
||||
can be used for IdP-initiated logins.
|
||||
type: boolean
|
||||
assertion_key_pair:
|
||||
description: EncryptionKeyPair is a key pair used for decrypting SAML
|
||||
assertions.
|
||||
nullable: true
|
||||
properties:
|
||||
cert:
|
||||
description: Cert is a PEM-encoded x509 certificate.
|
||||
type: string
|
||||
private_key:
|
||||
description: PrivateKey is a PEM encoded x509 private key.
|
||||
type: string
|
||||
type: object
|
||||
attributes_to_roles:
|
||||
description: AttributesToRoles is a list of mappings of attribute
|
||||
statements to roles.
|
||||
items:
|
||||
properties:
|
||||
name:
|
||||
description: Name is an attribute statement name.
|
||||
type: string
|
||||
roles:
|
||||
description: Roles is a list of static teleport roles to map
|
||||
to.
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
value:
|
||||
description: Value is an attribute statement value to match.
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
audience:
|
||||
description: Audience uniquely identifies our service provider.
|
||||
type: string
|
||||
cert:
|
||||
description: Cert is the identity provider certificate PEM. IDP signs
|
||||
`<Response>` responses using this certificate.
|
||||
type: string
|
||||
client_redirect_settings:
|
||||
description: ClientRedirectSettings defines which client redirect
|
||||
URLs are allowed for non-browser SSO logins other than the standard
|
||||
localhost ones.
|
||||
nullable: true
|
||||
properties:
|
||||
allowed_https_hostnames:
|
||||
description: a list of hostnames allowed for https client redirect
|
||||
URLs
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
insecure_allowed_cidr_ranges:
|
||||
description: a list of CIDRs allowed for HTTP or HTTPS client
|
||||
redirect URLs
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
type: object
|
||||
display:
|
||||
description: Display controls how this connector is displayed.
|
||||
type: string
|
||||
entity_descriptor:
|
||||
description: EntityDescriptor is XML with descriptor. It can be used
|
||||
to supply configuration parameters in one XML file rather than supplying
|
||||
them in the individual elements.
|
||||
type: string
|
||||
entity_descriptor_url:
|
||||
description: EntityDescriptorURL is a URL that supplies a configuration
|
||||
XML.
|
||||
type: string
|
||||
force_authn:
|
||||
description: ForceAuthn specified whether re-authentication should
|
||||
be forced on login. UNSPECIFIED is treated as NO.
|
||||
x-kubernetes-int-or-string: true
|
||||
issuer:
|
||||
description: Issuer is the identity provider issuer.
|
||||
type: string
|
||||
mfa:
|
||||
description: MFASettings contains settings to enable SSO MFA checks
|
||||
through this auth connector.
|
||||
nullable: true
|
||||
properties:
|
||||
cert:
|
||||
description: Cert is the identity provider certificate PEM. IDP
|
||||
signs `<Response>` responses using this certificate.
|
||||
type: string
|
||||
enabled:
|
||||
description: Enabled specified whether this SAML connector supports
|
||||
MFA checks. Defaults to false.
|
||||
type: boolean
|
||||
entity_descriptor:
|
||||
description: EntityDescriptor is XML with descriptor. It can be
|
||||
used to supply configuration parameters in one XML file rather
|
||||
than supplying them in the individual elements. Usually set
|
||||
from EntityDescriptorUrl.
|
||||
type: string
|
||||
entity_descriptor_url:
|
||||
description: EntityDescriptorUrl is a URL that supplies a configuration
|
||||
XML.
|
||||
type: string
|
||||
force_authn:
|
||||
description: ForceAuthn specified whether re-authentication should
|
||||
be forced for MFA checks. UNSPECIFIED is treated as YES to always
|
||||
re-authentication for MFA checks. This should only be set to
|
||||
NO if the IdP is setup to perform MFA checks on top of active
|
||||
user sessions.
|
||||
x-kubernetes-int-or-string: true
|
||||
issuer:
|
||||
description: Issuer is the identity provider issuer. Usually set
|
||||
from EntityDescriptor.
|
||||
type: string
|
||||
sso:
|
||||
description: SSO is the URL of the identity provider's SSO service.
|
||||
Usually set from EntityDescriptor.
|
||||
type: string
|
||||
type: object
|
||||
provider:
|
||||
description: Provider is the external identity provider.
|
||||
type: string
|
||||
service_provider_issuer:
|
||||
description: ServiceProviderIssuer is the issuer of the service provider
|
||||
(Teleport).
|
||||
type: string
|
||||
signing_key_pair:
|
||||
description: SigningKeyPair is an x509 key pair used to sign AuthnRequest.
|
||||
nullable: true
|
||||
properties:
|
||||
cert:
|
||||
description: Cert is a PEM-encoded x509 certificate.
|
||||
type: string
|
||||
private_key:
|
||||
description: PrivateKey is a PEM encoded x509 private key.
|
||||
type: string
|
||||
type: object
|
||||
single_logout_url:
|
||||
description: SingleLogoutURL is the SAML Single log-out URL to initiate
|
||||
SAML SLO (single log-out). If this is not provided, SLO is disabled.
|
||||
type: string
|
||||
sso:
|
||||
description: SSO is the URL of the identity provider's SSO service.
|
||||
type: string
|
||||
type: object
|
||||
status:
|
||||
description: Status defines the observed state of the Teleport resource
|
||||
properties:
|
||||
conditions:
|
||||
description: Conditions represent the latest available observations
|
||||
of an object's state
|
||||
items:
|
||||
description: Condition contains details for one aspect of the current
|
||||
state of this API Resource.
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: |-
|
||||
lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: |-
|
||||
message is a human readable message indicating details about the transition.
|
||||
This may be an empty string.
|
||||
maxLength: 32768
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: |-
|
||||
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
||||
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
||||
with respect to the current state of the instance.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
reason:
|
||||
description: |-
|
||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||
Producers of specific condition types may define expected values and meanings for this field,
|
||||
and whether the values are considered a guaranteed API.
|
||||
The value should be a CamelCase string.
|
||||
This field may not be empty.
|
||||
maxLength: 1024
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||
type: string
|
||||
status:
|
||||
description: status of the condition, one of True, False, Unknown.
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||
maxLength: 316
|
||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||
type: string
|
||||
required:
|
||||
- lastTransitionTime
|
||||
- message
|
||||
- reason
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
teleportResourceID:
|
||||
format: int64
|
||||
type: integer
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: null
|
||||
storedVersions: null
|
||||
-149
@@ -1,149 +0,0 @@
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: teleporttrustedclustersv2.resources.teleport.dev
|
||||
spec:
|
||||
group: resources.teleport.dev
|
||||
names:
|
||||
kind: TeleportTrustedClusterV2
|
||||
listKind: TeleportTrustedClusterV2List
|
||||
plural: teleporttrustedclustersv2
|
||||
shortNames:
|
||||
- trustedclusterv2
|
||||
- trustedclustersv2
|
||||
singular: teleporttrustedclusterv2
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: TrustedClusterV2 is the Schema for the trustedclustersv2 API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: TrustedCluster resource definition v2 from Teleport
|
||||
properties:
|
||||
enabled:
|
||||
description: Enabled is a bool that indicates if the TrustedCluster
|
||||
is enabled or disabled. Setting Enabled to false has a side effect
|
||||
of deleting the user and host certificate authority (CA).
|
||||
type: boolean
|
||||
role_map:
|
||||
description: RoleMap specifies role mappings to remote roles.
|
||||
items:
|
||||
properties:
|
||||
local:
|
||||
description: Local specifies local roles to map to
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
remote:
|
||||
description: Remote specifies remote role name to map from
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
token:
|
||||
description: Token is the authorization token provided by another
|
||||
cluster needed by this cluster to join. This field supports secret
|
||||
lookup. See the operator documentation for more details.
|
||||
type: string
|
||||
tunnel_addr:
|
||||
description: ReverseTunnelAddress is the address of the SSH proxy
|
||||
server of the cluster to join. If not set, it is derived from `<metadata.name>:<default
|
||||
reverse tunnel port>`.
|
||||
type: string
|
||||
web_proxy_addr:
|
||||
description: ProxyAddress is the address of the web proxy server of
|
||||
the cluster to join. If not set, it is derived from `<metadata.name>:<default
|
||||
web proxy server port>`.
|
||||
type: string
|
||||
type: object
|
||||
status:
|
||||
description: Status defines the observed state of the Teleport resource
|
||||
properties:
|
||||
conditions:
|
||||
description: Conditions represent the latest available observations
|
||||
of an object's state
|
||||
items:
|
||||
description: Condition contains details for one aspect of the current
|
||||
state of this API Resource.
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: |-
|
||||
lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: |-
|
||||
message is a human readable message indicating details about the transition.
|
||||
This may be an empty string.
|
||||
maxLength: 32768
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: |-
|
||||
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
||||
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
||||
with respect to the current state of the instance.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
reason:
|
||||
description: |-
|
||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||
Producers of specific condition types may define expected values and meanings for this field,
|
||||
and whether the values are considered a guaranteed API.
|
||||
The value should be a CamelCase string.
|
||||
This field may not be empty.
|
||||
maxLength: 1024
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||
type: string
|
||||
status:
|
||||
description: status of the condition, one of True, False, Unknown.
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||
maxLength: 316
|
||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||
type: string
|
||||
required:
|
||||
- lastTransitionTime
|
||||
- message
|
||||
- reason
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
teleportResourceID:
|
||||
format: int64
|
||||
type: integer
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: null
|
||||
storedVersions: null
|
||||
-220
@@ -1,220 +0,0 @@
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: teleportusers.resources.teleport.dev
|
||||
spec:
|
||||
group: resources.teleport.dev
|
||||
names:
|
||||
kind: TeleportUser
|
||||
listKind: TeleportUserList
|
||||
plural: teleportusers
|
||||
shortNames:
|
||||
- user
|
||||
- users
|
||||
singular: teleportuser
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- description: List of Teleport roles granted to the user.
|
||||
jsonPath: .spec.roles
|
||||
name: Roles
|
||||
type: string
|
||||
- description: The age of this resource
|
||||
jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v2
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: User is the Schema for the users API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: User resource definition v2 from Teleport
|
||||
properties:
|
||||
github_identities:
|
||||
description: GithubIdentities list associated Github OAuth2 identities
|
||||
that let user log in using externally verified identity
|
||||
items:
|
||||
properties:
|
||||
connector_id:
|
||||
description: ConnectorID is id of registered OIDC connector,
|
||||
e.g. 'google-example.com'
|
||||
type: string
|
||||
samlSingleLogoutUrl:
|
||||
description: SAMLSingleLogoutURL is the SAML Single log-out
|
||||
URL to initiate SAML SLO (single log-out), if applicable.
|
||||
type: string
|
||||
user_id:
|
||||
description: UserID is the ID of the identity. Some connectors
|
||||
like GitHub have an unique ID apart from the username.
|
||||
type: string
|
||||
username:
|
||||
description: Username is username supplied by external identity
|
||||
provider
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
oidc_identities:
|
||||
description: OIDCIdentities lists associated OpenID Connect identities
|
||||
that let user log in using externally verified identity
|
||||
items:
|
||||
properties:
|
||||
connector_id:
|
||||
description: ConnectorID is id of registered OIDC connector,
|
||||
e.g. 'google-example.com'
|
||||
type: string
|
||||
samlSingleLogoutUrl:
|
||||
description: SAMLSingleLogoutURL is the SAML Single log-out
|
||||
URL to initiate SAML SLO (single log-out), if applicable.
|
||||
type: string
|
||||
user_id:
|
||||
description: UserID is the ID of the identity. Some connectors
|
||||
like GitHub have an unique ID apart from the username.
|
||||
type: string
|
||||
username:
|
||||
description: Username is username supplied by external identity
|
||||
provider
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
roles:
|
||||
description: Roles is a list of roles assigned to user
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
saml_identities:
|
||||
description: SAMLIdentities lists associated SAML identities that
|
||||
let user log in using externally verified identity
|
||||
items:
|
||||
properties:
|
||||
connector_id:
|
||||
description: ConnectorID is id of registered OIDC connector,
|
||||
e.g. 'google-example.com'
|
||||
type: string
|
||||
samlSingleLogoutUrl:
|
||||
description: SAMLSingleLogoutURL is the SAML Single log-out
|
||||
URL to initiate SAML SLO (single log-out), if applicable.
|
||||
type: string
|
||||
user_id:
|
||||
description: UserID is the ID of the identity. Some connectors
|
||||
like GitHub have an unique ID apart from the username.
|
||||
type: string
|
||||
username:
|
||||
description: Username is username supplied by external identity
|
||||
provider
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
traits:
|
||||
additionalProperties:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
description: Traits are key/value pairs received from an identity
|
||||
provider (through OIDC claims or SAML assertions) or from a system
|
||||
administrator for local accounts. Traits are used to populate role
|
||||
variables.
|
||||
type: object
|
||||
trusted_device_ids:
|
||||
description: TrustedDeviceIDs contains the IDs of trusted devices
|
||||
enrolled by the user. Note that SSO users are transient and thus
|
||||
may contain an empty TrustedDeviceIDs field, even though the user->device
|
||||
association exists under the Device Trust subsystem. Do not rely
|
||||
on this field to determine device associations or ownership, it
|
||||
exists for legacy/informative purposes only. Managed by the Device
|
||||
Trust subsystem, avoid manual edits.
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
type: object
|
||||
status:
|
||||
description: Status defines the observed state of the Teleport resource
|
||||
properties:
|
||||
conditions:
|
||||
description: Conditions represent the latest available observations
|
||||
of an object's state
|
||||
items:
|
||||
description: Condition contains details for one aspect of the current
|
||||
state of this API Resource.
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: |-
|
||||
lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: |-
|
||||
message is a human readable message indicating details about the transition.
|
||||
This may be an empty string.
|
||||
maxLength: 32768
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: |-
|
||||
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
||||
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
||||
with respect to the current state of the instance.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
reason:
|
||||
description: |-
|
||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||
Producers of specific condition types may define expected values and meanings for this field,
|
||||
and whether the values are considered a guaranteed API.
|
||||
The value should be a CamelCase string.
|
||||
This field may not be empty.
|
||||
maxLength: 1024
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||
type: string
|
||||
status:
|
||||
description: status of the condition, one of True, False, Unknown.
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||
maxLength: 316
|
||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||
type: string
|
||||
required:
|
||||
- lastTransitionTime
|
||||
- message
|
||||
- reason
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
teleportResourceID:
|
||||
format: int64
|
||||
type: integer
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: null
|
||||
storedVersions: null
|
||||
Vendored
-273
@@ -1,273 +0,0 @@
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: teleportworkloadidentitiesv1.resources.teleport.dev
|
||||
spec:
|
||||
group: resources.teleport.dev
|
||||
names:
|
||||
kind: TeleportWorkloadIdentityV1
|
||||
listKind: TeleportWorkloadIdentityV1List
|
||||
plural: teleportworkloadidentitiesv1
|
||||
shortNames:
|
||||
- workloadidentityv1
|
||||
- workloadidentitiesv1
|
||||
singular: teleportworkloadidentityv1
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: WorkloadIdentityV1 is the Schema for the workloadidentitiesv1
|
||||
API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: WorkloadIdentity resource definition v1 from Teleport
|
||||
properties:
|
||||
rules:
|
||||
description: The rules which are evaluated before the WorkloadIdentity
|
||||
can be issued.
|
||||
nullable: true
|
||||
properties:
|
||||
allow:
|
||||
description: A list of rules used to determine if a WorkloadIdentity
|
||||
can be issued. If none are provided, it will be considered a
|
||||
pass. If any are provided, then at least one must pass for the
|
||||
rules to be considered passed.
|
||||
items:
|
||||
properties:
|
||||
conditions:
|
||||
description: The conditions that must be met for this rule
|
||||
to be considered passed. Mutually exclusive with expression.
|
||||
items:
|
||||
properties:
|
||||
attribute:
|
||||
description: The name of the attribute to evaluate
|
||||
the condition against.
|
||||
type: string
|
||||
eq:
|
||||
description: The attribute casted to a string must
|
||||
be equal to the value.
|
||||
nullable: true
|
||||
properties:
|
||||
value:
|
||||
description: The value to compare the attribute
|
||||
against.
|
||||
type: string
|
||||
type: object
|
||||
in:
|
||||
description: The attribute casted to a string must
|
||||
be in the list of values.
|
||||
nullable: true
|
||||
properties:
|
||||
values:
|
||||
description: The list of values to compare the
|
||||
attribute against.
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
type: object
|
||||
not_eq:
|
||||
description: The attribute casted to a string must
|
||||
not be equal to the value.
|
||||
nullable: true
|
||||
properties:
|
||||
value:
|
||||
description: The value to compare the attribute
|
||||
against.
|
||||
type: string
|
||||
type: object
|
||||
not_in:
|
||||
description: The attribute casted to a string must
|
||||
not be in the list of values.
|
||||
nullable: true
|
||||
properties:
|
||||
values:
|
||||
description: The list of values to compare the
|
||||
attribute against.
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
type: object
|
||||
type: object
|
||||
nullable: true
|
||||
type: array
|
||||
expression:
|
||||
description: An expression written in Teleport's predicate
|
||||
language that must evaluate to true for this rule to be
|
||||
considered passed. Mutually exclusive with conditions.
|
||||
type: string
|
||||
type: object
|
||||
nullable: true
|
||||
type: array
|
||||
type: object
|
||||
spiffe:
|
||||
description: Configuration pertaining to the issuance of SPIFFE-compatible
|
||||
workload identity credentials.
|
||||
nullable: true
|
||||
properties:
|
||||
hint:
|
||||
description: A freeform text field which is provided to workloads
|
||||
along with a credential produced by this WorkloadIdentity. This
|
||||
can be used to provide additional context that can be used to
|
||||
select between multiple credentials.
|
||||
type: string
|
||||
id:
|
||||
description: The path of the SPIFFE ID that will be issued to
|
||||
the workload. This should be prefixed with a forward-slash
|
||||
("/"). This field supports templating using attributes.
|
||||
type: string
|
||||
jwt:
|
||||
description: Configuration specific to JWT-SVIDs.
|
||||
nullable: true
|
||||
properties:
|
||||
extra_claims:
|
||||
additionalProperties: true
|
||||
description: Additional claims that will be added to the JWT.
|
||||
nullable: true
|
||||
type: object
|
||||
maximum_ttl:
|
||||
description: Control the maximum TTL of JWT-SVIDs issued using
|
||||
this WorkloadIdentity. If a JWT-SVID is requested with
|
||||
a TTL greater than this value, then the returned JWT-SVID
|
||||
will have a TTL of this value. Defaults to 24 hours. The
|
||||
maximum this value can be set to is 24 hours.
|
||||
format: duration
|
||||
type: string
|
||||
type: object
|
||||
x509:
|
||||
description: Configuration specific to X509-SVIDs.
|
||||
nullable: true
|
||||
properties:
|
||||
dns_sans:
|
||||
description: The DNS Subject Alternative Names (SANs) that
|
||||
should be included in an X509-SVID issued using this WorkloadIdentity. Each
|
||||
entry in this list supports templating using attributes.
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
maximum_ttl:
|
||||
description: Control the maximum TTL of X509-SVIDs issued
|
||||
using this WorkloadIdentity. If a X509-SVID is requested
|
||||
with a TTL greater than this value, then the returned X509-SVID
|
||||
will have a TTL of this value. Defaults to 24 hours. The
|
||||
maximum this value can be set to is 14 days.
|
||||
format: duration
|
||||
type: string
|
||||
subject_template:
|
||||
description: Used to configure the Subject Distinguished Name
|
||||
(DN) of the X509-SVID. In most circumstances, it is recommended
|
||||
to prefer relying on the SPIFFE ID encoded in the URI SAN.
|
||||
However, the Subject DN may be needed to support legacy
|
||||
systems designed for X509 and not SPIFFE/WIMSE. If not
|
||||
provided, the X509-SVID will be issued with an empty Subject
|
||||
DN.
|
||||
nullable: true
|
||||
properties:
|
||||
common_name:
|
||||
description: Common Name (CN) - 2.5.4.3 If empty, the
|
||||
RDN will be omitted from the DN.
|
||||
type: string
|
||||
organization:
|
||||
description: Organization (O) - 2.5.4.10 If empty, the
|
||||
RDN will be omitted from the DN.
|
||||
type: string
|
||||
organizational_unit:
|
||||
description: Organizational Unit (OU) - 2.5.4.11 If empty,
|
||||
the RDN will be omitted from the DN.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
status:
|
||||
description: Status defines the observed state of the Teleport resource
|
||||
properties:
|
||||
conditions:
|
||||
description: Conditions represent the latest available observations
|
||||
of an object's state
|
||||
items:
|
||||
description: Condition contains details for one aspect of the current
|
||||
state of this API Resource.
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: |-
|
||||
lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: |-
|
||||
message is a human readable message indicating details about the transition.
|
||||
This may be an empty string.
|
||||
maxLength: 32768
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: |-
|
||||
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
||||
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
||||
with respect to the current state of the instance.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
reason:
|
||||
description: |-
|
||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||
Producers of specific condition types may define expected values and meanings for this field,
|
||||
and whether the values are considered a guaranteed API.
|
||||
The value should be a CamelCase string.
|
||||
This field may not be empty.
|
||||
maxLength: 1024
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||
type: string
|
||||
status:
|
||||
description: status of the condition, one of True, False, Unknown.
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||
maxLength: 316
|
||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||
type: string
|
||||
required:
|
||||
- lastTransitionTime
|
||||
- message
|
||||
- reason
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
teleportResourceID:
|
||||
format: int64
|
||||
type: integer
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: null
|
||||
storedVersions: null
|
||||
Vendored
-52
@@ -1,52 +0,0 @@
|
||||
// Copyright 2024 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.access_graph.v1;
|
||||
|
||||
import "teleport/header/v1/metadata.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/accessgraph/v1;accessgraphv1";
|
||||
|
||||
// The `AuthorizedKey` message represents an authorized key entry for a specific local user.
|
||||
// These authorized keys are generated by the server when a particular SSH AuthorizedKey is granted access to a user on the node.
|
||||
message AuthorizedKey {
|
||||
// metadata is the AuthorizedKey's metadata.
|
||||
teleport.header.v1.Metadata metadata = 1;
|
||||
// kind is a resource kind.
|
||||
string kind = 2;
|
||||
// sub_kind is an optional resource sub kind, used in some resources.
|
||||
string sub_kind = 3;
|
||||
// version is version.
|
||||
string version = 4;
|
||||
// Spec is an AuthorizedKey specification.
|
||||
AuthorizedKeySpec spec = 5;
|
||||
}
|
||||
|
||||
// AuthorizedKeySpec is the authorized key spec.
|
||||
message AuthorizedKeySpec {
|
||||
// host_id is the node identifier and must match the credentials used.
|
||||
string host_id = 1;
|
||||
// key_fingerprint is the SHA256 SSH public key fingerprint.
|
||||
string key_fingerprint = 2;
|
||||
// host_user is the user who can be accessed using the fingerprint above.
|
||||
string host_user = 3;
|
||||
// key_comment is the authorized key's comment.
|
||||
// Authorized keys consist of the following space-separated fields:
|
||||
// options, keytype, base64-encoded key, comment. The options field is optional.
|
||||
string key_comment = 4;
|
||||
// key_type is the ssh's key type.
|
||||
string key_type = 5;
|
||||
}
|
||||
Vendored
-67
@@ -1,67 +0,0 @@
|
||||
// Copyright 2024 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.access_graph.v1;
|
||||
|
||||
import "teleport/header/v1/metadata.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/accessgraph/v1;accessgraphv1";
|
||||
|
||||
// The `PrivateKey` message represents a private key entry for a specific local user.
|
||||
// It serves as a reference to a private key located on a user's laptop. Note that it *NEVER* contains the private key itself.
|
||||
// Instead, it stores metadata related to the key, including the fingerprint of the public key, the device trust identifier, and the public key mode.
|
||||
// The Teleport Access Graph uses this metadata to assess whether a particular private key is authorized to access a user on the node without using Teleport.
|
||||
message PrivateKey {
|
||||
// metadata is the PrivateKey's metadata.
|
||||
teleport.header.v1.Metadata metadata = 1;
|
||||
// kind is a resource kind.
|
||||
string kind = 2;
|
||||
// sub_kind is an optional resource sub kind, used in some resources.
|
||||
string sub_kind = 3;
|
||||
// version is version.
|
||||
string version = 4;
|
||||
// Spec is a PrivateKey specification.
|
||||
PrivateKeySpec spec = 5;
|
||||
}
|
||||
|
||||
// PrivateKeySpec is the private key spec.
|
||||
message PrivateKeySpec {
|
||||
// device_id is the device trust identifier of the device that owns the key.
|
||||
string device_id = 1;
|
||||
// public_key_fingerprint is the SHA256 of the SSH public key corresponding to
|
||||
// the private key.
|
||||
string public_key_fingerprint = 2;
|
||||
// public_key_mode is the public key mode.
|
||||
PublicKeyMode public_key_mode = 3;
|
||||
}
|
||||
|
||||
// PublicKeyMode is the mode of the public key.
|
||||
// The public key can be derived from the private key, stored in a separate file, or the private key was password protected
|
||||
// and we could not extract the public key from it or from the file.
|
||||
enum PublicKeyMode {
|
||||
// PUBLIC_KEY_MODE_UNSPECIFIED is an invalid state.
|
||||
PUBLIC_KEY_MODE_UNSPECIFIED = 0;
|
||||
// PUBLIC_KEY_MODE_DERIVED is the state where the public key is derived from the private key.
|
||||
PUBLIC_KEY_MODE_DERIVED = 1;
|
||||
// PUBLIC_KEY_MODE_PUB_FILE is a state where the public key is stored in a separate file from the private key.
|
||||
// The private key is password protected and we could not extract the public key from it.
|
||||
// This mode is used when the private key is password protected and there is a <key>.pub file next to the private key
|
||||
// that contains the public key.
|
||||
PUBLIC_KEY_MODE_PUB_FILE = 2;
|
||||
// PUBLIC_KEY_MODE_PROTECTED is a state where the private key is password protected and we could not extract the public key from it
|
||||
// or from the .pub file.
|
||||
PUBLIC_KEY_MODE_PROTECTED = 3;
|
||||
}
|
||||
Vendored
-101
@@ -1,101 +0,0 @@
|
||||
// Copyright 2024 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.access_graph.v1;
|
||||
|
||||
import "teleport/access_graph/v1/authorized_key.proto";
|
||||
import "teleport/access_graph/v1/private_key.proto";
|
||||
import "teleport/devicetrust/v1/assert.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/accessgraph/v1;accessgraphv1";
|
||||
|
||||
// SecretsScannerService provides methods for Access Graph Secret Scanner functionality.
|
||||
service SecretsScannerService {
|
||||
// ReportAuthorizedKeys is used by Teleport SSH nodes to report authorized keys
|
||||
// that could be used to bypass Teleport.
|
||||
// The client (Teleport SSH Node) should authenticate using the certificate-key pair signed by Teleport HostCA.
|
||||
rpc ReportAuthorizedKeys(stream ReportAuthorizedKeysRequest) returns (stream ReportAuthorizedKeysResponse) {}
|
||||
|
||||
// ReportSecrets is used by trusted devices to report secrets found on the host that could be used to bypass Teleport.
|
||||
// The client (device) should first authenticate using the [ReportSecretsRequest.device_assertion] flow. Please refer to
|
||||
// the [teleport.devicetrust.v1.AssertDeviceRequest] and [teleport.devicetrust.v1.AssertDeviceResponse] messages for more details.
|
||||
//
|
||||
// Once the device is asserted, the client can send the secrets using the [ReportSecretsRequest.private_keys] field
|
||||
// and then close the client side of the stream.
|
||||
//
|
||||
// -> ReportSecrets (client) [1 or more]
|
||||
// -> CloseStream (client)
|
||||
// <- TerminateStream (server)
|
||||
//
|
||||
// Any failure in the assertion ceremony will result in the stream being terminated by the server. All secrets
|
||||
// reported by the client before the assertion terminates will be ignored and result in the stream being terminated.
|
||||
rpc ReportSecrets(stream ReportSecretsRequest) returns (stream ReportSecretsResponse) {}
|
||||
}
|
||||
|
||||
// ReportAuthorizedKeysRequest is used by Teleport nodes to report authorized keys
|
||||
// that could be used to bypass Teleport.
|
||||
message ReportAuthorizedKeysRequest {
|
||||
// keys is a list of authorized keys that could be used to bypass Teleport.
|
||||
repeated teleport.access_graph.v1.AuthorizedKey keys = 1;
|
||||
// operation indicates the operation that the client wants to perform.
|
||||
OperationType operation = 2;
|
||||
}
|
||||
|
||||
// ReportAuthorizedKeysResponse is the response from ReportAuthorizedKeys
|
||||
// RPC method.
|
||||
message ReportAuthorizedKeysResponse {}
|
||||
|
||||
// ReportSecretsRequest is used by trusted devices to report secrets found on the host
|
||||
// that could be used to bypass Teleport.
|
||||
message ReportSecretsRequest {
|
||||
oneof payload {
|
||||
// The device should initiate the device assertion ceremony by sending the
|
||||
// AssertDeviceRequest. Please refer to the [teleport.devicetrust.v1.AssertDeviceRequest]
|
||||
// message for more details.
|
||||
teleport.devicetrust.v1.AssertDeviceRequest device_assertion = 1;
|
||||
// private_keys is a list of private keys that were found on the device.
|
||||
ReportPrivateKeys private_keys = 4;
|
||||
}
|
||||
}
|
||||
|
||||
// ReportPrivateKeys is used by trusted devices to report private keys found on the host
|
||||
// that could be used to bypass Teleport.
|
||||
message ReportPrivateKeys {
|
||||
// keys is a list of private keys that could be used to bypass Teleport.
|
||||
repeated teleport.access_graph.v1.PrivateKey keys = 1;
|
||||
}
|
||||
|
||||
// ReportSecretsResponse is the response from the ReportSecrets
|
||||
// RPC method.
|
||||
message ReportSecretsResponse {
|
||||
oneof payload {
|
||||
// device_assertion is the response from the device assertion ceremony.
|
||||
// Please refer to the [teleport.devicetrust.v1.AssertDeviceResponse]
|
||||
// message for more details
|
||||
teleport.devicetrust.v1.AssertDeviceResponse device_assertion = 1;
|
||||
}
|
||||
}
|
||||
|
||||
// OperationType is an enum that indicates the operation that the client wants to perform.
|
||||
enum OperationType {
|
||||
// OPERATION_TYPE_UNSPECIFIED is an unknown operation.
|
||||
OPERATION_TYPE_UNSPECIFIED = 0;
|
||||
// OPERATION_TYPE_ADD is an operation that indicates that the client wants to add keys to the list.
|
||||
OPERATION_TYPE_ADD = 1;
|
||||
// OPERATION_TYPE_SYNC is an operation that indicates that the client has sent all the keys and
|
||||
// the server can proceed with the analysis.
|
||||
OPERATION_TYPE_SYNC = 2;
|
||||
}
|
||||
-298
@@ -1,298 +0,0 @@
|
||||
// Copyright 2023 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.accesslist.v1;
|
||||
|
||||
import "google/protobuf/duration.proto";
|
||||
import "google/protobuf/timestamp.proto";
|
||||
import "teleport/header/v1/resourceheader.proto";
|
||||
import "teleport/trait/v1/trait.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/accesslist/v1;accesslistv1";
|
||||
|
||||
// AccessList describes the basic building block of access grants, which are
|
||||
// similar to access requests but for longer lived permissions that need to be
|
||||
// regularly audited.
|
||||
message AccessList {
|
||||
// header is the header for the resource.
|
||||
teleport.header.v1.ResourceHeader header = 1;
|
||||
|
||||
// spec is the specification for the Access List.
|
||||
AccessListSpec spec = 2;
|
||||
|
||||
// status contains dynamically calculated fields.
|
||||
AccessListStatus status = 3;
|
||||
}
|
||||
|
||||
// AccessListSpec is the specification for an Access List.
|
||||
message AccessListSpec {
|
||||
reserved 7, 9, 10;
|
||||
reserved "members", "membership", "ownership";
|
||||
|
||||
// description is an optional plaintext description of the Access List.
|
||||
string description = 1;
|
||||
|
||||
// owners is a list of owners of the Access List.
|
||||
repeated AccessListOwner owners = 2;
|
||||
|
||||
// audit describes the frequency that this Access List must be audited.
|
||||
AccessListAudit audit = 3;
|
||||
|
||||
// membership_requires describes the requirements for a user to be a member of
|
||||
// the Access List. For a membership to an Access List to be effective, the
|
||||
// user must meet the requirements of Membership_requires and must be in the
|
||||
// members list.
|
||||
AccessListRequires membership_requires = 4;
|
||||
|
||||
// ownership_requires describes the requirements for a user to be an owner of
|
||||
// the Access List. For ownership of an Access List to be effective, the user
|
||||
// must meet the requirements of ownership_requires and must be in the owners
|
||||
// list.
|
||||
AccessListRequires ownership_requires = 5;
|
||||
|
||||
// grants describes the access granted by membership to this Access List.
|
||||
AccessListGrants grants = 6;
|
||||
|
||||
// title is a plaintext short description of the Access List.
|
||||
string title = 8;
|
||||
|
||||
// owner_grants describes the access granted by owners to this Access List.
|
||||
AccessListGrants owner_grants = 11;
|
||||
}
|
||||
|
||||
// AccessListOwner is an owner of an Access List.
|
||||
message AccessListOwner {
|
||||
// name is the username of the owner.
|
||||
string name = 1;
|
||||
|
||||
// description is the plaintext description of the owner and why they are an
|
||||
// owner.
|
||||
string description = 2;
|
||||
|
||||
// ineligible_status describes if this owner is eligible or not
|
||||
// and if not, describes how they're lacking eligibility.
|
||||
IneligibleStatus ineligible_status = 3;
|
||||
|
||||
// membership_kind describes the type of membership, either
|
||||
// `MEMBERSHIP_KIND_USER` or `MEMBERSHIP_KIND_LIST`.
|
||||
MembershipKind membership_kind = 4;
|
||||
}
|
||||
|
||||
// AccessListAudit describes the audit configuration for an Access List.
|
||||
message AccessListAudit {
|
||||
reserved 1;
|
||||
reserved "frequency";
|
||||
|
||||
// next_audit_date is when the next audit date should be done by.
|
||||
google.protobuf.Timestamp next_audit_date = 2;
|
||||
|
||||
// recurrence is the recurrence definition
|
||||
Recurrence recurrence = 3;
|
||||
|
||||
// notifications is the configuration for notifying users.
|
||||
Notifications notifications = 4;
|
||||
}
|
||||
|
||||
// ReviewFrequency is the frequency of reviews.
|
||||
enum ReviewFrequency {
|
||||
REVIEW_FREQUENCY_UNSPECIFIED = 0;
|
||||
REVIEW_FREQUENCY_ONE_MONTH = 1;
|
||||
REVIEW_FREQUENCY_THREE_MONTHS = 3;
|
||||
REVIEW_FREQUENCY_SIX_MONTHS = 6;
|
||||
REVIEW_FREQUENCY_ONE_YEAR = 12;
|
||||
}
|
||||
|
||||
// ReviewDayOfMonth is the day of month that reviews will repeat on.
|
||||
enum ReviewDayOfMonth {
|
||||
REVIEW_DAY_OF_MONTH_UNSPECIFIED = 0;
|
||||
REVIEW_DAY_OF_MONTH_FIRST = 1;
|
||||
REVIEW_DAY_OF_MONTH_FIFTEENTH = 15;
|
||||
REVIEW_DAY_OF_MONTH_LAST = 31;
|
||||
}
|
||||
|
||||
// Recurrence is the definition for when reviews will be scheduled.
|
||||
message Recurrence {
|
||||
// frequency is the frequency of reviews. This represents the period in months
|
||||
// between two reviews.
|
||||
// Supported values are 0, 1, 3, 6, and 12.
|
||||
ReviewFrequency frequency = 1;
|
||||
|
||||
// day_of_month is the day of month that reviews will be scheduled on.
|
||||
// Supported values are 0, 1, 15, and 31.
|
||||
ReviewDayOfMonth day_of_month = 2;
|
||||
}
|
||||
|
||||
// Notifications contains the configuration for notifying users of a nearing
|
||||
// next audit date.
|
||||
message Notifications {
|
||||
// start specifies when to start notifying users that the next audit date is
|
||||
// coming up.
|
||||
google.protobuf.Duration start = 1;
|
||||
}
|
||||
|
||||
// AccessListRequires describes a requirement section for an Access List. A user
|
||||
// must meet the following criteria to obtain the specific access to the list.
|
||||
message AccessListRequires {
|
||||
// roles are the user roles that must be present for the user to obtain
|
||||
// access.
|
||||
repeated string roles = 1;
|
||||
|
||||
// traits are the traits that must be present for the user to obtain access.
|
||||
repeated teleport.trait.v1.Trait traits = 2;
|
||||
}
|
||||
|
||||
// AccessListGrants describes what access is granted by membership to the Access
|
||||
// List.
|
||||
message AccessListGrants {
|
||||
// roles are the roles that are granted to users who are members of the Access
|
||||
// List.
|
||||
repeated string roles = 1;
|
||||
|
||||
// traits are the traits that are granted to users who are members of the
|
||||
// Access List.
|
||||
repeated teleport.trait.v1.Trait traits = 2;
|
||||
}
|
||||
|
||||
// Member describes a member of an Access List.
|
||||
message Member {
|
||||
// header is the header for the resource.
|
||||
teleport.header.v1.ResourceHeader header = 1;
|
||||
|
||||
// spec is the specification for the Access List member.
|
||||
MemberSpec spec = 2;
|
||||
}
|
||||
|
||||
// MemberSpec is the specification for an Access List member.
|
||||
message MemberSpec {
|
||||
reserved 8;
|
||||
reserved "membership";
|
||||
|
||||
// associated Access List
|
||||
string access_list = 1;
|
||||
|
||||
// name is the name of the member of the Access List.
|
||||
string name = 2;
|
||||
|
||||
// joined is when the user joined the Access List.
|
||||
google.protobuf.Timestamp joined = 3;
|
||||
|
||||
// expires is when the user's membership to the Access List expires.
|
||||
google.protobuf.Timestamp expires = 4;
|
||||
|
||||
// reason is the reason this user was added to the Access List.
|
||||
string reason = 5;
|
||||
|
||||
// added_by is the user that added this user to the Access List.
|
||||
string added_by = 6;
|
||||
|
||||
// ineligible_status describes if this member is eligible or not
|
||||
// and if not, describes how they're lacking eligibility.
|
||||
IneligibleStatus ineligible_status = 7;
|
||||
|
||||
// membership_kind describes the type of membership, either
|
||||
// `MEMBERSHIP_KIND_USER` or `MEMBERSHIP_KIND_LIST`.
|
||||
MembershipKind membership_kind = 9;
|
||||
}
|
||||
|
||||
// MembershipKind represents the different kinds of list membership
|
||||
enum MembershipKind {
|
||||
// MEMBERSHIP_KIND_UNSPECIFIED represents list members that are of
|
||||
// unknown membership kind, defaulting to being treated as type USER
|
||||
MEMBERSHIP_KIND_UNSPECIFIED = 0;
|
||||
// MEMBERSHIP_KIND_USER represents list members that are normal users
|
||||
MEMBERSHIP_KIND_USER = 1;
|
||||
// MEMBERSHIP_KIND_LIST represents list members that are nested Access Lists
|
||||
MEMBERSHIP_KIND_LIST = 2;
|
||||
}
|
||||
|
||||
// IneligibleStatus describes how the user is ineligible.
|
||||
enum IneligibleStatus {
|
||||
// INELIGIBLE_STATUS_UNSPECIFIED means eligiblity is unknown.
|
||||
INELIGIBLE_STATUS_UNSPECIFIED = 0;
|
||||
// INELIGIBLE_STATUS_ELIGIBLE means checks were done and user met all
|
||||
// requirements.
|
||||
INELIGIBLE_STATUS_ELIGIBLE = 1;
|
||||
// INELIGIBLE_STATUS_USER_NOT_EXIST means user was not found in backend.
|
||||
INELIGIBLE_STATUS_USER_NOT_EXIST = 2;
|
||||
// INELIGIBLE_STATUS_MISSING_REQUIREMENTS means user is missing some
|
||||
// requirements defined by AccessListRequires (fields can be either
|
||||
// ownership_requires or membership_requires)
|
||||
INELIGIBLE_STATUS_MISSING_REQUIREMENTS = 3;
|
||||
// INELIGIBLE_STATUS_EXPIRED means user is expired.
|
||||
// Only applicable to members.
|
||||
INELIGIBLE_STATUS_EXPIRED = 4;
|
||||
}
|
||||
|
||||
// Review is a review of an Access List.
|
||||
message Review {
|
||||
// header is the header for the resource.
|
||||
teleport.header.v1.ResourceHeader header = 1;
|
||||
|
||||
// spec is the specification for the Access List review.
|
||||
ReviewSpec spec = 2;
|
||||
}
|
||||
|
||||
// ReviewSpec is the specification for an Access List review.
|
||||
message ReviewSpec {
|
||||
// access_list is the name of the Access List that this review is for.
|
||||
string access_list = 1;
|
||||
|
||||
// reviewers are the users who performed the review.
|
||||
repeated string reviewers = 2;
|
||||
|
||||
// review_date is the date that this review was created.
|
||||
google.protobuf.Timestamp review_date = 3;
|
||||
|
||||
// notes is an optional plaintext attached to the review that can be used by
|
||||
// the review for arbitrary note taking on the review.
|
||||
string notes = 4;
|
||||
|
||||
// changes are the changes made as part of the review.
|
||||
ReviewChanges changes = 5;
|
||||
}
|
||||
|
||||
// ReviewChanges are the changes that were made as part of the review.
|
||||
message ReviewChanges {
|
||||
reserved 1;
|
||||
reserved "frequency_changed";
|
||||
|
||||
// membership_requirements_changed is populated if the requirements were
|
||||
// changed as part of this review.
|
||||
AccessListRequires membership_requirements_changed = 2;
|
||||
|
||||
// removed_members contains the members that were removed as part of this
|
||||
// review.
|
||||
repeated string removed_members = 3;
|
||||
|
||||
// review_frequency_changed is populated if the review frequency has changed.
|
||||
ReviewFrequency review_frequency_changed = 4;
|
||||
|
||||
// review_day_of_month_changed is populated if the review day of month has
|
||||
// changed.
|
||||
ReviewDayOfMonth review_day_of_month_changed = 5;
|
||||
}
|
||||
|
||||
// AccessListStatus contains dynamic fields calculated during retrieval.
|
||||
message AccessListStatus {
|
||||
// member_count is the number of members in the Access List.
|
||||
optional uint32 member_count = 1;
|
||||
// member_list_count is the number of nested list members in the Access List.
|
||||
optional uint32 member_list_count = 2;
|
||||
// owner_of describes Access Lists where this Access List is an explicit owner.
|
||||
repeated string owner_of = 3;
|
||||
// member_of describes Access Lists where this Access List is an explicit member.
|
||||
repeated string member_of = 4;
|
||||
}
|
||||
Vendored
-418
@@ -1,418 +0,0 @@
|
||||
// Copyright 2023 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.accesslist.v1;
|
||||
|
||||
import "google/protobuf/empty.proto";
|
||||
import "google/protobuf/timestamp.proto";
|
||||
import "teleport/accesslist/v1/accesslist.proto";
|
||||
import "teleport/legacy/types/types.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/accesslist/v1;accesslistv1";
|
||||
|
||||
// AccessListService provides CRUD methods for Access List resources.
|
||||
service AccessListService {
|
||||
// GetAccessLists returns a list of all access lists.
|
||||
rpc GetAccessLists(GetAccessListsRequest) returns (GetAccessListsResponse);
|
||||
// ListAccessLists returns a paginated list of all access lists.
|
||||
rpc ListAccessLists(ListAccessListsRequest) returns (ListAccessListsResponse);
|
||||
// GetAccessList returns the specified access list resource.
|
||||
rpc GetAccessList(GetAccessListRequest) returns (AccessList);
|
||||
// UpsertAccessList creates or updates an access list resource.
|
||||
rpc UpsertAccessList(UpsertAccessListRequest) returns (AccessList);
|
||||
// UpdateAccessList updates an access list resource.
|
||||
rpc UpdateAccessList(UpdateAccessListRequest) returns (AccessList);
|
||||
// DeleteAccessList hard deletes the specified access list resource.
|
||||
rpc DeleteAccessList(DeleteAccessListRequest) returns (google.protobuf.Empty);
|
||||
// DeleteAllAccessLists hard deletes all access lists.
|
||||
rpc DeleteAllAccessLists(DeleteAllAccessListsRequest) returns (google.protobuf.Empty);
|
||||
// GetAccessListsToReview will return access lists that need to be reviewed by
|
||||
// the current user.
|
||||
rpc GetAccessListsToReview(GetAccessListsToReviewRequest) returns (GetAccessListsToReviewResponse);
|
||||
|
||||
// CountAccessListMembers returns the count of access list members in an
|
||||
// access list.
|
||||
rpc CountAccessListMembers(CountAccessListMembersRequest) returns (CountAccessListMembersResponse);
|
||||
// ListAccessListMembers returns a paginated list of all access list members.
|
||||
rpc ListAccessListMembers(ListAccessListMembersRequest) returns (ListAccessListMembersResponse);
|
||||
// ListAllAccessListMembers returns a paginated list of all access list
|
||||
// members for all access lists.
|
||||
rpc ListAllAccessListMembers(ListAllAccessListMembersRequest) returns (ListAllAccessListMembersResponse);
|
||||
// GetAccessListMember returns the specified access list member resource.
|
||||
rpc GetAccessListMember(GetAccessListMemberRequest) returns (Member);
|
||||
// GetAccessListOwners returns a list of all owners in an Access List,
|
||||
// including those inherited from nested Access Lists.
|
||||
rpc GetAccessListOwners(GetAccessListOwnersRequest) returns (GetAccessListOwnersResponse);
|
||||
// UpsertAccessListMember creates or updates an access list member resource.
|
||||
rpc UpsertAccessListMember(UpsertAccessListMemberRequest) returns (Member);
|
||||
// UpdateAccessListMember conditionally updates an access list member resource.
|
||||
rpc UpdateAccessListMember(UpdateAccessListMemberRequest) returns (Member);
|
||||
// DeleteAccessListMember hard deletes the specified access list member
|
||||
// resource.
|
||||
rpc DeleteAccessListMember(DeleteAccessListMemberRequest) returns (google.protobuf.Empty);
|
||||
// DeleteAllAccessListMembers hard deletes all access list members for an
|
||||
// access list.
|
||||
rpc DeleteAllAccessListMembersForAccessList(DeleteAllAccessListMembersForAccessListRequest) returns (google.protobuf.Empty);
|
||||
// DeleteAllAccessListMembers hard deletes all access list members for an
|
||||
// access list.
|
||||
rpc DeleteAllAccessListMembers(DeleteAllAccessListMembersRequest) returns (google.protobuf.Empty);
|
||||
|
||||
// UpsertAccessListWithMembers creates or updates an access list with members.
|
||||
rpc UpsertAccessListWithMembers(UpsertAccessListWithMembersRequest) returns (UpsertAccessListWithMembersResponse);
|
||||
|
||||
// ListAccessListReviews will list access list reviews for a particular access
|
||||
// list.
|
||||
rpc ListAccessListReviews(ListAccessListReviewsRequest) returns (ListAccessListReviewsResponse);
|
||||
// ListAllAccessListReviews will list access list reviews for all access
|
||||
// lists.
|
||||
rpc ListAllAccessListReviews(ListAllAccessListReviewsRequest) returns (ListAllAccessListReviewsResponse);
|
||||
// CreateAccessListReview will create a new review for an access list. It will
|
||||
// also modify the original access list and its members depending on the
|
||||
// details of the review.
|
||||
rpc CreateAccessListReview(CreateAccessListReviewRequest) returns (CreateAccessListReviewResponse);
|
||||
// DeleteAccessListReview will delete an access list review from the backend.
|
||||
rpc DeleteAccessListReview(DeleteAccessListReviewRequest) returns (google.protobuf.Empty);
|
||||
|
||||
// AccessRequestPromote promotes an access request to an access list.
|
||||
rpc AccessRequestPromote(AccessRequestPromoteRequest) returns (AccessRequestPromoteResponse);
|
||||
|
||||
// GetSuggestedAccessLists returns suggested access lists for an access
|
||||
// request.
|
||||
rpc GetSuggestedAccessLists(GetSuggestedAccessListsRequest) returns (GetSuggestedAccessListsResponse);
|
||||
|
||||
// GetInheritedGrants returns the inherited grants for an access list.
|
||||
rpc GetInheritedGrants(GetInheritedGrantsRequest) returns (GetInheritedGrantsResponse);
|
||||
}
|
||||
|
||||
// GetAccessListsRequest is the request for getting all access lists.
|
||||
message GetAccessListsRequest {}
|
||||
|
||||
// GetAccessListsResponse is the response for getting all access lists.
|
||||
message GetAccessListsResponse {
|
||||
// access_lists is the list of access lists.
|
||||
repeated AccessList access_lists = 1;
|
||||
}
|
||||
|
||||
// ListAccessListsRequest is the request for getting paginated access lists.
|
||||
message ListAccessListsRequest {
|
||||
// page_size is the size of the page to request.
|
||||
int32 page_size = 1;
|
||||
|
||||
// next_token is the page token.
|
||||
string next_token = 2;
|
||||
}
|
||||
|
||||
// ListAccessListsResponse is the response for getting paginated access lists.
|
||||
message ListAccessListsResponse {
|
||||
// access_lists is the list of access lists.
|
||||
repeated AccessList access_lists = 1;
|
||||
// next_token is the next page token.
|
||||
string next_token = 2;
|
||||
}
|
||||
|
||||
// GetInheritedGrantsRequest is the request for getting inherited grants.
|
||||
message GetInheritedGrantsRequest {
|
||||
// access_list_id is the ID of the access list to retrieve.
|
||||
string access_list_id = 1;
|
||||
}
|
||||
|
||||
// GetInheritedGrantsResponse is the response for getting inherited grants.
|
||||
message GetInheritedGrantsResponse {
|
||||
// grants is the list of inherited member grants.
|
||||
AccessListGrants grants = 1;
|
||||
}
|
||||
|
||||
// GetAccessListRequest is the request for retrieving an access list.
|
||||
message GetAccessListRequest {
|
||||
// name is the name of the access list to retrieve.
|
||||
string name = 1;
|
||||
}
|
||||
|
||||
// UpsertAccessListRequest is the request for upserting an access list.
|
||||
message UpsertAccessListRequest {
|
||||
// access_list is the access list to upsert.
|
||||
AccessList access_list = 1;
|
||||
}
|
||||
|
||||
// UpdateAccessListRequest is the request for updating an access list.
|
||||
message UpdateAccessListRequest {
|
||||
// access_list is the access list to upsert.
|
||||
AccessList access_list = 1;
|
||||
}
|
||||
|
||||
// DeleteAccessListRequest is the request for deleting an access list.
|
||||
message DeleteAccessListRequest {
|
||||
// name is the name of the access list to delete.
|
||||
string name = 1;
|
||||
}
|
||||
|
||||
// DeleteAllAccessListsRequest is the request for deleting all access lists.
|
||||
message DeleteAllAccessListsRequest {}
|
||||
|
||||
// GetAccessListsToReviewRequest is the request for getting access lists that
|
||||
// the current user needs to review.
|
||||
message GetAccessListsToReviewRequest {}
|
||||
|
||||
// GetAccessListsToReviewResponse is the response for getting access lists that
|
||||
// the current user needs to review.
|
||||
message GetAccessListsToReviewResponse {
|
||||
repeated AccessList access_lists = 1;
|
||||
}
|
||||
|
||||
// CountAccessListMembersRequest is the request for counting access list
|
||||
// members.
|
||||
message CountAccessListMembersRequest {
|
||||
// access_list_name is the name of the access list to retrieve.
|
||||
string access_list_name = 1;
|
||||
}
|
||||
|
||||
// CountAccessListMembersResponse is the response for counting access list
|
||||
// members.
|
||||
message CountAccessListMembersResponse {
|
||||
// count is the number of access list members in the access list.
|
||||
uint32 count = 1;
|
||||
// list_count is the number of access list members of type list in the access list.
|
||||
uint32 list_count = 2;
|
||||
}
|
||||
|
||||
// ListAccessListMembersRequest is the request for getting paginated access list
|
||||
// members.
|
||||
message ListAccessListMembersRequest {
|
||||
// page_size is the size of the page to request.
|
||||
int32 page_size = 1;
|
||||
|
||||
// page_token is the page token.
|
||||
string page_token = 2;
|
||||
|
||||
// access_list is the name of the access list that the member belongs to.
|
||||
string access_list = 3;
|
||||
}
|
||||
|
||||
// ListAccessListMembersResponse is the response for getting paginated access
|
||||
// list members.
|
||||
message ListAccessListMembersResponse {
|
||||
// members is the list of access list members.
|
||||
repeated Member members = 1;
|
||||
// next_page_token is the next page token.
|
||||
string next_page_token = 2;
|
||||
}
|
||||
|
||||
// ListAllAccessListMembersRequest is the request for getting paginated access
|
||||
// list members for all access lists.
|
||||
message ListAllAccessListMembersRequest {
|
||||
// page_size is the size of the page to request.
|
||||
int32 page_size = 1;
|
||||
|
||||
// page_token is the page token.
|
||||
string page_token = 2;
|
||||
}
|
||||
|
||||
// ListAllAccessListMembersResponse is the response for getting paginated access
|
||||
// list members for all access lists.
|
||||
message ListAllAccessListMembersResponse {
|
||||
// members is the list of access list members.
|
||||
repeated Member members = 1;
|
||||
// next_page_token is the next page token.
|
||||
string next_page_token = 2;
|
||||
}
|
||||
|
||||
// UpsertAccessListWithMembers is the request for upserting an access list with
|
||||
// members.
|
||||
message UpsertAccessListWithMembersRequest {
|
||||
// access_list is the access list to upsert.
|
||||
AccessList access_list = 1;
|
||||
// members is the list of access list members.
|
||||
repeated Member members = 2;
|
||||
}
|
||||
|
||||
// UpsertAccessListWithMembersResponse is the response for upserting an access
|
||||
// list with members.
|
||||
message UpsertAccessListWithMembersResponse {
|
||||
// access_list is the access list that was upserted.
|
||||
AccessList access_list = 1;
|
||||
// members is the list of access list members that were upserted.
|
||||
repeated Member members = 2;
|
||||
}
|
||||
|
||||
// GetAccessListMemberRequest is the request for retrieving an access list
|
||||
// member.
|
||||
message GetAccessListMemberRequest {
|
||||
// access_list is the name of the access list that the member belongs to.
|
||||
string access_list = 1;
|
||||
|
||||
// member_name is the name of the user that belongs to the access list.
|
||||
string member_name = 2;
|
||||
}
|
||||
|
||||
// GetAccessListOwnersRequest is the request for getting a list of all owners
|
||||
// in an Access List, including those inherited from nested Access Lists.
|
||||
message GetAccessListOwnersRequest {
|
||||
// access_list is the name of the access list.
|
||||
string access_list = 1;
|
||||
}
|
||||
|
||||
// GetAccessListOwnersResponse is the response for getting a list of all
|
||||
// owners in an Access List, including those inherited from nested Access Lists.
|
||||
message GetAccessListOwnersResponse {
|
||||
// owners is the list of all owners in the Access List, including those
|
||||
// inherited from nested Access Lists.
|
||||
repeated accesslist.v1.AccessListOwner owners = 1;
|
||||
}
|
||||
|
||||
// UpsertAccessListMemberRequest is the request for upserting an access list
|
||||
// member.
|
||||
message UpsertAccessListMemberRequest {
|
||||
reserved 1, 2, 3;
|
||||
reserved "access_list", "name", "reason";
|
||||
|
||||
// member is the access list member to upsert.
|
||||
Member member = 4;
|
||||
}
|
||||
|
||||
// UpdateAccessListMemberRequest is the request for updating an access list
|
||||
// member.
|
||||
message UpdateAccessListMemberRequest {
|
||||
// member is the access list member to upsert.
|
||||
Member member = 1;
|
||||
}
|
||||
|
||||
// DeleteAccessListMemberRequest is the request for deleting a member from an
|
||||
// access list.
|
||||
message DeleteAccessListMemberRequest {
|
||||
reserved 2;
|
||||
reserved "name";
|
||||
|
||||
// access_list is the name of access list.
|
||||
string access_list = 1;
|
||||
// member_name is the name of the user to delete.
|
||||
string member_name = 3;
|
||||
}
|
||||
|
||||
// DeleteAllAccessListMembersForAccessListRequest is the request for deleting
|
||||
// all members from an access list.
|
||||
message DeleteAllAccessListMembersForAccessListRequest {
|
||||
// access_list is the name of access list.
|
||||
string access_list = 1;
|
||||
}
|
||||
|
||||
// DeleteAllAccessListMembersRequest is the request for all access list members
|
||||
// in the backend.
|
||||
message DeleteAllAccessListMembersRequest {
|
||||
reserved 1;
|
||||
reserved "access_list";
|
||||
}
|
||||
|
||||
// ListAccessListReviewsRequest is the request for getting paginated access list
|
||||
// reviews for a particular access list.
|
||||
message ListAccessListReviewsRequest {
|
||||
// access_list is the name of the access list that we're listing reviews for.
|
||||
string access_list = 1;
|
||||
|
||||
// page_size is the size of the page to request.
|
||||
int32 page_size = 2;
|
||||
|
||||
// next_token is the page token.
|
||||
string next_token = 3;
|
||||
}
|
||||
|
||||
// ListAccessListReviewsResponse is the response for getting paginated access
|
||||
// list reviews for a particular access list.
|
||||
message ListAccessListReviewsResponse {
|
||||
// reviews is the list of access list reviews.
|
||||
repeated Review reviews = 1;
|
||||
|
||||
// next_token is the next page token.
|
||||
string next_token = 2;
|
||||
}
|
||||
|
||||
// ListAllAccessListReviewsRequest is the request for getting paginated access
|
||||
// list reviews for all access lists.
|
||||
message ListAllAccessListReviewsRequest {
|
||||
// page_size is the size of the page to request.
|
||||
int32 page_size = 1;
|
||||
|
||||
// next_token is the page token.
|
||||
string next_token = 2;
|
||||
}
|
||||
|
||||
// ListAllAccessListReviewsResponse is the response for getting paginated access
|
||||
// list reviews for all access lists.
|
||||
message ListAllAccessListReviewsResponse {
|
||||
// reviews is the list of access list reviews.
|
||||
repeated Review reviews = 1;
|
||||
|
||||
// next_token is the next page token.
|
||||
string next_token = 2;
|
||||
}
|
||||
|
||||
// CreateAccessListReviewRequest is the request for creating an access list
|
||||
// review.
|
||||
message CreateAccessListReviewRequest {
|
||||
// review is the actual review to create.
|
||||
Review review = 1;
|
||||
}
|
||||
|
||||
// CreateAccessListReviewResponse is the response for creating an access list
|
||||
// review.
|
||||
message CreateAccessListReviewResponse {
|
||||
// review_name is the name of the review that was just created.
|
||||
string review_name = 1;
|
||||
|
||||
// next_audit_date is when the next audit should be done by.
|
||||
google.protobuf.Timestamp next_audit_date = 2;
|
||||
}
|
||||
|
||||
// DeleteAccessListReviewRequest is the request for deleting an access list
|
||||
// review.
|
||||
message DeleteAccessListReviewRequest {
|
||||
// review_name is the name of the review to delete.
|
||||
string review_name = 1;
|
||||
|
||||
// access_list_name is the name of the access list to delete the review from.
|
||||
string access_list_name = 2;
|
||||
}
|
||||
|
||||
// AccessRequestPromoteRequest is the request for promoting an access request to
|
||||
// an access list.
|
||||
message AccessRequestPromoteRequest {
|
||||
// RequestID is the unique ID of the request to be promoted.
|
||||
string request_id = 1;
|
||||
// AccessListName is the name of the access list to promote the request to.
|
||||
string access_list_name = 2;
|
||||
// Reason is the access request review reason.
|
||||
string reason = 3;
|
||||
}
|
||||
|
||||
// AccessRequestPromoteResponse is the response for promoting an access request
|
||||
// to an access list.
|
||||
message AccessRequestPromoteResponse {
|
||||
// AccessRequest is the updated access request.
|
||||
types.AccessRequestV3 access_request = 1;
|
||||
}
|
||||
|
||||
// GetSuggestedAccessListsRequest is the request for suggested access lists for
|
||||
// an access request.
|
||||
message GetSuggestedAccessListsRequest {
|
||||
// access_request_id is the unique ID of the request.
|
||||
string access_request_id = 1;
|
||||
}
|
||||
|
||||
// GetSuggestedAccessListsResponse is the response for suggested access lists
|
||||
// for an access request.
|
||||
message GetSuggestedAccessListsResponse {
|
||||
// access_lists is the list of suggested lists.
|
||||
repeated AccessList access_lists = 1;
|
||||
}
|
||||
-166
@@ -1,166 +0,0 @@
|
||||
// Copyright 2024 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.accessmonitoringrules.v1;
|
||||
|
||||
import "teleport/header/v1/metadata.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/accessmonitoringrules/v1;accessmonitoringrulesv1";
|
||||
|
||||
// AccessMonitoringRule represents an access monitoring rule resources.
|
||||
message AccessMonitoringRule {
|
||||
// metadata is the rules's metadata.
|
||||
teleport.header.v1.Metadata metadata = 1;
|
||||
// kind is a resource kind
|
||||
string kind = 2;
|
||||
// sub_kind is an optional resource sub kind, used in some resources
|
||||
string sub_kind = 3;
|
||||
// version is version
|
||||
string version = 4;
|
||||
// Spec is an AccessMonitoringRule specification
|
||||
AccessMonitoringRuleSpec spec = 5;
|
||||
}
|
||||
|
||||
// AccessMonitoringRuleSpec is the access monitoring rule spec
|
||||
message AccessMonitoringRuleSpec {
|
||||
// subjects the rule operates on, can be a resource kind or a particular resource property.
|
||||
repeated string subjects = 1;
|
||||
// states are the desired state which the monitoring rule is attempting to bring the subjects matching the condition to.
|
||||
repeated string states = 2;
|
||||
// condition is a predicate expression that operates on the specified subject resources,
|
||||
// and determines whether the subject will be moved into desired state.
|
||||
string condition = 3;
|
||||
// notification defines the plugin configuration for notifications if rule is triggered.
|
||||
// Both notification and automatic_review may be set within the same
|
||||
// access_monitoring_rule. If both fields are set, the rule will trigger
|
||||
// both notifications and automatic reviews for the same set of access events.
|
||||
// Separate plugins may be used if both notifications and automatic_reviews is
|
||||
// set.
|
||||
Notification notification = 4;
|
||||
|
||||
// automatic_approval has been replaced by automatic_review.
|
||||
reserved 5;
|
||||
reserved "automatic_approval";
|
||||
|
||||
// automatic_review defines automatic review configurations for access requests.
|
||||
// Both notification and automatic_review may be set within the same
|
||||
// access_monitoring_rule. If both fields are set, the rule will trigger
|
||||
// both notifications and automatic reviews for the same set of access events.
|
||||
// Separate plugins may be used if both notifications and automatic_reviews is
|
||||
// set.
|
||||
AutomaticReview automatic_review = 6;
|
||||
|
||||
// desired_state defines the desired state of the subject. For access request
|
||||
// subjects, the desired_state may be set to `reviewed` to indicate that the
|
||||
// access request should be automatically reviewed.
|
||||
string desired_state = 7;
|
||||
}
|
||||
|
||||
// Notification contains configurations for plugin notification rules.
|
||||
message Notification {
|
||||
// name is the name of the plugin to which this configuration should apply.
|
||||
string name = 1;
|
||||
// recipients is the list of recipients the plugin should notify.
|
||||
repeated string recipients = 2;
|
||||
}
|
||||
|
||||
// AutomaticReview contains configurations for automatic review rules.
|
||||
message AutomaticReview {
|
||||
// integration is the name of the integration that is responsible for monitoring
|
||||
// the rule. Set this value to `builtin` to monitor the rule with Teleport.
|
||||
string integration = 1;
|
||||
// decision specifies the proposed state of the access review. This can be
|
||||
// either 'approved' or 'denied'.
|
||||
string decision = 2;
|
||||
}
|
||||
|
||||
// CreateAccessMonitoringRuleRequest is the request for CreateAccessMonitoringRule.
|
||||
message CreateAccessMonitoringRuleRequest {
|
||||
// access_monitoring_rule is the specification of the rule to be created.
|
||||
AccessMonitoringRule rule = 1;
|
||||
}
|
||||
|
||||
// UpdateAccessMonitoringRuleRequest is the request for UpdateAccessMonitoringRule.
|
||||
message UpdateAccessMonitoringRuleRequest {
|
||||
// access_monitoring_rule is the specification of the rule to be updated.
|
||||
AccessMonitoringRule rule = 1;
|
||||
}
|
||||
|
||||
// UpsertAccessMonitoringRuleRequest is the request for UpsertAccessMonitoringRule.
|
||||
message UpsertAccessMonitoringRuleRequest {
|
||||
// access_monitoring_rule is the specification of the rule to be upserted.
|
||||
AccessMonitoringRule rule = 1;
|
||||
}
|
||||
|
||||
// GetAccessMonitoringRuleRequest is the request for GetAccessMonitoringRule.
|
||||
message GetAccessMonitoringRuleRequest {
|
||||
// resource_name is the name of the rule to be returned.
|
||||
string name = 1;
|
||||
}
|
||||
|
||||
// DeleteAccessMonitoringRuleRequest is the request for DeleteAccessMonitoringRule.
|
||||
message DeleteAccessMonitoringRuleRequest {
|
||||
// resource_name is the name of the rule to be removed.
|
||||
string name = 1;
|
||||
}
|
||||
|
||||
// ListAccessMonitoringRulesRequest is the request for ListAccessMonitoringRules.
|
||||
message ListAccessMonitoringRulesRequest {
|
||||
// page_size is the maximum number of items to return.
|
||||
// The server may impose a different page size at its discretion.
|
||||
int64 page_size = 1;
|
||||
// page_token is the next_page_token value returned from a previous List request, if any.
|
||||
string page_token = 2;
|
||||
}
|
||||
|
||||
// ListAccessMonitoringRulesWithFilterRequest is the request for ListAccessMonitoringRulesWithFilter.
|
||||
message ListAccessMonitoringRulesWithFilterRequest {
|
||||
// page_size is the maximum number of items to return.
|
||||
// The server may impose a different page size at its discretion.
|
||||
int64 page_size = 1;
|
||||
// page_token is the next_page_token value returned from a previous List request, if any.
|
||||
string page_token = 2;
|
||||
// subjects are the subjects the access monitoring rules must have. This field is optional.
|
||||
repeated string subjects = 3;
|
||||
// notification_name is the value of the notification name field the rule must have. This field is optional.
|
||||
string notification_name = 4;
|
||||
|
||||
// automatic_approval_name is replaced by automatic_review_name.
|
||||
reserved 5;
|
||||
reserved "automatic_approval_name";
|
||||
|
||||
// automatic_review_name is the value of the automatic_review integration field
|
||||
// the rule must have. This field is optional.
|
||||
string automatic_review_name = 6;
|
||||
}
|
||||
|
||||
// ListAccessMonitoringRulesResponse is the response from ListAccessMonitoringRules.
|
||||
message ListAccessMonitoringRulesResponse {
|
||||
// The page of AccessMonitoringRule that matched the request.
|
||||
repeated AccessMonitoringRule rules = 1;
|
||||
// Token to retrieve the next page of results, or empty if there are no
|
||||
// more results in the list.
|
||||
string next_page_token = 2;
|
||||
}
|
||||
|
||||
// ListAccessMonitoringRulesWithFilterResponse is the response from ListAccessMonitoringRulesWithFilter.
|
||||
message ListAccessMonitoringRulesWithFilterResponse {
|
||||
// The page of AccessMonitoringRule that matched the request.
|
||||
repeated AccessMonitoringRule rules = 1;
|
||||
// Token to retrieve the next page of results, or empty if there are no
|
||||
// more results in the list.
|
||||
string next_page_token = 2;
|
||||
}
|
||||
-46
@@ -1,46 +0,0 @@
|
||||
// Copyright 2024 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.accessmonitoringrules.v1;
|
||||
|
||||
import "google/protobuf/empty.proto";
|
||||
import "teleport/accessmonitoringrules/v1/access_monitoring_rules.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/accessmonitoringrules/v1;accessmonitoringrulesv1";
|
||||
|
||||
// AccessMonitoringRulesService provides CRUD methods for Access Monitoring Rules resources.
|
||||
service AccessMonitoringRulesService {
|
||||
// CreateAccessMonitoringRule creates the specified access monitoring rule.
|
||||
rpc CreateAccessMonitoringRule(CreateAccessMonitoringRuleRequest) returns (AccessMonitoringRule);
|
||||
|
||||
// UpdateAccessMonitoringRule updates the specified access monitoring rule.
|
||||
rpc UpdateAccessMonitoringRule(UpdateAccessMonitoringRuleRequest) returns (AccessMonitoringRule);
|
||||
|
||||
// UpsertAccessMonitoringRule upserts the specified access monitoring rule.
|
||||
rpc UpsertAccessMonitoringRule(UpsertAccessMonitoringRuleRequest) returns (AccessMonitoringRule);
|
||||
|
||||
// GetAccessMonitoringRule gets the specified access monitoring rule.
|
||||
rpc GetAccessMonitoringRule(GetAccessMonitoringRuleRequest) returns (AccessMonitoringRule);
|
||||
|
||||
// DeleteAccessMonitoringRule deletes the specified access monitoring rule.
|
||||
rpc DeleteAccessMonitoringRule(DeleteAccessMonitoringRuleRequest) returns (google.protobuf.Empty);
|
||||
|
||||
// ListAccessMonitoringRules lists current access monitoring rules.
|
||||
rpc ListAccessMonitoringRules(ListAccessMonitoringRulesRequest) returns (ListAccessMonitoringRulesResponse);
|
||||
|
||||
// ListAccessMonitoringRulesWithFilter lists current access monitoring rules that match the provided filter.
|
||||
rpc ListAccessMonitoringRulesWithFilter(ListAccessMonitoringRulesWithFilterRequest) returns (ListAccessMonitoringRulesWithFilterResponse);
|
||||
}
|
||||
-37
@@ -1,37 +0,0 @@
|
||||
// Copyright 2022 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.attestation.v1;
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/attestation/v1;attestationv1";
|
||||
|
||||
// AttestationStatement is an attestation statement for a hardware private key.
|
||||
message AttestationStatement {
|
||||
oneof attestation_statement {
|
||||
// yubikey_attestation_statement is an attestation statement for a specific YubiKey PIV slot.
|
||||
YubiKeyAttestationStatement yubikey_attestation_statement = 1;
|
||||
}
|
||||
}
|
||||
|
||||
// YubiKeyAttestationStatement is an attestation statement for a specific YubiKey PIV slot.
|
||||
message YubiKeyAttestationStatement {
|
||||
// slot_cert is an attestation certificate generated from a YubiKey PIV
|
||||
// slot's public key and signed by the YubiKey's attestation certificate.
|
||||
bytes slot_cert = 1;
|
||||
|
||||
// attestation_cert is the YubiKey's unique attestation certificate, signed by a Yubico CA.
|
||||
bytes attestation_cert = 2;
|
||||
}
|
||||
-131
@@ -1,131 +0,0 @@
|
||||
// Copyright 2023 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.auditlog.v1;
|
||||
|
||||
import "google/protobuf/struct.proto";
|
||||
import "google/protobuf/timestamp.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/auditlog/v1;auditlogv1";
|
||||
|
||||
// AuditLogService provides methods to access audit log.
|
||||
service AuditLogService {
|
||||
// StreamUnstructuredSessionEvents streams audit events from a given session recording in an unstructured format.
|
||||
// This endpoint is used by the event handler to retrieve the session events as JSON.
|
||||
rpc StreamUnstructuredSessionEvents(StreamUnstructuredSessionEventsRequest) returns (stream EventUnstructured);
|
||||
// GetUnstructuredEvents gets events from the audit log in an unstructured format.
|
||||
// This endpoint is used by the event handler to retrieve the events as JSON.
|
||||
rpc GetUnstructuredEvents(GetUnstructuredEventsRequest) returns (EventsUnstructured);
|
||||
// ExportUnstructuredEvents exports events from a given event chunk returned by GetEventExportChunks. This API prioritizes
|
||||
// performance over ordering and filtering, and is intended for bulk export of events.
|
||||
rpc ExportUnstructuredEvents(ExportUnstructuredEventsRequest) returns (stream ExportEventUnstructured);
|
||||
// GetEventExportChunks returns a stream of event chunks that can be exported via ExportUnstructuredEvents. The returned
|
||||
// list isn't ordered and polling for new chunks requires re-consuming the entire stream from the beginning.
|
||||
rpc GetEventExportChunks(GetEventExportChunksRequest) returns (stream EventExportChunk);
|
||||
}
|
||||
|
||||
// StreamUnstructuredSessionEventsRequest is a request containing data needed to fetch a session recording.
|
||||
message StreamUnstructuredSessionEventsRequest {
|
||||
// session_id is the ID for a given session in an UUIDv4 format.
|
||||
string session_id = 1;
|
||||
// start_index is the index of the event to resume the stream after.
|
||||
// A start_index of 0 creates a new stream.
|
||||
int32 start_index = 2;
|
||||
}
|
||||
|
||||
// Order controls the ordering of objects returned based on the timestamp field.
|
||||
enum Order {
|
||||
ORDER_DESCENDING_UNSPECIFIED = 0;
|
||||
ORDER_ASCENDING = 1;
|
||||
}
|
||||
|
||||
// GetUnstructuredEventsRequest is a request with the needed data to fetch events.
|
||||
message GetUnstructuredEventsRequest {
|
||||
// namespace, if not set, defaults to 'default'.
|
||||
string namespace = 1;
|
||||
// start_date is the oldest date of returned events.
|
||||
google.protobuf.Timestamp start_date = 2;
|
||||
// end_date is the newest date of returned events.
|
||||
google.protobuf.Timestamp end_date = 3;
|
||||
// event_types is optional, if not set, returns all events.
|
||||
repeated string event_types = 4;
|
||||
// limit is the maximum amount of events returned.
|
||||
int32 limit = 5;
|
||||
// start_key is used to resume a query in order to enable pagination.
|
||||
// If the previous response had LastKey set then this should be
|
||||
// set to its value. Otherwise leave empty.
|
||||
string start_key = 6;
|
||||
// order specifies an ascending or descending order of events.
|
||||
// A value of 0 means a descending order and a value of 1 means an ascending order.
|
||||
Order order = 7;
|
||||
}
|
||||
|
||||
// EventsUnstructured represents a list of events.AuditEvent in an unstructured format.
|
||||
message EventsUnstructured {
|
||||
// items is a list of unstructured formatted audit events.
|
||||
repeated EventUnstructured items = 1;
|
||||
// last_key is the key of the last event if the returned set did not contain all events found i.e limit <
|
||||
// actual amount. this is the key clients can supply in another API request to continue fetching
|
||||
// events from the previous last position.
|
||||
string last_key = 2;
|
||||
}
|
||||
|
||||
// ExportUnstructuredEventsRequest is a request with the needed data to export events.
|
||||
message ExportUnstructuredEventsRequest {
|
||||
// date is the target date from which to export events. note that only the UTC date of the
|
||||
// timestamp value is used. use of a specific local timestamp may produce confusing results.
|
||||
google.protobuf.Timestamp date = 1;
|
||||
// chunk is the chunk to export events from.
|
||||
string chunk = 2;
|
||||
// cursor is an optional mechanism to resume interrupted streams for a given chunk.
|
||||
string cursor = 3;
|
||||
}
|
||||
|
||||
// ExportEventUnstructured is the stream item of the ExportUnstructuredEvents method.
|
||||
message ExportEventUnstructured {
|
||||
// event is the unstructured representation of the event payload.
|
||||
EventUnstructured event = 1;
|
||||
// cursor is the cursor to resume the stream after this point.
|
||||
string cursor = 2;
|
||||
}
|
||||
|
||||
// EventUnstructured represents a single events.AuditEvent in an unstructured format.
|
||||
message EventUnstructured {
|
||||
// type is the type of the event.
|
||||
string type = 1;
|
||||
// id is the unique ID of the event.
|
||||
// If the underlying event defines an ID, it will be used, otherwise
|
||||
// it is a SHA256 hash of the event payload.
|
||||
string id = 2;
|
||||
// time is the time when the event was generated.
|
||||
google.protobuf.Timestamp time = 3;
|
||||
// index is the index of the event.
|
||||
int64 index = 4;
|
||||
// unstructured is the unstructured representation of the event payload.
|
||||
google.protobuf.Struct unstructured = 5;
|
||||
}
|
||||
|
||||
// GetEventExportChunksRequest is used to request the next set of event chunks to export.
|
||||
message GetEventExportChunksRequest {
|
||||
// date is the date for which to list export shards.
|
||||
google.protobuf.Timestamp date = 1;
|
||||
}
|
||||
|
||||
// EventExportChunk represents a chunk of events to export.
|
||||
message EventExportChunk {
|
||||
// chunk is the chunk to export.
|
||||
string chunk = 1;
|
||||
}
|
||||
-250
@@ -1,250 +0,0 @@
|
||||
// Copyright 2024 Gravitational, Inc.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.autoupdate.v1;
|
||||
|
||||
import "google/protobuf/duration.proto";
|
||||
import "google/protobuf/timestamp.proto";
|
||||
import "teleport/header/v1/metadata.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/autoupdate/v1;autoupdate";
|
||||
|
||||
// AutoUpdateConfig is a config singleton used to configure cluster
|
||||
// autoupdate settings.
|
||||
message AutoUpdateConfig {
|
||||
string kind = 1;
|
||||
string sub_kind = 2;
|
||||
string version = 3;
|
||||
teleport.header.v1.Metadata metadata = 4;
|
||||
|
||||
AutoUpdateConfigSpec spec = 5;
|
||||
}
|
||||
|
||||
// AutoUpdateConfigSpec encodes the parameters of the autoupdate config object.
|
||||
message AutoUpdateConfigSpec {
|
||||
reserved 1;
|
||||
reserved "tools_autoupdate"; // ToolsAutoupdate is replaced by tools.mode.
|
||||
AutoUpdateConfigSpecTools tools = 2;
|
||||
AutoUpdateConfigSpecAgents agents = 3;
|
||||
}
|
||||
|
||||
// AutoUpdateConfigSpecTools encodes the parameters for client tools auto updates.
|
||||
message AutoUpdateConfigSpecTools {
|
||||
// Mode defines state of the client tools auto update.
|
||||
string mode = 1;
|
||||
}
|
||||
|
||||
// AutoUpdateConfigSpecAgents encodes the parameters of automatic agent updates.
|
||||
message AutoUpdateConfigSpecAgents {
|
||||
reserved 5;
|
||||
reserved "agent_schedules";
|
||||
// mode specifies whether agent autoupdates are enabled, disabled, or paused.
|
||||
string mode = 1;
|
||||
// strategy to use for updating the agents.
|
||||
string strategy = 2;
|
||||
// maintenance_window_duration is the maintenance window duration. This can only be set if `strategy` is "time-based".
|
||||
// Once the window is over, the group transitions to the done state. Existing agents won't be updated until the next
|
||||
// maintenance window.
|
||||
google.protobuf.Duration maintenance_window_duration = 3;
|
||||
// schedules specifies schedules for updates of grouped agents.
|
||||
AgentAutoUpdateSchedules schedules = 6;
|
||||
}
|
||||
|
||||
// AgentAutoUpdateSchedules specifies update scheduled for grouped agents.
|
||||
message AgentAutoUpdateSchedules {
|
||||
// regular schedules for non-critical versions.
|
||||
repeated AgentAutoUpdateGroup regular = 1;
|
||||
}
|
||||
|
||||
// AgentAutoUpdateGroup specifies the update schedule for a group of agents.
|
||||
message AgentAutoUpdateGroup {
|
||||
reserved 4;
|
||||
reserved "wait_days";
|
||||
|
||||
// name of the group
|
||||
string name = 1;
|
||||
// days when the update can run. Supported values are "Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun" and "*"
|
||||
repeated string days = 2;
|
||||
// start_hour to initiate update
|
||||
int32 start_hour = 3;
|
||||
// wait_hours after last group succeeds before this group can run. This can only be used when the strategy is "halt-on-failure".
|
||||
// This field must be positive.
|
||||
int32 wait_hours = 5;
|
||||
}
|
||||
|
||||
// AutoUpdateVersion is a resource singleton with version required for
|
||||
// tools autoupdate.
|
||||
message AutoUpdateVersion {
|
||||
string kind = 1;
|
||||
string sub_kind = 2;
|
||||
string version = 3;
|
||||
teleport.header.v1.Metadata metadata = 4;
|
||||
|
||||
AutoUpdateVersionSpec spec = 5;
|
||||
}
|
||||
|
||||
// AutoUpdateVersionSpec encodes the parameters of the autoupdate versions.
|
||||
message AutoUpdateVersionSpec {
|
||||
reserved 1;
|
||||
reserved "tools_version"; // ToolsVersion is replaced by tools.target_version.
|
||||
AutoUpdateVersionSpecTools tools = 2;
|
||||
AutoUpdateVersionSpecAgents agents = 3;
|
||||
}
|
||||
|
||||
// AutoUpdateVersionSpecTools encodes the parameters for client tools auto updates.
|
||||
message AutoUpdateVersionSpecTools {
|
||||
// TargetVersion specifies the semantic version required for tools to establish a connection with the cluster.
|
||||
// Client tools after connection to the cluster going to be updated to this version automatically.
|
||||
string target_version = 1;
|
||||
}
|
||||
|
||||
// AutoUpdateVersionSpecAgents is the spec for the autoupdate version.
|
||||
message AutoUpdateVersionSpecAgents {
|
||||
// start_version is the version to update from.
|
||||
string start_version = 1;
|
||||
// target_version is the version to update to.
|
||||
string target_version = 2;
|
||||
// schedule to use for the rollout
|
||||
string schedule = 3;
|
||||
// autoupdate_mode to use for the rollout
|
||||
string mode = 4;
|
||||
}
|
||||
|
||||
// AutoUpdateAgentRollout is the resource the Teleport Auth Service uses to track and control the rollout of a new
|
||||
// agent version. This resource is written by the automatic agent update controller in the Teleport Auth Service
|
||||
// and read by the Teleport Proxy Service.
|
||||
message AutoUpdateAgentRollout {
|
||||
string kind = 1;
|
||||
string sub_kind = 2;
|
||||
string version = 3;
|
||||
teleport.header.v1.Metadata metadata = 4;
|
||||
AutoUpdateAgentRolloutSpec spec = 5;
|
||||
AutoUpdateAgentRolloutStatus status = 6;
|
||||
}
|
||||
|
||||
// AutoUpdateAgentRolloutSpec describes the desired agent rollout.
|
||||
// This is built by merging the user-provided AutoUpdateConfigSpecAgents and the operator-provided
|
||||
// AutoUpdateVersionSpecAgents.
|
||||
message AutoUpdateAgentRolloutSpec {
|
||||
// start_version is the version to update from.
|
||||
string start_version = 1;
|
||||
// target_version is the version to update to.
|
||||
string target_version = 2;
|
||||
// schedule to use for the rollout. Supported values are "regular" and "immediate".
|
||||
// - "regular" follows the regular group schedule
|
||||
// - "immediate" updates all the agents immediately
|
||||
string schedule = 3;
|
||||
// autoupdate_mode to use for the rollout. Supported modes are:
|
||||
// - "enabled": Teleport will update existing agents.
|
||||
// - "disabled": Teleport will not update existing agents.
|
||||
// - "suspended": Teleport will temporarily stop updating existing agents.
|
||||
string autoupdate_mode = 4;
|
||||
// strategy to use for updating the agents. Supported strategies are:
|
||||
// - "time-based": agents update as soon as their maintenance window starts. There is no dependency between groups.
|
||||
// This strategy allows Teleport users to setup reliable follow-the-sun updates and enforce the maintenance window
|
||||
// more strictly. A group finishes its update at the end of the maintenance window, regardless of the new version
|
||||
// adoption rate. Agents that missed the maintenance window will not attempt to update until the next maintenance
|
||||
// window.
|
||||
// - "halt-on-failure": the update proceeds from the first group to the last group, ensuring that each group
|
||||
// successfully updates before allowing the next group to proceed. This is the strategy that offers the best
|
||||
// availability. A group finishes its update once most of its agents are running the correct version. Agents that
|
||||
// missed the group update will try to catch back as soon as possible.
|
||||
string strategy = 5;
|
||||
// maintenance_window_duration is the maintenance window duration. This can only be set if `strategy` is "time-based".
|
||||
// Once the window is over, the group transitions to the done state. Existing agents won't be updated until the next
|
||||
// maintenance window.
|
||||
google.protobuf.Duration maintenance_window_duration = 6;
|
||||
}
|
||||
|
||||
// AutoUpdateAgentRolloutStatus tracks the current agent rollout status.
|
||||
// The status is reset if any spec field changes except the mode.
|
||||
message AutoUpdateAgentRolloutStatus {
|
||||
repeated AutoUpdateAgentRolloutStatusGroup groups = 1;
|
||||
AutoUpdateAgentRolloutState state = 2;
|
||||
// The start time is set when the rollout is created or reset. Usually this is caused by a version change.
|
||||
// The timestamp allows the controller to detect that the rollout just changed.
|
||||
// The controller will not start any group that should have been active before the start_time to avoid a double-update
|
||||
// effect.
|
||||
// For example, a group updates every day between 13:00 and 14:00. If the target version changes to 13:30, the group
|
||||
// will not start updating to the new version directly. The controller sees that the group theoretical start time is
|
||||
// before the rollout start time and the maintenance window belongs to the previous rollout.
|
||||
// When the timestamp is nil, the controller will ignore the start time and check and allow groups to activate.
|
||||
google.protobuf.Timestamp start_time = 3;
|
||||
|
||||
// Time override is an optional timestamp making the autoupdate_agent_rollout controller use a specific time instead
|
||||
// of the system clock when evaluating time-based criteria. This field is used for testing and troubleshooting
|
||||
// purposes.
|
||||
google.protobuf.Timestamp time_override = 4;
|
||||
}
|
||||
|
||||
// AutoUpdateAgentRolloutStatusGroup tracks the current agent rollout status of a specific group.
|
||||
message AutoUpdateAgentRolloutStatusGroup {
|
||||
reserved 8;
|
||||
reserved "config_wait_days";
|
||||
|
||||
// name of the group
|
||||
string name = 1;
|
||||
// start_time of the rollout
|
||||
google.protobuf.Timestamp start_time = 2;
|
||||
// state is the current state of the rollout.
|
||||
AutoUpdateAgentGroupState state = 3;
|
||||
// last_update_time is the time of the previous update for this group.
|
||||
google.protobuf.Timestamp last_update_time = 4;
|
||||
// last_update_reason is the trigger for the last update
|
||||
string last_update_reason = 5;
|
||||
// config_days when the update can run. Supported values are "Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun" and "*"
|
||||
repeated string config_days = 6;
|
||||
// config_start_hour to initiate update
|
||||
int32 config_start_hour = 7;
|
||||
// config_wait_hours after last group succeeds before this group can run. This can only be used when the strategy is "halt-on-failure".
|
||||
// This field must be positive.
|
||||
int32 config_wait_hours = 9;
|
||||
}
|
||||
|
||||
// AutoUpdateAgentGroupState represents the agent group state. This state controls whether the agents from this group
|
||||
// should install the start version, the target version, and if they should update immediately or wait.
|
||||
enum AutoUpdateAgentGroupState {
|
||||
// AUTO_UPDATE_AGENT_GROUP_STATE_UNSPECIFIED state
|
||||
AUTO_UPDATE_AGENT_GROUP_STATE_UNSPECIFIED = 0;
|
||||
// AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED represents that the group update has not been started yet.
|
||||
AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED = 1;
|
||||
// AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE represents that the group is actively getting updated.
|
||||
// New agents should run v2, existing agents are instructed to update to v2.
|
||||
AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE = 2;
|
||||
// AUTO_UPDATE_AGENT_GROUP_STATE_DONE represents that the group has been updated. New agents should run v2.
|
||||
AUTO_UPDATE_AGENT_GROUP_STATE_DONE = 3;
|
||||
// AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK represents that the group has been rolled back.
|
||||
// New agents should run v1, existing agents should update to v1.
|
||||
AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK = 4;
|
||||
}
|
||||
|
||||
// AutoUpdateAgentRolloutState represents the rollout state. This tells if Teleport started updating agents from the
|
||||
// start version to the target version, if the update is done, still in progress
|
||||
// or if the rollout was manually reverted.
|
||||
enum AutoUpdateAgentRolloutState {
|
||||
// AUTO_UPDATE_AGENT_ROLLOUT_STATE_UNSPECIFIED state
|
||||
AUTO_UPDATE_AGENT_ROLLOUT_STATE_UNSPECIFIED = 0;
|
||||
// AUTO_UPDATE_AGENT_ROLLOUT_STATE_UNSTARTED represents that no group in the rollout has been started yet.
|
||||
AUTO_UPDATE_AGENT_ROLLOUT_STATE_UNSTARTED = 1;
|
||||
// AUTO_UPDATE_AGENT_ROLLOUT_STATE_ACTIVE represents that at least one group of the rollout has started.
|
||||
// If every group is finished, the state will be AUTO_UPDATE_AGENT_ROLLOUT_STATE_DONE.
|
||||
AUTO_UPDATE_AGENT_ROLLOUT_STATE_ACTIVE = 2;
|
||||
// AUTO_UPDATE_AGENT_ROLLOUT_STATE_DONE represents that every group is in the DONE state, or has been in the done
|
||||
// state (groups might become active again in time-based strategy).
|
||||
AUTO_UPDATE_AGENT_ROLLOUT_STATE_DONE = 3;
|
||||
// AUTO_UPDATE_AGENT_ROLLOUT_STATE_ROLLEDBACK represents that at least one group is in the rolledback state.
|
||||
AUTO_UPDATE_AGENT_ROLLOUT_STATE_ROLLEDBACK = 4;
|
||||
}
|
||||
Vendored
-172
@@ -1,172 +0,0 @@
|
||||
// Copyright 2024 Gravitational, Inc.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.autoupdate.v1;
|
||||
|
||||
import "google/protobuf/empty.proto";
|
||||
import "teleport/autoupdate/v1/autoupdate.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/autoupdate/v1;autoupdate";
|
||||
|
||||
// AutoUpdateService provides an API to manage autoupdates.
|
||||
service AutoUpdateService {
|
||||
// GetAutoUpdateConfig gets the current autoupdate config singleton.
|
||||
rpc GetAutoUpdateConfig(GetAutoUpdateConfigRequest) returns (AutoUpdateConfig);
|
||||
|
||||
// CreateAutoUpdateConfig creates a new AutoUpdateConfig.
|
||||
rpc CreateAutoUpdateConfig(CreateAutoUpdateConfigRequest) returns (AutoUpdateConfig);
|
||||
|
||||
// CreateAutoUpdateConfig updates AutoUpdateConfig singleton.
|
||||
rpc UpdateAutoUpdateConfig(UpdateAutoUpdateConfigRequest) returns (AutoUpdateConfig);
|
||||
|
||||
// UpsertAutoUpdateConfig creates a new AutoUpdateConfig or replaces an existing AutoUpdateConfig.
|
||||
rpc UpsertAutoUpdateConfig(UpsertAutoUpdateConfigRequest) returns (AutoUpdateConfig);
|
||||
|
||||
// DeleteAutoUpdateConfig hard deletes the specified AutoUpdateConfig.
|
||||
rpc DeleteAutoUpdateConfig(DeleteAutoUpdateConfigRequest) returns (google.protobuf.Empty);
|
||||
|
||||
// GetAutoUpdateVersion gets the current autoupdate version singleton.
|
||||
rpc GetAutoUpdateVersion(GetAutoUpdateVersionRequest) returns (AutoUpdateVersion);
|
||||
|
||||
// CreateAutoUpdateVersion creates a new AutoUpdateVersion.
|
||||
rpc CreateAutoUpdateVersion(CreateAutoUpdateVersionRequest) returns (AutoUpdateVersion);
|
||||
|
||||
// UpdateAutoUpdateVersion updates AutoUpdateVersion singleton.
|
||||
rpc UpdateAutoUpdateVersion(UpdateAutoUpdateVersionRequest) returns (AutoUpdateVersion);
|
||||
|
||||
// UpsertAutoUpdateVersion creates a new AutoUpdateVersion or replaces an existing AutoUpdateVersion.
|
||||
rpc UpsertAutoUpdateVersion(UpsertAutoUpdateVersionRequest) returns (AutoUpdateVersion);
|
||||
|
||||
// DeleteAutoUpdateVersion hard deletes the specified AutoUpdateVersionRequest.
|
||||
rpc DeleteAutoUpdateVersion(DeleteAutoUpdateVersionRequest) returns (google.protobuf.Empty);
|
||||
|
||||
// GetAutoUpdateVersion gets the current autoupdate version singleton.
|
||||
rpc GetAutoUpdateAgentRollout(GetAutoUpdateAgentRolloutRequest) returns (AutoUpdateAgentRollout);
|
||||
|
||||
// CreateAutoUpdateAgentRollout creates a new AutoUpdateAgentRollout.
|
||||
rpc CreateAutoUpdateAgentRollout(CreateAutoUpdateAgentRolloutRequest) returns (AutoUpdateAgentRollout);
|
||||
|
||||
// UpdateAutoUpdateAgentRollout updates AutoUpdateAgentRollout singleton.
|
||||
rpc UpdateAutoUpdateAgentRollout(UpdateAutoUpdateAgentRolloutRequest) returns (AutoUpdateAgentRollout);
|
||||
|
||||
// UpsertAutoUpdateAgentRollout creates a new AutoUpdateAgentRollout or replaces an existing AutoUpdateAgentRollout.
|
||||
rpc UpsertAutoUpdateAgentRollout(UpsertAutoUpdateAgentRolloutRequest) returns (AutoUpdateAgentRollout);
|
||||
|
||||
// DeleteAutoUpdateAgentRollout hard deletes the specified AutoUpdateAgentRolloutRequest.
|
||||
rpc DeleteAutoUpdateAgentRollout(DeleteAutoUpdateAgentRolloutRequest) returns (google.protobuf.Empty);
|
||||
|
||||
// TriggerAutoUpdateAgentGroup changes the state of an agent group from `unstarted` to `active`.
|
||||
// This RPC will be extended later to switch the group state to `canary` by default,
|
||||
// and `active` if a flag is set.
|
||||
rpc TriggerAutoUpdateAgentGroup(TriggerAutoUpdateAgentGroupRequest) returns (AutoUpdateAgentRollout);
|
||||
|
||||
// ForceAutoUpdateAgentGroup changes the state of an agent group from `unstarted`, `canary`, or `active` to the `done` state.
|
||||
rpc ForceAutoUpdateAgentGroup(ForceAutoUpdateAgentGroupRequest) returns (AutoUpdateAgentRollout);
|
||||
|
||||
// RollbackAutoUpdateAgentGroup changes the state of an agent group to `rolledback`.
|
||||
rpc RollbackAutoUpdateAgentGroup(RollbackAutoUpdateAgentGroupRequest) returns (AutoUpdateAgentRollout);
|
||||
}
|
||||
|
||||
// Request for GetAutoUpdateConfig.
|
||||
message GetAutoUpdateConfigRequest {}
|
||||
|
||||
// Request for CreateAutoUpdateConfig.
|
||||
message CreateAutoUpdateConfigRequest {
|
||||
AutoUpdateConfig config = 1;
|
||||
}
|
||||
|
||||
// Request for UpdateAutoUpdateConfig.
|
||||
message UpdateAutoUpdateConfigRequest {
|
||||
AutoUpdateConfig config = 1;
|
||||
}
|
||||
|
||||
// Request for UpsertAutoUpdateConfig.
|
||||
message UpsertAutoUpdateConfigRequest {
|
||||
AutoUpdateConfig config = 1;
|
||||
}
|
||||
|
||||
// Request for DeleteAutoUpdateConfig.
|
||||
message DeleteAutoUpdateConfigRequest {}
|
||||
|
||||
// Request for GetAutoUpdateVersion.
|
||||
message GetAutoUpdateVersionRequest {}
|
||||
|
||||
// Request for CreateAutoUpdateVersion.
|
||||
message CreateAutoUpdateVersionRequest {
|
||||
AutoUpdateVersion version = 1;
|
||||
}
|
||||
|
||||
// Request for UpdateAutoUpdateConfig.
|
||||
message UpdateAutoUpdateVersionRequest {
|
||||
AutoUpdateVersion version = 1;
|
||||
}
|
||||
|
||||
// Request for UpsertAutoUpdateVersion.
|
||||
message UpsertAutoUpdateVersionRequest {
|
||||
AutoUpdateVersion version = 1;
|
||||
}
|
||||
|
||||
// Request for DeleteAutoUpdateVersion.
|
||||
message DeleteAutoUpdateVersionRequest {}
|
||||
|
||||
// Request for GetAutoUpdateAgentRollout.
|
||||
message GetAutoUpdateAgentRolloutRequest {}
|
||||
|
||||
// Request for CreateAutoUpdateAgentRollout.
|
||||
message CreateAutoUpdateAgentRolloutRequest {
|
||||
AutoUpdateAgentRollout rollout = 1;
|
||||
}
|
||||
|
||||
// Request for UpdateAutoUpdateConfig.
|
||||
message UpdateAutoUpdateAgentRolloutRequest {
|
||||
AutoUpdateAgentRollout rollout = 1;
|
||||
}
|
||||
|
||||
// Request for UpsertAutoUpdateAgentRollout.
|
||||
message UpsertAutoUpdateAgentRolloutRequest {
|
||||
AutoUpdateAgentRollout rollout = 1;
|
||||
}
|
||||
|
||||
// Request for DeleteAutoUpdateAgentRollout.
|
||||
message DeleteAutoUpdateAgentRolloutRequest {}
|
||||
|
||||
// Request for TriggerAutoUpdateAgentGroup.
|
||||
message TriggerAutoUpdateAgentGroupRequest {
|
||||
// groups contains the agent update group names whose maintenance should be triggered.
|
||||
repeated string groups = 1;
|
||||
|
||||
// desired_state describes the desired start state.
|
||||
// Supported values are AUTO_UPDATE_AGENT_GROUP_STATE_UNSPECIFIED, and AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE.
|
||||
// Current default desired state is active. This will change when we'll introduce the
|
||||
// AUTO_UPDATE_AGENT_GROUP_STATE_CANARY state.
|
||||
AutoUpdateAgentGroupState desired_state = 2;
|
||||
}
|
||||
|
||||
// Request for ForceAutoUpdateAgentGroup.
|
||||
message ForceAutoUpdateAgentGroupRequest {
|
||||
// groups contains the agent update group names whose state should be forced to `done`.
|
||||
repeated string groups = 1;
|
||||
}
|
||||
|
||||
// Request for RollbackAutoUpdateAgentGroup.
|
||||
message RollbackAutoUpdateAgentGroupRequest {
|
||||
// groups contains the agent update group name whose state should change to `rolledback`.
|
||||
repeated string groups = 1;
|
||||
// all_started_groups instructs Teleport to rollback every started groups.
|
||||
// When both groups and all_started_groups are set, both unstarted and specified groups
|
||||
// are rolled-back.
|
||||
bool all_started_groups = 2;
|
||||
}
|
||||
Vendored
-41
@@ -1,41 +0,0 @@
|
||||
// Copyright 2024 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.clusterconfig.v1;
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/clusterconfig/v1;clusterconfigv1";
|
||||
|
||||
// AccessGraphConfig holds the information about the configured Access Graph service.
|
||||
message AccessGraphConfig {
|
||||
// enabled indicates if the Access Graph is enabled for the cluster.
|
||||
bool enabled = 1;
|
||||
// address is the address of the access graph service. The address is in the
|
||||
// form of "host:port".
|
||||
string address = 2;
|
||||
// ca is the PEM-encoded CA certificate of the access graph service.
|
||||
bytes ca = 3;
|
||||
// insecure is a flag that indicates whether the access graph service should
|
||||
// skip verifying the server's certificate chain and host name.
|
||||
bool insecure = 4;
|
||||
// secrets_scan_config is used to configure the parameters for the secrets scanning functionality.
|
||||
AccessGraphSecretsScanConfiguration secrets_scan_config = 5;
|
||||
}
|
||||
|
||||
// AccessGraphSecretsScanConfiguration controls the secrets scanning service parameters.
|
||||
message AccessGraphSecretsScanConfiguration {
|
||||
// ssh_scan_enabled indicates if the SSH scan feature is enabled for the cluster.
|
||||
bool ssh_scan_enabled = 1;
|
||||
}
|
||||
-71
@@ -1,71 +0,0 @@
|
||||
// Copyright 2024 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.clusterconfig.v1;
|
||||
|
||||
import "teleport/header/v1/metadata.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/clusterconfig/v1;clusterconfigv1";
|
||||
|
||||
// AccessGraphSettings holds dynamic configuration settings for the Access Graph service.
|
||||
message AccessGraphSettings {
|
||||
// kind is the kind of the resource.
|
||||
string kind = 1;
|
||||
// sub_kind is the sub kind of the resource.
|
||||
string sub_kind = 2;
|
||||
// version is the version of the resource.
|
||||
string version = 3;
|
||||
// metadata is the metadata of the resource.
|
||||
teleport.header.v1.Metadata metadata = 4;
|
||||
// spec is the spec of the resource.
|
||||
AccessGraphSettingsSpec spec = 5;
|
||||
// status is the status of the configured access graph service
|
||||
AccessGraphSettingsStatus status = 6;
|
||||
}
|
||||
|
||||
// AccessGraphSettingsStatus is the status of the configured access graph service
|
||||
message AccessGraphSettingsStatus {
|
||||
// initial_sync_complete indicates if the access graph service has sent resources to access graph at least once.
|
||||
bool initial_sync_complete = 1;
|
||||
}
|
||||
|
||||
// AccessGraphSettingsSpec is the spec for the Access Graph service configuration settings.
|
||||
message AccessGraphSettingsSpec {
|
||||
// secrets_scan_config is used to configure the parameters for the secrets scanning functionality.
|
||||
AccessGraphSecretsScanConfig secrets_scan_config = 1;
|
||||
// demo_mode is used to determine if some features should be available for use in a demo capacity
|
||||
AccessGraphDemoMode demo_mode = 2;
|
||||
}
|
||||
|
||||
// AccessGraphDemoMode is used to determine if some features should be available for use in a demo capacity
|
||||
enum AccessGraphDemoMode {
|
||||
// ACCESS_GRAPH_DEMO_MODE_UNSPECIFIED is an unknown demo mode configuration.
|
||||
ACCESS_GRAPH_DEMO_MODE_UNSPECIFIED = 0;
|
||||
// ACCESS_GRAPH_DEMO_MODE_DISABLED is a disabled demo mode configuration.
|
||||
ACCESS_GRAPH_DEMO_MODE_DISABLED = 1;
|
||||
// ACCESS_GRAPH_DEMO_MODE_ENABLED is an enabled demo mode configuration.
|
||||
ACCESS_GRAPH_DEMO_MODE_ENABLED = 2;
|
||||
}
|
||||
|
||||
// AccessGraphSecretsScanConfig is used to configure the parameters for the secrets scanning functionality.
|
||||
enum AccessGraphSecretsScanConfig {
|
||||
// ACCESS_GRAPH_SECRETS_SCAN_CONFIG_UNSPECIFIED is an unknown secrets scan configuration.
|
||||
ACCESS_GRAPH_SECRETS_SCAN_CONFIG_UNSPECIFIED = 0;
|
||||
// ACCESS_GRAPH_SECRETS_SCAN_CONFIG_DISABLED is a disabled secrets scan configuration.
|
||||
ACCESS_GRAPH_SECRETS_SCAN_CONFIG_DISABLED = 1;
|
||||
// ACCESS_GRAPH_SECRETS_SCAN_CONFIG_ENABLED is an enabled secrets scan configuration.
|
||||
ACCESS_GRAPH_SECRETS_SCAN_CONFIG_ENABLED = 2;
|
||||
}
|
||||
-157
@@ -1,157 +0,0 @@
|
||||
// Copyright 2023 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.clusterconfig.v1;
|
||||
|
||||
import "teleport/clusterconfig/v1/access_graph.proto";
|
||||
import "teleport/clusterconfig/v1/access_graph_settings.proto";
|
||||
import "teleport/legacy/types/types.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/clusterconfig/v1;clusterconfigv1";
|
||||
|
||||
// ClusterConfigService provides methods to manage cluster configuration resources.
|
||||
service ClusterConfigService {
|
||||
// GetClusterNetworkingConfig retrieves the active cluster networking configuration.
|
||||
rpc GetClusterNetworkingConfig(GetClusterNetworkingConfigRequest) returns (types.ClusterNetworkingConfigV2);
|
||||
// UpdateClusterNetworkingConfig updates the cluster networking configuration.
|
||||
rpc UpdateClusterNetworkingConfig(UpdateClusterNetworkingConfigRequest) returns (types.ClusterNetworkingConfigV2);
|
||||
// UpsertClusterNetworkingConfig overwrites the active cluster networking configuration.
|
||||
rpc UpsertClusterNetworkingConfig(UpsertClusterNetworkingConfigRequest) returns (types.ClusterNetworkingConfigV2);
|
||||
// ResetClusterNetworkingConfig restores the active cluster networking configuration to default settings.
|
||||
rpc ResetClusterNetworkingConfig(ResetClusterNetworkingConfigRequest) returns (types.ClusterNetworkingConfigV2);
|
||||
|
||||
// GetSessionRecordingConfig retrieves the active session recording configuration.
|
||||
rpc GetSessionRecordingConfig(GetSessionRecordingConfigRequest) returns (types.SessionRecordingConfigV2);
|
||||
// UpdateSessionRecordingConfig updates the session recording configuration.
|
||||
rpc UpdateSessionRecordingConfig(UpdateSessionRecordingConfigRequest) returns (types.SessionRecordingConfigV2);
|
||||
// UpsertSessionRecordingConfig overwrites the active session recording configuration.
|
||||
rpc UpsertSessionRecordingConfig(UpsertSessionRecordingConfigRequest) returns (types.SessionRecordingConfigV2);
|
||||
// ResetSessionRecordingConfig restores the active session recording configuration to default settings.
|
||||
rpc ResetSessionRecordingConfig(ResetSessionRecordingConfigRequest) returns (types.SessionRecordingConfigV2);
|
||||
|
||||
// GetAuthPreference retrieves the active auth preference.
|
||||
rpc GetAuthPreference(GetAuthPreferenceRequest) returns (types.AuthPreferenceV2);
|
||||
// UpdateAuthPreference updates the auth preference.
|
||||
rpc UpdateAuthPreference(UpdateAuthPreferenceRequest) returns (types.AuthPreferenceV2);
|
||||
// UpsertAuthPreference overwrites the active auth preference.
|
||||
rpc UpsertAuthPreference(UpsertAuthPreferenceRequest) returns (types.AuthPreferenceV2);
|
||||
// ResetAuthPreference restores the active auth preference to default settings.
|
||||
rpc ResetAuthPreference(ResetAuthPreferenceRequest) returns (types.AuthPreferenceV2);
|
||||
|
||||
// GetClusterAuditConfig retrieves the active cluster audit configuration.
|
||||
rpc GetClusterAuditConfig(GetClusterAuditConfigRequest) returns (types.ClusterAuditConfigV2);
|
||||
|
||||
// GetClusterAccessGraphConfig retrieves the cluster Access Graph configuration from Auth service.
|
||||
rpc GetClusterAccessGraphConfig(GetClusterAccessGraphConfigRequest) returns (GetClusterAccessGraphConfigResponse);
|
||||
|
||||
// GetAccessGraphSettings updates the cluster Access Graph configuration.
|
||||
rpc GetAccessGraphSettings(GetAccessGraphSettingsRequest) returns (teleport.clusterconfig.v1.AccessGraphSettings);
|
||||
// CreateAccessGraphSettings creates the cluster Access Graph configuration.
|
||||
rpc CreateAccessGraphSettings(CreateAccessGraphSettingsRequest) returns (teleport.clusterconfig.v1.AccessGraphSettings);
|
||||
// UpdateAccessGraphSettings updates the cluster Access Graph configuration.
|
||||
rpc UpdateAccessGraphSettings(UpdateAccessGraphSettingsRequest) returns (teleport.clusterconfig.v1.AccessGraphSettings);
|
||||
// UpsertAccessGraphSettings overwrites the active cluster Access Graph configuration.
|
||||
rpc UpsertAccessGraphSettings(UpsertAccessGraphSettingsRequest) returns (teleport.clusterconfig.v1.AccessGraphSettings);
|
||||
// ResetAccessGraphSettings restores the active cluster Access Graph to default settings.
|
||||
rpc ResetAccessGraphSettings(ResetAccessGraphSettingsRequest) returns (teleport.clusterconfig.v1.AccessGraphSettings);
|
||||
|
||||
// GetClusterName retrieves the cluster name.
|
||||
rpc GetClusterName(GetClusterNameRequest) returns (types.ClusterNameV2);
|
||||
}
|
||||
|
||||
// Request for GetClusterNetworkingConfig
|
||||
message GetClusterNetworkingConfigRequest {}
|
||||
|
||||
// Request for UpdateClusterNetworkingConfig
|
||||
message UpdateClusterNetworkingConfigRequest {
|
||||
types.ClusterNetworkingConfigV2 cluster_network_config = 1;
|
||||
}
|
||||
|
||||
// Request for UpsertClusterNetworkingConfig
|
||||
message UpsertClusterNetworkingConfigRequest {
|
||||
types.ClusterNetworkingConfigV2 cluster_network_config = 1;
|
||||
}
|
||||
|
||||
// Request for ResetClusterNetworkingConfig
|
||||
message ResetClusterNetworkingConfigRequest {}
|
||||
|
||||
// Request for GetSessionRecordingConfig
|
||||
message GetSessionRecordingConfigRequest {}
|
||||
|
||||
// Request for UpdateSessionRecordingConfig
|
||||
message UpdateSessionRecordingConfigRequest {
|
||||
types.SessionRecordingConfigV2 session_recording_config = 1;
|
||||
}
|
||||
|
||||
// Request for UpsertSessionRecordingConfig
|
||||
message UpsertSessionRecordingConfigRequest {
|
||||
types.SessionRecordingConfigV2 session_recording_config = 1;
|
||||
}
|
||||
|
||||
// Request for ResetSessionRecordingConfig
|
||||
message ResetSessionRecordingConfigRequest {}
|
||||
|
||||
// Request for GetAuthPreference
|
||||
message GetAuthPreferenceRequest {}
|
||||
|
||||
// Request for UpdateAuthPreference
|
||||
message UpdateAuthPreferenceRequest {
|
||||
types.AuthPreferenceV2 auth_preference = 1;
|
||||
}
|
||||
|
||||
// Request for UpsertAuthPreference
|
||||
message UpsertAuthPreferenceRequest {
|
||||
types.AuthPreferenceV2 auth_preference = 1;
|
||||
}
|
||||
|
||||
// Request for ResetAuthPreference
|
||||
message ResetAuthPreferenceRequest {}
|
||||
|
||||
// Request for GetClusterAuditConfig
|
||||
message GetClusterAuditConfigRequest {}
|
||||
|
||||
// Request for GetClusterAccessGraphConfig
|
||||
message GetClusterAccessGraphConfigRequest {}
|
||||
|
||||
// Response for GetClusterAccessGraphConfig
|
||||
message GetClusterAccessGraphConfigResponse {
|
||||
// access_graph holds the information about Access Graph service.
|
||||
teleport.clusterconfig.v1.AccessGraphConfig access_graph = 1;
|
||||
}
|
||||
|
||||
// Request for GetAccessGraphSettings
|
||||
message GetAccessGraphSettingsRequest {}
|
||||
|
||||
// Request for CreateAccessGraphSettings
|
||||
message CreateAccessGraphSettingsRequest {
|
||||
teleport.clusterconfig.v1.AccessGraphSettings access_graph_settings = 1;
|
||||
}
|
||||
|
||||
// Request for UpdateAccessGraphSettings
|
||||
message UpdateAccessGraphSettingsRequest {
|
||||
teleport.clusterconfig.v1.AccessGraphSettings access_graph_settings = 1;
|
||||
}
|
||||
|
||||
// Request for UpsertAccessGraphSettings
|
||||
message UpsertAccessGraphSettingsRequest {
|
||||
teleport.clusterconfig.v1.AccessGraphSettings access_graph_settings = 1;
|
||||
}
|
||||
|
||||
// Request for ResetAccessGraphSettings
|
||||
message ResetAccessGraphSettingsRequest {}
|
||||
|
||||
// Request for GetClusterName
|
||||
message GetClusterNameRequest {}
|
||||
-93
@@ -1,93 +0,0 @@
|
||||
// Copyright 2023 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.crownjewel.v1;
|
||||
|
||||
import "google/protobuf/wrappers.proto";
|
||||
import "teleport/header/v1/metadata.proto";
|
||||
import "teleport/label/v1/label.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/crownjewel/v1;crownjewelv1";
|
||||
|
||||
// CrownJewel represents a Crown Jewel resource.
|
||||
// Crown Jewel is a resource that represents a set of resources that are
|
||||
// considered critical to the organization. Access Graph uses Crown Jewel to
|
||||
// generate audit events if access to a resource has changed.
|
||||
message CrownJewel {
|
||||
// The kind of resource represented.
|
||||
string kind = 1;
|
||||
// Mandatory field for all resources. Not populated for this resource type.
|
||||
string sub_kind = 2;
|
||||
// The version of the resource being represented.
|
||||
string version = 3;
|
||||
// Common metadata that all resources share.
|
||||
teleport.header.v1.Metadata metadata = 4;
|
||||
// Spec is the crown jewel spec.
|
||||
CrownJewelSpec spec = 5;
|
||||
}
|
||||
|
||||
// CrownJewelSpec is the specification of a Crown Jewel.
|
||||
message CrownJewelSpec {
|
||||
// TeleportMatchers is a list of teleport matchers.
|
||||
// DEPRECATED: Use query instead.
|
||||
repeated TeleportMatcher teleport_matchers = 1;
|
||||
// AWSMatchers is a list of AWS matchers.
|
||||
// DEPRECATED: Use query instead.
|
||||
repeated AWSMatcher aws_matchers = 2;
|
||||
// Query is a Access Graph query to match resources.
|
||||
string query = 3;
|
||||
}
|
||||
|
||||
// TeleportMatcher represents a matcher for Teleport resources.
|
||||
message TeleportMatcher {
|
||||
reserved 1;
|
||||
reserved "name";
|
||||
// Kind is the kind of the resource: ssh, k8s, db, etc
|
||||
// Multiple kinds can be provided to match multiple kinds.
|
||||
repeated string kinds = 2;
|
||||
// Labels is a set of labels.
|
||||
repeated teleport.label.v1.Label labels = 3;
|
||||
// Names are the name of resources. When the name is provided, it will match
|
||||
// resources with the same name.
|
||||
repeated string names = 4;
|
||||
}
|
||||
|
||||
// AWSMatcher represents a matcher for AWS resources.
|
||||
// Those matchers are used only by Access Graph. Teleport related matchers are
|
||||
// defined in the TeleportMatcher.
|
||||
message AWSMatcher {
|
||||
// Types are AWS database types to match, "ec2", "rds", "s3", etc
|
||||
repeated string types = 1;
|
||||
// Regions are AWS regions to query for resources.
|
||||
repeated string regions = 2;
|
||||
// Tags are AWS resource Tags to match.
|
||||
// labels is a set of labels.
|
||||
repeated AWSTag tags = 3;
|
||||
|
||||
reserved 4;
|
||||
reserved "arn";
|
||||
|
||||
// ARNs are AWS resources ARN to match.
|
||||
repeated string arns = 5;
|
||||
}
|
||||
|
||||
// AWSTag is a tag that is attached to an AWS resource.
|
||||
message AWSTag {
|
||||
// Key is the key of the tag.
|
||||
string key = 1;
|
||||
// Value is the value of the tag.
|
||||
repeated google.protobuf.StringValue values = 2;
|
||||
}
|
||||
Vendored
-92
@@ -1,92 +0,0 @@
|
||||
// Copyright 2024 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.crownjewel.v1;
|
||||
|
||||
import "google/protobuf/empty.proto";
|
||||
import "teleport/crownjewel/v1/crownjewel.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/crownjewel/v1;crownjewelv1";
|
||||
|
||||
// CrownJewelService is a service that provides methods to manage CrownJewels.
|
||||
service CrownJewelService {
|
||||
// CreateCrownJewel creates a new CrownJewel.
|
||||
rpc CreateCrownJewel(CreateCrownJewelRequest) returns (CrownJewel);
|
||||
// GetCrownJewel gets a CrownJewel by name.
|
||||
rpc GetCrownJewel(GetCrownJewelRequest) returns (CrownJewel);
|
||||
// ListCrownJewels returns a list of CrownJewels. It supports pagination.
|
||||
rpc ListCrownJewels(ListCrownJewelsRequest) returns (ListCrownJewelsResponse);
|
||||
// UpdateCrownJewel updates an existing CrownJewel.
|
||||
rpc UpdateCrownJewel(UpdateCrownJewelRequest) returns (CrownJewel);
|
||||
// UpsertCrownJewel upserts a CrownJewel.
|
||||
rpc UpsertCrownJewel(UpsertCrownJewelRequest) returns (CrownJewel);
|
||||
// DeleteCrownJewel deletes a CrownJewel.
|
||||
rpc DeleteCrownJewel(DeleteCrownJewelRequest) returns (google.protobuf.Empty);
|
||||
}
|
||||
|
||||
// CrownJewelRequest is a request to create a new CrownJewel.
|
||||
message CreateCrownJewelRequest {
|
||||
reserved 1;
|
||||
reserved "crown_jewels";
|
||||
|
||||
teleport.crownjewel.v1.CrownJewel crown_jewel = 2;
|
||||
}
|
||||
|
||||
// GetCrownJewelRequest is a request to get a CrownJewel by name.
|
||||
message GetCrownJewelRequest {
|
||||
// Name is the name of the CrownJewel to get.
|
||||
string name = 1;
|
||||
}
|
||||
|
||||
// ListCrownJewelsRequest is a request to get a list of CrownJewels.
|
||||
message ListCrownJewelsRequest {
|
||||
// page_size is the maximum number of items to return.
|
||||
// The server may impose a different page size at its discretion.
|
||||
int64 page_size = 1;
|
||||
// page_token is the next_page_token value returned from a previous List request, if any.
|
||||
string page_token = 2;
|
||||
}
|
||||
|
||||
// ListCrownJewelsResponse is a response to GetCrownJewelsRequest.
|
||||
message ListCrownJewelsResponse {
|
||||
repeated teleport.crownjewel.v1.CrownJewel crown_jewels = 1;
|
||||
|
||||
// Token to retrieve the next page of results, or empty if there are no
|
||||
// more results in the list.
|
||||
string next_page_token = 2;
|
||||
}
|
||||
|
||||
// UpdateCrownJewelRequest is a request to update an existing CrownJewel.
|
||||
message UpdateCrownJewelRequest {
|
||||
reserved 1;
|
||||
reserved "crown_jewels";
|
||||
|
||||
teleport.crownjewel.v1.CrownJewel crown_jewel = 2;
|
||||
}
|
||||
|
||||
// UpsertCrownJewelRequest is a request to upsert a CrownJewel.
|
||||
message UpsertCrownJewelRequest {
|
||||
reserved 1;
|
||||
reserved "crown_jewels";
|
||||
|
||||
teleport.crownjewel.v1.CrownJewel crown_jewel = 2;
|
||||
}
|
||||
|
||||
// DeleteCrownJewelRequest is a request to delete a CrownJewel.
|
||||
message DeleteCrownJewelRequest {
|
||||
// Name is the name of the CrownJewel to delete.
|
||||
string name = 1;
|
||||
}
|
||||
-53
@@ -1,53 +0,0 @@
|
||||
// Copyright 2023 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.dbobject.v1;
|
||||
|
||||
import "teleport/header/v1/metadata.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/dbobject/v1;dbobjectv1";
|
||||
|
||||
// DatabaseObject represents a database object that can be imported into Teleport.
|
||||
// An example of such object would be a database table, along with various metadata.
|
||||
// For rationale behind this type, see the RFD 151.
|
||||
message DatabaseObject {
|
||||
// The kind of resource represented.
|
||||
string kind = 1;
|
||||
// Mandatory field for all resources. Not populated for this resource type.
|
||||
string sub_kind = 2;
|
||||
// The version of the resource being represented.
|
||||
string version = 3;
|
||||
// Common metadata that all resources share.
|
||||
teleport.header.v1.Metadata metadata = 4;
|
||||
// Specification for the database object.
|
||||
DatabaseObjectSpec spec = 5;
|
||||
}
|
||||
|
||||
// DatabaseObjectSpec is the spec for the database object.
|
||||
message DatabaseObjectSpec {
|
||||
// The protocol used to connect to the database (e.g., postgres). Required.
|
||||
string protocol = 1;
|
||||
// The name of the database service that this object belongs to. Required.
|
||||
string database_service_name = 2;
|
||||
// The kind of database object (e.g., table, view). Required.
|
||||
string object_kind = 3;
|
||||
// The database containing the object. Optional.
|
||||
string database = 4;
|
||||
// The schema containing the object (if applicable). Optional.
|
||||
string schema = 5;
|
||||
// The name of the object. Required.
|
||||
string name = 6;
|
||||
}
|
||||
Vendored
-102
@@ -1,102 +0,0 @@
|
||||
// Copyright 2024 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.dbobject.v1;
|
||||
|
||||
import "google/protobuf/empty.proto";
|
||||
import "teleport/dbobject/v1/dbobject.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/dbobject/v1;dbobjectv1";
|
||||
|
||||
// DatabaseObjectService provides methods to manage Teleport DatabaseObjects
|
||||
service DatabaseObjectService {
|
||||
// GetDatabaseObject is used to query a database object resource by its name.
|
||||
//
|
||||
// This will return a NotFound error if the specified database object does not exist.
|
||||
rpc GetDatabaseObject(GetDatabaseObjectRequest) returns (DatabaseObject);
|
||||
|
||||
// ListDatabaseObjects is used to query database objects.
|
||||
//
|
||||
// Follows the pagination semantics of
|
||||
// https://cloud.google.com/apis/design/standard_methods#list.
|
||||
rpc ListDatabaseObjects(ListDatabaseObjectsRequest) returns (ListDatabaseObjectsResponse);
|
||||
|
||||
// CreateDatabaseObject is used to create a database object.
|
||||
//
|
||||
// This will return an error if a database object by that name already exists.
|
||||
rpc CreateDatabaseObject(CreateDatabaseObjectRequest) returns (DatabaseObject);
|
||||
|
||||
// UpdateDatabaseObject is used to modify an existing database object.
|
||||
rpc UpdateDatabaseObject(UpdateDatabaseObjectRequest) returns (DatabaseObject);
|
||||
|
||||
// UpsertDatabaseObject is used to create or replace an existing database object.
|
||||
//
|
||||
// Prefer using CreateDatabaseObject and UpdateDatabaseObject.
|
||||
rpc UpsertDatabaseObject(UpsertDatabaseObjectRequest) returns (DatabaseObject);
|
||||
|
||||
// DeleteDatabaseObject is used to delete a specific database object.
|
||||
//
|
||||
// This will return a NotFound error if the specified database object does not exist.
|
||||
rpc DeleteDatabaseObject(DeleteDatabaseObjectRequest) returns (google.protobuf.Empty);
|
||||
}
|
||||
|
||||
// The request for CreateDatabaseObject.
|
||||
message CreateDatabaseObjectRequest {
|
||||
// The database object to create.
|
||||
DatabaseObject object = 1;
|
||||
}
|
||||
|
||||
// The request for GetDatabaseObject.
|
||||
message GetDatabaseObjectRequest {
|
||||
// The name of the database object to fetch.
|
||||
string name = 1;
|
||||
}
|
||||
|
||||
// The request for ListDatabaseObjects.
|
||||
message ListDatabaseObjectsRequest {
|
||||
// The maximum number of items to return.
|
||||
// The server may impose a different page size at its discretion.
|
||||
int32 page_size = 1;
|
||||
// The page_token is the next_page_token value returned from a previous List request, if any.
|
||||
string page_token = 2;
|
||||
}
|
||||
|
||||
// The response for ListDatabaseObjects.
|
||||
message ListDatabaseObjectsResponse {
|
||||
// The page of database objects that matched the request.
|
||||
repeated DatabaseObject objects = 1;
|
||||
// Token to retrieve the next page of results, or empty if there are no
|
||||
// more results in the list.
|
||||
string next_page_token = 2;
|
||||
}
|
||||
|
||||
// The request for UpdateDatabaseObject.
|
||||
message UpdateDatabaseObjectRequest {
|
||||
// The database object to replace.
|
||||
DatabaseObject object = 1;
|
||||
}
|
||||
|
||||
// The request for UpsertDatabaseObject.
|
||||
message UpsertDatabaseObjectRequest {
|
||||
// The database object to create or replace.
|
||||
DatabaseObject object = 1;
|
||||
}
|
||||
|
||||
// The request for DeleteDatabaseObject.
|
||||
message DeleteDatabaseObjectRequest {
|
||||
// The name of the database object to delete.
|
||||
string name = 1;
|
||||
}
|
||||
-91
@@ -1,91 +0,0 @@
|
||||
// Copyright 2023 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.dbobjectimportrule.v1;
|
||||
|
||||
import "teleport/header/v1/metadata.proto";
|
||||
import "teleport/label/v1/label.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/dbobjectimportrule/v1;dbobjectimportrulev1";
|
||||
|
||||
// DatabaseObjectImportRule is the resource representing a global database object import rule.
|
||||
// The import rules govern which database objects are imported from databases.
|
||||
// See type teleport.dbobject.v1.DatabaseObject for the description of a database object.
|
||||
// For rationale behind this type, see the RFD 151.
|
||||
message DatabaseObjectImportRule {
|
||||
// The kind of resource represented.
|
||||
string kind = 1;
|
||||
// Mandatory field for all resources. Not populated for this resource type.
|
||||
string sub_kind = 2;
|
||||
// The version of the resource being represented.
|
||||
string version = 3;
|
||||
// Common metadata that all resources share.
|
||||
teleport.header.v1.Metadata metadata = 4;
|
||||
|
||||
// spec represents the specifications for the database object import rule.
|
||||
DatabaseObjectImportRuleSpec spec = 5;
|
||||
}
|
||||
|
||||
// DatabaseObjectImportRuleSpec is the spec for database object import rule.
|
||||
message DatabaseObjectImportRuleSpec {
|
||||
// priority represents the priority of the rule application.
|
||||
//
|
||||
// Rules are processed from lowest to highest priority.
|
||||
// If two rules apply the same label, then the value applied with the rule with the highest priority wins.
|
||||
int32 priority = 1;
|
||||
|
||||
reserved 2;
|
||||
reserved "db_labels";
|
||||
|
||||
// db_labels is a set of labels matched against database labels.
|
||||
repeated teleport.label.v1.Label database_labels = 3;
|
||||
|
||||
// mappings is a list of matches that will map match conditions to labels.
|
||||
repeated DatabaseObjectImportRuleMapping mappings = 4;
|
||||
}
|
||||
|
||||
// DatabaseObjectImportRuleMapping is the mapping between object properties and labels that will be added to the object.
|
||||
message DatabaseObjectImportRuleMapping {
|
||||
// match specifies the matching rules, like the object names.
|
||||
DatabaseObjectImportMatch match = 1;
|
||||
|
||||
// scope specifies the object scope. Optional. If not provided, all scopes will be accepted.
|
||||
DatabaseObjectImportScope scope = 2;
|
||||
|
||||
// add_labels specifies which labels to add if the match succeeds. At least one should be present.
|
||||
map<string, string> add_labels = 3;
|
||||
}
|
||||
|
||||
// DatabaseObjectImportMatch specifies acceptable object names. Must have at least one non-empty member.
|
||||
message DatabaseObjectImportMatch {
|
||||
// table_names specify the names of the tables to match. Optional.
|
||||
repeated string table_names = 1;
|
||||
|
||||
// view_names specify the names of the views to match. Optional.
|
||||
repeated string view_names = 2;
|
||||
|
||||
// procedure_names specify the names of the procedures to match. Optional.
|
||||
repeated string procedure_names = 3;
|
||||
}
|
||||
|
||||
// DatabaseObjectImportScope specifies the object scope. Members are matched independently of each other.
|
||||
message DatabaseObjectImportScope {
|
||||
// database_names specify the names of the databases to include in the scope. Optional.
|
||||
repeated string database_names = 1;
|
||||
|
||||
// schema_names specify the names of the schemas to include in the scope. Optional.
|
||||
repeated string schema_names = 2;
|
||||
}
|
||||
-102
@@ -1,102 +0,0 @@
|
||||
// Copyright 2023 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.dbobjectimportrule.v1;
|
||||
|
||||
import "google/protobuf/empty.proto";
|
||||
import "teleport/dbobjectimportrule/v1/dbobjectimportrule.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/dbobjectimportrule/v1;dbobjectimportrulev1";
|
||||
|
||||
// DatabaseObjectImportRuleService provides methods to manage Teleport DatabaseObjectImportRules
|
||||
service DatabaseObjectImportRuleService {
|
||||
// GetDatabaseObjectImportRule is used to query a DatabaseObjectImportRule resource by its name.
|
||||
//
|
||||
// This will return a NotFound error if the specified DatabaseObjectImportRule does not exist.
|
||||
rpc GetDatabaseObjectImportRule(GetDatabaseObjectImportRuleRequest) returns (DatabaseObjectImportRule);
|
||||
|
||||
// ListDatabaseObjectImportRules is used to query DatabaseObjectImportRules.
|
||||
//
|
||||
// Follows the pagination semantics of
|
||||
// https://cloud.google.com/apis/design/standard_methods#list.
|
||||
rpc ListDatabaseObjectImportRules(ListDatabaseObjectImportRulesRequest) returns (ListDatabaseObjectImportRulesResponse);
|
||||
|
||||
// CreateDatabaseObjectImportRule is used to create a DatabaseObjectImportRule.
|
||||
//
|
||||
// This will return an error if a DatabaseObjectImportRule by that name already exists.
|
||||
rpc CreateDatabaseObjectImportRule(CreateDatabaseObjectImportRuleRequest) returns (DatabaseObjectImportRule);
|
||||
|
||||
// UpdateDatabaseObjectImportRule is used to modify an existing DatabaseObjectImportRule.
|
||||
rpc UpdateDatabaseObjectImportRule(UpdateDatabaseObjectImportRuleRequest) returns (DatabaseObjectImportRule);
|
||||
|
||||
// UpsertDatabaseObjectImportRule is used to create or replace an existing DatabaseObjectImportRule.
|
||||
//
|
||||
// Prefer using CreateDatabaseObjectImportRule and UpdateDatabaseObjectImportRule.
|
||||
rpc UpsertDatabaseObjectImportRule(UpsertDatabaseObjectImportRuleRequest) returns (DatabaseObjectImportRule);
|
||||
|
||||
// DeleteDatabaseObjectImportRule is used to delete a specific DatabaseObjectImportRule.
|
||||
//
|
||||
// This will return a NotFound error if the specified DatabaseObjectImportRule does not exist.
|
||||
rpc DeleteDatabaseObjectImportRule(DeleteDatabaseObjectImportRuleRequest) returns (google.protobuf.Empty);
|
||||
}
|
||||
|
||||
// The request for CreateDatabaseObjectImportRule.
|
||||
message CreateDatabaseObjectImportRuleRequest {
|
||||
// The DatabaseObjectImportRule to create.
|
||||
DatabaseObjectImportRule rule = 1;
|
||||
}
|
||||
|
||||
// The request for GetDatabaseObjectImportRule.
|
||||
message GetDatabaseObjectImportRuleRequest {
|
||||
// The name of the DatabaseObjectImportRule to fetch.
|
||||
string name = 1;
|
||||
}
|
||||
|
||||
// The request for ListDatabaseObjectImportRules.
|
||||
message ListDatabaseObjectImportRulesRequest {
|
||||
// The maximum number of items to return.
|
||||
// The server may impose a different page size at its discretion.
|
||||
int32 page_size = 1;
|
||||
// The page_token is the next_page_token value returned from a previous List request, if any.
|
||||
string page_token = 2;
|
||||
}
|
||||
|
||||
// The response for ListDatabaseObjectImportRules.
|
||||
message ListDatabaseObjectImportRulesResponse {
|
||||
// The page of DatabaseObjectImportRules that matched the request.
|
||||
repeated DatabaseObjectImportRule rules = 1;
|
||||
// Token to retrieve the next page of results, or empty if there are no
|
||||
// more results in the list.
|
||||
string next_page_token = 2;
|
||||
}
|
||||
|
||||
// The request for UpdateDatabaseObjectImportRule.
|
||||
message UpdateDatabaseObjectImportRuleRequest {
|
||||
// The DatabaseObjectImportRule to replace.
|
||||
DatabaseObjectImportRule rule = 1;
|
||||
}
|
||||
|
||||
// The request for UpsertDatabaseObjectImportRule.
|
||||
message UpsertDatabaseObjectImportRuleRequest {
|
||||
// The DatabaseObjectImportRule to create or replace.
|
||||
DatabaseObjectImportRule rule = 1;
|
||||
}
|
||||
|
||||
// The request for DeleteDatabaseObjectImportRule.
|
||||
message DeleteDatabaseObjectImportRuleRequest {
|
||||
// The name of the DatabaseObjectImportRule to delete.
|
||||
string name = 1;
|
||||
}
|
||||
Vendored
-53
@@ -1,53 +0,0 @@
|
||||
// Copyright 2024 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.decision.v1alpha1;
|
||||
|
||||
import "teleport/decision/v1alpha1/denial_metadata.proto";
|
||||
import "teleport/decision/v1alpha1/permit_metadata.proto";
|
||||
import "teleport/decision/v1alpha1/request_metadata.proto";
|
||||
import "teleport/decision/v1alpha1/resource.proto";
|
||||
import "teleport/decision/v1alpha1/tls_identity.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/decision/v1alpha1;decisionpb";
|
||||
|
||||
// EvaluateDatabaseAccessRequest describes a request to evaluate whether or not
|
||||
// a given database access attempt should be permitted.
|
||||
message EvaluateDatabaseAccessRequest {
|
||||
RequestMetadata metadata = 1;
|
||||
TLSIdentity tls_identity = 2;
|
||||
Resource database = 3;
|
||||
}
|
||||
|
||||
// EvaluateDatabaseAccessResponse describes the result of a database access
|
||||
// evaluation.
|
||||
message EvaluateDatabaseAccessResponse {
|
||||
oneof result {
|
||||
DatabaseAccessPermit permit = 1;
|
||||
DatabaseAccessDenial denial = 2;
|
||||
}
|
||||
}
|
||||
|
||||
// DatabaseAccessPermit describes the parameters/constraints of a permissible
|
||||
// database access attempt.
|
||||
message DatabaseAccessPermit {
|
||||
PermitMetadata metadata = 1;
|
||||
}
|
||||
|
||||
// DatabaseAccessDenial describes a database access denial.
|
||||
message DatabaseAccessDenial {
|
||||
DenialMetadata metadata = 1;
|
||||
}
|
||||
Vendored
-44
@@ -1,44 +0,0 @@
|
||||
// Copyright 2024 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.decision.v1alpha1;
|
||||
|
||||
import "teleport/decision/v1alpha1/database_access.proto";
|
||||
import "teleport/decision/v1alpha1/ssh_access.proto";
|
||||
import "teleport/decision/v1alpha1/ssh_join.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/decision/v1alpha1;decisionpb";
|
||||
|
||||
// DecisionService performs authorization decisions for Teleport.
|
||||
//
|
||||
// DecisionService acts the PDP (Policy Decision Point) for Teleport services,
|
||||
// whereas the services themselves act as the PEP (Policy Enforcement Point).
|
||||
// In other words, it calculates the outcome of an authorization request but
|
||||
// does not enforce it - each Teleport service must do so.
|
||||
//
|
||||
// Evaluation responses carry all the data necessary for the enforcement of a
|
||||
// decision. A successful evaluation carries a Permit, whereas a failed
|
||||
// evaluation carries a Denial.
|
||||
service DecisionService {
|
||||
// EvaluateSSHAccess evaluates an SSH access attempt.
|
||||
rpc EvaluateSSHAccess(EvaluateSSHAccessRequest) returns (EvaluateSSHAccessResponse);
|
||||
|
||||
// EvaluateSSHJoin evaluates an SSH session-joining attempt.
|
||||
rpc EvaluateSSHJoin(EvaluateSSHJoinRequest) returns (EvaluateSSHJoinResponse);
|
||||
|
||||
// EvaluateDatabaseAccess evaluate a database access attempt.
|
||||
rpc EvaluateDatabaseAccess(EvaluateDatabaseAccessRequest) returns (EvaluateDatabaseAccessResponse);
|
||||
}
|
||||
Vendored
-38
@@ -1,38 +0,0 @@
|
||||
// Copyright 2024 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.decision.v1alpha1;
|
||||
|
||||
import "teleport/decision/v1alpha1/enforcement_feature.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/decision/v1alpha1;decisionpb";
|
||||
|
||||
// Metadata for access denials.
|
||||
message DenialMetadata {
|
||||
// FeatureAssertions is a list of EnforcementFeature that the PEP (Policy
|
||||
// Enforcement Point) *must* implement in order to correctly enforce the
|
||||
// decision. Note that denials rarely need feature assertions since they
|
||||
// typically "fail safe" anyway.
|
||||
repeated EnforcementFeature feature_assertions = 1;
|
||||
|
||||
// PdpVersion is the version of the PDP (Policy Decision Point) that evaluated
|
||||
// the decision request.
|
||||
string pdp_version = 2;
|
||||
|
||||
// UserMessage is a sanitized message safe for return to the subject identity
|
||||
// of the decision request.
|
||||
string user_message = 3;
|
||||
}
|
||||
-26
@@ -1,26 +0,0 @@
|
||||
// Copyright 2024 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.decision.v1alpha1;
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/decision/v1alpha1;decisionpb";
|
||||
|
||||
// EnforcementFeature represents PEP (Policy Enforcement Point) features.
|
||||
enum EnforcementFeature {
|
||||
// ENFORCEMENT_FEATURE_UNSPECIFIED is the default/unspecified value for
|
||||
// EnforcementFeature. Asserting this feature has no effect.
|
||||
ENFORCEMENT_FEATURE_UNSPECIFIED = 0;
|
||||
}
|
||||
Vendored
-34
@@ -1,34 +0,0 @@
|
||||
// Copyright 2024 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.decision.v1alpha1;
|
||||
|
||||
import "teleport/decision/v1alpha1/enforcement_feature.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/decision/v1alpha1;decisionpb";
|
||||
|
||||
// Metadata for access permits.
|
||||
message PermitMetadata {
|
||||
// FeatureAssertions is a list of EnforcementFeature that the PEP (Policy
|
||||
// Enforcement Point) *must* implement in order to correctly enforce the
|
||||
// decision. Note that where possible new features should be structured to
|
||||
// "fail safe" rather than relying on feature assertions.
|
||||
repeated EnforcementFeature feature_assertions = 1;
|
||||
|
||||
// PdpVersion is the version of the PDP (Policy Decision Point) that evaluated
|
||||
// the decision request.
|
||||
string pdp_version = 2;
|
||||
}
|
||||
Vendored
-67
@@ -1,67 +0,0 @@
|
||||
// Copyright 2024 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.decision.v1alpha1;
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/decision/v1alpha1;decisionpb";
|
||||
|
||||
// Metadata for evaluation requests.
|
||||
message RequestMetadata {
|
||||
// FeatureAssertions is a list of DecisionFeature that the PDP (Policy
|
||||
// Decision Point) *must* implement in order to correctly evaluate the
|
||||
// decision request. Note that changes that require new features in the PDP in
|
||||
// order for it to understand a decision request are rare and should be
|
||||
// avoided if possible.
|
||||
repeated DecisionFeature feature_assertions = 1;
|
||||
|
||||
// PepVersionHint is the *likely* version of the PEP that will enforce the
|
||||
// decision. Not all decision requests can guarantee that the expected PEP
|
||||
// (Policy Enforcement Point) version will actually be the version that ends
|
||||
// up enforcing the decision. Hard compatibility requirements must be enforced
|
||||
// via feature assertions so that PEPs can correctly reject decisions that
|
||||
// they cannot enforce.
|
||||
string pep_version_hint = 2;
|
||||
|
||||
// DryRun indicates that the request is a dry-run if set to true. Decisions returned by
|
||||
// dry run requests are for informational/audit purposes only and must not be used to make
|
||||
// access-control decisions.
|
||||
bool dry_run = 3;
|
||||
|
||||
// DryRunOptions customize the behavior of dry-run decision requests. Specification of any
|
||||
// dry run options when the dry run flag is false is an error.
|
||||
DryRunOptions dry_run_options = 4;
|
||||
}
|
||||
|
||||
// DecisionFeature represents supported PDP (Policy Decision Point) features.
|
||||
enum DecisionFeature {
|
||||
// DECISION_FEATURE_UNSPECIFIED is the default/unspecified value for
|
||||
// DecisionFeature. Asserting this feature has no effect.
|
||||
DECISION_FEATURE_UNSPECIFIED = 0;
|
||||
}
|
||||
|
||||
// DryRunOptions customize the behavior of dry-run decision requests.
|
||||
message DryRunOptions {
|
||||
// GenerateIdentity customizes a dry run by having the PDP generate an identity locally
|
||||
// rather than using a caller-provided identity derived from a cert.
|
||||
DryRunIdentity generate_identity = 1;
|
||||
}
|
||||
|
||||
// DryRunIdentity is a dry run option that allows the caller to request a fake identity be used
|
||||
// for the decision request.
|
||||
message DryRunIdentity {
|
||||
// Username is the teleport username of the identity to be used.
|
||||
string username = 1;
|
||||
}
|
||||
-37
@@ -1,37 +0,0 @@
|
||||
// Copyright 2024 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.decision.v1alpha1;
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/decision/v1alpha1;decisionpb";
|
||||
|
||||
// Resource is the conventional reference type used to refer to the "object" of
|
||||
// an action that is being considered for an authorization decision. For
|
||||
// example, a call to EvaluateSSHAccess would use the Resource type to reference
|
||||
// the ssh node being accessed.
|
||||
message Resource {
|
||||
// Kind is the type of the resource. Required for requests that support
|
||||
// multiple types, otherwise safe to omit.
|
||||
string kind = 1;
|
||||
|
||||
// SubKind is the subtype of the resource. Usually not required as most
|
||||
// resources don't have subkinds, or their subkinds do not have an effect on
|
||||
// authorization decisions.
|
||||
string sub_kind = 2;
|
||||
|
||||
// Name is the unique name of the resource.
|
||||
string name = 3;
|
||||
}
|
||||
Vendored
-93
@@ -1,93 +0,0 @@
|
||||
// Copyright 2024 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.decision.v1alpha1;
|
||||
|
||||
import "google/protobuf/duration.proto";
|
||||
import "teleport/decision/v1alpha1/denial_metadata.proto";
|
||||
import "teleport/decision/v1alpha1/permit_metadata.proto";
|
||||
import "teleport/decision/v1alpha1/request_metadata.proto";
|
||||
import "teleport/decision/v1alpha1/resource.proto";
|
||||
import "teleport/decision/v1alpha1/ssh_identity.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/decision/v1alpha1;decisionpb";
|
||||
|
||||
// EvaluateSSHAccessRequest describes a request to evaluate whether or not a
|
||||
// given ssh access attempt should be permitted.
|
||||
message EvaluateSSHAccessRequest {
|
||||
// Metadata holds common authorization decision request fields.
|
||||
RequestMetadata metadata = 1;
|
||||
|
||||
// SshAuthority identifies the authority that issued the below identity.
|
||||
SSHAuthority ssh_authority = 2;
|
||||
|
||||
// SshIdentity describes the teleport user requesting access.
|
||||
SSHIdentity ssh_identity = 3;
|
||||
|
||||
// Node references the target node the user is attempting to access.
|
||||
Resource node = 4;
|
||||
|
||||
// OSUser is the user on the target node the user is attempting to access.
|
||||
string os_user = 5;
|
||||
}
|
||||
|
||||
// EvaluateSSHAccessResponse describes the result of an SSH access evaluation.
|
||||
message EvaluateSSHAccessResponse {
|
||||
oneof decision {
|
||||
SSHAccessPermit permit = 1;
|
||||
SSHAccessDenial denial = 2;
|
||||
}
|
||||
}
|
||||
|
||||
// SSHAccessPermit describes the parameters/constraints of a permissible SSH
|
||||
// access attempt.
|
||||
message SSHAccessPermit {
|
||||
PermitMetadata metadata = 1;
|
||||
repeated string logins = 2;
|
||||
bool forward_agent = 3;
|
||||
google.protobuf.Duration max_session_ttl = 4;
|
||||
SSHPortForwardMode port_forward_mode = 5;
|
||||
google.protobuf.Duration client_idle_timeout = 6;
|
||||
bool disconnect_expired_cert = 7;
|
||||
repeated string bpf = 8;
|
||||
bool x11_forwarding = 9;
|
||||
int64 max_connections = 10;
|
||||
int64 max_sessions = 11;
|
||||
string lock = 12;
|
||||
bool create_host_user = 13;
|
||||
bool ssh_file_copy = 14;
|
||||
string create_host_user_mode = 15;
|
||||
string create_host_user_shell = 16;
|
||||
repeated string host_groups = 17;
|
||||
repeated string host_sudoers = 18;
|
||||
|
||||
string session_recording_mode = 19;
|
||||
string locking_mode = 20;
|
||||
}
|
||||
|
||||
// SSHAccessDenial describes an SSH access denial.
|
||||
message SSHAccessDenial {
|
||||
DenialMetadata metadata = 1;
|
||||
}
|
||||
|
||||
// SSHPortForwardMode describes the mode of port forwarding permitted.
|
||||
enum SSHPortForwardMode {
|
||||
SSH_PORT_FORWARD_MODE_UNSPECIFIED = 0;
|
||||
SSH_PORT_FORWARD_MODE_OFF = 1;
|
||||
SSH_PORT_FORWARD_MODE_ON = 2;
|
||||
SSH_PORT_FORWARD_MODE_LOCAL = 3;
|
||||
SSH_PORT_FORWARD_MODE_REMOTE = 4;
|
||||
}
|
||||
Vendored
-197
@@ -1,197 +0,0 @@
|
||||
// Copyright 2024 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.decision.v1alpha1;
|
||||
|
||||
import "google/protobuf/timestamp.proto";
|
||||
import "teleport/decision/v1alpha1/tls_identity.proto";
|
||||
import "teleport/trait/v1/trait.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/decision/v1alpha1;decisionpb";
|
||||
|
||||
// SSHAuthority identifies the authority that issued an SSHIdentity.
|
||||
message SSHAuthority {
|
||||
// ClusterName is the name of the issuing cluster.
|
||||
string cluster_name = 1;
|
||||
// AuthorityType is the type of authority that issued the identity.
|
||||
string authority_type = 2;
|
||||
}
|
||||
|
||||
// SSHIdentity is the identity used for SSH connections.
|
||||
message SSHIdentity {
|
||||
// --- common identity fields ---
|
||||
|
||||
// ValidAfter is the unix timestamp that marks the start time for when the certificate should
|
||||
// be considered valid.
|
||||
uint64 valid_after = 1;
|
||||
|
||||
// ValidBefore is the unix timestamp that marks the end time for when the certificate should
|
||||
// be considered valid.
|
||||
uint64 valid_before = 2;
|
||||
|
||||
// CertType indicates what type of cert this is (user or host).
|
||||
uint32 cert_type = 3;
|
||||
|
||||
// Principals is the list of SSH principals associated with the certificate (this means the
|
||||
// list of allowed unix logins in the case of user certs).
|
||||
repeated string principals = 4;
|
||||
|
||||
// --- host identity fields ---
|
||||
|
||||
// ClusterName is the name of the cluster within which a node lives
|
||||
string cluster_name = 5;
|
||||
// SystemRole identifies the system role of a Teleport instance
|
||||
string system_role = 6;
|
||||
|
||||
// -- user identity fields ---
|
||||
|
||||
// Username is teleport username
|
||||
string username = 7;
|
||||
|
||||
// Impersonator is set when a user requests certificate for another user
|
||||
string impersonator = 8;
|
||||
|
||||
// PermitX11Forwarding permits X11 forwarding for this cert
|
||||
bool permit_x11_forwarding = 9;
|
||||
|
||||
// PermitAgentForwarding permits agent forwarding for this cert
|
||||
bool permit_agent_forwarding = 10;
|
||||
|
||||
// PermitPortForwarding permits port forwarding.
|
||||
bool permit_port_forwarding = 11;
|
||||
|
||||
// Roles is a list of roles assigned to this user
|
||||
repeated string roles = 12;
|
||||
|
||||
// RouteToCluster specifies the target cluster
|
||||
// if present in the certificate, will be used
|
||||
// to route the requests to
|
||||
string route_to_cluster = 13;
|
||||
|
||||
// Traits hold claim data used to populate a role at runtime.
|
||||
repeated teleport.trait.v1.Trait traits = 14;
|
||||
|
||||
// ActiveRequests tracks privilege escalation requests applied during
|
||||
// certificate construction.
|
||||
repeated string active_requests = 15;
|
||||
|
||||
// MFAVerified is the UUID of an MFA device when this Identity was
|
||||
// confirmed immediately after an MFA check.
|
||||
string mfa_verified = 16;
|
||||
|
||||
// PreviousIdentityExpires is the expiry time of the identity/cert that this
|
||||
// identity/cert was derived from. It is used to determine a session's hard
|
||||
// deadline in cases where both require_session_mfa and disconnect_expired_cert
|
||||
// are enabled. See https://github.com/gravitational/teleport/issues/18544.
|
||||
google.protobuf.Timestamp previous_identity_expires = 17;
|
||||
|
||||
// LoginIP is an observed IP of the client on the moment of certificate creation.
|
||||
string login_ip = 18;
|
||||
|
||||
// PinnedIP is an IP from which client must communicate with Teleport.
|
||||
string pinned_ip = 19;
|
||||
|
||||
// DisallowReissue flags that any attempt to request new certificates while
|
||||
// authenticated with this cert should be denied.
|
||||
bool disallow_reissue = 20;
|
||||
|
||||
// CertificateExtensions are user configured ssh key extensions (note: this field also
|
||||
// ends up aggregating all *unknown* extensions during cert parsing, meaning that this
|
||||
// can sometimes contain fields that were inserted by a newer version of teleport).
|
||||
repeated CertExtension certificate_extensions = 21;
|
||||
|
||||
// Renewable indicates this certificate is renewable.
|
||||
bool renewable = 22;
|
||||
|
||||
// Generation counts the number of times a certificate has been renewed, with a generation of 1
|
||||
// meaning the cert has never been renewed. A generation of zero means the cert's generation is
|
||||
// not being tracked.
|
||||
uint64 generation = 23;
|
||||
|
||||
// BotName is set to the name of the bot, if the user is a Machine ID bot user.
|
||||
// Empty for human users.
|
||||
string bot_name = 24;
|
||||
|
||||
// BotInstanceID is the unique identifier for the bot instance, if this is a
|
||||
// Machine ID bot. It is empty for human users.
|
||||
string bot_instance_id = 25;
|
||||
|
||||
// AllowedResourceIDs lists the resources the user should be able to access.
|
||||
repeated ResourceId allowed_resource_ids = 26;
|
||||
|
||||
// ConnectionDiagnosticID references the ConnectionDiagnostic that we should use to append traces when testing a Connection.
|
||||
string connection_diagnostic_id = 27;
|
||||
|
||||
// PrivateKeyPolicy is the private key policy supported by this certificate.
|
||||
string private_key_policy = 28;
|
||||
|
||||
// DeviceID is the trusted device identifier.
|
||||
string device_id = 29;
|
||||
|
||||
// DeviceAssetTag is the device inventory identifier.
|
||||
string device_asset_tag = 30;
|
||||
|
||||
// DeviceCredentialID is the identifier for the credential used by the device
|
||||
// to authenticate itself.
|
||||
string device_credential_id = 31;
|
||||
|
||||
// GitHubUserID indicates the GitHub user ID identified by the GitHub
|
||||
// connector.
|
||||
string github_user_id = 32;
|
||||
|
||||
// GitHubUsername indicates the GitHub username identified by the GitHub
|
||||
// connector.
|
||||
string github_username = 33;
|
||||
}
|
||||
|
||||
// CertExtensionMode specifies the type of extension to use in the cert. This type
|
||||
// must be kept up to date with types.CertExtensionMode.
|
||||
enum CertExtensionMode {
|
||||
// CERT_EXTENSION_MODE_UNSPECIFIED is the default value and should not be used.
|
||||
CERT_EXTENSION_MODE_UNSPECIFIED = 0;
|
||||
|
||||
// EXTENSION represents a cert extension that may or may not be
|
||||
// honored by the server.
|
||||
CERT_EXTENSION_MODE_EXTENSION = 1;
|
||||
}
|
||||
|
||||
// CertExtensionType represents the certificate type the extension is for.
|
||||
// Currently only ssh is supported. This type must be kept up to date with
|
||||
// types.CertExtensionType.
|
||||
enum CertExtensionType {
|
||||
// CERT_EXTENSION_TYPE_UNSPECIFIED is the default value and should not be used.
|
||||
CERT_EXTENSION_TYPE_UNSPECIFIED = 0;
|
||||
|
||||
// SSH is used when extending an ssh certificate
|
||||
CERT_EXTENSION_TYPE_SSH = 1;
|
||||
}
|
||||
|
||||
// CertExtension represents a key/value for a certificate extension. This type must
|
||||
// be kept up to date with types.CertExtension.
|
||||
message CertExtension {
|
||||
// Type represents the certificate type being extended, only ssh
|
||||
// is supported at this time.
|
||||
// 0 is "ssh".
|
||||
CertExtensionType type = 1;
|
||||
// Mode is the type of extension to be used -- currently
|
||||
// critical-option is not supported.
|
||||
// 0 is "extension".
|
||||
CertExtensionMode mode = 2;
|
||||
// Name specifies the key to be used in the cert extension.
|
||||
string name = 3;
|
||||
// Value specifies the value to be used in the cert extension.
|
||||
string value = 4;
|
||||
}
|
||||
-64
@@ -1,64 +0,0 @@
|
||||
// Copyright 2024 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.decision.v1alpha1;
|
||||
|
||||
import "teleport/decision/v1alpha1/denial_metadata.proto";
|
||||
import "teleport/decision/v1alpha1/permit_metadata.proto";
|
||||
import "teleport/decision/v1alpha1/request_metadata.proto";
|
||||
import "teleport/decision/v1alpha1/resource.proto";
|
||||
import "teleport/decision/v1alpha1/ssh_identity.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/decision/v1alpha1;decisionpb";
|
||||
|
||||
// EvaluateSSHJoinRequest describes a request to evaluate whether or not a
|
||||
// given ssh session-joining attempt should be permitted.
|
||||
message EvaluateSSHJoinRequest {
|
||||
// Metadata holds common authorization decision request fields.
|
||||
RequestMetadata metadata = 1;
|
||||
|
||||
// SshAuthority identifies the authority that issued the below identity.
|
||||
SSHAuthority ssh_authority = 2;
|
||||
|
||||
// SshIdentity describes the teleport user requesting access.
|
||||
SSHIdentity ssh_identity = 3;
|
||||
|
||||
// Node references the target node the user is attempting to access.
|
||||
Resource node = 4;
|
||||
|
||||
// SessionId is the ID of the session the user is attempting to join.
|
||||
string session_id = 5;
|
||||
}
|
||||
|
||||
// EvaluateSSHJoinResponse describes the result of an SSH session-joining evaluation.
|
||||
message EvaluateSSHJoinResponse {
|
||||
oneof decision {
|
||||
SSHJoinPermit permit = 1;
|
||||
SSHJoinDenial denial = 2;
|
||||
}
|
||||
}
|
||||
|
||||
// SSHJoinPermit describes the parameters/constraints of a permissible SSH
|
||||
// access attempt.
|
||||
message SSHJoinPermit {
|
||||
PermitMetadata metadata = 1;
|
||||
// TODO
|
||||
}
|
||||
|
||||
// SSHJoinDenial describes an SSH session-joining denial.
|
||||
message SSHJoinDenial {
|
||||
DenialMetadata metadata = 1;
|
||||
}
|
||||
Vendored
-249
@@ -1,249 +0,0 @@
|
||||
// Copyright 2024 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.decision.v1alpha1;
|
||||
|
||||
import "google/protobuf/timestamp.proto";
|
||||
import "teleport/trait/v1/trait.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/decision/v1alpha1;decisionpb";
|
||||
|
||||
// TLSIdentity is the identity used for TLS connections.
|
||||
// Must be kept in sync with tlsca.Identity.
|
||||
message TLSIdentity {
|
||||
// Username is the name of the user (for end-users/bots) or the Host ID (for
|
||||
// Teleport processes).
|
||||
string username = 1;
|
||||
|
||||
// Impersonator is a username of a user impersonating this user.
|
||||
string impersonator = 2;
|
||||
|
||||
// Groups is a list of groups (Teleport roles) encoded in the identity.
|
||||
repeated string groups = 3;
|
||||
|
||||
// SystemRoles is a list of system roles (e.g. auth, proxy, node, etc) used in
|
||||
// "multi-role" certificates. Single-role certificates encode the system role
|
||||
// in `Groups` for back-compat reasons.
|
||||
repeated string system_roles = 4;
|
||||
|
||||
// Usage is a list of usage restrictions encoded in the identity.
|
||||
repeated string usage = 5;
|
||||
|
||||
// Principals is a list of Unix logins allowed.
|
||||
repeated string principals = 6;
|
||||
|
||||
// KubernetesGroups is a list of Kubernetes groups allowed.
|
||||
repeated string kubernetes_groups = 7;
|
||||
|
||||
// KubernetesUsers is a list of Kubernetes users allowed.
|
||||
repeated string kubernetes_users = 8;
|
||||
|
||||
// Expires specifies whenever the session will expire.
|
||||
google.protobuf.Timestamp expires = 9;
|
||||
|
||||
// RouteToCluster specifies the target cluster.
|
||||
string route_to_cluster = 10;
|
||||
|
||||
// KubernetesCluster specifies the target kubernetes cluster for TLS
|
||||
// identities. This can be empty on older Teleport clients.
|
||||
string kubernetes_cluster = 11;
|
||||
|
||||
// Traits hold claim data used to populate a role at runtime.
|
||||
repeated teleport.trait.v1.Trait traits = 12;
|
||||
|
||||
// RouteToApp holds routing information for applications. Routing metadata
|
||||
// allows Teleport web proxy to route HTTP requests to the appropriate cluster
|
||||
// and Teleport application proxy within the cluster.
|
||||
RouteToApp route_to_app = 13;
|
||||
|
||||
// TeleportCluster is the name of the teleport cluster that this identity
|
||||
// originated from. For TLS certs this may not be the same as cert issuer, in
|
||||
// case of multi-hop requests that originate from a remote cluster.
|
||||
string teleport_cluster = 14;
|
||||
|
||||
// RouteToDatabase contains routing information for databases.
|
||||
RouteToDatabase route_to_database = 15;
|
||||
|
||||
// DatabaseNames is a list of allowed database names.
|
||||
repeated string database_names = 16;
|
||||
|
||||
// DatabaseUsers is a list of allowed database users.
|
||||
repeated string database_users = 17;
|
||||
|
||||
// MfaVerified is the UUID of an MFA device when this Identity was
|
||||
// confirmed immediately after an MFA check.
|
||||
string mfa_verified = 18;
|
||||
|
||||
// PreviousIdentityExpires is the expiry time of the identity/cert that this
|
||||
// identity/cert was derived from. It is used to determine a session's hard
|
||||
// deadline in cases where both require_session_mfa and
|
||||
// disconnect_expired_cert are enabled.
|
||||
// See https://github.com/gravitational/teleport/issues/18544.
|
||||
google.protobuf.Timestamp previous_identity_expires = 19;
|
||||
|
||||
// LoginIp is an observed IP of the client that this Identity represents.
|
||||
string login_ip = 20;
|
||||
|
||||
// PinnedIp is an IP the certificate is pinned to.
|
||||
string pinned_ip = 21;
|
||||
|
||||
// AwsRoleArns is a list of allowed AWS role ARNs user can assume.
|
||||
repeated string aws_role_arns = 22;
|
||||
|
||||
// AzureIdentities is a list of allowed Azure identities user can assume.
|
||||
repeated string azure_identities = 23;
|
||||
|
||||
// GcpServiceAccounts is a list of allowed GCP service accounts that the user
|
||||
// can assume.
|
||||
repeated string gcp_service_accounts = 24;
|
||||
|
||||
// ActiveRequests is a list of UUIDs of active requests for this Identity.
|
||||
repeated string active_requests = 25;
|
||||
|
||||
// DisallowReissue is a flag that, if set, instructs the auth server to deny
|
||||
// any attempts to reissue new certificates while authenticated with this
|
||||
// certificate.
|
||||
bool disallow_reissue = 26;
|
||||
|
||||
// Renewable indicates that this identity is allowed to renew it's own
|
||||
// credentials. This is only enabled for certificate renewal bots.
|
||||
bool renewable = 27;
|
||||
|
||||
// Generation counts the number of times this certificate has been renewed.
|
||||
uint64 generation = 28;
|
||||
|
||||
// BotName indicates the name of the Machine ID bot this identity was issued
|
||||
// to, if any.
|
||||
string bot_name = 29;
|
||||
|
||||
// BotInstanceId is a unique identifier for Machine ID bots that is persisted
|
||||
// through renewals.
|
||||
string bot_instance_id = 30;
|
||||
|
||||
// AllowedResourceIds lists the resources the identity should be allowed to
|
||||
// access.
|
||||
repeated ResourceId allowed_resource_ids = 31;
|
||||
|
||||
// PrivateKeyPolicy is the private key policy supported by this identity.
|
||||
string private_key_policy = 32;
|
||||
|
||||
// ConnectionDiagnosticId is used to add connection diagnostic messages when
|
||||
// Testing a Connection.
|
||||
string connection_diagnostic_id = 33;
|
||||
|
||||
// DeviceExtensions holds device-aware extensions for the identity.
|
||||
DeviceExtensions device_extensions = 34;
|
||||
|
||||
// UserType indicates if the User was created by an SSO Provider or locally.
|
||||
string user_type = 35;
|
||||
}
|
||||
|
||||
// RouteToApp holds routing information for applications.
|
||||
message RouteToApp {
|
||||
// SessionId is an ID used to identify application sessions created by this
|
||||
// certificate.
|
||||
string session_id = 1;
|
||||
|
||||
// PublicAddr (and ClusterName) are used to route requests issued with this
|
||||
// certificate to the appropriate application proxy/cluster.
|
||||
string public_addr = 2;
|
||||
|
||||
// ClusterName (and PublicAddr) are used to route requests issued with this
|
||||
// certificate to the appropriate application proxy/cluster.
|
||||
string cluster_name = 3;
|
||||
|
||||
// Name is the app name.
|
||||
string name = 4;
|
||||
|
||||
// AwsRoleArn is the AWS role to assume when accessing AWS console.
|
||||
string aws_role_arn = 5;
|
||||
|
||||
// AzureIdentity is the Azure identity to assume when accessing Azure API.
|
||||
string azure_identity = 6;
|
||||
|
||||
// GcpServiceAccount is the GCP service account to assume when accessing GCP
|
||||
// API.
|
||||
string gcp_service_account = 7;
|
||||
|
||||
// Uri is the URI of the app. This is the internal endpoint where the
|
||||
// application is running and isn't user-facing.
|
||||
string uri = 8;
|
||||
|
||||
// TargetPort is the port to which connections should be routed to. Used only
|
||||
// for multi-port TCP apps. It is appended to the hostname from the URI in the
|
||||
// app spec, since the URI from RouteToApp is not used as the source of truth
|
||||
// for routing.
|
||||
int32 target_port = 9;
|
||||
}
|
||||
|
||||
// RouteToDatabase contains routing information for databases.
|
||||
message RouteToDatabase {
|
||||
// ServiceName is the name of the Teleport database proxy service to route
|
||||
// requests to.
|
||||
string service_name = 1;
|
||||
|
||||
// Protocol is the database protocol.
|
||||
//
|
||||
// It is embedded in identity so clients can understand what type of database
|
||||
// this is without contacting server.
|
||||
string protocol = 2;
|
||||
|
||||
// Username is an optional database username to serve as a default username to
|
||||
// connect as.
|
||||
string username = 3;
|
||||
|
||||
// Database is an optional database name to serve as a default database to
|
||||
// connect to.
|
||||
string database = 4;
|
||||
|
||||
// Roles is an optional list of database roles to use for a database session.
|
||||
// This list should be a subset of allowed database roles. If not specified,
|
||||
// Database Service will use all allowed database roles for this database.
|
||||
repeated string roles = 5;
|
||||
}
|
||||
|
||||
// ResourceId is a unique identifier for a teleport resource.
|
||||
// Must be kept in sync with types.ResourceID.
|
||||
message ResourceId {
|
||||
// ClusterName is the name of the cluster the resource is in.
|
||||
string cluster_name = 1;
|
||||
|
||||
// Kind is the resource kind.
|
||||
string kind = 2;
|
||||
|
||||
// Name is the name of the specific resource.
|
||||
string name = 3;
|
||||
|
||||
// SubResourceName is the resource belonging to resource identified by "Name"
|
||||
// that the user is allowed to access to. When granting access to a
|
||||
// subresource, access to other resources is limited. Currently it just
|
||||
// supports resources of Kind=pod and the format is the following
|
||||
// "<kube_namespace>/<kube_pod>".
|
||||
string sub_resource_name = 4;
|
||||
}
|
||||
|
||||
// DeviceExtensions holds device-aware extensions for the identity.
|
||||
message DeviceExtensions {
|
||||
// DeviceId is the trusted device identifier.
|
||||
string device_id = 1;
|
||||
|
||||
// AssetTag is the device inventory identifier.
|
||||
string asset_tag = 2;
|
||||
|
||||
// CredentialId is the identifier for the credential used by the device to
|
||||
// authenticate itself.
|
||||
string credential_id = 3;
|
||||
}
|
||||
-74
@@ -1,74 +0,0 @@
|
||||
// Copyright 2024 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.devicetrust.v1;
|
||||
|
||||
import "teleport/devicetrust/v1/authenticate_challenge.proto";
|
||||
import "teleport/devicetrust/v1/device_collected_data.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/devicetrust/v1;devicetrustv1";
|
||||
|
||||
// Request to assert an enrolled device. Assertion authenticates the device,
|
||||
// regardless of the user driving the assertion.
|
||||
//
|
||||
// Assertion messages are meant to be included by other requests and responses,
|
||||
// either streams or multi-stage RPCs. The ceremony is resolved by a co-located
|
||||
// DeviceTrustService.
|
||||
//
|
||||
// See the lib/devicetrust/assert (client) and lib/devicetrust/assertserver
|
||||
// (server) packages.
|
||||
//
|
||||
// Assertion ceremony flow:
|
||||
// -> AssertDeviceInit (client)
|
||||
// <- AssertDeviceChallenge (server)
|
||||
// -> AssertDeviceChallengeResponse (client)
|
||||
// <- DeviceAsserted (server)
|
||||
//
|
||||
// A successful ceremony signifies that the device is registered, enrolled and
|
||||
// passed the authentication challenge.
|
||||
message AssertDeviceRequest {
|
||||
oneof payload {
|
||||
AssertDeviceInit init = 1;
|
||||
AuthenticateDeviceChallengeResponse challenge_response = 2;
|
||||
TPMAuthenticateDeviceChallengeResponse tpm_challenge_response = 3;
|
||||
}
|
||||
}
|
||||
|
||||
// Response of the device assertion ceremony.
|
||||
// See [AssertDeviceRequest].
|
||||
message AssertDeviceResponse {
|
||||
oneof payload {
|
||||
AuthenticateDeviceChallenge challenge = 1;
|
||||
TPMAuthenticateDeviceChallenge tpm_challenge = 2;
|
||||
DeviceAsserted device_asserted = 3;
|
||||
}
|
||||
}
|
||||
|
||||
// AssertDeviceInit initiates the device assertion ceremony.
|
||||
// See [AssertDeviceRequest].
|
||||
message AssertDeviceInit {
|
||||
// ID of the enrolled device credential.
|
||||
string credential_id = 1;
|
||||
|
||||
// Device collected data.
|
||||
// Matched against the device registration information and any previously
|
||||
// collected data.
|
||||
DeviceCollectedData device_data = 2;
|
||||
}
|
||||
|
||||
// DeviceAsserted marks a successful device assertion ceremony.
|
||||
// See [AssertDeviceRequest].
|
||||
message DeviceAsserted {}
|
||||
-58
@@ -1,58 +0,0 @@
|
||||
// Copyright 2022 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.devicetrust.v1;
|
||||
|
||||
import "teleport/devicetrust/v1/tpm.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/devicetrust/v1;devicetrustv1";
|
||||
|
||||
// AuthenticateDeviceChallenge carries the authentication challenge.
|
||||
message AuthenticateDeviceChallenge {
|
||||
// Randomly-generated, opaque challenge to be signed using the device key.
|
||||
bytes challenge = 1;
|
||||
}
|
||||
|
||||
// AuthenticateDeviceChallengeResponse carries the authentication challenge
|
||||
// response.
|
||||
message AuthenticateDeviceChallengeResponse {
|
||||
// Signature over the challenge, using the device key.
|
||||
bytes signature = 1;
|
||||
// Signature over the challenge, using the SSH key. This is required when the
|
||||
// SSH and TLS public keys do not match, to prove ownership of the private key
|
||||
// associated with the SSH certificate being augmented.
|
||||
bytes ssh_signature = 2;
|
||||
}
|
||||
|
||||
// TPMAuthenticateDeviceChallenge carries the authentication challenge
|
||||
// specific to TPMs.
|
||||
message TPMAuthenticateDeviceChallenge {
|
||||
// Randomly-generated nonce to be used during platform attestation by the
|
||||
// TPM.
|
||||
bytes attestation_nonce = 1;
|
||||
}
|
||||
|
||||
// TPMAuthenticateDeviceChallengeResponse carries the authentication challenge
|
||||
// response specific to TPMs.
|
||||
message TPMAuthenticateDeviceChallengeResponse {
|
||||
// The result of the client's platform attestation with the nonce provided
|
||||
// in `TPMAuthenticateDeviceChallenge`.
|
||||
TPMPlatformParameters platform_parameters = 1;
|
||||
// Signature over the attestation_nonce, using the SSH key. This is required
|
||||
// when the SSH and TLS public keys do not match, to prove ownership of the
|
||||
// private key associated with the SSH certificate being augmented.
|
||||
bytes ssh_signature = 2;
|
||||
}
|
||||
-137
@@ -1,137 +0,0 @@
|
||||
// Copyright 2022 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.devicetrust.v1;
|
||||
|
||||
import "google/protobuf/timestamp.proto";
|
||||
import "teleport/devicetrust/v1/device_collected_data.proto";
|
||||
import "teleport/devicetrust/v1/device_enroll_token.proto";
|
||||
import "teleport/devicetrust/v1/device_profile.proto";
|
||||
import "teleport/devicetrust/v1/device_source.proto";
|
||||
import "teleport/devicetrust/v1/os_type.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/devicetrust/v1;devicetrustv1";
|
||||
|
||||
// Device represents a registered device.
|
||||
// Registered devices may be enrolled. Enrolled devices are allowed to perform
|
||||
// device-aware actions.
|
||||
message Device {
|
||||
// API version of the Device definition, present for compatibility with
|
||||
// types.DeviceV1.
|
||||
// Always "v1".
|
||||
string api_version = 1;
|
||||
|
||||
// Unique device identifier.
|
||||
// System managed.
|
||||
string id = 2;
|
||||
|
||||
// Device operating system.
|
||||
// Required.
|
||||
OSType os_type = 3;
|
||||
|
||||
// Device inventory identifier.
|
||||
// Takes different meanings depending on the device and operating system.
|
||||
// For macOS devices it is the device serial number.
|
||||
// Required.
|
||||
string asset_tag = 4;
|
||||
|
||||
// Create time.
|
||||
// System managed.
|
||||
google.protobuf.Timestamp create_time = 5;
|
||||
|
||||
// Last update time.
|
||||
// System managed.
|
||||
google.protobuf.Timestamp update_time = 6;
|
||||
|
||||
// Enrollment token for the device.
|
||||
// Only present in situations where device creation and enrollment are rolled
|
||||
// into a single operation.
|
||||
// Transient.
|
||||
DeviceEnrollToken enroll_token = 7;
|
||||
|
||||
// Enrollment status of the device.
|
||||
// May be changed to DEVICE_ENROLL_STATUS_NOT_ENROLLED at any time to
|
||||
// forcefully unenroll a device (server-side only).
|
||||
// System managed.
|
||||
DeviceEnrollStatus enroll_status = 8;
|
||||
|
||||
// Currently enrolled device credential.
|
||||
// Manually unenrolling a device clears the credential.
|
||||
// System managed.
|
||||
DeviceCredential credential = 9;
|
||||
|
||||
// Device data collected during enrollment and device authentication.
|
||||
// Enrollment data is always present, while authentication data is capped at N
|
||||
// most recent events.
|
||||
// Only present in certain read modes.
|
||||
// Transient.
|
||||
repeated DeviceCollectedData collected_data = 10;
|
||||
|
||||
// Source of the device.
|
||||
// Devices managed directly via Teleport (`tctl`, Web UI, etc) have no
|
||||
// assigned source.
|
||||
DeviceSource source = 11;
|
||||
|
||||
// Device information acquired from an external source.
|
||||
DeviceProfile profile = 12;
|
||||
|
||||
// Device owner.
|
||||
// Usually the owner is the same user who performed the enrollment ceremony.
|
||||
// May be empty for legacy devices (Teleport v13.2 and older).
|
||||
// Manually unenrolling a device clears the owner.
|
||||
// System-managed.
|
||||
string owner = 13;
|
||||
}
|
||||
|
||||
// DeviceCredential represents the current enrolled public key of a device.
|
||||
message DeviceCredential {
|
||||
// Unique identifier of the credential, defined client-side.
|
||||
string id = 1;
|
||||
// Device public key marshaled as a PKIX, ASN.1 DER. Used only on MacOS.
|
||||
bytes public_key_der = 2;
|
||||
// The degree to which the device credential is attested.
|
||||
DeviceAttestationType device_attestation_type = 3;
|
||||
// For TPM devices, the serial number of the TPM endorsement certificate.
|
||||
string tpm_ekcert_serial = 4;
|
||||
// For TPM devices, the encoded TPMT_PUBLIC structure containing the
|
||||
// attestation public key and signing parameters.
|
||||
bytes tpm_ak_public = 5;
|
||||
}
|
||||
|
||||
// AttestationType indicates the degree to which the device credential has
|
||||
// been attested.
|
||||
enum DeviceAttestationType {
|
||||
// Bare public key which has only verified with proof of ownership.
|
||||
// Used on macOS.
|
||||
DEVICE_ATTESTATION_TYPE_UNSPECIFIED = 0;
|
||||
// Credential was verified through a TPM EK->AK chain on enrollment.
|
||||
DEVICE_ATTESTATION_TYPE_TPM_EKPUB = 1;
|
||||
// Credential was verified through a TPM EKCert->AK chain on enrollment,
|
||||
// but no allow-listed CAs were configured to validate this EKCert against.
|
||||
DEVICE_ATTESTATION_TYPE_TPM_EKCERT = 2;
|
||||
// Credential was verified through a TPM EKCert->AK chain on enrollment, and
|
||||
// the EKCert was signed by a configured allow-listed CA.
|
||||
DEVICE_ATTESTATION_TYPE_TPM_EKCERT_TRUSTED = 3;
|
||||
}
|
||||
|
||||
// DeviceEnrollStatus represents the enrollment status of a device.
|
||||
enum DeviceEnrollStatus {
|
||||
DEVICE_ENROLL_STATUS_UNSPECIFIED = 0;
|
||||
// Device is registered but not enrolled.
|
||||
DEVICE_ENROLL_STATUS_NOT_ENROLLED = 1;
|
||||
// Device is registered and enrolled.
|
||||
DEVICE_ENROLL_STATUS_ENROLLED = 2;
|
||||
}
|
||||
integrations/operator/crdgen/testdata/protofiles/teleport/devicetrust/v1/device_collected_data.proto
Vendored
-106
@@ -1,106 +0,0 @@
|
||||
// Copyright 2022 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.devicetrust.v1;
|
||||
|
||||
import "google/protobuf/timestamp.proto";
|
||||
import "teleport/devicetrust/v1/os_type.proto";
|
||||
import "teleport/devicetrust/v1/tpm.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/devicetrust/v1;devicetrustv1";
|
||||
|
||||
// DeviceCollectedData contains information gathered from the device during
|
||||
// various ceremonies.
|
||||
// Gathered information must match, within reason, the original registration
|
||||
// data and previous instances of collected data.
|
||||
message DeviceCollectedData {
|
||||
// Time of data collection, set by the client.
|
||||
// Required.
|
||||
google.protobuf.Timestamp collect_time = 1;
|
||||
|
||||
// Time of data collection, as received by the server.
|
||||
// System managed.
|
||||
google.protobuf.Timestamp record_time = 2;
|
||||
|
||||
// Device operating system.
|
||||
// Required.
|
||||
OSType os_type = 3;
|
||||
|
||||
// Device serial number used to match the device with the inventory.
|
||||
// This field is one of the three following
|
||||
// values in this precedence:
|
||||
// - reported_asset_tag
|
||||
// - system_serial_number
|
||||
// - base_board_serial_number
|
||||
// Required.
|
||||
string serial_number = 4;
|
||||
|
||||
// Non-descriptive model identifier.
|
||||
// Example: "MacBookPro9,2".
|
||||
string model_identifier = 5;
|
||||
|
||||
// OS version number, without the leading 'v'.
|
||||
// Example: "13.2.1".
|
||||
string os_version = 6;
|
||||
|
||||
// OS build identifier. Augments the os_version.
|
||||
// May match either the DeviceProfile os_build or os_build_supplemental.
|
||||
// Example: "22D68" or "22F770820d".
|
||||
string os_build = 7;
|
||||
|
||||
// OS username (distinct from the Teleport user).
|
||||
string os_username = 8;
|
||||
|
||||
// Jamf binary version, without the leading 'v'.
|
||||
// Example: "9.27" or "10.44.1-t1677509507".
|
||||
string jamf_binary_version = 9;
|
||||
|
||||
// Unmodified output of `/usr/bin/profiles status -type enrollment`.
|
||||
// Used to verify the presence of an enrollment profile.
|
||||
string macos_enrollment_profiles = 10;
|
||||
|
||||
// The asset tag of the device as reported by the BIOS DMI Type 3. Tools
|
||||
// used by customers to manage their fleet may set this value.
|
||||
string reported_asset_tag = 11;
|
||||
|
||||
// The serial number of the "system" as reported by the BIOS DMI Type 1.
|
||||
// This field can be empty if no value has been configured.
|
||||
string system_serial_number = 12;
|
||||
|
||||
// The serial number of the "base board" as reported by BIOS DMI Type 2.
|
||||
// This field can be empty if no value has been configured.
|
||||
string base_board_serial_number = 13;
|
||||
|
||||
// If during the collection of this device data, the device performed a TPM
|
||||
// platform attestation (e.g during enrollment or authentication), then this
|
||||
// field holds the record of this attestation. This allows the state of the
|
||||
// device to be compared to historical state, and allows for the platform
|
||||
// attestations to be revalidated at a later date.
|
||||
//
|
||||
// This field is not explicitly sent up by the client, and any DCD sent by a
|
||||
// client including this field should be rejected. The server should inject
|
||||
// this field once verifying that the submitted platform attestation during
|
||||
// the enrollment or authentication.
|
||||
//
|
||||
// System managed.
|
||||
TPMPlatformAttestation tpm_platform_attestation = 14;
|
||||
|
||||
// OS identifier.
|
||||
// Mainly used to differentiate Linux distros, as there is be no variation
|
||||
// for systems like macOS or Windows.
|
||||
// Example: "ubuntu", "centos", "fedora", "rhel".
|
||||
string os_id = 15;
|
||||
}
|
||||
-36
@@ -1,36 +0,0 @@
|
||||
// Copyright 2024 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.devicetrust.v1;
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/devicetrust/v1;devicetrustv1";
|
||||
|
||||
// A device confirmation token marks the last step of device web authentication.
|
||||
// It is acquired at the end of a successful AuthenticateDevice stream and
|
||||
// exchanged during the ConfirmDeviceWebAuthentication RPC.
|
||||
//
|
||||
// See
|
||||
// https://github.com/gravitational/teleport.e/blob/master/rfd/0009e-device-trust-web-support.md#device-confirmation-token.
|
||||
message DeviceConfirmationToken {
|
||||
// Opaque token identifier.
|
||||
// System-generated.
|
||||
string id = 1;
|
||||
|
||||
// Opaque device confirmation token, in plaintext, encoded in
|
||||
// base64.RawURLEncoding (so it is inherently safe for URl use).
|
||||
// System-generated.
|
||||
string token = 2;
|
||||
}
|
||||
Vendored
-32
@@ -1,32 +0,0 @@
|
||||
// Copyright 2022 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.devicetrust.v1;
|
||||
|
||||
import "google/protobuf/timestamp.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/devicetrust/v1;devicetrustv1";
|
||||
|
||||
// DeviceEnrollToken encapsulates the permission, granted by a device
|
||||
// administrator to an user, to enroll a device.
|
||||
// An enrolled device allows its user to perform device-aware actions.
|
||||
message DeviceEnrollToken {
|
||||
// Opaque enrollement token required by the EnrollDevice RPC.
|
||||
string token = 1;
|
||||
|
||||
// Expiration time for the token.
|
||||
google.protobuf.Timestamp expire_time = 2;
|
||||
}
|
||||
Vendored
-64
@@ -1,64 +0,0 @@
|
||||
// Copyright 2023 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.devicetrust.v1;
|
||||
|
||||
import "google/protobuf/timestamp.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/devicetrust/v1;devicetrustv1";
|
||||
|
||||
// Device profile information acquired from an external source.
|
||||
// If present, it's used to further validate collected data.
|
||||
message DeviceProfile {
|
||||
// Latest profile update time.
|
||||
// System managed.
|
||||
google.protobuf.Timestamp update_time = 1;
|
||||
|
||||
// Non-descriptive model identifier.
|
||||
// Example: "MacBookPro9,2".
|
||||
string model_identifier = 2;
|
||||
|
||||
// OS version number, without the leading 'v'.
|
||||
// See the Device's os_type for the general OS category.
|
||||
// Example: "13.2.1".
|
||||
string os_version = 3;
|
||||
|
||||
// OS build identifier. Augments the os_version.
|
||||
// Example: "22D68".
|
||||
string os_build = 4;
|
||||
|
||||
// Known OS users (distinct from the Teleport user).
|
||||
repeated string os_usernames = 5;
|
||||
|
||||
// Jamf binary version, without the leading 'v'.
|
||||
// Example: "9.27" or "10.44.1-t1677509507".
|
||||
string jamf_binary_version = 6;
|
||||
|
||||
// External device identifier, for example the Jamf or Intune ID.
|
||||
string external_id = 7;
|
||||
|
||||
// OS build supplemental number.
|
||||
// May match `sw_vers` BuildVersion more closely in certain situations, like
|
||||
// macOS rapid security response builds.
|
||||
// Example: "22F770820d".
|
||||
string os_build_supplemental = 8;
|
||||
|
||||
// OS identifier.
|
||||
// Mainly used to differentiate Linux distros, as there is be no variation
|
||||
// for systems like macOS or Windows.
|
||||
// Example: "ubuntu", "centos", "fedora", "rhel".
|
||||
string os_id = 9;
|
||||
}
|
||||
Vendored
-47
@@ -1,47 +0,0 @@
|
||||
// Copyright 2023 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.devicetrust.v1;
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/devicetrust/v1;devicetrustv1";
|
||||
|
||||
// Source of device, for devices that are managed by external systems
|
||||
// (for example, MDMs).
|
||||
message DeviceSource {
|
||||
// Name of the source.
|
||||
// Matches the name of the corresponding MDM service, if applicable.
|
||||
// Readonly.
|
||||
string name = 1;
|
||||
|
||||
// Origin of the source.
|
||||
// Readonly.
|
||||
DeviceOrigin origin = 2;
|
||||
}
|
||||
|
||||
// Origin of a device.
|
||||
enum DeviceOrigin {
|
||||
// Unspecified or absent origin.
|
||||
DEVICE_ORIGIN_UNSPECIFIED = 0;
|
||||
|
||||
// Devices originated from direct API usage.
|
||||
DEVICE_ORIGIN_API = 1;
|
||||
|
||||
// Devices originated from Jamf sync.
|
||||
DEVICE_ORIGIN_JAMF = 2;
|
||||
|
||||
// Source originated from Microsoft Intune sync.
|
||||
DEVICE_ORIGIN_INTUNE = 3;
|
||||
}
|
||||
Vendored
-63
@@ -1,63 +0,0 @@
|
||||
// Copyright 2024 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.devicetrust.v1;
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/devicetrust/v1;devicetrustv1";
|
||||
|
||||
// A device web token is a token used to device-authenticate a Web UI session.
|
||||
//
|
||||
// Tokens are generally acquired on login and exchanged for a single
|
||||
// on-behalf-of device authentication attempt, performed by Connect.
|
||||
//
|
||||
// See
|
||||
// https://github.com/gravitational/teleport.e/blob/master/rfd/0009e-device-trust-web-support.md#device-web-token.
|
||||
message DeviceWebToken {
|
||||
// Opaque token identifier.
|
||||
// Required for token usage.
|
||||
// System-generated.
|
||||
string id = 1;
|
||||
|
||||
// Opaque device web token, in plaintext, encoded in base64.RawURLEncoding
|
||||
// (so it is inherently safe for URl use).
|
||||
// Required for token usage.
|
||||
// System-generated.
|
||||
string token = 2;
|
||||
|
||||
// Identifier for the Web Session being device-authorized.
|
||||
// Required for creation.
|
||||
string web_session_id = 3;
|
||||
|
||||
// Browser user agent, as acquired from the Web UI browser.
|
||||
// Used as part of expected device checks.
|
||||
// Required for creation.
|
||||
string browser_user_agent = 4;
|
||||
|
||||
// Browser public IP, as acquired from the Web UI browser.
|
||||
// Used as part of expected device checks.
|
||||
// Required for creation.
|
||||
string browser_ip = 5;
|
||||
|
||||
// Owner of the Web Session and trusted device.
|
||||
// Used internally by the Device Trust system.
|
||||
// Transient.
|
||||
string user = 6;
|
||||
|
||||
// ID of the devices allowed to perform on-behalf-of device authentication.
|
||||
// Used internally by the Device Trust system.
|
||||
// Transient.
|
||||
repeated string expected_device_ids = 7;
|
||||
}
|
||||
Vendored
-683
@@ -1,683 +0,0 @@
|
||||
// Copyright 2022 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.devicetrust.v1;
|
||||
|
||||
import "google/protobuf/empty.proto";
|
||||
import "google/protobuf/field_mask.proto";
|
||||
import "google/protobuf/timestamp.proto";
|
||||
import "google/rpc/status.proto";
|
||||
import "teleport/devicetrust/v1/authenticate_challenge.proto";
|
||||
import "teleport/devicetrust/v1/device.proto";
|
||||
import "teleport/devicetrust/v1/device_collected_data.proto";
|
||||
import "teleport/devicetrust/v1/device_confirmation_token.proto";
|
||||
import "teleport/devicetrust/v1/device_enroll_token.proto";
|
||||
import "teleport/devicetrust/v1/device_source.proto";
|
||||
import "teleport/devicetrust/v1/device_web_token.proto";
|
||||
import "teleport/devicetrust/v1/tpm.proto";
|
||||
import "teleport/devicetrust/v1/usage.proto";
|
||||
import "teleport/devicetrust/v1/user_certificates.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/devicetrust/v1;devicetrustv1";
|
||||
|
||||
// DeviceTrustService provides methods to manage, enroll and authenticate
|
||||
// trusted devices.
|
||||
//
|
||||
// A trusted device is a device that is registered and enrolled with Teleport,
|
||||
// thus allowing the system to provide some guarantees about its provenance and
|
||||
// state.
|
||||
//
|
||||
// Managing devices requires the corresponding CRUD "device" permission.
|
||||
// Additionally, creating enrollment tokens requires the "create_enroll_token"
|
||||
// permission and enrolling devices requires the "enroll" permission. See
|
||||
// CreateDevice, CreateDeviceEnrollToken and EnrollDevice for reference.
|
||||
//
|
||||
// An authenticated, trusted device allows its user to perform device-aware
|
||||
// actions. Such actions include accessing an SSH node, managing sensitive
|
||||
// resources via `tctl`, etc. The enforcement mode is defined via cluster-wide
|
||||
// and/or per-role toggles. Device authentication is automatic for enrolled
|
||||
// devices communicating with Enterprise clusters. See AuthenticateDevice for
|
||||
// reference.
|
||||
//
|
||||
// Device Trust is a Teleport Enterprise feature. Open Source Teleport clusters
|
||||
// treat all Device RPCs as unimplemented (which, in fact, they are for OSS.)
|
||||
service DeviceTrustService {
|
||||
// CreateDevice creates a device, effectively registering it on Teleport.
|
||||
// Devices need to be registered before they can be enrolled.
|
||||
//
|
||||
// It is possible to create both a Device and a DeviceEnrollToken in a
|
||||
// single invocation, see CreateDeviceRequest.create_enroll_token.
|
||||
rpc CreateDevice(CreateDeviceRequest) returns (Device);
|
||||
|
||||
// UpdateDevice is a masked device update.
|
||||
//
|
||||
// Only certain fields may be updated, see Device for details.
|
||||
rpc UpdateDevice(UpdateDeviceRequest) returns (Device);
|
||||
|
||||
// UpsertDevice creates or updates a device.
|
||||
//
|
||||
// UpsertDevice attempts a write of all mutable fields on updates, therefore
|
||||
// reading a fresh copy of the device is recommended. Update semantics still
|
||||
// apply.
|
||||
rpc UpsertDevice(UpsertDeviceRequest) returns (Device);
|
||||
|
||||
// DeleteDevice hard-deletes a device, removing it and all collected data
|
||||
// history from the system.
|
||||
//
|
||||
// Prefer locking the device instead (see the `tctl lock` command). Deleting a
|
||||
// device doesn't invalidate existing device certificates, but does prevent
|
||||
// new device authentication ceremonies from occurring.
|
||||
//
|
||||
// Use with caution.
|
||||
rpc DeleteDevice(DeleteDeviceRequest) returns (google.protobuf.Empty);
|
||||
|
||||
// FindDevices retrieves devices by device ID and/or asset tag.
|
||||
//
|
||||
// It provides an in-between search between fetching a device by ID and
|
||||
// listing all devices.
|
||||
//
|
||||
// ID matches are guaranteed to be present in the response.
|
||||
rpc FindDevices(FindDevicesRequest) returns (FindDevicesResponse);
|
||||
|
||||
// GetDevice retrieves a device by ID.
|
||||
rpc GetDevice(GetDeviceRequest) returns (Device);
|
||||
|
||||
// ListDevices lists all registered devices.
|
||||
rpc ListDevices(ListDevicesRequest) returns (ListDevicesResponse);
|
||||
|
||||
// ListDevicesByUser lists all devices owned by the user
|
||||
rpc ListDevicesByUser(ListDevicesByUserRequest) returns (ListDevicesByUserResponse);
|
||||
|
||||
// BulkCreateDevices is a bulk variant of CreateDevice.
|
||||
//
|
||||
// Unlike CreateDevice, it does not support creation of enrollment tokens, as
|
||||
// it is meant for bulk inventory registration.
|
||||
rpc BulkCreateDevices(BulkCreateDevicesRequest) returns (BulkCreateDevicesResponse);
|
||||
|
||||
// CreateDeviceEnrollToken creates a DeviceEnrollToken for a Device.
|
||||
// An enrollment token is required for the enrollment ceremony. See
|
||||
// EnrollDevice.
|
||||
rpc CreateDeviceEnrollToken(CreateDeviceEnrollTokenRequest) returns (DeviceEnrollToken);
|
||||
|
||||
// EnrollDevice performs the device enrollment ceremony.
|
||||
//
|
||||
// Enrollment requires a previously-registered Device and a DeviceEnrollToken,
|
||||
// see CreateDevice and CreateDeviceEnrollToken.
|
||||
//
|
||||
// An enrolled device is allowed, via AuthenticateDevice, to acquire
|
||||
// certificates containing device extensions, thus gaining access to
|
||||
// device-aware actions.
|
||||
//
|
||||
// macOS enrollment flow:
|
||||
// -> EnrollDeviceInit (client)
|
||||
// <- MacOSEnrollChallenge (server)
|
||||
// -> MacOSEnrollChallengeResponse
|
||||
// <- EnrollDeviceSuccess
|
||||
//
|
||||
// TPM enrollment flow:
|
||||
// -> EnrollDeviceInit (client)
|
||||
// <- TPMEnrollChallenge (server)
|
||||
// -> TPMEnrollChallengeResponse
|
||||
// <- EnrollDeviceSuccess
|
||||
rpc EnrollDevice(stream EnrollDeviceRequest) returns (stream EnrollDeviceResponse);
|
||||
|
||||
// AuthenticateDevice performs the device authentication ceremony.
|
||||
//
|
||||
// Device authentication exchanges existing user certificates without device
|
||||
// extensions for certificates augmented with device extensions. The new
|
||||
// certificates allow the user to perform device-aware actions.
|
||||
//
|
||||
// Only registered and enrolled devices may perform device authentication.
|
||||
rpc AuthenticateDevice(stream AuthenticateDeviceRequest) returns (stream AuthenticateDeviceResponse);
|
||||
|
||||
// ConfirmDeviceWebAuthentication finalizes the device web authentication
|
||||
// ceremony started by the creation of a DeviceWebToken and subsequent
|
||||
// AuthenticateDevice call.
|
||||
//
|
||||
// The DeviceConfirmationToken issued by AuthenticateDevice is spent in this
|
||||
// method, which consequently augments the corresponding Web Session
|
||||
// certificates with device extensions.
|
||||
//
|
||||
// This method must be called by the Teleport Proxy, and the Proxy itself must
|
||||
// be called by the same browser that started the on-behalf-of authentication
|
||||
// attempt. See the /webapi/device/webconfirm endpoint.
|
||||
//
|
||||
// See
|
||||
// https://github.com/gravitational/teleport.e/blob/master/rfd/0009e-device-trust-web-support.md#device-web-authentication.
|
||||
rpc ConfirmDeviceWebAuthentication(ConfirmDeviceWebAuthenticationRequest) returns (ConfirmDeviceWebAuthenticationResponse);
|
||||
|
||||
// Syncs device inventory from a source exterior to Teleport, for example an
|
||||
// MDM.
|
||||
// Allows both partial and full syncs; for the latter, devices missing from
|
||||
// the external inventory are handled as specified.
|
||||
// Authorized either by a valid MDM service certificate or the appropriate
|
||||
// "device" permissions (create/update/delete).
|
||||
rpc SyncInventory(stream SyncInventoryRequest) returns (stream SyncInventoryResponse);
|
||||
|
||||
// Superseded by ResourceUsageService.GetUsage.
|
||||
rpc GetDevicesUsage(GetDevicesUsageRequest) returns (DevicesUsage) {
|
||||
option deprecated = true;
|
||||
}
|
||||
}
|
||||
|
||||
// Request for CreateDevice.
|
||||
message CreateDeviceRequest {
|
||||
// Device to create.
|
||||
Device device = 1;
|
||||
|
||||
// If true, a DeviceEnrollToken is created along with the Device.
|
||||
bool create_enroll_token = 2;
|
||||
|
||||
// If true, create the device as a Teleport resource, meaning that fields that
|
||||
// are usually considered read-only or system managed are copied as provided
|
||||
// to storage.
|
||||
// Prefer using non-resource creation semantics if possible.
|
||||
bool create_as_resource = 3;
|
||||
|
||||
// Custom expiration time for enrollment tokens.
|
||||
// A short (for humans) server default is used if unset.
|
||||
google.protobuf.Timestamp enroll_token_expire_time = 4;
|
||||
}
|
||||
|
||||
// Request for UpdateDevice.
|
||||
message UpdateDeviceRequest {
|
||||
// Device to update.
|
||||
Device device = 1;
|
||||
|
||||
// Update mask applied to the resource.
|
||||
// Fields are masked according to their proto name.
|
||||
google.protobuf.FieldMask update_mask = 2;
|
||||
}
|
||||
|
||||
// Request for UpsertDevice.
|
||||
message UpsertDeviceRequest {
|
||||
// Device to create or update.
|
||||
Device device = 1;
|
||||
|
||||
// If true, creates the device using resource semantics.
|
||||
// Has no effect on device updates.
|
||||
// See create_as_resource in CreateDeviceRequest.
|
||||
bool create_as_resource = 2;
|
||||
}
|
||||
|
||||
// Request for DeleteDevice.
|
||||
message DeleteDeviceRequest {
|
||||
// ID of the Device to delete.
|
||||
string device_id = 1;
|
||||
}
|
||||
|
||||
// Request for FindDevices.
|
||||
//
|
||||
// Inspect the returned devices to determine whether the match was by ID or
|
||||
// asset tag.
|
||||
message FindDevicesRequest {
|
||||
// Device ID or asset tag.
|
||||
string id_or_tag = 1;
|
||||
}
|
||||
|
||||
// Response for FindDevices.
|
||||
message FindDevicesResponse {
|
||||
// Devices that matched the search.
|
||||
// The number of resulting devices is expected to be low and may be
|
||||
// artificially capped by the server otherwise.
|
||||
repeated Device devices = 1;
|
||||
}
|
||||
|
||||
// Request for GetDevice.
|
||||
message GetDeviceRequest {
|
||||
// ID of the device.
|
||||
string device_id = 1;
|
||||
}
|
||||
|
||||
// Request for ListDevices.
|
||||
//
|
||||
// Follows the pagination semantics of
|
||||
// https://cloud.google.com/apis/design/standard_methods#list.
|
||||
message ListDevicesRequest {
|
||||
// The maximum number of items to return.
|
||||
// The server may impose a different page size at its discretion.
|
||||
int32 page_size = 1;
|
||||
|
||||
// The next_page_token value returned from a previous List request, if any.
|
||||
string page_token = 2;
|
||||
|
||||
// Specifies which fields of the resource should be returned in the response.
|
||||
// Defaults to DEVICE_VIEW_LIST.
|
||||
DeviceView view = 3;
|
||||
}
|
||||
|
||||
// Response for ListDevices.
|
||||
message ListDevicesResponse {
|
||||
// Devices that matched the search.
|
||||
repeated Device devices = 1;
|
||||
|
||||
// Token to retrieve the next page of results, or empty if there are no
|
||||
// more results in the list.
|
||||
string next_page_token = 2;
|
||||
}
|
||||
|
||||
// Request for ListDevicesByUser.
|
||||
//
|
||||
// Follows the pagination semantics of
|
||||
// https://cloud.google.com/apis/design/standard_methods#list.
|
||||
message ListDevicesByUserRequest {
|
||||
reserved 3;
|
||||
reserved "view";
|
||||
// The maximum number of items to return.
|
||||
// The server may impose a different page size at its discretion.
|
||||
int32 page_size = 1;
|
||||
|
||||
// The next_page_token value returned from a previous List request, if any.
|
||||
string page_token = 2;
|
||||
}
|
||||
|
||||
// Response for ListDevicesByUser.
|
||||
message ListDevicesByUserResponse {
|
||||
// Devices owned by the user.
|
||||
repeated Device devices = 1;
|
||||
|
||||
// Token to retrieve the next page of results, or empty if there are no
|
||||
// more results in the list.
|
||||
string next_page_token = 2;
|
||||
}
|
||||
|
||||
// DeviceView specifies which fields of returned devices should be present.
|
||||
enum DeviceView {
|
||||
DEVICE_VIEW_UNSPECIFIED = 0;
|
||||
|
||||
// View for general device listings, like `tctl devices ls`.
|
||||
// Contains only basic information, such as IDs and enrollment status.
|
||||
DEVICE_VIEW_LIST = 1;
|
||||
|
||||
// View for detailed device queries, like `tctl get devices`.
|
||||
// Presents a complete view of the device.
|
||||
DEVICE_VIEW_RESOURCE = 2;
|
||||
}
|
||||
|
||||
// Request for BulkCreateDevices.
|
||||
message BulkCreateDevicesRequest {
|
||||
// Devices to create.
|
||||
repeated Device devices = 1;
|
||||
|
||||
// If true, create the device as a Teleport resource, meaning that fields that
|
||||
// are usually considered read-only or system managed are copied as provided
|
||||
// to storage.
|
||||
// Prefer using non-resource creation semantics if possible.
|
||||
bool create_as_resource = 2;
|
||||
}
|
||||
|
||||
// Response for BulkCreateDevices.
|
||||
message BulkCreateDevicesResponse {
|
||||
// Created devices or a failure reason.
|
||||
// Responses are sorted according to the request.
|
||||
repeated DeviceOrStatus devices = 1;
|
||||
}
|
||||
|
||||
// DeviceOrStatus contains either a device ID, in case of success, or a status
|
||||
// in case of failures.
|
||||
message DeviceOrStatus {
|
||||
// Status of the operation.
|
||||
// May either be absent or contain the OK code for successes, at the
|
||||
// implementation's discretion.
|
||||
google.rpc.Status status = 1;
|
||||
|
||||
// ID of the created device.
|
||||
// Only present if the status is OK.
|
||||
string id = 2;
|
||||
|
||||
// If true the action attempted against the device was a delete, instead of a
|
||||
// create or update.
|
||||
bool deleted = 3;
|
||||
}
|
||||
|
||||
// Request for CreateDeviceEnrollToken.
|
||||
message CreateDeviceEnrollTokenRequest {
|
||||
// ID of the device.
|
||||
string device_id = 1;
|
||||
|
||||
// Device collected data.
|
||||
// Used to authorize issuance of device enrollment tokens for auto-enrollment.
|
||||
// Not required otherwise.
|
||||
DeviceCollectedData device_data = 2;
|
||||
|
||||
// Custom expiration time for enrollment tokens.
|
||||
// A short (for humans) server default is used if unset.
|
||||
google.protobuf.Timestamp expire_time = 3;
|
||||
}
|
||||
|
||||
// Request for EnrollDevice.
|
||||
message EnrollDeviceRequest {
|
||||
oneof payload {
|
||||
EnrollDeviceInit init = 1;
|
||||
MacOSEnrollChallengeResponse macos_challenge_response = 2;
|
||||
TPMEnrollChallengeResponse tpm_challenge_response = 3;
|
||||
}
|
||||
}
|
||||
|
||||
// Response for EnrollDevice.
|
||||
message EnrollDeviceResponse {
|
||||
oneof payload {
|
||||
EnrollDeviceSuccess success = 1;
|
||||
MacOSEnrollChallenge macos_challenge = 2;
|
||||
TPMEnrollChallenge tpm_challenge = 3;
|
||||
}
|
||||
}
|
||||
|
||||
// EnrollDeviceInit initiates the enrollment ceremony.
|
||||
message EnrollDeviceInit {
|
||||
// Device enrollment token.
|
||||
// See CreateDevice or CreateDeviceEnrollToken.
|
||||
string token = 1;
|
||||
|
||||
// ID of the device credential.
|
||||
string credential_id = 2;
|
||||
|
||||
// Device collected data.
|
||||
// Matched against the device registration information and any previously
|
||||
// collected data.
|
||||
DeviceCollectedData device_data = 3;
|
||||
|
||||
// Payload for macOS-specific data.
|
||||
MacOSEnrollPayload macos = 4;
|
||||
|
||||
// Payload for TPM-specific data. Used for Windows/Linux.
|
||||
TPMEnrollPayload tpm = 5;
|
||||
}
|
||||
|
||||
// EnrollDeviceSuccess marks a successful device enrollment ceremony.
|
||||
message EnrollDeviceSuccess {
|
||||
// The enrolled device.
|
||||
Device device = 1;
|
||||
}
|
||||
|
||||
// MacOSEnrollPayload is the macOS-specific enrollment payload.
|
||||
message MacOSEnrollPayload {
|
||||
// Device public key marshaled as a PKIX, ASN.1 DER.
|
||||
bytes public_key_der = 2;
|
||||
}
|
||||
|
||||
// MacOSEnrollChallenge is a macOS enrollment challenge.
|
||||
message MacOSEnrollChallenge {
|
||||
// Randomly-generated, opaque challenge to be signed using the device key.
|
||||
bytes challenge = 1;
|
||||
}
|
||||
|
||||
// MacOSEnrollChallengeResponse is a macOS enrollment challenge response.
|
||||
message MacOSEnrollChallengeResponse {
|
||||
// Signature over the challenge, using the device key.
|
||||
bytes signature = 2;
|
||||
}
|
||||
|
||||
// The payload containing TPM specific information required on device
|
||||
// enrollment.
|
||||
message TPMEnrollPayload {
|
||||
oneof ek {
|
||||
// The device's endorsement certificate in X509, ASN.1 DER form. This
|
||||
// certificate contains the public key of the endorsement key. This is
|
||||
// preferred to ek_key.
|
||||
bytes ek_cert = 1;
|
||||
// The device's public endorsement key in PKIX, ASN.1 DER form. This is
|
||||
// used when a TPM does not contain any endorsement certificates.
|
||||
bytes ek_key = 2;
|
||||
}
|
||||
// The attestation key and the parameters necessary to remotely verify it as
|
||||
// related to the endorsement key.
|
||||
TPMAttestationParameters attestation_parameters = 3;
|
||||
}
|
||||
|
||||
// The attestation key and the parameters necessary to remotely verify it as
|
||||
// related to the endorsement key.
|
||||
// See https://pkg.go.dev/github.com/google/go-attestation/attest#AttestationParameters.
|
||||
// This message excludes the `UseTCSDActivationFormat` field from the link above
|
||||
// as it is TMP 1.x specific and always false.
|
||||
message TPMAttestationParameters {
|
||||
// The encoded TPMT_PUBLIC structure containing the attestation public key
|
||||
// and signing parameters.
|
||||
bytes public = 1;
|
||||
// The properties of the attestation key, encoded as a TPMS_CREATION_DATA
|
||||
// structure.
|
||||
bytes create_data = 2;
|
||||
// An assertion as to the details of the key, encoded as a TPMS_ATTEST
|
||||
// structure.
|
||||
bytes create_attestation = 3;
|
||||
// A signature of create_attestation, encoded as a TPMT_SIGNATURE structure.
|
||||
bytes create_signature = 4;
|
||||
}
|
||||
|
||||
// The challenge sent to the client by the server during enrollment.
|
||||
// The challenge involves two parts:
|
||||
// - Solving an encrypted credential with `ActivateCredential`.
|
||||
// - Producing a platform attestation using the provided nonce.
|
||||
message TPMEnrollChallenge {
|
||||
// The encrypted credential for the client to prove possession of the EK and
|
||||
// AK.
|
||||
TPMEncryptedCredential encrypted_credential = 1;
|
||||
// The nonce to use when producing the quotes over the PCRs with the TPM
|
||||
// during the platform attestation.
|
||||
bytes attestation_nonce = 2;
|
||||
}
|
||||
|
||||
// These values are used by the TPM2.0 `ActivateCredential` command to produce
|
||||
// the solution which proves possession of the EK and AK.
|
||||
//
|
||||
// For a more in-depth description see:
|
||||
// - https://pkg.go.dev/github.com/google/go-attestation/attest#EncryptedCredential
|
||||
// - https://trustedcomputinggroup.org/wp-content/uploads/TCG_TPM2_r1p59_Part3_Commands_code_pub.pdf (Heading 12.5.1 "TPM2_ActivateCredential" "General Description")
|
||||
// - https://github.com/google/go-attestation/blob/v0.4.3/attest/activation.go#L199
|
||||
// - https://github.com/google/go-tpm/blob/v0.3.3/tpm2/credactivation/credential_activation.go#L61
|
||||
message TPMEncryptedCredential {
|
||||
// The `credential_blob` parameter to be used with the `ActivateCredential`
|
||||
// command. This is used with the decrypted value of `secret` in a
|
||||
// cryptographic process to decrypt the solution.
|
||||
bytes credential_blob = 1;
|
||||
// The `secret` parameter to be used with `ActivateCredential`. This is a
|
||||
// seed which can be decrypted with the EK. The decrypted seed is then used
|
||||
// when decrypting `credential_blob`.
|
||||
bytes secret = 2;
|
||||
}
|
||||
|
||||
// The enrollment challenge response containing the solution returned by
|
||||
// calling the TPM2.0 `ActivateCredential` command on the client with the
|
||||
// parameters provided in `TPMEnrollChallenge`.
|
||||
message TPMEnrollChallengeResponse {
|
||||
// The client's solution to `TPMEncryptedCredential` included in
|
||||
// `TPMEnrollChallenge` using ActivateCredential.
|
||||
bytes solution = 1;
|
||||
// The result of the client's platform attestation with the nonce provided
|
||||
// in `TPMEnrollChallenge`.
|
||||
TPMPlatformParameters platform_parameters = 2;
|
||||
}
|
||||
|
||||
// Request for AuthenticateDevice.
|
||||
//
|
||||
// Authentication ceremony flow:
|
||||
// -> AuthenticateDeviceInit (client)
|
||||
// <- AuthenticateDeviceChallenge (server)
|
||||
// -> AuthenticateDeviceChallengeResponse
|
||||
// <- UserCertificates (regular authn) or ConfirmationToken (web authn)
|
||||
message AuthenticateDeviceRequest {
|
||||
oneof payload {
|
||||
AuthenticateDeviceInit init = 1;
|
||||
AuthenticateDeviceChallengeResponse challenge_response = 2;
|
||||
TPMAuthenticateDeviceChallengeResponse tpm_challenge_response = 3;
|
||||
}
|
||||
}
|
||||
|
||||
// Response for AuthenticateDevice.
|
||||
message AuthenticateDeviceResponse {
|
||||
oneof payload {
|
||||
AuthenticateDeviceChallenge challenge = 1;
|
||||
|
||||
// User certificates are returned as the result of a successful device
|
||||
// authentication attempt ("regular" or non-web authentication).
|
||||
UserCertificates user_certificates = 2;
|
||||
|
||||
TPMAuthenticateDeviceChallenge tpm_challenge = 3;
|
||||
|
||||
// A confirmation token is returned as the result of a successful device web
|
||||
// authentication.
|
||||
//
|
||||
// See AuthenticateDeviceInit.device_web_token.
|
||||
DeviceConfirmationToken confirmation_token = 4;
|
||||
}
|
||||
}
|
||||
|
||||
// AuthenticateDeviceInit initiates the device authentication ceremony.
|
||||
message AuthenticateDeviceInit {
|
||||
// In-band user certificates to augment with device extensions.
|
||||
// - The x509 certificate is acquired from the mTLS connection, thus the
|
||||
// in-band certificate is ignored.
|
||||
// - All certificates must be valid and issued by the Teleport CA.
|
||||
// - TLS and SSH certificates must match (same Teleport user, plus whatever
|
||||
// additional checks the backend sees fit).
|
||||
// - TLS and SSH certificates must either have matching public keys, or
|
||||
// (TPM)AuthenticateDeviceChallengeResponse.SshSignature must be a valid
|
||||
// signature over the challenge by the SSH private key.
|
||||
// - Augmented certificates have the same expiration as the original
|
||||
// certificates.
|
||||
UserCertificates user_certificates = 1;
|
||||
|
||||
// ID of the enrolled device credential.
|
||||
string credential_id = 2;
|
||||
|
||||
// Device collected data.
|
||||
// Matched against the device registration information and any previously
|
||||
// collected data.
|
||||
DeviceCollectedData device_data = 3;
|
||||
|
||||
// If present, on-behalf-of device authentication is performed.
|
||||
// The user_certificates input field is ignored and no certificate data is
|
||||
// returned to the caller, instead a confirmation_token is returned in
|
||||
// the last step.
|
||||
//
|
||||
// See ConfirmDeviceWebAuthentication.
|
||||
DeviceWebToken device_web_token = 4;
|
||||
}
|
||||
|
||||
// Request for ConfirmDeviceWebAuthentication.
|
||||
message ConfirmDeviceWebAuthenticationRequest {
|
||||
// Confirmation token to be spent.
|
||||
DeviceConfirmationToken confirmation_token = 1;
|
||||
|
||||
// Web Session identifier of the session that started this request, via
|
||||
// Teleport Proxy.
|
||||
//
|
||||
// For the request to be successful the Web Session must match the session
|
||||
// that started the authentication attempt.
|
||||
string current_web_session_id = 2;
|
||||
}
|
||||
|
||||
// Response for ConfirmDeviceWebAuthentication.
|
||||
message ConfirmDeviceWebAuthenticationResponse {}
|
||||
|
||||
// Request for SyncInventory.
|
||||
//
|
||||
// A typical message sequence is as follows:
|
||||
// (-> means client-to-server, <- means server-to-client)
|
||||
// -> SyncInventoryStart
|
||||
// <- SyncInventoryAck
|
||||
// (loop)
|
||||
// -> SyncInventoryDevices (add/remove devices)
|
||||
// <- SyncInventoryResult
|
||||
// (end loop)
|
||||
// -> SyncInventoryEnd
|
||||
// (loop until server closes the stream, zero or more times)
|
||||
// <- SyncInventoryMissingDevices
|
||||
// -> SyncInventoryDevices (removals only)
|
||||
// <- SyncInventoryResult
|
||||
// (end loop)
|
||||
message SyncInventoryRequest {
|
||||
oneof payload {
|
||||
SyncInventoryStart start = 1;
|
||||
SyncInventoryEnd end = 2;
|
||||
SyncInventoryDevices devices_to_upsert = 3;
|
||||
SyncInventoryDevices devices_to_remove = 4;
|
||||
}
|
||||
}
|
||||
|
||||
// Response for SyncInventory.
|
||||
message SyncInventoryResponse {
|
||||
oneof payload {
|
||||
SyncInventoryAck ack = 1;
|
||||
SyncInventoryResult result = 2;
|
||||
SyncInventoryMissingDevices missing_devices = 3;
|
||||
}
|
||||
}
|
||||
|
||||
// SyncInventoryStart starts the inventory sync.
|
||||
message SyncInventoryStart {
|
||||
// Source of the inventory sync.
|
||||
// Used for all devices. The `source` field in individual devices is ignored
|
||||
// by this RPC.
|
||||
DeviceSource source = 1;
|
||||
|
||||
reserved 2; // SyncInventoryMode mode
|
||||
reserved "mode";
|
||||
|
||||
reserved 3; // SyncInventoryDeviceAction on_missing_action
|
||||
reserved "on_missing_action";
|
||||
|
||||
// If true, the server keeps track of the devices upserted during the sync.
|
||||
// After receiving the [SyncInventoryEnd] message, the server informs the
|
||||
// client of all devices that are present in storage but not observed in the
|
||||
// upserts.
|
||||
// See [SyncInventoryRequest] and [SyncInventoryMissingDevices] for details.
|
||||
bool track_missing_devices = 4;
|
||||
}
|
||||
|
||||
// SyncInventoryEnd ends the inventory sync, signaling that no more
|
||||
// SyncInventoryDevices messages will be sent by the client.
|
||||
message SyncInventoryEnd {
|
||||
reserved 1; // bool external_sync_successful
|
||||
reserved "external_sync_successful";
|
||||
}
|
||||
|
||||
// SyncInventoryDevices transports devices to add/update/remove.
|
||||
// Removals only need identifying fields to be set.
|
||||
message SyncInventoryDevices {
|
||||
// Devices to sync.
|
||||
repeated Device devices = 1;
|
||||
}
|
||||
|
||||
// SyncInventoryAck is used to confirm successful processing of messages that
|
||||
// lack a more specific response.
|
||||
message SyncInventoryAck {}
|
||||
|
||||
// SyncInventoryResult is the response for SyncInventoryDevices or
|
||||
// SyncInventoryEnd
|
||||
// It lists all synced/deleted devices.
|
||||
message SyncInventoryResult {
|
||||
// Devices modified, in the same order as the input when applicable.
|
||||
repeated DeviceOrStatus devices = 1;
|
||||
}
|
||||
|
||||
// SyncInventoryMissingDevices informs the sync client of all stored devices
|
||||
// that were not observed in upserts during the sync.
|
||||
//
|
||||
// Requires `track_missing_devices` to be set in the [SyncInventoryStart]
|
||||
// message.
|
||||
//
|
||||
// The client must follow up with a [SyncInventoryDevices] message, including
|
||||
// any devices to be deleted.
|
||||
message SyncInventoryMissingDevices {
|
||||
// Devices missing from the client-side sync.
|
||||
// Guaranteed to have the following fields: id, os_type, asset_tag and
|
||||
// profile.external_id.
|
||||
repeated Device devices = 1;
|
||||
}
|
||||
|
||||
// Superseded by ResourceUsageService.GetUsage.
|
||||
message GetDevicesUsageRequest {}
|
||||
-30
@@ -1,30 +0,0 @@
|
||||
// Copyright 2022 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.devicetrust.v1;
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/devicetrust/v1;devicetrustv1";
|
||||
|
||||
// OSType represents the operating system of a device.
|
||||
enum OSType {
|
||||
OS_TYPE_UNSPECIFIED = 0;
|
||||
// Linux.
|
||||
OS_TYPE_LINUX = 1;
|
||||
// macOS.
|
||||
OS_TYPE_MACOS = 2;
|
||||
// Windows.
|
||||
OS_TYPE_WINDOWS = 3;
|
||||
}
|
||||
-59
@@ -1,59 +0,0 @@
|
||||
// Copyright 2023 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.devicetrust.v1;
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/devicetrust/v1;devicetrustv1";
|
||||
|
||||
// Encapsulates the value of a PCR at a point at time.
|
||||
// See https://pkg.go.dev/github.com/google/go-attestation/attest#PCR
|
||||
message TPMPCR {
|
||||
// the PCR index in the PCR bank
|
||||
int32 index = 1;
|
||||
// the digest currently held in the PCR
|
||||
bytes digest = 2;
|
||||
// the hash algorithm used to produce the digest in this PCR bank. This value
|
||||
// is the underlying value of the Go crypto.Hash type.
|
||||
uint64 digest_alg = 3;
|
||||
}
|
||||
|
||||
// Encapsulates the result of a quote operation against the TPM over a PCR
|
||||
// using an attestation key.
|
||||
// See https://pkg.go.dev/github.com/google/go-attestation/attest#Quote
|
||||
message TPMQuote {
|
||||
bytes quote = 1;
|
||||
bytes signature = 2;
|
||||
}
|
||||
|
||||
// The quotes, PCRs and event log from a TPM that attest to the booted state
|
||||
// of the machine.
|
||||
// See https://pkg.go.dev/github.com/google/go-attestation/attest#PlatformParameters
|
||||
// Excludes TPMVersion and Public since these are already known values.
|
||||
message TPMPlatformParameters {
|
||||
repeated TPMQuote quotes = 1;
|
||||
repeated TPMPCR pcrs = 2;
|
||||
bytes event_log = 3;
|
||||
}
|
||||
|
||||
// Holds the record of a TPM platform attestation, including the platform
|
||||
// parameters sent by the device and the nonce the server generated. This allows
|
||||
// a historical platform attestation to be revalidated and allows us to compare
|
||||
// the incoming state of a device (e.g during authentication) against the
|
||||
// historical state in order to detect potentially malicious actions.
|
||||
message TPMPlatformAttestation {
|
||||
bytes nonce = 1;
|
||||
TPMPlatformParameters platform_parameters = 2;
|
||||
}
|
||||
-38
@@ -1,38 +0,0 @@
|
||||
// Copyright 2023 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.devicetrust.v1;
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/devicetrust/v1;devicetrustv1";
|
||||
|
||||
// Superseded by ResourceUsageService.GetUsage.
|
||||
enum AccountUsageType {
|
||||
ACCOUNT_USAGE_TYPE_UNSPECIFIED = 0;
|
||||
ACCOUNT_USAGE_TYPE_UNLIMITED = 1;
|
||||
ACCOUNT_USAGE_TYPE_USAGE_BASED = 2;
|
||||
}
|
||||
|
||||
// Superseded by ResourceUsageService.GetUsage.
|
||||
message DevicesUsage {
|
||||
reserved 1; // AccountUsageType account_usage_type
|
||||
reserved "account_usage_type";
|
||||
|
||||
reserved 2; // int32 devices_usage_limit
|
||||
reserved "devices_usage_limit";
|
||||
|
||||
reserved 3; // int32 devices_in_use
|
||||
reserved "devices_in_use";
|
||||
}
|
||||
Vendored
-30
@@ -1,30 +0,0 @@
|
||||
// Copyright 2022 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.devicetrust.v1;
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/devicetrust/v1;devicetrustv1";
|
||||
|
||||
// UserCertificates is used to transport X.509 and SSH certificates during
|
||||
// device authentication.
|
||||
// See the AuthenticateDevice RPC.
|
||||
message UserCertificates {
|
||||
// DER-encoded X.509 user certificate.
|
||||
bytes x509_der = 1;
|
||||
|
||||
// SSH certificate marshaled in the authorized key format.
|
||||
bytes ssh_authorized_key = 2;
|
||||
}
|
||||
Vendored
-111
@@ -1,111 +0,0 @@
|
||||
// Copyright 2023 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.discoveryconfig.v1;
|
||||
|
||||
import "google/protobuf/timestamp.proto";
|
||||
import "teleport/header/v1/resourceheader.proto";
|
||||
import "teleport/legacy/types/types.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/discoveryconfig/v1;discoveryconfigv1";
|
||||
|
||||
// DiscoveryConfig is a resource that has Discovery Resource Matchers and a Discovery Group.
|
||||
//
|
||||
// Teleport Discovery Services will load the dynamic DiscoveryConfigs whose Discovery Group matches the discovery_group defined in their configuration.
|
||||
message DiscoveryConfig {
|
||||
// Header is the resource header.
|
||||
teleport.header.v1.ResourceHeader header = 1;
|
||||
|
||||
// Spec is an DiscoveryConfig specification.
|
||||
DiscoveryConfigSpec spec = 2;
|
||||
|
||||
// Status is the resource Status
|
||||
DiscoveryConfigStatus status = 3;
|
||||
}
|
||||
|
||||
// DiscoveryConfigSpec contains properties required to create matchers to be used by discovery_service.
|
||||
// Those matchers are used by discovery_service to watch for cloud resources and create them in Teleport.
|
||||
message DiscoveryConfigSpec {
|
||||
// DiscoveryGroup is used by discovery_service to add extra matchers.
|
||||
// All the discovery_services that have the same discovery_group, will load the matchers of this resource.
|
||||
string discovery_group = 1;
|
||||
|
||||
// AWS is a list of AWS Matchers.
|
||||
repeated types.AWSMatcher aws = 2;
|
||||
// Azure is a list of Azure Matchers.
|
||||
repeated types.AzureMatcher azure = 3;
|
||||
// GCP is a list of GCP Matchers.
|
||||
repeated types.GCPMatcher gcp = 4;
|
||||
// Kube is a list of Kubernetes Matchers.
|
||||
repeated types.KubernetesMatcher kube = 5;
|
||||
// AccessGraph is the configurations for syncing Cloud accounts into Access Graph.
|
||||
types.AccessGraphSync access_graph = 6;
|
||||
}
|
||||
|
||||
// DiscoveryConfigStatus holds dynamic information about the discovery configuration
|
||||
// running status such as errors, state and count of the resources.
|
||||
message DiscoveryConfigStatus {
|
||||
// State reports the Discovery config state.
|
||||
DiscoveryConfigState state = 1;
|
||||
// error_message holds the error message when state is DISCOVERY_CONFIG_STATE_ERROR.
|
||||
optional string error_message = 2;
|
||||
// discovered_resources holds the count of the discovered resources in the previous iteration.
|
||||
uint64 discovered_resources = 3;
|
||||
// last_sync_time is the timestamp when the Discovery Config was last sync.
|
||||
google.protobuf.Timestamp last_sync_time = 4;
|
||||
|
||||
reserved 5;
|
||||
reserved "aws_ec2_instances_discovered";
|
||||
|
||||
// IntegrationDiscoveredResources maps an integration to discovered resources summary.
|
||||
map<string, IntegrationDiscoveredSummary> integration_discovered_resources = 6;
|
||||
}
|
||||
|
||||
// DiscoveryConfigState is the state of the discovery config resource.
|
||||
enum DiscoveryConfigState {
|
||||
DISCOVERY_CONFIG_STATE_UNSPECIFIED = 0;
|
||||
// DISCOVERY_CONFIG_STATE_RUNNING is used when the operation doesn't report
|
||||
// incidents.
|
||||
DISCOVERY_CONFIG_STATE_RUNNING = 1;
|
||||
// DISCOVERY_CONFIG_STATE_ERROR is used when the operation reports
|
||||
// incidents.
|
||||
DISCOVERY_CONFIG_STATE_ERROR = 2;
|
||||
// DISCOVERY_CONFIG_STATE_SYNCING is used when the discovery process has started but didn't finished yet.
|
||||
DISCOVERY_CONFIG_STATE_SYNCING = 3;
|
||||
}
|
||||
|
||||
// IntegrationDiscoveredSummary contains the a summary for each resource type that was discovered.
|
||||
message IntegrationDiscoveredSummary {
|
||||
// AWSEC2 contains the summary for the AWS EC2 discovered instances.
|
||||
ResourcesDiscoveredSummary aws_ec2 = 1;
|
||||
|
||||
// AWSRDS contains the summary for the AWS RDS discovered databases.
|
||||
ResourcesDiscoveredSummary aws_rds = 2;
|
||||
|
||||
// AWSEKS contains the summary for the AWS EKS discovered clusters.
|
||||
ResourcesDiscoveredSummary aws_eks = 3;
|
||||
}
|
||||
|
||||
// ResourcesDiscoveredSummary represents the AWS resources that were discovered.
|
||||
message ResourcesDiscoveredSummary {
|
||||
// Found holds the count of resources found.
|
||||
// After a resource is found, it starts the sync process and ends in either an enrolled or a failed resource.
|
||||
uint64 found = 1;
|
||||
// Enrolled holds the count of the resources that were successfully enrolled.
|
||||
uint64 enrolled = 2;
|
||||
// Failed holds the count of the resources that failed to enroll.
|
||||
uint64 failed = 3;
|
||||
}
|
||||
-114
@@ -1,114 +0,0 @@
|
||||
// Copyright 2023 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.discoveryconfig.v1;
|
||||
|
||||
import "google/protobuf/empty.proto";
|
||||
import "teleport/discoveryconfig/v1/discoveryconfig.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/discoveryconfig/v1;discoveryconfigv1";
|
||||
|
||||
// DiscoveryConfigService provides methods to manage Discovery Configs.
|
||||
//
|
||||
// Each Discovery Config has a set of matchers and a DiscoveryGroup.
|
||||
// DiscoveryServices also have a DiscoveryGroup which will be used to load all the matchers from
|
||||
// all the DiscoveryConfigs that have the same Group.
|
||||
service DiscoveryConfigService {
|
||||
// ListDiscoveryConfigs returns a paginated list of Discovery Config resources.
|
||||
rpc ListDiscoveryConfigs(ListDiscoveryConfigsRequest) returns (ListDiscoveryConfigsResponse);
|
||||
|
||||
// GetDiscoveryConfig returns the specified DiscoveryConfig resource.
|
||||
rpc GetDiscoveryConfig(GetDiscoveryConfigRequest) returns (DiscoveryConfig);
|
||||
|
||||
// CreateDiscoveryConfig creates a new DiscoveryConfig resource.
|
||||
rpc CreateDiscoveryConfig(CreateDiscoveryConfigRequest) returns (DiscoveryConfig);
|
||||
|
||||
// UpdateDiscoveryConfig updates an existing DiscoveryConfig resource.
|
||||
rpc UpdateDiscoveryConfig(UpdateDiscoveryConfigRequest) returns (DiscoveryConfig);
|
||||
|
||||
// UpsertDiscoveryConfig creates or updates a DiscoveryConfig resource.
|
||||
rpc UpsertDiscoveryConfig(UpsertDiscoveryConfigRequest) returns (DiscoveryConfig);
|
||||
|
||||
// DeleteDiscoveryConfig removes the specified DiscoveryConfig resource.
|
||||
rpc DeleteDiscoveryConfig(DeleteDiscoveryConfigRequest) returns (google.protobuf.Empty);
|
||||
|
||||
// DeleteAllDiscoveryConfigs removes all DiscoveryConfigs.
|
||||
rpc DeleteAllDiscoveryConfigs(DeleteAllDiscoveryConfigsRequest) returns (google.protobuf.Empty);
|
||||
|
||||
// UpdateDiscoveryConfigStatus updates an existing DiscoveryConfig resource status object.
|
||||
rpc UpdateDiscoveryConfigStatus(UpdateDiscoveryConfigStatusRequest) returns (DiscoveryConfig);
|
||||
}
|
||||
|
||||
// ListDiscoveryConfigsRequest is a request for a paginated list of DiscoveryConfigs.
|
||||
message ListDiscoveryConfigsRequest {
|
||||
// page_size is the size of the page to request.
|
||||
int32 page_size = 1;
|
||||
|
||||
// next_token is the page token.
|
||||
string next_token = 2;
|
||||
}
|
||||
|
||||
// ListDiscoveryConfigsResponse is the response for ListDiscoveryConfigsRequest.
|
||||
message ListDiscoveryConfigsResponse {
|
||||
// DiscoveryConfigs is a list of DiscoveryConfigs.
|
||||
repeated DiscoveryConfig discovery_configs = 1;
|
||||
// NextKey is the key for the next page of DiscoveryConfigs.
|
||||
string next_key = 2;
|
||||
// TotalCount is the total number of discovery_config in all pages.
|
||||
int32 total_count = 3;
|
||||
}
|
||||
|
||||
// GetDiscoveryConfigRequest is a request for a specific DiscoveryConfig resource.
|
||||
message GetDiscoveryConfigRequest {
|
||||
// Name is the name of the DiscoveryConfig to be requested.
|
||||
string name = 1;
|
||||
}
|
||||
|
||||
// CreateDiscoveryConfigRequest is the request to create the provided DiscoveryConfig.
|
||||
message CreateDiscoveryConfigRequest {
|
||||
// DiscoveryConfig is the DiscoveryConfig to be created.
|
||||
DiscoveryConfig discovery_config = 1;
|
||||
}
|
||||
|
||||
// UpdateDiscoveryConfigRequest is the request to update the provided DiscoveryConfig.
|
||||
message UpdateDiscoveryConfigRequest {
|
||||
// DiscoveryConfig is the DiscoveryConfig to be updated.
|
||||
DiscoveryConfig discovery_config = 1;
|
||||
}
|
||||
|
||||
// UpsertDiscoveryConfigRequest is the request to upsert the provided DiscoveryConfig.
|
||||
message UpsertDiscoveryConfigRequest {
|
||||
// DiscoveryConfig is the DiscoveryConfig to be upserted.
|
||||
DiscoveryConfig discovery_config = 1;
|
||||
}
|
||||
|
||||
// DeleteDiscoveryConfigRequest is a request for deleting a specific DiscoveryConfig resource.
|
||||
message DeleteDiscoveryConfigRequest {
|
||||
// Name is the name of the DiscoveryConfig to be deleted.
|
||||
string name = 1;
|
||||
}
|
||||
|
||||
// DeleteAllDiscoveryConfigsRequest is the request for deleting all DiscoveryConfigs.
|
||||
message DeleteAllDiscoveryConfigsRequest {}
|
||||
|
||||
// UpdateDiscoveryConfigStatusRequest is the request to update the status field of the provided
|
||||
// Discovery Config.
|
||||
message UpdateDiscoveryConfigStatusRequest {
|
||||
// Name is the name of the DiscoveryConfig to receive the status update.
|
||||
string name = 1;
|
||||
// status is the status payload to be persisted.
|
||||
DiscoveryConfigStatus status = 2;
|
||||
}
|
||||
-90
@@ -1,90 +0,0 @@
|
||||
/**
|
||||
* Teleport
|
||||
* Copyright (C) 2024 Gravitational, Inc.
|
||||
*
|
||||
* This program is free software: you can redistribute it and/or modify
|
||||
* it under the terms of the GNU Affero General Public License as published by
|
||||
* the Free Software Foundation, either version 3 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU Affero General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU Affero General Public License
|
||||
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.dynamicwindows.v1;
|
||||
|
||||
import "google/protobuf/empty.proto";
|
||||
import "teleport/legacy/types/types.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/dynamicwindows/v1;dynamicwindowsv1";
|
||||
|
||||
// DynamicWindowsService provides methods to access dynamic Windows desktops.
|
||||
service DynamicWindowsService {
|
||||
// GetDynamicWindowsDesktops returns all registered dynamic Windows desktops.
|
||||
rpc ListDynamicWindowsDesktops(ListDynamicWindowsDesktopsRequest) returns (ListDynamicWindowsDesktopsResponse);
|
||||
// GetDynamicWindowsDesktop returns registered dynamic Windows desktop by name.
|
||||
rpc GetDynamicWindowsDesktop(GetDynamicWindowsDesktopRequest) returns (types.DynamicWindowsDesktopV1);
|
||||
// CreateDynamicWindowsDesktop registers a new dynamic Windows desktop.
|
||||
rpc CreateDynamicWindowsDesktop(CreateDynamicWindowsDesktopRequest) returns (types.DynamicWindowsDesktopV1);
|
||||
// UpdateDynamicWindowsDesktop updates an existing dynamic Windows desktop.
|
||||
rpc UpdateDynamicWindowsDesktop(UpdateDynamicWindowsDesktopRequest) returns (types.DynamicWindowsDesktopV1);
|
||||
// UpsertDynamicWindowsDesktop updates an existing dynamic Windows desktop or creates new if it doesn't exist.
|
||||
rpc UpsertDynamicWindowsDesktop(UpsertDynamicWindowsDesktopRequest) returns (types.DynamicWindowsDesktopV1);
|
||||
// DeleteDynamicWindowsDesktop removes the specified dynamic Windows desktop.
|
||||
rpc DeleteDynamicWindowsDesktop(DeleteDynamicWindowsDesktopRequest) returns (google.protobuf.Empty);
|
||||
}
|
||||
|
||||
// ListDynamicWindowsDesktopsRequest is request to fetch single page of dynamic Windows desktops
|
||||
message ListDynamicWindowsDesktopsRequest {
|
||||
// The maximum number of items to return.
|
||||
// The server may impose a different page size at its discretion.
|
||||
int32 page_size = 1;
|
||||
// The next_page_token value returned from a previous List request, if any.
|
||||
string page_token = 2;
|
||||
}
|
||||
|
||||
// ListDynamicWindowsDesktopsRequest is single page of dynamic Windows desktops
|
||||
message ListDynamicWindowsDesktopsResponse {
|
||||
// The page of DynamicWindowsDesktops that matched the request.
|
||||
repeated types.DynamicWindowsDesktopV1 desktops = 1;
|
||||
// Token to retrieve the next page of results, or empty if there are no
|
||||
// more results in the list.
|
||||
string next_page_token = 2;
|
||||
}
|
||||
|
||||
// GetDynamicWindowsDesktopRequest is a request for a specific dynamic Windows desktop.
|
||||
message GetDynamicWindowsDesktopRequest {
|
||||
// name is the name of the dynamic Windows desktop to be requested.
|
||||
string name = 1;
|
||||
}
|
||||
|
||||
// CreateDynamicWindowsDesktopRequest is used for creating new dynamic Windows desktops.
|
||||
message CreateDynamicWindowsDesktopRequest {
|
||||
// desktop to be created
|
||||
types.DynamicWindowsDesktopV1 desktop = 1;
|
||||
}
|
||||
|
||||
// UpdateDynamicWindowsDesktopRequest is used for updating existing dynamic Windows desktops.
|
||||
message UpdateDynamicWindowsDesktopRequest {
|
||||
// desktop to be updated
|
||||
types.DynamicWindowsDesktopV1 desktop = 1;
|
||||
}
|
||||
|
||||
// UpsertDynamicWindowsDesktopRequest is used for upserting dynamic Windows desktops.
|
||||
message UpsertDynamicWindowsDesktopRequest {
|
||||
// desktop to be upserted
|
||||
types.DynamicWindowsDesktopV1 desktop = 1;
|
||||
}
|
||||
|
||||
// DeleteDynamicWindowsDesktopRequest is a request to delete a Windows desktop host.
|
||||
message DeleteDynamicWindowsDesktopRequest {
|
||||
// name is the name of the Windows desktop host.
|
||||
string name = 1;
|
||||
}
|
||||
-38
@@ -1,38 +0,0 @@
|
||||
// Copyright 2023 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.embedding.v1;
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/embedding/v1;embeddingv1";
|
||||
|
||||
// Embedding contains a Teleport resource embedding. Embeddings are small semantic
|
||||
// representations of larger and more complex data. Embeddings can be compared,
|
||||
// the smaller the distance between two vectors, the closer the concepts are.
|
||||
// Teleport Assist embeds resources to perform semantic search.
|
||||
message Embedding {
|
||||
// EmbeddedKind is the kind of the embedded resource.
|
||||
string embedded_kind = 1;
|
||||
|
||||
// EmbeddedId is the ID of the embedded resource.
|
||||
string embedded_id = 2;
|
||||
|
||||
// EmbeddedHash is the hash of the embedded resource after serialization.
|
||||
// This helps checking if the resource has changed and needs a new embedding.
|
||||
bytes embedded_hash = 3;
|
||||
|
||||
// Vector is the embedding itself, as provided by the model.
|
||||
repeated double vector = 4;
|
||||
}
|
||||
-57
@@ -1,57 +0,0 @@
|
||||
// Copyright 2023 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.externalauditstorage.v1;
|
||||
|
||||
import "teleport/header/v1/resourceheader.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/externalauditstorage/v1;externalauditstoragev1";
|
||||
|
||||
// ExternalAuditStorage contains External Audit Storage configuration.
|
||||
// It contains configuration that allows users to store audit events and session
|
||||
// recordings on customer-owned infra instead of in Teleport Cloud.
|
||||
message ExternalAuditStorage {
|
||||
// Header is the header for the resource.
|
||||
teleport.header.v1.ResourceHeader header = 1;
|
||||
// Spec is the specification for external audit storage.
|
||||
ExternalAuditStorageSpec spec = 2;
|
||||
}
|
||||
|
||||
// ExternalAuditStorageConfigSpec is the specification of external audit storage.
|
||||
message ExternalAuditStorageSpec {
|
||||
// IntegrationName is name of an existing AWS OIDC integration used to
|
||||
// authenticate to the external AWS account.
|
||||
string integration_name = 1;
|
||||
// Region is the AWS region where the infrastructure is hosted.
|
||||
string region = 2;
|
||||
// SessionRecordingsURI is the S3 path used to store session recordings.
|
||||
string session_recordings_uri = 3;
|
||||
// AuditEventsLongTermURI is the S3 path used to store batched parquet files
|
||||
// with audit events.
|
||||
string audit_events_long_term_uri = 4;
|
||||
// AthenaResultsURI is the S3 path used to store temporary results of Athena
|
||||
// queries.
|
||||
string athena_results_uri = 5;
|
||||
// AthenaWorkgroup is the workgroup used for Athena audit log queries.
|
||||
string athena_workgroup = 6;
|
||||
// GlueDatabase is the database used for Athena audit log queries.
|
||||
string glue_database = 7;
|
||||
// GlueTable is the table used for Athena audit log queries.
|
||||
string glue_table = 8;
|
||||
// PolicyName is the name of the IAM policy attached to the OIDC integration
|
||||
// role.
|
||||
string policy_name = 9;
|
||||
}
|
||||
-186
@@ -1,186 +0,0 @@
|
||||
// Copyright 2023 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.externalauditstorage.v1;
|
||||
|
||||
import "google/protobuf/empty.proto";
|
||||
import "teleport/externalauditstorage/v1/externalauditstorage.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/externalauditstorage/v1;externalauditstoragev1";
|
||||
|
||||
// ExternalAuditStorageService provides methods to manage External Audit Storage.
|
||||
//
|
||||
// The service supports singleton "draft" and "cluster" configurations, allowing
|
||||
// us to store state for an in-progress configuring and to test the connection
|
||||
// before enabling the feature in the cluster.
|
||||
//
|
||||
// After creating and testing a draft configuration call
|
||||
// PromoteToClusterExternalAuditStorage, which will clone the existing draft
|
||||
// ExternalAuditStorage into a new resource and upsert it as the new cluster
|
||||
// ExternalAuditStorage.
|
||||
// The promoted cluster resource can't be mutated, it can only be deleted or
|
||||
// replaced by promoting a new draft.
|
||||
service ExternalAuditStorageService {
|
||||
// GetDraftExternalAuditStorage returns the draft external audit storage configuration resource.
|
||||
rpc GetDraftExternalAuditStorage(GetDraftExternalAuditStorageRequest) returns (GetDraftExternalAuditStorageResponse);
|
||||
|
||||
// CreateDraftExternalAuditStorage creates a draft External Audit Storage
|
||||
// resource if one does not already exist.
|
||||
rpc CreateDraftExternalAuditStorage(CreateDraftExternalAuditStorageRequest) returns (CreateDraftExternalAuditStorageResponse);
|
||||
|
||||
// UpsertDraftExternalAuditStorage upserts a draft External Audit Storage resource.
|
||||
rpc UpsertDraftExternalAuditStorage(UpsertDraftExternalAuditStorageRequest) returns (UpsertDraftExternalAuditStorageResponse);
|
||||
|
||||
// DeleteDraftExternalAuditStorage removes draft External Audit Storage resource.
|
||||
rpc DeleteDraftExternalAuditStorage(DeleteDraftExternalAuditStorageRequest) returns (google.protobuf.Empty);
|
||||
|
||||
// PromoteToClusterExternalAuditStorage promotes the current draft External
|
||||
// Audit Storage configuration to be used in the cluster.
|
||||
// This method causes the Teleport Auth service to reload.
|
||||
rpc PromoteToClusterExternalAuditStorage(PromoteToClusterExternalAuditStorageRequest) returns (PromoteToClusterExternalAuditStorageResponse);
|
||||
|
||||
// GetClusterExternalAuditStorage gets cluster external audit storage.
|
||||
rpc GetClusterExternalAuditStorage(GetClusterExternalAuditStorageRequest) returns (GetClusterExternalAuditStorageResponse);
|
||||
|
||||
// DisableClusterExternalAuditStorage disables the external audit storage feature.
|
||||
// This method causes the Teleport Auth service to reload.
|
||||
rpc DisableClusterExternalAuditStorage(DisableClusterExternalAuditStorageRequest) returns (google.protobuf.Empty);
|
||||
|
||||
// GenerateDraftExternalAuditStorage generates a new external audit storage
|
||||
// resource with randomized resource names and upserts it as the current
|
||||
// draft.
|
||||
rpc GenerateDraftExternalAuditStorage(GenerateDraftExternalAuditStorageRequest) returns (GenerateDraftExternalAuditStorageResponse);
|
||||
|
||||
// TestDraftExternalAuditStorageBuckets tests the connection to the current draft buckets.
|
||||
rpc TestDraftExternalAuditStorageBuckets(TestDraftExternalAuditStorageBucketsRequest) returns (TestDraftExternalAuditStorageBucketsResponse);
|
||||
|
||||
// TestDraftExternalAuditStorageGlue tests the configuration to the current draft glue table and database.
|
||||
rpc TestDraftExternalAuditStorageGlue(TestDraftExternalAuditStorageGlueRequest) returns (TestDraftExternalAuditStorageGlueResponse);
|
||||
|
||||
// TestDraftExternalAuditStorageAthena tests the configuration to the current draft athena.
|
||||
rpc TestDraftExternalAuditStorageAthena(TestDraftExternalAuditStorageAthenaRequest) returns (TestDraftExternalAuditStorageAthenaResponse);
|
||||
}
|
||||
|
||||
// GetDraftExternalAuditStorageRequest is a request to get the draft external
|
||||
// audit storage configuration.
|
||||
message GetDraftExternalAuditStorageRequest {}
|
||||
|
||||
// GetDraftExternalAuditStorageResponse is a response to getting the draft
|
||||
// external audit storage configuration.
|
||||
message GetDraftExternalAuditStorageResponse {
|
||||
// ExternalAuditStorage is the current draft ExternalAuditStorage.
|
||||
ExternalAuditStorage external_audit_storage = 1;
|
||||
}
|
||||
|
||||
// CreateDraftExternalAuditStorageRequest is a request to create the provided
|
||||
// draft external audit storage configuration if one does not already exist.
|
||||
message CreateDraftExternalAuditStorageRequest {
|
||||
// ExternalAuditStorage is the ExternalAuditStorage to be created.
|
||||
ExternalAuditStorage external_audit_storage = 1;
|
||||
}
|
||||
|
||||
// CreateDraftExternalAuditStorageResponse is a response to creating the draft
|
||||
// external audit storage configuration.
|
||||
message CreateDraftExternalAuditStorageResponse {
|
||||
// ExternalAuditStorage is the ExternalAuditStorage that was created.
|
||||
ExternalAuditStorage external_audit_storage = 1;
|
||||
}
|
||||
|
||||
// UpsertDraftExternalAuditStorageRequest is a request to upsert the provided
|
||||
// draft external audit storage configuration.
|
||||
message UpsertDraftExternalAuditStorageRequest {
|
||||
// ExternalAuditStorage is the ExternalAuditStorage to be upserted.
|
||||
ExternalAuditStorage external_audit_storage = 1;
|
||||
}
|
||||
|
||||
// UpsertDraftExternalAuditStorageResponse is a response to upserting the draft
|
||||
// external audit storage configuration.
|
||||
message UpsertDraftExternalAuditStorageResponse {
|
||||
// ExternalAuditStorage is the ExternalAuditStorage that was upserted.
|
||||
ExternalAuditStorage external_audit_storage = 1;
|
||||
}
|
||||
|
||||
// DeleteDraftExternalAuditStorageRequest is a request to delete a draft External
|
||||
// Audit Storage configuration.
|
||||
message DeleteDraftExternalAuditStorageRequest {}
|
||||
|
||||
// PromoteToClusterExternalAuditStorageRequest is a request to promote the current
|
||||
// draft to cluster external audit storage.
|
||||
message PromoteToClusterExternalAuditStorageRequest {}
|
||||
|
||||
// PromoteToClusterExternalAuditStorageResponse is a response of promote the
|
||||
// current draft to cluster external audit storage.
|
||||
message PromoteToClusterExternalAuditStorageResponse {
|
||||
// ClusterExternalAuditStorage is the ExternalAuditStorage will be used in cluster.
|
||||
ExternalAuditStorage cluster_external_audit_storage = 1;
|
||||
}
|
||||
|
||||
// GetClusterExternalAuditStorageRequest is a request to get an cluster External
|
||||
// Audit Storage configuration.
|
||||
message GetClusterExternalAuditStorageRequest {}
|
||||
|
||||
// GetClusterExternalAuditStorageResponse is a response of getting an cluster
|
||||
// external audit storage configuration.
|
||||
message GetClusterExternalAuditStorageResponse {
|
||||
// ClusterExternalAuditStorage contains name of external audit storage.
|
||||
ExternalAuditStorage cluster_external_audit_storage = 1;
|
||||
}
|
||||
|
||||
// DisableClusterExternalAuditStorageRequest is a request for disabling cluster
|
||||
// external audit storage.
|
||||
message DisableClusterExternalAuditStorageRequest {}
|
||||
|
||||
// GenerateDraftExternalAuditStorageRequest is a request for
|
||||
// GenerateDraftExternalAuditStorage.
|
||||
message GenerateDraftExternalAuditStorageRequest {
|
||||
// IntegrationName is name of existing AWS OIDC integration used to get AWS
|
||||
// credentials.
|
||||
string integration_name = 1;
|
||||
// Region is the AWS region where infrastructure is hosted.
|
||||
string region = 2;
|
||||
}
|
||||
|
||||
// GenerateDraftExternalAuditStorageResponse is a response for
|
||||
// GenerateDraftExternalAuditStorage.
|
||||
message GenerateDraftExternalAuditStorageResponse {
|
||||
// ExternalAuditStorage is the generated ExternalAuditStorage that has been set as
|
||||
// the current draft.
|
||||
ExternalAuditStorage external_audit_storage = 1;
|
||||
}
|
||||
|
||||
// TestDraftExternalAuditStorageBucketsRequest is a request to test the connection of
|
||||
// the current draft external audit storage configuration buckets.
|
||||
message TestDraftExternalAuditStorageBucketsRequest {}
|
||||
|
||||
// TestDraftExternalAuditStorageBucketsResponse is a response from testing the connection
|
||||
// of the current draft external audit storage configuration buckets.
|
||||
message TestDraftExternalAuditStorageBucketsResponse {}
|
||||
|
||||
// TestDraftExternalAuditStorageGlueRequest is a request to test the connection of
|
||||
// the current draft external audit storage configuration glue table.
|
||||
message TestDraftExternalAuditStorageGlueRequest {}
|
||||
|
||||
// TestDraftExternalAuditStorageGlueResponse is a response from testing the connection
|
||||
// of the current draft external audit storage configuration glue table.
|
||||
message TestDraftExternalAuditStorageGlueResponse {}
|
||||
|
||||
// TestDraftExternalAuditStorageAthenaRequest is a request to test the connection of
|
||||
// the current draft external audit storage configuration athena.
|
||||
message TestDraftExternalAuditStorageAthenaRequest {}
|
||||
|
||||
// TestDraftExternalAuditStorageAthenaResponse is a response from testing the connection
|
||||
// of the current draft external audit storage configuration athena.
|
||||
message TestDraftExternalAuditStorageAthenaResponse {}
|
||||
Vendored
-97
@@ -1,97 +0,0 @@
|
||||
// Copyright 2024 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.gitserver.v1;
|
||||
|
||||
import "google/protobuf/empty.proto";
|
||||
import "teleport/legacy/types/types.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/gitserver/v1;gitserverv1";
|
||||
|
||||
// GitServerService provides methods to manage Git server.
|
||||
service GitServerService {
|
||||
// CreateGitServer is used to create a Git server object.
|
||||
rpc CreateGitServer(CreateGitServerRequest) returns (types.ServerV2);
|
||||
// GetGitServer is used to retrieve a Git server object.
|
||||
rpc GetGitServer(GetGitServerRequest) returns (types.ServerV2);
|
||||
// ListGitServers is used to query Git servers.
|
||||
rpc ListGitServers(ListGitServersRequest) returns (ListGitServersResponse);
|
||||
// UpdateGitServer is used to update a Git server object.
|
||||
rpc UpdateGitServer(UpdateGitServerRequest) returns (types.ServerV2);
|
||||
// UpsertGitServer is used to create or replace a Git server object.
|
||||
rpc UpsertGitServer(UpsertGitServerRequest) returns (types.ServerV2);
|
||||
// DeleteGitServer is used to delete a Git server object.
|
||||
rpc DeleteGitServer(DeleteGitServerRequest) returns (google.protobuf.Empty);
|
||||
|
||||
// CreateGitHubAuthRequest starts GitHub OAuth flow for authenticated user.
|
||||
rpc CreateGitHubAuthRequest(CreateGitHubAuthRequestRequest) returns (types.GithubAuthRequest);
|
||||
}
|
||||
|
||||
// CreateGitServerRequest is a request to create a Git server.
|
||||
message CreateGitServerRequest {
|
||||
// Server is the Git server to create.
|
||||
types.ServerV2 server = 1;
|
||||
}
|
||||
|
||||
// GetGitServerRequest is a request to get a Git server.
|
||||
message GetGitServerRequest {
|
||||
// Name is the uuid of the server.
|
||||
string name = 1;
|
||||
}
|
||||
|
||||
// ListGitServersRequest is the request to list Git servers.
|
||||
message ListGitServersRequest {
|
||||
// The maximum number of items to return.
|
||||
// The server may impose a different page size at its discretion.
|
||||
int32 page_size = 1;
|
||||
// The page_token is the next_page_token value returned from a previous List request, if any.
|
||||
string page_token = 2;
|
||||
}
|
||||
|
||||
// ListGitServersResponse is the response to ListGitServers.
|
||||
message ListGitServersResponse {
|
||||
// The page of Git servers that matched the request.
|
||||
repeated types.ServerV2 servers = 1;
|
||||
// Token to retrieve the next page of results, or empty if there are no
|
||||
// more results in the list.
|
||||
string next_page_token = 2;
|
||||
}
|
||||
|
||||
// UpdateGitServerRequest is the request to update a Git server.
|
||||
message UpdateGitServerRequest {
|
||||
// Server is the Git server to update.
|
||||
types.ServerV2 server = 1;
|
||||
}
|
||||
|
||||
// UpsertGitServerRequest is the request to upsert a Git server.
|
||||
message UpsertGitServerRequest {
|
||||
// Server is the Git server to upsert.
|
||||
types.ServerV2 server = 1;
|
||||
}
|
||||
|
||||
// DeleteGitServerRequest is the request to delete a Git server.
|
||||
message DeleteGitServerRequest {
|
||||
// Name is the uuid of the server.
|
||||
string name = 1;
|
||||
}
|
||||
|
||||
// CreateGitHubAuthRequestRequest is the request for CreateGitHubAuthRequest.
|
||||
message CreateGitHubAuthRequestRequest {
|
||||
// Request is the basic GitHub auth request.
|
||||
types.GithubAuthRequest request = 1;
|
||||
// Organization is the GitHub organization that the user is accessing.
|
||||
string organization = 2;
|
||||
}
|
||||
-43
@@ -1,43 +0,0 @@
|
||||
// Copyright 2023 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.header.v1;
|
||||
|
||||
import "google/protobuf/timestamp.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1;headerv1";
|
||||
|
||||
// Metadata is resource metadata.
|
||||
message Metadata {
|
||||
reserved 7; // id
|
||||
reserved "id";
|
||||
// name is an object name.
|
||||
string name = 1;
|
||||
// namespace is object namespace. The field should be called "namespace"
|
||||
// when it returns in Teleport 2.4.
|
||||
string namespace = 2;
|
||||
// description is object description.
|
||||
string description = 3;
|
||||
// labels is a set of labels.
|
||||
map<string, string> labels = 5;
|
||||
// expires is a global expiry time header can be set on any resource in the
|
||||
// system.
|
||||
google.protobuf.Timestamp expires = 6;
|
||||
// revision is an opaque identifier which tracks the versions of a resource
|
||||
// over time. Clients should ignore and not alter its value but must return
|
||||
// the revision in any updates of a resource.
|
||||
string revision = 8;
|
||||
}
|
||||
-36
@@ -1,36 +0,0 @@
|
||||
// Copyright 2023 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.header.v1;
|
||||
|
||||
import "teleport/header/v1/metadata.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1;headerv1";
|
||||
|
||||
// ResourceHeader is a shared resource header.
|
||||
message ResourceHeader {
|
||||
// kind is a resource kind.
|
||||
string kind = 1;
|
||||
// sub_kind is an optional resource sub kind, used in some resources.
|
||||
string sub_kind = 2;
|
||||
// Version is the API version used to create the resource. It must be
|
||||
// specified. Based on this version, Teleport will apply different defaults on
|
||||
// resource creation or deletion. It must be an integer prefixed by "v".
|
||||
// For example: `v1`
|
||||
string version = 3;
|
||||
// metadata is resource metadata.
|
||||
Metadata metadata = 4;
|
||||
}
|
||||
-67
@@ -1,67 +0,0 @@
|
||||
// Copyright 2025 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.healthcheckconfig.v1;
|
||||
|
||||
import "google/protobuf/duration.proto";
|
||||
import "teleport/header/v1/metadata.proto";
|
||||
import "teleport/label/v1/label.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/healthcheckconfig/v1;healthcheckconfigv1";
|
||||
|
||||
// HealthCheckConfig is the configuration for network health checks from an
|
||||
// agent to its proxied resource.
|
||||
message HealthCheckConfig {
|
||||
// Kind is the resource kind. Must be "health_check_config".
|
||||
string kind = 1;
|
||||
// SubKind is an optional resource sub kind.
|
||||
string sub_kind = 2;
|
||||
// Version is the health check config version.
|
||||
string version = 3;
|
||||
// Metadata is the health check config resource's metadata.
|
||||
teleport.header.v1.Metadata metadata = 4;
|
||||
|
||||
// Spec is the health check config specification.
|
||||
HealthCheckConfigSpec spec = 5;
|
||||
}
|
||||
|
||||
// HealthCheckConfigSpec is the health check spec.
|
||||
message HealthCheckConfigSpec {
|
||||
// Match is used to select resources that these settings apply to.
|
||||
Matcher match = 1;
|
||||
// Timeout is the health check connection establishment timeout.
|
||||
// An attempt that times out is a failed attempt.
|
||||
google.protobuf.Duration timeout = 2;
|
||||
// Interval is the time between each health check.
|
||||
google.protobuf.Duration interval = 3;
|
||||
// HealthyThreshold is the number of consecutive passing health checks after
|
||||
// which a target's health status becomes "healthy".
|
||||
uint32 healthy_threshold = 4;
|
||||
// UnhealthyThreshold is the number of consecutive failing health checks after
|
||||
// which a target's health status becomes "unhealthy".
|
||||
uint32 unhealthy_threshold = 5;
|
||||
}
|
||||
|
||||
// Matcher is a resource matcher for health check config.
|
||||
message Matcher {
|
||||
// DBLabels matches database labels. An empty value is ignored. The match
|
||||
// result is logically ANDed with DBLabelsExpression, if both are non-empty.
|
||||
repeated teleport.label.v1.Label db_labels = 1;
|
||||
// DBLabelsExpression is a label predicate expression to match databases. An
|
||||
// empty value is ignored. The match result is logically ANDed with DBLabels,
|
||||
// if both are non-empty.
|
||||
string db_labels_expression = 2;
|
||||
}
|
||||
-91
@@ -1,91 +0,0 @@
|
||||
// Copyright 2025 Gravitational, Inc.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.healthcheckconfig.v1;
|
||||
|
||||
import "google/protobuf/empty.proto";
|
||||
import "teleport/healthcheckconfig/v1/health_check_config.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/healthcheckconfig/v1;healthcheckconfigv1";
|
||||
|
||||
// HealthCheckConfigService provides CRUD ops for health check config resources.
|
||||
service HealthCheckConfigService {
|
||||
// CreateHealthCheckConfig creates a new HealthCheckConfig.
|
||||
rpc CreateHealthCheckConfig(CreateHealthCheckConfigRequest) returns (HealthCheckConfig);
|
||||
|
||||
// GetHealthCheckConfig returns the specified HealthCheckConfig.
|
||||
rpc GetHealthCheckConfig(GetHealthCheckConfigRequest) returns (HealthCheckConfig);
|
||||
|
||||
// ListHealthCheckConfigs lists HealthCheckConfig resources.
|
||||
rpc ListHealthCheckConfigs(ListHealthCheckConfigsRequest) returns (ListHealthCheckConfigsResponse);
|
||||
|
||||
// UpdateHealthCheckConfig updates an existing HealthCheckConfig.
|
||||
rpc UpdateHealthCheckConfig(UpdateHealthCheckConfigRequest) returns (HealthCheckConfig);
|
||||
|
||||
// UpsertHealthCheckConfig creates or replaces a HealthCheckConfig.
|
||||
rpc UpsertHealthCheckConfig(UpsertHealthCheckConfigRequest) returns (HealthCheckConfig);
|
||||
|
||||
// DeleteHealthCheckConfig deletes the specified HealthCheckConfig.
|
||||
rpc DeleteHealthCheckConfig(DeleteHealthCheckConfigRequest) returns (google.protobuf.Empty);
|
||||
}
|
||||
|
||||
// Request for CreateHealthCheckConfig.
|
||||
message CreateHealthCheckConfigRequest {
|
||||
// Config is the resource to create.
|
||||
HealthCheckConfig config = 1;
|
||||
}
|
||||
|
||||
// GetHealthCheckConfigRequest is a request for GetHealthCheckConfig.
|
||||
message GetHealthCheckConfigRequest {
|
||||
// Name is the name of the HealthCheckConfig to retrieve.
|
||||
string name = 1;
|
||||
}
|
||||
|
||||
// ListHealthCheckConfigsRequest is the request for ListHealthCheckConfigs.
|
||||
message ListHealthCheckConfigsRequest {
|
||||
// PageSize is the maximum number of items to return.
|
||||
// The server may impose a different page size at its discretion.
|
||||
int32 page_size = 1;
|
||||
// PageToken is the page token value returned from a prior list request, if any.
|
||||
string page_token = 2;
|
||||
}
|
||||
|
||||
// ListHealthCheckConfigsResponse is the response from ListHealthCheckConfigs.
|
||||
message ListHealthCheckConfigsResponse {
|
||||
// Configs is a page of health check configs.
|
||||
repeated HealthCheckConfig configs = 1;
|
||||
// NextPageToken is the token that can be used to retrieve the next page of
|
||||
// results or empty if there are no more pages.
|
||||
string next_page_token = 2;
|
||||
}
|
||||
|
||||
// Request for UpdateHealthCheckConfig.
|
||||
message UpdateHealthCheckConfigRequest {
|
||||
// Config is the resource to update.
|
||||
HealthCheckConfig config = 1;
|
||||
}
|
||||
|
||||
// Request for UpsertHealthCheckConfig.
|
||||
message UpsertHealthCheckConfigRequest {
|
||||
// Config is the resource to upsert.
|
||||
HealthCheckConfig config = 1;
|
||||
}
|
||||
|
||||
// Request for DeleteHealthCheckConfig.
|
||||
message DeleteHealthCheckConfigRequest {
|
||||
// Name is the name of the HealthCheckConfig to delete.
|
||||
string name = 1;
|
||||
}
|
||||
Vendored
-217
@@ -1,217 +0,0 @@
|
||||
// Copyright 2024 Gravitational, Inc.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.identitycenter.v1;
|
||||
|
||||
import "teleport/header/v1/metadata.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/identitycenter/v1;identitycenterv1";
|
||||
|
||||
// PermissionSetInfo represents a permission set that is available on a given
|
||||
// account. This is not intended to be a complete description of a PermissionSet,
|
||||
// but just enough to identify it for cross-referencing when included in an
|
||||
// Account record.
|
||||
message PermissionSetInfo {
|
||||
// Arn is the unique ARN for this permission set
|
||||
string arn = 1;
|
||||
|
||||
// Title is the human-readable name of the permission set
|
||||
string name = 2;
|
||||
|
||||
// Role is an optional ARN indicating role provisioned to this account. May be
|
||||
// empty if the permission set is not provisioned or is not relevant in the
|
||||
string role = 3;
|
||||
|
||||
// AssignmentID is the name of a Teleport Account Assignment resource
|
||||
// representing this permission set assigned to the enclosing Account.
|
||||
string assignment_id = 4;
|
||||
}
|
||||
|
||||
// AccountStatus represents any commonly-changing data about an Identity
|
||||
// Center account.
|
||||
message AccountStatus {}
|
||||
|
||||
// Account is an Identity-Center-managed AWS account
|
||||
message Account {
|
||||
string kind = 1;
|
||||
string sub_kind = 2;
|
||||
string version = 3;
|
||||
teleport.header.v1.Metadata metadata = 4;
|
||||
AccountSpec spec = 5;
|
||||
AccountStatus status = 6;
|
||||
}
|
||||
|
||||
// AccountSpec holds non-changing data about an AWS Account
|
||||
message AccountSpec {
|
||||
// Id is the AWS-assigned PermissionSet ID
|
||||
string id = 1;
|
||||
|
||||
// Arn is the unique ARN for this permission set
|
||||
string arn = 2;
|
||||
|
||||
// Name is the human-readable name of the permission set
|
||||
string name = 3;
|
||||
|
||||
// Description is a heman-readable description of the AWS Permission Set
|
||||
string description = 4;
|
||||
|
||||
// StartUrl is the address of the AWS start page
|
||||
string start_url = 5;
|
||||
|
||||
// PermissionSetInfo contains a list of the available Perission Sets on this
|
||||
// account.
|
||||
repeated PermissionSetInfo permission_set_info = 6;
|
||||
|
||||
// IsOrganizationOwner indicates that this account is the organisation owner,
|
||||
// and may have restrictions about adding permission sets
|
||||
bool is_organization_owner = 7;
|
||||
}
|
||||
|
||||
// PermissionSet identifies a single permission set by name and ARN
|
||||
message PermissionSet {
|
||||
string kind = 1;
|
||||
string sub_kind = 2;
|
||||
string version = 3;
|
||||
teleport.header.v1.Metadata metadata = 4;
|
||||
PermissionSetSpec spec = 5;
|
||||
}
|
||||
|
||||
// PermissionSetSpec holds rarely-changing information about ans AWS pwermission
|
||||
// set
|
||||
message PermissionSetSpec {
|
||||
// Arn is the unique ARN for this permission set
|
||||
string arn = 1;
|
||||
|
||||
// Name is the human-readable name of the permission set
|
||||
string name = 2;
|
||||
|
||||
// Description is a human-readable description of the AWS Permission Set
|
||||
string description = 3;
|
||||
}
|
||||
|
||||
// AccountAssignment captures the relationship between a PermissionSet
|
||||
// and an Identity Center Account. It represents two parts of a potential 3-part
|
||||
// Identity Center Account Assignment. This is the primary requestable resource
|
||||
// for a user and a user having access to an AccountAssignment resource implies
|
||||
// that there is a corresponding Account Assignment in AWS Identity Center that
|
||||
// grants that user the Permission Set specified in that resource, on the
|
||||
// AWS Account specified in that resource.
|
||||
message AccountAssignment {
|
||||
string kind = 1;
|
||||
string sub_kind = 2;
|
||||
string version = 3;
|
||||
teleport.header.v1.Metadata metadata = 4;
|
||||
AccountAssignmentSpec spec = 5;
|
||||
}
|
||||
|
||||
// AccountAssignmentSpec holds static information abount an AccountAssignment,
|
||||
// linking a Permission Set and an AWS account.
|
||||
message AccountAssignmentSpec {
|
||||
string display = 1;
|
||||
PermissionSetInfo permission_set = 2;
|
||||
string account_name = 3;
|
||||
string account_id = 4;
|
||||
}
|
||||
|
||||
// PrincipalAssignment relates a collection of PermissionSets and Applications
|
||||
// to a given principal. This is the source of truth for all Account & Permission
|
||||
// Set assignments in AWS
|
||||
message PrincipalAssignment {
|
||||
string kind = 1;
|
||||
string sub_kind = 2;
|
||||
string version = 3;
|
||||
teleport.header.v1.Metadata metadata = 4;
|
||||
PrincipalAssignmentSpec spec = 5;
|
||||
PrincipalAssignmentStatus status = 6;
|
||||
}
|
||||
|
||||
// PrincipalType indicates the type of principal represented by a PrincipalAssignment
|
||||
enum PrincipalType {
|
||||
PRINCIPAL_TYPE_UNSPECIFIED = 0;
|
||||
PRINCIPAL_TYPE_USER = 1;
|
||||
PRINCIPAL_TYPE_ACCESS_LIST = 2;
|
||||
}
|
||||
|
||||
// PrincipalAssignmentSpec holds information about the Account Assignments
|
||||
// assigned to the target principal.
|
||||
message PrincipalAssignmentSpec {
|
||||
// PrincipalId identifies what kind of principal this assignment applies to, either
|
||||
// a User or a Group (i.e. AccessList)
|
||||
PrincipalType principal_type = 1;
|
||||
|
||||
// PrincipalId identifies the Teleport User or Access List that this assignment
|
||||
// applies to
|
||||
string principal_id = 2;
|
||||
|
||||
// ExternalIdSource
|
||||
string external_id_source = 3;
|
||||
|
||||
// ExternalID identifies the user or group within AWS
|
||||
string external_id = 4;
|
||||
}
|
||||
|
||||
// ProvisioningState indicates the current stage of the Account-Assignment
|
||||
// provisioning pipeline a resource is in.
|
||||
enum ProvisioningState {
|
||||
// PROVISIONING_STATE_UNSPECIFIED is the default empty state. This should never
|
||||
// be used in practice.
|
||||
PROVISIONING_STATE_UNSPECIFIED = 0;
|
||||
|
||||
// PROVISIONING_STATE_STALE indicates that Teleport has recalculated the
|
||||
// principal's Account Assignment set, but this has not yet been reflected in
|
||||
// AWS.
|
||||
PROVISIONING_STATE_STALE = 1;
|
||||
|
||||
// PROVISIONING_STATE_PROVISIONED indicates that Teleport has synced the
|
||||
// principal's Account Assignments with AWS, and no further work needs to be
|
||||
// done.
|
||||
PROVISIONING_STATE_PROVISIONED = 2;
|
||||
|
||||
// PROVISIONING_STATE_DELETED indicates that the principal as been deleted in
|
||||
// Teleport and all account assignments need to be revoked in AWS and the
|
||||
// Teleport PrincipalAssignment record needs to be deleted
|
||||
PROVISIONING_STATE_DELETED = 3;
|
||||
}
|
||||
|
||||
// AccountAssignmentRef is a minimal link between an AWS Account and a
|
||||
// permission set. Optionally contains human-readable metadata describing the
|
||||
// target AWS Account and Permission Set.
|
||||
message AccountAssignmentRef {
|
||||
// AccountId holds the AWS account ID for the target AWS account. This will
|
||||
// always be set
|
||||
string account_id = 1;
|
||||
|
||||
// AccountName optionally holds the heman-readable name of the target AwS
|
||||
// account
|
||||
string account_name = 2;
|
||||
|
||||
// PermissionSetArn holds the target Permission Set ARN. This will always be
|
||||
// set.
|
||||
string permission_set_arn = 3;
|
||||
|
||||
// PermissionSetName optionally holds the human-readable name of the target
|
||||
// AWS Permission Set.
|
||||
string permission_set_name = 4;
|
||||
}
|
||||
|
||||
// PrincipalAssignmentAssignmentStatus holds frequently-changing iinformation
|
||||
// about the PrincipalAssignment
|
||||
message PrincipalAssignmentStatus {
|
||||
ProvisioningState provisioning_state = 1;
|
||||
repeated AccountAssignmentRef assignments = 2;
|
||||
repeated string applications = 3;
|
||||
string error = 4;
|
||||
}
|
||||
-49
@@ -1,49 +0,0 @@
|
||||
// Copyright 2024 Gravitational, Inc.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.identitycenter.v1;
|
||||
|
||||
import "google/protobuf/empty.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/identitycenter/v1;identitycenterv1";
|
||||
|
||||
// IdentityCenterService provides methods to manage Identity Center
|
||||
// resources.
|
||||
service IdentityCenterService {
|
||||
// DeleteAllIdentityCenterAccounts deletes all Identity Center accounts.
|
||||
rpc DeleteAllIdentityCenterAccounts(DeleteAllIdentityCenterAccountsRequest) returns (google.protobuf.Empty);
|
||||
|
||||
// DeleteAllAccountAssignments deletes all Identity Center Account assignments.
|
||||
rpc DeleteAllAccountAssignments(DeleteAllAccountAssignmentsRequest) returns (google.protobuf.Empty);
|
||||
|
||||
// DeleteAllPrincipalAssignments deletes all Identity Center principal assignments.
|
||||
rpc DeleteAllPrincipalAssignments(DeleteAllPrincipalAssignmentsRequest) returns (google.protobuf.Empty);
|
||||
|
||||
// DeleteAllPermissionSets deletes all Identity Center permission sets.
|
||||
rpc DeleteAllPermissionSets(DeleteAllPermissionSetsRequest) returns (google.protobuf.Empty);
|
||||
}
|
||||
|
||||
// DeleteAllIdentityCenterAccountsRequest is a request to delete all Identity Center imported accounts.
|
||||
message DeleteAllIdentityCenterAccountsRequest {}
|
||||
|
||||
// DeleteAllAccountAssignmentsRequest is a request to delete all Identity Center account assignments.
|
||||
message DeleteAllAccountAssignmentsRequest {}
|
||||
|
||||
// DeleteAllPrincipalAssignmentsRequest is a request to delete all Identity Center principal assignments.
|
||||
message DeleteAllPrincipalAssignmentsRequest {}
|
||||
|
||||
// DeleteAllPermissionSetsRequest is a request to delete all Identity Center permission sets.
|
||||
message DeleteAllPermissionSetsRequest {}
|
||||
Vendored
-622
@@ -1,622 +0,0 @@
|
||||
// Copyright 2023 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.integration.v1;
|
||||
|
||||
import "teleport/legacy/types/types.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/integration/v1;integrationv1";
|
||||
|
||||
// AWSOIDCService provides access to AWS APIs using the AWS OIDC Integration.
|
||||
service AWSOIDCService {
|
||||
// ListEICE returns a list of EC2 Instance Connect Endpoints.
|
||||
// An optional NextToken that can be used to fetch the next page.
|
||||
// It uses the following API:
|
||||
// https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstanceConnectEndpoints.html
|
||||
rpc ListEICE(ListEICERequest) returns (ListEICEResponse) {
|
||||
// TODO(marco): DELETE IN v19.0.0
|
||||
option deprecated = true;
|
||||
}
|
||||
|
||||
// CreateEICE creates multiple EC2 Instance Connect Endpoint using the provided Subnets and Security Group IDs.
|
||||
// It uses the following API:
|
||||
// https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateInstanceConnectEndpoint.html
|
||||
rpc CreateEICE(CreateEICERequest) returns (CreateEICEResponse) {
|
||||
// TODO(marco): DELETE IN v19.0.0
|
||||
option deprecated = true;
|
||||
}
|
||||
|
||||
// ListDatabases calls the following AWS API:
|
||||
// https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBClusters.html
|
||||
// https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBInstances.html
|
||||
// It returns a list of Databases and an optional NextToken that can be used to fetch the next page
|
||||
rpc ListDatabases(ListDatabasesRequest) returns (ListDatabasesResponse);
|
||||
|
||||
// ListSecurityGroups returns a list of AWS VPC SecurityGroups.
|
||||
// It uses the following API:
|
||||
// https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSecurityGroups.html
|
||||
rpc ListSecurityGroups(ListSecurityGroupsRequest) returns (ListSecurityGroupsResponse);
|
||||
|
||||
// ListSubnets returns a list of AWS VPC subnets.
|
||||
// It uses the following API:
|
||||
// https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSubnets.html
|
||||
rpc ListSubnets(ListSubnetsRequest) returns (ListSubnetsResponse);
|
||||
|
||||
// ListVPCs returns a list of AWS VPCs.
|
||||
// It uses the following API:
|
||||
// https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcs.html
|
||||
rpc ListVPCs(ListVPCsRequest) returns (ListVPCsResponse);
|
||||
|
||||
// DeployDatabaseService deploys a Database Services to Amazon ECS.
|
||||
rpc DeployDatabaseService(DeployDatabaseServiceRequest) returns (DeployDatabaseServiceResponse);
|
||||
|
||||
// ListDeployedDatabaseServices returns the deployed Database Services in Amazon ECS.
|
||||
rpc ListDeployedDatabaseServices(ListDeployedDatabaseServicesRequest) returns (ListDeployedDatabaseServicesResponse);
|
||||
|
||||
// DeployService deploys an ECS Service to Amazon ECS.
|
||||
rpc DeployService(DeployServiceRequest) returns (DeployServiceResponse);
|
||||
|
||||
// EnrollEKSClusters enrolls EKS clusters by installing kube agent Helm chart.
|
||||
rpc EnrollEKSClusters(EnrollEKSClustersRequest) returns (EnrollEKSClustersResponse);
|
||||
|
||||
// ListEC2 lists the EC2 instances of the AWS account per region.
|
||||
// It uses the following API:
|
||||
// https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstances.html
|
||||
rpc ListEC2(ListEC2Request) returns (ListEC2Response) {
|
||||
// TODO(marco): DELETE IN v19.0.0
|
||||
option deprecated = true;
|
||||
}
|
||||
|
||||
// ListEKSClusters retrieves a paginated list of EKS clusters in the specified AWS region for a specific account.
|
||||
// It uses the following APIs:
|
||||
// https://docs.aws.amazon.com/eks/latest/APIReference/API_ListClusters.html
|
||||
// https://docs.aws.amazon.com/eks/latest/APIReference/API_DescribeCluster.html
|
||||
rpc ListEKSClusters(ListEKSClustersRequest) returns (ListEKSClustersResponse);
|
||||
|
||||
// Ping does an health check for the integration.
|
||||
// Returns the caller identity.
|
||||
// It uses the following APIs:
|
||||
// https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html
|
||||
rpc Ping(PingRequest) returns (PingResponse);
|
||||
}
|
||||
|
||||
// ListEICERequest is a request for a paginated list of AWS EC2 Instance Connect Endpoints.
|
||||
message ListEICERequest {
|
||||
option deprecated = true;
|
||||
// Integration is the AWS OIDC Integration name.
|
||||
// Required.
|
||||
string integration = 1;
|
||||
// Region is the AWS Region
|
||||
// Required.
|
||||
string region = 2;
|
||||
// VPCIDs is used to filter for EICEs of those VPCs.
|
||||
// Required.
|
||||
repeated string vpc_ids = 3;
|
||||
// NextToken is the token to be used to fetch the next page.
|
||||
// If empty, the first page is fetched.
|
||||
string next_token = 4;
|
||||
}
|
||||
|
||||
// EC2InstanceConnectEndpoint is a representation of a Amazon VPC EC2 Instance Connect Endpoint.
|
||||
message EC2InstanceConnectEndpoint {
|
||||
option deprecated = true;
|
||||
// Name is the endpoint name.
|
||||
string name = 1;
|
||||
// State is the endpoint state.
|
||||
// Known values:
|
||||
// create-in-progress | create-complete | create-failed | delete-in-progress | delete-complete | delete-failed
|
||||
string state = 2;
|
||||
// StateMessage contains a message describing the state of the EICE.
|
||||
string state_message = 3;
|
||||
// DashboardLink is a URL to AWS Console where the user can see the EC2 Instance Connect Endpoint.
|
||||
string dashboard_link = 4;
|
||||
// SubnetID is the subnet used by the endpoint.
|
||||
string subnet_id = 5;
|
||||
// VPCID is the VPC ID where the Endpoint is created.
|
||||
string vpc_id = 6;
|
||||
}
|
||||
|
||||
// ListEICEResponse contains a page of AWS EC2 Instance Connect Endpoints.
|
||||
message ListEICEResponse {
|
||||
option deprecated = true;
|
||||
// EC2ICEs contains the page of EC2 Instance Connect Endpoints.
|
||||
repeated EC2InstanceConnectEndpoint ec2ices = 1;
|
||||
// DashboardLink is the URL for AWS Web Console that lists all the Endpoints for the queries VPCs.
|
||||
string dashboard_link = 2;
|
||||
// NextToken is used for pagination.
|
||||
// If non-empty, it can be used to request the next page.
|
||||
string next_token = 3;
|
||||
}
|
||||
|
||||
// CreateEICERequest contains the required fields to create an AWS EC2 Instance Connect Endpoint.
|
||||
message CreateEICERequest {
|
||||
option deprecated = true;
|
||||
// Integration is the AWS OIDC Integration name.
|
||||
// Required.
|
||||
string integration = 1;
|
||||
// Region is the AWS Region
|
||||
// Required.
|
||||
string region = 2;
|
||||
// Endpoints is is a list of EC2 Instance Connect Endpoints to be created.
|
||||
// Required.
|
||||
repeated EC2ICEndpoint endpoints = 3;
|
||||
}
|
||||
|
||||
// EC2ICEndpoint contains the information for a single Endpoint to be created.
|
||||
message EC2ICEndpoint {
|
||||
option deprecated = true;
|
||||
// Name is the endpoint name.
|
||||
string name = 1;
|
||||
// SubnetID is the Subnet where the Endpoint will be created.
|
||||
string subnet_id = 2;
|
||||
// SecurityGroupIDs is a list of SecurityGroups to assign to the Endpoint.
|
||||
// If not specified, the Endpoint will receive the default SG for the Subnet's VPC.
|
||||
repeated string security_group_ids = 3;
|
||||
}
|
||||
|
||||
// CreateEICEResponse is a request to create a VPC Endpoint of EC2 Instance Connect Endpoint type.
|
||||
message CreateEICEResponse {
|
||||
option deprecated = true;
|
||||
// Name is the Endpoint ID.
|
||||
string name = 1;
|
||||
// CreatedEndpoints contains the name of created endpoints and their Subnet.
|
||||
repeated EC2ICEndpoint created_endpoints = 2;
|
||||
}
|
||||
|
||||
// ListDatabasesRequest is a request for a paginated list of AWS Databases.
|
||||
message ListDatabasesRequest {
|
||||
// Integration is the AWS OIDC Integration name.
|
||||
// Required.
|
||||
string integration = 1;
|
||||
// Region is the AWS Region
|
||||
// Required.
|
||||
string region = 2;
|
||||
// RDSType is either instance or cluster (for Aurora DBs).
|
||||
// Required.
|
||||
string rds_type = 3;
|
||||
// Engines filters the returned Databases based on their engine.
|
||||
// Eg, mysql, postgres, mariadb, aurora, aurora-mysql, aurora-postgresql
|
||||
// Required.
|
||||
repeated string engines = 4;
|
||||
// NextToken is the token to be used to fetch the next page.
|
||||
// If empty, the first page is fetched.
|
||||
string next_token = 5;
|
||||
// VPCID filters databases to only include those deployed in the VPC.
|
||||
// If empty, no filtering is done.
|
||||
string vpc_id = 6;
|
||||
}
|
||||
|
||||
// ListDatabasesResponse contains a page of AWS Databases.
|
||||
message ListDatabasesResponse {
|
||||
// Databases contains the page of Databases.
|
||||
repeated types.DatabaseV3 databases = 1;
|
||||
// NextToken is used for pagination.
|
||||
// If non-empty, it can be used to request the next page.
|
||||
string next_token = 2;
|
||||
}
|
||||
|
||||
// ListSecurityGroupsRequest is a request for a paginated list of AWS SecurityGroups.
|
||||
message ListSecurityGroupsRequest {
|
||||
// Integration is the AWS OIDC Integration name.
|
||||
// Required.
|
||||
string integration = 1;
|
||||
// Region is the AWS Region
|
||||
// Required.
|
||||
string region = 2;
|
||||
// VPCID is the VPC ID for listing SecurityGroups.
|
||||
// Required.
|
||||
string vpc_id = 3;
|
||||
// NextToken is the token to be used to fetch the next page.
|
||||
// If empty, the first page is fetched.
|
||||
string next_token = 4;
|
||||
}
|
||||
|
||||
// CIDR has a CIDR (IP Range) and a description for the value.
|
||||
message SecurityGroupRuleCIDR {
|
||||
// CIDR is the IP range using CIDR notation.
|
||||
string cidr = 1;
|
||||
// Description contains a small text describing the CIDR.
|
||||
string description = 2;
|
||||
}
|
||||
|
||||
// SecurityGroupRuleGroupID has an allowed security group ID and a description
|
||||
// for the rule.
|
||||
message SecurityGroupRuleGroupID {
|
||||
// GroupID is the allowed security group ID.
|
||||
string group_id = 1;
|
||||
// Description contains a small text describing the allowed security group.
|
||||
string description = 2;
|
||||
}
|
||||
|
||||
// SecurityGroupRule is a representation of a SecurityGroupRule.
|
||||
// Either for Inbound or Outbound rules.
|
||||
message SecurityGroupRule {
|
||||
// IPProtocol is the protocol used to describe the rule.
|
||||
// If the rule applies to all protocols, the "all" value is used.
|
||||
// The IP protocol name ( tcp , udp , icmp , icmpv6 ) or number (see Protocol
|
||||
// Numbers (http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml)).
|
||||
string ip_protocol = 1;
|
||||
// FromPort is the inclusive start of the Port range for the Rule.
|
||||
int32 from_port = 2;
|
||||
// ToPort is the inclusive end of the Port range for the Rule.
|
||||
int32 to_port = 3;
|
||||
// CIDRs contains a list of IP ranges that this rule applies to and a description for the value.
|
||||
repeated SecurityGroupRuleCIDR cidrs = 4;
|
||||
// GroupIds is a list of rules that allow another security group referenced
|
||||
// by ID.
|
||||
repeated SecurityGroupRuleGroupID group_ids = 5;
|
||||
}
|
||||
|
||||
// SecurityGroup is a representation of a SecurityGroup
|
||||
message SecurityGroup {
|
||||
// Name is the SecurityGroup name.
|
||||
string name = 1;
|
||||
// ID is the SecurityGroup ID.
|
||||
string id = 2;
|
||||
// Description is a small description of the SecurityGroup.
|
||||
string description = 3;
|
||||
// InboundRules describe the Security Group Inbound Rules.
|
||||
// The CIDR of each rule represents the source IP that the rule applies to.
|
||||
repeated SecurityGroupRule inbound_rules = 4;
|
||||
// OutboundRules describe the Security Group Outbound Rules.
|
||||
// The CIDR of each rule represents the destination IP that the rule applies to.
|
||||
repeated SecurityGroupRule outbound_rules = 5;
|
||||
}
|
||||
|
||||
// ListSecurityGroupsResponse contains a page of AWS SecurityGroups.
|
||||
message ListSecurityGroupsResponse {
|
||||
// SecurityGroups contains the page of SecurityGroups.
|
||||
repeated SecurityGroup security_groups = 1;
|
||||
// NextToken is used for pagination.
|
||||
// If non-empty, it can be used to request the next page.
|
||||
string next_token = 2;
|
||||
}
|
||||
|
||||
// ListSubnetsRequest is a request for a paginated list of AWS VPC subnets.
|
||||
message ListSubnetsRequest {
|
||||
// Integration is the AWS OIDC Integration name.
|
||||
// Required.
|
||||
string integration = 1;
|
||||
// Region is the AWS Region
|
||||
// Required.
|
||||
string region = 2;
|
||||
// VPCID is the VPC ID for listing subnets.
|
||||
// Required.
|
||||
string vpc_id = 3;
|
||||
// NextToken is the token to be used to fetch the next page.
|
||||
// If empty, the first page is fetched.
|
||||
string next_token = 4;
|
||||
}
|
||||
|
||||
// Subnet is a representation of an AWS VPC subnet.
|
||||
message Subnet {
|
||||
// Name is the subnet name. Can be empty.
|
||||
string name = 1;
|
||||
// ID is the subnet ID.
|
||||
string id = 2;
|
||||
// AvailabilityZone is the availability zone of the subnet.
|
||||
string availability_zone = 3;
|
||||
}
|
||||
|
||||
// ListSubnetsResponse contains a page of AWS VPC subnets.
|
||||
message ListSubnetsResponse {
|
||||
// Subnets contains the page of subnets.
|
||||
repeated Subnet subnets = 1;
|
||||
// NextToken is used for pagination.
|
||||
// If non-empty, it can be used to request the next page.
|
||||
string next_token = 2;
|
||||
}
|
||||
|
||||
// ListVPCsRequest is a request for a paginated list of AWS VPCs.
|
||||
message ListVPCsRequest {
|
||||
// Integration is the AWS OIDC Integration name.
|
||||
// Required.
|
||||
string integration = 1;
|
||||
// Region is the AWS Region
|
||||
// Required.
|
||||
string region = 2;
|
||||
// NextToken is the token to be used to fetch the next page.
|
||||
// If empty, the first page is fetched.
|
||||
string next_token = 3;
|
||||
}
|
||||
|
||||
// VPC is a representation of an AWS VPC.
|
||||
message VPC {
|
||||
// Name is the VPC name. Can be empty.
|
||||
string name = 1;
|
||||
// ID is the VPC ID.
|
||||
string id = 2;
|
||||
}
|
||||
|
||||
// ListVPCsResponse contains a page of AWS VPCs.
|
||||
message ListVPCsResponse {
|
||||
// VPCs contains the page of VPCs.
|
||||
repeated VPC vpcs = 1;
|
||||
// NextToken is used for pagination.
|
||||
// If non-empty, it can be used to request the next page.
|
||||
string next_token = 2;
|
||||
}
|
||||
|
||||
// DeployDatabaseServiceRequest is a request to deploy .
|
||||
message DeployDatabaseServiceRequest {
|
||||
// Integration is the AWS OIDC Integration name.
|
||||
// Required.
|
||||
string integration = 1;
|
||||
// Region is the AWS Region
|
||||
// Required.
|
||||
string region = 2;
|
||||
// TaskRoleARN is the AWS IAM Role received by the deployed service.
|
||||
// Required.
|
||||
string task_role_arn = 3;
|
||||
// TeleportVersion is the teleport version to be deployed.
|
||||
// This is used to fetch the correct tag for the teleport container image.
|
||||
// Eg, 14.3.4 (no "v" prefix)
|
||||
// Required.
|
||||
string teleport_version = 4;
|
||||
// DeploymentJoinTokenName is the Teleport IAM Join Token to be used by the deployed
|
||||
// service to join the cluster.
|
||||
// Required.
|
||||
string deployment_join_token_name = 5;
|
||||
// Deployments is a list of services that will be deployed.
|
||||
repeated DeployDatabaseServiceDeployment deployments = 6;
|
||||
}
|
||||
|
||||
// DeployDatabaseServiceDeployment represents a single deployment.
|
||||
message DeployDatabaseServiceDeployment {
|
||||
// TeleportConfigString is the teleport.yaml configuration (base64 encoded) used by teleport.
|
||||
// Required.
|
||||
string teleport_config_string = 1;
|
||||
// VpcId is the VPCID where the service is going to be deployed.
|
||||
// Required.
|
||||
string vpc_id = 2;
|
||||
// SubnetIds are the subnets for the network configuration.
|
||||
// They must belong to the VpcId above.
|
||||
// Required.
|
||||
repeated string subnet_ids = 3;
|
||||
// SecurityGroups are the SecurityGroup IDs to associate with this particular deployment.
|
||||
// If empty, the default security group for the VPC is going to be used.
|
||||
repeated string security_groups = 4;
|
||||
}
|
||||
|
||||
// DeployDatabaseServiceResponse contains information about the deployed service.
|
||||
message DeployDatabaseServiceResponse {
|
||||
// ClusterArn identifies the cluster where the deployment was made.
|
||||
string cluster_arn = 1;
|
||||
// ClusterDashboardURL is a link to the Amazon ECS cluster dashboard or a
|
||||
// specific cluster service if a single deployment was requested.
|
||||
string cluster_dashboard_url = 2;
|
||||
}
|
||||
|
||||
// ListDeployedDatabaseServicesRequest is a request for listing the deployed database services in Amazon ECS.
|
||||
message ListDeployedDatabaseServicesRequest {
|
||||
// Integration is the AWS OIDC Integration name.
|
||||
// Required.
|
||||
string integration = 1;
|
||||
// Region is the AWS Region
|
||||
// Required.
|
||||
string region = 2;
|
||||
// NextToken is the token to be used to fetch the next page.
|
||||
// If empty, the first page is fetched.
|
||||
string next_token = 3;
|
||||
}
|
||||
|
||||
// DeployedDatabaseService contains a database service that was deployed to Amazon ECS.
|
||||
message DeployedDatabaseService {
|
||||
// Name is the Amazon ECS Service name.
|
||||
string name = 1;
|
||||
// ServiceDashboardURL is a link to the Amazon ECS Service dashboard.
|
||||
string service_dashboard_url = 2;
|
||||
// ContainerEntryPoint is the entry point for the container 0 that is running in the ECS Task.
|
||||
repeated string container_entry_point = 3;
|
||||
// ContainerCommand is the list of arguments that are passed into the ContainerEntryPoint.
|
||||
repeated string container_command = 4;
|
||||
}
|
||||
|
||||
// ListDeployedDatabaseServicesResponse contains the list of the database services that were deployed in Amazon ECS.
|
||||
message ListDeployedDatabaseServicesResponse {
|
||||
// DeployedDatabaseServices contains a page of page of EC2.
|
||||
repeated DeployedDatabaseService deployed_database_services = 1;
|
||||
// NextToken is the token to be used to fetch the next page.
|
||||
// If empty, the first page is fetched.
|
||||
string next_token = 2;
|
||||
}
|
||||
|
||||
// DeployServiceRequest is a request to deploy .
|
||||
message DeployServiceRequest {
|
||||
// Integration is the AWS OIDC Integration name.
|
||||
// Required.
|
||||
string integration = 1;
|
||||
// Region is the AWS Region
|
||||
// Required.
|
||||
string region = 2;
|
||||
// DeploymentMode is the deployment name that should be applied when creating the ECS Service.
|
||||
// Allowed modes: database-service
|
||||
// Required.
|
||||
string deployment_mode = 3;
|
||||
// SecurityGroups to apply to the service's network configuration.
|
||||
// If empty, the default security group for the VPC is going to be used.
|
||||
repeated string security_groups = 4;
|
||||
// SubnetIds are the subnets for the network configuration.
|
||||
// Required.
|
||||
repeated string subnet_ids = 5;
|
||||
// TaskRoleARN is the AWS IAM Role received by the deployed service.
|
||||
// Required.
|
||||
string task_role_arn = 6;
|
||||
// TeleportVersion is the teleport version to be deployed.
|
||||
// This is used to fetch the correct tag for the teleport container image.
|
||||
// Eg, 14.3.4 (no "v" prefix)
|
||||
// Required.
|
||||
string teleport_version = 7;
|
||||
// DeploymentJoinTokenName is the Teleport IAM Join Token to be used by the deployed
|
||||
// service to join the cluster.
|
||||
// Required.
|
||||
string deployment_join_token_name = 8;
|
||||
// TeleportConfigString is the teleport.yaml configuration (base64 encoded) used by teleport.
|
||||
// Required.
|
||||
string teleport_config_string = 9;
|
||||
}
|
||||
|
||||
// DeployServiceResponse contains information about the deployed service.
|
||||
message DeployServiceResponse {
|
||||
// ClusterArn identifies the cluster where the deployment was made.
|
||||
string cluster_arn = 1;
|
||||
// ServiceARN is the Amazon ECS Cluster Service ARN created to run the task.
|
||||
string service_arn = 2;
|
||||
// TaskDefinitionARN is the Amazon ECS Task Definition ARN created to run the Service.
|
||||
string task_definition_arn = 3;
|
||||
// ServiceDashboardURL is a link to the service's Dashboard URL in Amazon Console.
|
||||
string service_dashboard_url = 4;
|
||||
}
|
||||
|
||||
// EnrollEKSClustersRequest is request to enroll EKS clusters.
|
||||
message EnrollEKSClustersRequest {
|
||||
// Integration is the AWS OIDC Integration name.
|
||||
// Required.
|
||||
string integration = 1;
|
||||
// Region is the AWS Region
|
||||
// Required.
|
||||
string region = 2;
|
||||
// ClusterNames is names of EKS clusters to enroll.
|
||||
// Required.
|
||||
repeated string eks_cluster_names = 3;
|
||||
// EnableAppDiscovery specifies if we should enable Kubernetes App Discovery inside the enrolled EKS cluster.
|
||||
bool enable_app_discovery = 4;
|
||||
// AgentVersion is version of agent Helm chart to install on the EKS cluster.
|
||||
// Required.
|
||||
string agent_version = 5;
|
||||
// ExtraLabels added to the enrolled clusters.
|
||||
map<string, string> extra_labels = 6;
|
||||
}
|
||||
|
||||
// EnrollEKSClusterResult contains result for a single cluster enrollment.
|
||||
message EnrollEKSClusterResult {
|
||||
// ClusterName identifies what EKS cluster this result is for.
|
||||
string eks_cluster_name = 1;
|
||||
// ResourceID shows what internal resource ID label was used by the Helm chart.
|
||||
string resource_id = 2;
|
||||
// Error show what error happened during enrollment. Empty if no error happened.
|
||||
string error = 3;
|
||||
// IssueType contains the UserTask's issue type for well-known errors.
|
||||
// Example of allowed values:
|
||||
// - eks-status-not-active
|
||||
// - eks-missing-endpoint-public-access
|
||||
// - eks-authentication-mode-unsupported
|
||||
// - eks-cluster-unreachable
|
||||
// - eks-agent-not-connecting
|
||||
// See usertasks.DiscoverEKSIssueTypes for a complete list of allowed values.
|
||||
// Empty if no error happened, or the error is not yet handled.
|
||||
string issue_type = 4;
|
||||
}
|
||||
|
||||
// EnrollEKSClustersResponse is a response to enrolling EKS clusters.
|
||||
message EnrollEKSClustersResponse {
|
||||
// Results shows result of enrollment for each requested EKS cluster.
|
||||
repeated EnrollEKSClusterResult results = 1;
|
||||
}
|
||||
|
||||
// ListEC2Request is a request for a paginated list of AWS EC2 instances.
|
||||
message ListEC2Request {
|
||||
option deprecated = true;
|
||||
// Integration is the AWS OIDC Integration name.
|
||||
// Required.
|
||||
string integration = 1;
|
||||
// Region is the AWS Region
|
||||
// Required.
|
||||
string region = 2;
|
||||
// NextToken is the token to be used to fetch the next page.
|
||||
// If empty, the first page is fetched.
|
||||
string next_token = 3;
|
||||
}
|
||||
|
||||
// ListEC2Response contains a page of AWS EC2 instances represented as Nodes.
|
||||
message ListEC2Response {
|
||||
option deprecated = true;
|
||||
// Servers contains the page of EC2.
|
||||
repeated types.ServerV2 servers = 1;
|
||||
// NextToken is used for pagination.
|
||||
// If non-empty, it can be used to request the next page.
|
||||
string next_token = 2;
|
||||
}
|
||||
|
||||
// ListEKSClustersRequest is a request for a paginated list of AWS EKS Clusters.
|
||||
message ListEKSClustersRequest {
|
||||
// Integration is the AWS OIDC Integration name.
|
||||
// Required.
|
||||
string integration = 1;
|
||||
// Region is the AWS Region
|
||||
// Required.
|
||||
string region = 2;
|
||||
// NextToken is the token to be used to fetch the next page.
|
||||
// If empty, the first page is fetched.
|
||||
string next_token = 3;
|
||||
}
|
||||
|
||||
// EKSCluster represents an Amazon EKS Cluster.
|
||||
message EKSCluster {
|
||||
// Name is the name of AWS EKS cluster.
|
||||
string name = 1;
|
||||
// Region is an AWS region.
|
||||
string region = 2;
|
||||
// Arn is an AWS ARN identification of the EKS cluster.
|
||||
string arn = 3;
|
||||
// Labels are labels of a EKS cluster.
|
||||
map<string, string> labels = 4;
|
||||
// JoinLabels are Teleport labels that should be injected into kube agent
|
||||
// if the cluster will be enrolled into Teleport (agent installed on it).
|
||||
map<string, string> join_labels = 5;
|
||||
// Status is a current status of an EKS cluster in AWS.
|
||||
// Known values are:
|
||||
// CREATING | ACTIVE | DELETING | FAILED | UPDATING | PENDING
|
||||
string status = 6;
|
||||
// EndpointPublicAccess indicates whether this EKS Cluster is accessible publicly.
|
||||
// If only private access is available, then the EKS Cluster can't be enrolled from Teleport Cloud.
|
||||
bool endpoint_public_access = 7;
|
||||
// AuthenticationMode is the allowed authentication mode for the cluster.
|
||||
// Known values are:
|
||||
// API | API_AND_CONFIG_MAP | CONFIG_MAP
|
||||
string authentication_mode = 8;
|
||||
}
|
||||
|
||||
// ListEKSClustersResponse contains a page of AWS EKS Clusters.
|
||||
message ListEKSClustersResponse {
|
||||
// Clusters contains the page of EKS Clusters.
|
||||
repeated EKSCluster clusters = 1;
|
||||
// NextToken is used for pagination.
|
||||
// If non-empty, it can be used to request the next page.
|
||||
string next_token = 2;
|
||||
}
|
||||
|
||||
// PingRequest is a request for doing an health check against the configured integration.
|
||||
message PingRequest {
|
||||
// Integration is the AWS OIDC Integration name.
|
||||
// Required if ARN is empty.
|
||||
string integration = 1;
|
||||
|
||||
// The AWS Role ARN to be used when generating the token.
|
||||
// This is used to test another ARN before saving the Integration.
|
||||
// Required if integration is empty.
|
||||
string role_arn = 2;
|
||||
}
|
||||
|
||||
// PingResponse contains the response for the Ping operation.
|
||||
message PingResponse {
|
||||
// The AWS account ID number of the account that owns or contains the calling entity.
|
||||
string account_id = 1;
|
||||
// The AWS ARN associated with the calling entity.
|
||||
string arn = 2;
|
||||
// The unique identifier of the calling entity.
|
||||
string user_id = 3;
|
||||
}
|
||||
Vendored
-175
@@ -1,175 +0,0 @@
|
||||
// Copyright 2023 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.integration.v1;
|
||||
|
||||
import "google/protobuf/duration.proto";
|
||||
import "google/protobuf/empty.proto";
|
||||
import "teleport/legacy/types/types.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/integration/v1;integrationv1";
|
||||
|
||||
// IntegrationService provides methods to manage Integrations with 3rd party APIs.
|
||||
service IntegrationService {
|
||||
// ListIntegrations returns a paginated list of Integration resources.
|
||||
rpc ListIntegrations(ListIntegrationsRequest) returns (ListIntegrationsResponse);
|
||||
|
||||
// GetIntegration returns the specified Integration resource.
|
||||
rpc GetIntegration(GetIntegrationRequest) returns (types.IntegrationV1);
|
||||
|
||||
// CreateIntegration creates a new Integration resource.
|
||||
rpc CreateIntegration(CreateIntegrationRequest) returns (types.IntegrationV1);
|
||||
|
||||
// UpdateIntegration updates an existing Integration resource.
|
||||
rpc UpdateIntegration(UpdateIntegrationRequest) returns (types.IntegrationV1);
|
||||
|
||||
// DeleteIntegration removes the specified Integration resource.
|
||||
rpc DeleteIntegration(DeleteIntegrationRequest) returns (google.protobuf.Empty);
|
||||
|
||||
// DeleteAllIntegrations removes all Integrations.
|
||||
// DEPRECATED: Can't delete all integrations over gRPC.
|
||||
rpc DeleteAllIntegrations(DeleteAllIntegrationsRequest) returns (google.protobuf.Empty);
|
||||
|
||||
// GenerateAWSOIDCToken generates a token to be used when executing an AWS OIDC Integration action.
|
||||
rpc GenerateAWSOIDCToken(GenerateAWSOIDCTokenRequest) returns (GenerateAWSOIDCTokenResponse);
|
||||
|
||||
// GenerateAzureOIDCToken generates a token to be used when executing an Azure OIDC Integration action.
|
||||
rpc GenerateAzureOIDCToken(GenerateAzureOIDCTokenRequest) returns (GenerateAzureOIDCTokenResponse);
|
||||
|
||||
// GenerateGitHubUserCert signs a SSH certificate for GitHub integration.
|
||||
rpc GenerateGitHubUserCert(GenerateGitHubUserCertRequest) returns (GenerateGitHubUserCertResponse);
|
||||
|
||||
// ExportIntegrationCertAuthorities exports cert authorities for an integration.
|
||||
rpc ExportIntegrationCertAuthorities(ExportIntegrationCertAuthoritiesRequest) returns (ExportIntegrationCertAuthoritiesResponse);
|
||||
}
|
||||
|
||||
// ListIntegrationsRequest is a request for a paginated list of Integrations.
|
||||
message ListIntegrationsRequest {
|
||||
// Limit is the maximum amount of resources to retrieve.
|
||||
int32 limit = 1;
|
||||
// NextKey is the key for the next page of Integrations.
|
||||
string next_key = 2;
|
||||
}
|
||||
|
||||
// ListIntegrationsResponse is the response for ListIntegrationsRequest.
|
||||
message ListIntegrationsResponse {
|
||||
// Integrations is a list of Integrations.
|
||||
repeated types.IntegrationV1 integrations = 1;
|
||||
// NextKey is the key for the next page of Integrations.
|
||||
string next_key = 2;
|
||||
// TotalCount is the total number of integrations in all pages.
|
||||
int32 total_count = 3;
|
||||
}
|
||||
|
||||
// GetIntegrationRequest is a request for a specific Integration resource.
|
||||
message GetIntegrationRequest {
|
||||
// Name is the name of the Integration to be requested.
|
||||
string name = 1;
|
||||
}
|
||||
|
||||
// CreateIntegrationRequest is the request to create the provided integration.
|
||||
message CreateIntegrationRequest {
|
||||
// Integration is the integration to be created.
|
||||
types.IntegrationV1 integration = 1;
|
||||
}
|
||||
|
||||
// UpdateIntegrationRequest is the request to update the provided integration.
|
||||
message UpdateIntegrationRequest {
|
||||
// Integration is the integration to be created.
|
||||
types.IntegrationV1 integration = 1;
|
||||
}
|
||||
|
||||
// DeleteIntegrationRequest is a request for deleting a specific Integration resource.
|
||||
message DeleteIntegrationRequest {
|
||||
// Name is the name of the Integration to be deleted.
|
||||
string name = 1;
|
||||
// DeleteAssociatedResources allows the request to search associated resources
|
||||
// and attempt to delete them.
|
||||
bool delete_associated_resources = 2;
|
||||
}
|
||||
|
||||
// DeleteAllIntegrationsRequest is the request for deleting all integrations.
|
||||
// DEPRECATED: Can't delete all integrations over gRPC.
|
||||
message DeleteAllIntegrationsRequest {}
|
||||
|
||||
// GenerateAWSOIDCTokenRequest are the parameters used to request an AWS OIDC
|
||||
// Integration token.
|
||||
message GenerateAWSOIDCTokenRequest {
|
||||
// Issuer is the entity that is signing the JWT.
|
||||
// This value must contain the AWS OIDC Integration configured provider (Teleport Proxy's Public URL)
|
||||
//
|
||||
// Deprecated: Ignored because value is calculated server side.
|
||||
string issuer = 1 [deprecated = true];
|
||||
|
||||
// Integration is the AWS OIDC Integration name.
|
||||
// Required.
|
||||
string integration = 2;
|
||||
}
|
||||
|
||||
// GenerateAWSOIDCTokenResponse contains a signed AWS OIDC Integration token.
|
||||
message GenerateAWSOIDCTokenResponse {
|
||||
// Token is the signed JWT ready to be used
|
||||
string token = 1;
|
||||
}
|
||||
|
||||
// GenerateAzureOIDCTokenRequest are the parameters used to request an Azure OIDC
|
||||
// Integration token.
|
||||
message GenerateAzureOIDCTokenRequest {
|
||||
// Integration is the Azure OIDC Integration name.
|
||||
// Required.
|
||||
string integration = 1;
|
||||
}
|
||||
|
||||
// GenerateAzureOIDCTokenResponse contains a signed Azure OIDC Integration token.
|
||||
message GenerateAzureOIDCTokenResponse {
|
||||
// Token is the signed JWT ready to be used
|
||||
string token = 1;
|
||||
}
|
||||
|
||||
// GenerateGitHubUserCertRequest is a request to sign a client certificate used by
|
||||
// GitHub integration to authenticate with GitHub enterprise.
|
||||
message GenerateGitHubUserCertRequest {
|
||||
// Integration is the name of the integration;
|
||||
string integration = 1;
|
||||
// PublicKey is the public key to be signed.
|
||||
bytes public_key = 2;
|
||||
// UserId is the GitHub user id.
|
||||
string user_id = 3;
|
||||
// KeyId is the certificate ID, usually the Teleport username.
|
||||
string key_id = 4;
|
||||
// Ttl is the duration the certificate will be valid for.
|
||||
google.protobuf.Duration ttl = 5;
|
||||
}
|
||||
|
||||
// GenerateGitHubUserCertResponse contains a signed certificate.
|
||||
message GenerateGitHubUserCertResponse {
|
||||
// AuthorizedKey is the signed certificate.
|
||||
bytes authorized_key = 1;
|
||||
}
|
||||
|
||||
// ExportIntegrationCertAuthoritiesRequest is the request to export cert
|
||||
// authorities for an integration.
|
||||
message ExportIntegrationCertAuthoritiesRequest {
|
||||
// Integration is the name of the integration;
|
||||
string integration = 1;
|
||||
}
|
||||
|
||||
// ExportIntegrationCertAuthoritiesResponse is the response to
|
||||
// ExportIntegrationCertAuthorities.
|
||||
message ExportIntegrationCertAuthoritiesResponse {
|
||||
// CertAuthorities are the CA key sets used to sign any new certificates.
|
||||
types.CAKeySet cert_authorities = 1;
|
||||
}
|
||||
-79
@@ -1,79 +0,0 @@
|
||||
// Copyright 2023 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.kube.v1;
|
||||
|
||||
import "teleport/legacy/types/types.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/kube/v1;kubev1";
|
||||
|
||||
// KubeService provides methods to list Kubernetes resources when users are not allowed
|
||||
// to access the underlying cluster or resources but their `search_as_roles` allow.
|
||||
//
|
||||
service KubeService {
|
||||
// ListKubernetesResources lists the Kubernetes resources without leaking details.
|
||||
rpc ListKubernetesResources(ListKubernetesResourcesRequest) returns (ListKubernetesResourcesResponse);
|
||||
}
|
||||
|
||||
// ListKubernetesResourcesRequest defines a request to retrieve resources paginated. Only
|
||||
// one type of resource can be retrieved per request.
|
||||
//
|
||||
message ListKubernetesResourcesRequest {
|
||||
// ResourceType is the Kubernetes resource that is going to be retrieved.
|
||||
string resource_type = 1;
|
||||
// Limit is the maximum amount of resources to retrieve.
|
||||
int32 limit = 2;
|
||||
// StartKey is used to start listing resources from a specific spot. It
|
||||
// should be set to the previous NextKey value if using pagination, or
|
||||
// left empty.
|
||||
string start_key = 3;
|
||||
// Labels is a label-based matcher if non-empty.
|
||||
map<string, string> labels = 4;
|
||||
// PredicateExpression defines boolean conditions that will be matched against the resource.
|
||||
string predicate_expression = 5;
|
||||
// SearchKeywords is a list of search keywords to match against resource field values.
|
||||
repeated string search_keywords = 6;
|
||||
// SortBy describes which resource field and which direction to sort by.
|
||||
types.SortBy sort_by = 7;
|
||||
// NeedTotalCount indicates whether or not the caller also wants the total number of resources
|
||||
// after filtering.
|
||||
bool need_total_count = 8;
|
||||
// UseSearchAsRoles indicates that the response should include all resources
|
||||
// the caller is able to request access to using search_as_roles
|
||||
bool use_search_as_roles = 9;
|
||||
// UsePreviewAsRoles indicates that the response should include all resources
|
||||
// the caller would be able to access with their preview_as_roles
|
||||
bool use_preview_as_roles = 11;
|
||||
// TeleportCluster is the Teleport Cluster name to route the request to.
|
||||
string teleport_cluster = 12;
|
||||
// Cluster is the Kubernetes Cluster to request the resources.
|
||||
string kubernetes_cluster = 13;
|
||||
// Namespace is the Kubernetes namespace where the resources must be located.
|
||||
// To search on every Kubernetes Namespace, do not define the value.
|
||||
string kubernetes_namespace = 14;
|
||||
}
|
||||
|
||||
// ListKubernetesResourcesResponse is the response of ListKubernetesResources method.
|
||||
message ListKubernetesResourcesResponse {
|
||||
// Resources is a list of resource.
|
||||
repeated types.KubernetesResourceV1 resources = 1;
|
||||
// NextKey is the next Key to use as StartKey in a ListResourcesRequest to
|
||||
// continue retrieving pages of resource. If NextKey is empty, there are no
|
||||
// more pages.
|
||||
string next_key = 2;
|
||||
// TotalCount is the total number of resources available after filter, if any.
|
||||
int32 total_count = 3;
|
||||
}
|
||||
-56
@@ -1,56 +0,0 @@
|
||||
// Copyright 2024 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.kubewaitingcontainer.v1;
|
||||
|
||||
import "teleport/header/v1/metadata.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/kubewaitingcontainer/v1;kubewaitingcontainerv1";
|
||||
|
||||
// KubernetesWaitingContainer is a Kubernetes pod that has ephemeral containers
|
||||
// waiting to be created until moderated session requirements are met.
|
||||
message KubernetesWaitingContainer {
|
||||
// kind is a resource kind
|
||||
string kind = 1;
|
||||
// sub_kind is an optional resource sub kind, used in some resources
|
||||
string sub_kind = 2;
|
||||
// version is the resource version. It must be specified.
|
||||
// Supported values are: `v1`.
|
||||
string version = 3;
|
||||
// metadata is resource metadata
|
||||
teleport.header.v1.Metadata metadata = 4;
|
||||
// spec is the Kubernetes waiting container spec.
|
||||
KubernetesWaitingContainerSpec spec = 5;
|
||||
}
|
||||
|
||||
// KubernetesWaitingContainerSpec is the Kubernetes waiting ephemeral container spec.
|
||||
message KubernetesWaitingContainerSpec {
|
||||
// username is the Teleport user that attempted to create the container
|
||||
string username = 1;
|
||||
// cluster is the Kubernetes cluster of this container
|
||||
string cluster = 2;
|
||||
// namespace is the Kubernetes namespace of this container
|
||||
string namespace = 3;
|
||||
// pod_name is the name of the parent pod
|
||||
string pod_name = 4;
|
||||
// container_name is the name of the ephemeral container
|
||||
string container_name = 5;
|
||||
// patch is the patch that should be applied to the parent pod
|
||||
// to create this ephemeral container
|
||||
bytes patch = 6;
|
||||
// patch_type identifies the patch model to be applied.
|
||||
string patch_type = 7;
|
||||
}
|
||||
-91
@@ -1,91 +0,0 @@
|
||||
// Copyright 2024 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.kubewaitingcontainer.v1;
|
||||
|
||||
import "google/protobuf/empty.proto";
|
||||
import "teleport/kubewaitingcontainer/v1/kubewaitingcontainer.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/kubewaitingcontainer/v1;kubewaitingcontainerv1";
|
||||
|
||||
// KubeWaitingContainersService manages Kubernetes ephemeral
|
||||
// containers that are waiting to be created until moderated
|
||||
// session conditions are met.
|
||||
service KubeWaitingContainersService {
|
||||
// ListKubernetesWaitingContainers returns a Kubernetes ephemeral
|
||||
// container that is waiting to be created.
|
||||
rpc ListKubernetesWaitingContainers(ListKubernetesWaitingContainersRequest) returns (ListKubernetesWaitingContainersResponse);
|
||||
// GetKubernetesWaitingContainer returns a Kubernetes ephemeral
|
||||
// container that is waiting to be created.
|
||||
rpc GetKubernetesWaitingContainer(GetKubernetesWaitingContainerRequest) returns (KubernetesWaitingContainer);
|
||||
// CreateKubernetesWaitingContainer creates a Kubernetes ephemeral
|
||||
// container that is waiting to be created.
|
||||
rpc CreateKubernetesWaitingContainer(CreateKubernetesWaitingContainerRequest) returns (KubernetesWaitingContainer);
|
||||
// DeleteKubernetesWaitingContainer deletes a Kubernetes ephemeral
|
||||
// container that is waiting to be created.
|
||||
rpc DeleteKubernetesWaitingContainer(DeleteKubernetesWaitingContainerRequest) returns (google.protobuf.Empty);
|
||||
}
|
||||
|
||||
// ListKubernetesWaitingContainersRequest is the request for ListKubernetesWaitingContainers.
|
||||
message ListKubernetesWaitingContainersRequest {
|
||||
// The maximum number of items to return.
|
||||
// The server may impose a different page size at its discretion.
|
||||
int32 page_size = 1;
|
||||
// The next_page_token value returned from a previous ListFoo request, if any.
|
||||
string page_token = 2;
|
||||
}
|
||||
|
||||
// ListKubernetesWaitingContainersResponse is the response for ListKubernetesWaitingContainers.
|
||||
message ListKubernetesWaitingContainersResponse {
|
||||
repeated KubernetesWaitingContainer waiting_containers = 1;
|
||||
// Token to retrieve the next page of results, or empty if there are no
|
||||
// more results exist.
|
||||
string next_page_token = 2;
|
||||
}
|
||||
|
||||
// GetKubernetesWaitingContainerRequest is the request for GetKubernetesWaitingContainer.
|
||||
message GetKubernetesWaitingContainerRequest {
|
||||
// username is the Teleport user that attempted to create the container
|
||||
string username = 1;
|
||||
// cluster is the Kubernetes cluster of this container
|
||||
string cluster = 2;
|
||||
// namespace is the Kubernetes namespace of this container
|
||||
string namespace = 3;
|
||||
// pod_name is the name of the parent pod
|
||||
string pod_name = 4;
|
||||
// container_name is the name of the ephemeral container
|
||||
string container_name = 5;
|
||||
}
|
||||
|
||||
// CreateKubernetesWaitingContainerRequest is the request for CreateKubernetesWaitingContainer.
|
||||
message CreateKubernetesWaitingContainerRequest {
|
||||
// waiting_container is the waiting container resource.
|
||||
KubernetesWaitingContainer waiting_container = 1;
|
||||
}
|
||||
|
||||
// DeleteKubernetesWaitingContainerRequest is the request for DeleteKubernetesWaitingContainer.
|
||||
message DeleteKubernetesWaitingContainerRequest {
|
||||
// username is the Teleport user that attempted to create the container
|
||||
string username = 1;
|
||||
// cluster is the Kubernetes cluster of this container
|
||||
string cluster = 2;
|
||||
// namespace is the Kubernetes namespace of this container
|
||||
string namespace = 3;
|
||||
// pod_name is the name of the parent pod
|
||||
string pod_name = 4;
|
||||
// container_name is the name of the ephemeral container
|
||||
string container_name = 5;
|
||||
}
|
||||
-27
@@ -1,27 +0,0 @@
|
||||
// Copyright 2024 Gravitational, Inc.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.label.v1;
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/label/v1;labelv1";
|
||||
|
||||
// Label represents a single label key along with a set of possible values for it.
|
||||
message Label {
|
||||
// The name of the label.
|
||||
string name = 1;
|
||||
// The values associated with the label.
|
||||
repeated string values = 2;
|
||||
}
|
||||
Vendored
-3709
File diff suppressed because it is too large
Load Diff
-36
@@ -1,36 +0,0 @@
|
||||
// Copyright 2022 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package proto;
|
||||
|
||||
import "gogoproto/gogo.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/client/proto";
|
||||
option (gogoproto.goproto_getters_all) = false;
|
||||
option (gogoproto.marshaler_all) = true;
|
||||
option (gogoproto.unmarshaler_all) = true;
|
||||
|
||||
// Set of certificates corresponding to a single public key.
|
||||
message Certs {
|
||||
// SSH certificate marshaled in the authorized key format.
|
||||
bytes SSH = 1 [(gogoproto.jsontag) = "ssh,omitempty"];
|
||||
// TLS X.509 certificate (PEM-encoded).
|
||||
bytes TLS = 2 [(gogoproto.jsontag) = "tls,omitempty"];
|
||||
// TLSCACerts is a list of TLS certificate authorities.
|
||||
repeated bytes TLSCACerts = 3 [(gogoproto.jsontag) = "tls_ca_certs,omitempty"];
|
||||
// SSHCACerts is a list of SSH certificate authorities.
|
||||
repeated bytes SSHCACerts = 4 [(gogoproto.jsontag) = "ssh_ca_certs,omitempty"];
|
||||
}
|
||||
-221
@@ -1,221 +0,0 @@
|
||||
// Copyright 2023 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package proto;
|
||||
|
||||
import "teleport/accesslist/v1/accesslist.proto";
|
||||
import "teleport/accessmonitoringrules/v1/access_monitoring_rules.proto";
|
||||
import "teleport/autoupdate/v1/autoupdate.proto";
|
||||
import "teleport/clusterconfig/v1/access_graph_settings.proto";
|
||||
import "teleport/crownjewel/v1/crownjewel.proto";
|
||||
import "teleport/dbobject/v1/dbobject.proto";
|
||||
import "teleport/discoveryconfig/v1/discoveryconfig.proto";
|
||||
import "teleport/healthcheckconfig/v1/health_check_config.proto";
|
||||
import "teleport/identitycenter/v1/identitycenter.proto";
|
||||
import "teleport/kubewaitingcontainer/v1/kubewaitingcontainer.proto";
|
||||
import "teleport/legacy/types/types.proto";
|
||||
import "teleport/machineid/v1/bot_instance.proto";
|
||||
import "teleport/machineid/v1/federation.proto";
|
||||
import "teleport/notifications/v1/notifications.proto";
|
||||
import "teleport/provisioning/v1/provisioning.proto";
|
||||
import "teleport/secreports/v1/secreports.proto";
|
||||
import "teleport/userloginstate/v1/userloginstate.proto";
|
||||
import "teleport/userprovisioning/v2/statichostuser.proto";
|
||||
import "teleport/usertasks/v1/user_tasks.proto";
|
||||
import "teleport/workloadidentity/v1/resource.proto";
|
||||
import "teleport/workloadidentity/v1/revocation_resource.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/client/proto";
|
||||
|
||||
// Operation identifies type of operation
|
||||
enum Operation {
|
||||
// INIT is sent as a first sentinel event
|
||||
// on the watch channel
|
||||
INIT = 0;
|
||||
// PUT identifies created or updated object
|
||||
PUT = 1;
|
||||
// DELETE identifies deleted object
|
||||
DELETE = 2;
|
||||
}
|
||||
|
||||
// Event returns cluster event
|
||||
message Event {
|
||||
reserved 7;
|
||||
reserved 49;
|
||||
reserved 63;
|
||||
reserved 68;
|
||||
reserved "ExternalCloudAudit";
|
||||
reserved "StaticHostUser";
|
||||
reserved "AutoUpdateAgentPlan";
|
||||
|
||||
// Operation identifies operation
|
||||
Operation Type = 1;
|
||||
// Resource contains the updated resource
|
||||
oneof Resource {
|
||||
// ResourceHeader is specified in delete events,
|
||||
// the full object is not available, so resource
|
||||
// header is used to provide information about object type
|
||||
types.ResourceHeader ResourceHeader = 2;
|
||||
// CertAuthority is filled in certificate-authority related events
|
||||
types.CertAuthorityV2 CertAuthority = 3;
|
||||
// StaticTokens is filled in static-tokens related events
|
||||
types.StaticTokensV2 StaticTokens = 4;
|
||||
// ProvisionToken is filled in provision-token related events
|
||||
types.ProvisionTokenV2 ProvisionToken = 5;
|
||||
// ClusterNameV2 is a cluster name resource
|
||||
types.ClusterNameV2 ClusterName = 6;
|
||||
// User is a user resource
|
||||
types.UserV2 User = 8;
|
||||
// Role is a role resource
|
||||
types.RoleV6 Role = 9;
|
||||
// Namespace is a namespace resource
|
||||
types.Namespace Namespace = 10;
|
||||
// Server is a node or proxy resource
|
||||
types.ServerV2 Server = 11;
|
||||
// ReverseTunnel is a resource with reverse tunnel
|
||||
types.ReverseTunnelV2 ReverseTunnel = 12;
|
||||
// TunnelConnection is a resource for tunnel connnections
|
||||
types.TunnelConnectionV2 TunnelConnection = 13;
|
||||
// AccessRequest is a resource for access requests
|
||||
types.AccessRequestV3 AccessRequest = 14;
|
||||
// AppSession is an application web session.
|
||||
types.WebSessionV2 AppSession = 15;
|
||||
// RemoteCluster is a resource for remote clusters
|
||||
types.RemoteClusterV3 RemoteCluster = 16;
|
||||
// DatabaseServer is a resource for database servers.
|
||||
types.DatabaseServerV3 DatabaseServer = 17;
|
||||
// WebSession is a regular web session.
|
||||
types.WebSessionV2 WebSession = 18;
|
||||
// WebToken is a web token.
|
||||
types.WebTokenV3 WebToken = 19;
|
||||
// ClusterNetworkingConfig is a resource for cluster networking configuration.
|
||||
types.ClusterNetworkingConfigV2 ClusterNetworkingConfig = 20;
|
||||
// SessionRecordingConfig is a resource for session recording configuration.
|
||||
types.SessionRecordingConfigV2 SessionRecordingConfig = 21;
|
||||
// AuthPreference is cluster auth preference.
|
||||
types.AuthPreferenceV2 AuthPreference = 22;
|
||||
// ClusterAuditConfig is a resource for cluster audit configuration.
|
||||
types.ClusterAuditConfigV2 ClusterAuditConfig = 23;
|
||||
// Lock is a lock resource.
|
||||
types.LockV2 Lock = 24;
|
||||
// NetworkRestrictions is a resource for network restrictions
|
||||
types.NetworkRestrictionsV4 NetworkRestrictions = 25;
|
||||
// WindowsDesktopService is a resource for Windows desktop services.
|
||||
types.WindowsDesktopServiceV3 WindowsDesktopService = 26;
|
||||
// WindowsDesktop is a resource for Windows desktop host.
|
||||
types.WindowsDesktopV3 WindowsDesktop = 27;
|
||||
// Database is a database resource.
|
||||
types.DatabaseV3 Database = 28;
|
||||
// AppServer is an application server resource.
|
||||
types.AppServerV3 AppServer = 29;
|
||||
// App is an application resource.
|
||||
types.AppV3 App = 30;
|
||||
// SnowflakeSession is a Snowflake web session.
|
||||
types.WebSessionV2 SnowflakeSession = 31;
|
||||
// KubernetesServer is an Kubernetes server resource.
|
||||
types.KubernetesServerV3 KubernetesServer = 32;
|
||||
// KubernetesCluster is an Kubernetes cluster resource.
|
||||
types.KubernetesClusterV3 KubernetesCluster = 33;
|
||||
// Installer is an installer resource
|
||||
types.InstallerV1 Installer = 34;
|
||||
// DatabaseService is a DatabaseService resource
|
||||
types.DatabaseServiceV1 DatabaseService = 35;
|
||||
// SAMLIdPServiceProvider is a SAMLIdPServiceProvider resource
|
||||
types.SAMLIdPServiceProviderV1 SAMLIdPServiceProvider = 36;
|
||||
// SAMLIdPSession is a SAML IdP session.
|
||||
types.WebSessionV2 SAMLIdPSession = 37;
|
||||
// UserGroup is a UserGroup resource
|
||||
types.UserGroupV1 UserGroup = 38;
|
||||
// UIConfig provides a way for users to adjust settings of the UI served by the proxy service.
|
||||
types.UIConfigV1 UIConfig = 39;
|
||||
// OktaImportRule is an OktaImportRule resource.
|
||||
types.OktaImportRuleV1 OktaImportRule = 40;
|
||||
// OktaAssignment is an OktaAssignment resource.
|
||||
types.OktaAssignmentV1 OktaAssignment = 41;
|
||||
// Integration is an Integration resource.
|
||||
types.IntegrationV1 Integration = 42;
|
||||
// WatchStatus is an WatchStatus resource.
|
||||
types.WatchStatusV1 WatchStatus = 43;
|
||||
// HeadlessAuthentication is a HeadlessAuthentication resource.
|
||||
types.HeadlessAuthentication HeadlessAuthentication = 44;
|
||||
// AccessList is an AccessList resource.
|
||||
teleport.accesslist.v1.AccessList AccessList = 45;
|
||||
// UserLoginState is a UserLoginState resource.
|
||||
teleport.userloginstate.v1.UserLoginState UserLoginState = 46;
|
||||
// AccessListMember is an access list member resource.
|
||||
teleport.accesslist.v1.Member AccessListMember = 47;
|
||||
// DiscoveryConfig contains a list of matchers to be loaded dynamically by Discovery Services.
|
||||
teleport.discoveryconfig.v1.DiscoveryConfig DiscoveryConfig = 48;
|
||||
// AuditQuery is an audit query resource.
|
||||
teleport.secreports.v1.AuditQuery AuditQuery = 50;
|
||||
// SecurityReport is a security report resource.
|
||||
teleport.secreports.v1.Report Report = 51;
|
||||
// SecurityReportState is a security report state resource.
|
||||
teleport.secreports.v1.ReportState ReportState = 52;
|
||||
// AccessListReview is an access list review resource.
|
||||
teleport.accesslist.v1.Review AccessListReview = 53;
|
||||
// AccessMonitoringRule is an access monitoring rule resource.
|
||||
teleport.accessmonitoringrules.v1.AccessMonitoringRule AccessMonitoringRule = 54;
|
||||
// KubernetesWaitingContainer is a Kubernetes ephemeral container
|
||||
// waiting to be created.
|
||||
teleport.kubewaitingcontainer.v1.KubernetesWaitingContainer KubernetesWaitingContainer = 55;
|
||||
// UserNotification is a user notification resource.
|
||||
teleport.notifications.v1.Notification UserNotification = 56;
|
||||
// GlobalNotification is a global notification resource.
|
||||
teleport.notifications.v1.GlobalNotification GlobalNotification = 57;
|
||||
// CrownJewel is a Crown Jewel resource.
|
||||
teleport.crownjewel.v1.CrownJewel CrownJewel = 58;
|
||||
// DatabaseObject is a database object resource.
|
||||
teleport.dbobject.v1.DatabaseObject DatabaseObject = 59;
|
||||
// BotInstance is a Machine ID bot instance.
|
||||
teleport.machineid.v1.BotInstance BotInstance = 60;
|
||||
// AccessGraphSettings is a resource for access graph settings.
|
||||
teleport.clusterconfig.v1.AccessGraphSettings AccessGraphSettings = 61;
|
||||
// SPIFFEFederation is a resource for SPIFFE federation.
|
||||
teleport.machineid.v1.SPIFFEFederation SPIFFEFederation = 62;
|
||||
// AutoUpdateConfig is a resource for autoupdate config.
|
||||
teleport.autoupdate.v1.AutoUpdateConfig AutoUpdateConfig = 64;
|
||||
// AutoUpdateVersion is a resource for autoupdate version.
|
||||
teleport.autoupdate.v1.AutoUpdateVersion AutoUpdateVersion = 65;
|
||||
// StaticHostUserV2 is a resource for static host users.
|
||||
teleport.userprovisioning.v2.StaticHostUser StaticHostUserV2 = 66;
|
||||
// UserTask is a resource for user task.
|
||||
teleport.usertasks.v1.UserTask UserTask = 67;
|
||||
// DynamicWindowsDesktop is a resource for dynamic Windows desktop host.
|
||||
types.DynamicWindowsDesktopV1 DynamicWindowsDesktop = 69;
|
||||
// ProvisioningPrincipalState is a resource for tracking the provisioning of
|
||||
// users and groups into downstream systems.
|
||||
teleport.provisioning.v1.PrincipalState ProvisioningPrincipalState = 70;
|
||||
// AutoUpdateVersion is a resource for controlling the autoupdate agent rollout.
|
||||
teleport.autoupdate.v1.AutoUpdateAgentRollout AutoUpdateAgentRollout = 71;
|
||||
// IdentityCenterAccount is a resource for tracking Identity Center accounts
|
||||
teleport.identitycenter.v1.Account IdentityCenterAccount = 72;
|
||||
// IdentityCenterPrincipalAssignment is a resource for tracking the AWS
|
||||
// Permission Sets assigned to a Teleport user or AAccess List
|
||||
teleport.identitycenter.v1.PrincipalAssignment IdentityCenterPrincipalAssignment = 73;
|
||||
// IdentityCenterAccountlAssignment is a resource representing a potential
|
||||
// Permission Set grant on a specific AWS account.
|
||||
teleport.identitycenter.v1.AccountAssignment IdentityCenterAccountAssignment = 74;
|
||||
// PluginStaticCredentials is filled in PluginStaticCredentials related events
|
||||
types.PluginStaticCredentialsV1 PluginStaticCredentials = 75;
|
||||
// WorkloadIdentity is a resource for workload identity.
|
||||
teleport.workloadidentity.v1.WorkloadIdentity WorkloadIdentity = 76;
|
||||
// WorkloadIdentityX509Revocation is a resource for workload identity x509 revocation.
|
||||
teleport.workloadidentity.v1.WorkloadIdentityX509Revocation WorkloadIdentityX509Revocation = 77;
|
||||
// HealthCheckConfig is a resource for configuring health checks.
|
||||
teleport.healthcheckconfig.v1.HealthCheckConfig HealthCheckConfig = 78;
|
||||
}
|
||||
}
|
||||
Vendored
-218
@@ -1,218 +0,0 @@
|
||||
// Copyright 2022 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package proto;
|
||||
|
||||
import "teleport/legacy/client/proto/certs.proto";
|
||||
import "teleport/legacy/types/types.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/client/proto";
|
||||
|
||||
// RegisterUsingIAMMethodRequest is a request for registration via the IAM join
|
||||
// method.
|
||||
message RegisterUsingIAMMethodRequest {
|
||||
// RegisterUsingTokenRequest holds registration parameters common to all
|
||||
// join methods.
|
||||
types.RegisterUsingTokenRequest register_using_token_request = 1;
|
||||
// StsIdentityRequest is a signed HTTP request to the AWS
|
||||
// sts:GetCallerIdentity API endpoint used to prove the AWS identity of a
|
||||
// joining node. It must include the challenge string as a signed header.
|
||||
bytes sts_identity_request = 2;
|
||||
}
|
||||
|
||||
// RegisterUsingIAMMethodResponse is a stream response and will contain either a
|
||||
// Challenge or signed Certs to join the cluster.
|
||||
message RegisterUsingIAMMethodResponse {
|
||||
// Challenge is a crypto-random string that should be included in the signed
|
||||
// sts:GetCallerIdentity request.
|
||||
string challenge = 1;
|
||||
// Certs is the returned signed certs.
|
||||
Certs certs = 2;
|
||||
}
|
||||
|
||||
// RegisterUsingAzureMethodRequest is the request for registration via the Azure
|
||||
// join method.
|
||||
message RegisterUsingAzureMethodRequest {
|
||||
// RegisterUsingTokenRequest holds registration parameters common to all
|
||||
// join methods.
|
||||
types.RegisterUsingTokenRequest register_using_token_request = 1;
|
||||
// AttestedData is a signed JSON document from an Azure VM's attested data
|
||||
// metadata endpoint used to prove the identity of a joining node. It must
|
||||
// include the challenge string as the nonce.
|
||||
bytes attested_data = 2;
|
||||
// AccessToken is a JWT signed by Azure, used to prove the identity of a
|
||||
// joining node.
|
||||
string access_token = 3;
|
||||
}
|
||||
|
||||
// RegisterUsingAzureMethodResponse is a stream response and will contain either
|
||||
// a Challenge or signed Certs to join the cluster.
|
||||
message RegisterUsingAzureMethodResponse {
|
||||
// Challenge is a crypto-random string that should be included in the signed
|
||||
// attested data.
|
||||
string challenge = 1;
|
||||
// Certs is the returned signed certs.
|
||||
Certs certs = 2;
|
||||
}
|
||||
|
||||
// The enrollment challenge response containing the solution returned by
|
||||
// calling the TPM2.0 `ActivateCredential` command on the client with the
|
||||
// parameters provided in `TPMEncryptedCredential`.
|
||||
message RegisterUsingTPMMethodChallengeResponse {
|
||||
// The client's solution to `TPMEncryptedCredential` included in
|
||||
// `TPMEncryptedCredential` using ActivateCredential.
|
||||
bytes solution = 1;
|
||||
}
|
||||
|
||||
// The initial payload sent from the client to the server during a TPM join
|
||||
// request.
|
||||
message RegisterUsingTPMMethodInitialRequest {
|
||||
// Holds the registration parameters shared by all join methods.
|
||||
types.RegisterUsingTokenRequest join_request = 1;
|
||||
oneof ek {
|
||||
// The device's endorsement certificate in X509, ASN.1 DER form. This
|
||||
// certificate contains the public key of the endorsement key. This is
|
||||
// preferred to ek_key.
|
||||
bytes ek_cert = 2;
|
||||
// The device's public endorsement key in PKIX, ASN.1 DER form. This is
|
||||
// used when a TPM does not contain any endorsement certificates.
|
||||
bytes ek_key = 3;
|
||||
}
|
||||
// The attestation key and the parameters necessary to remotely verify it as
|
||||
// related to the endorsement key.
|
||||
TPMAttestationParameters attestation_params = 4;
|
||||
}
|
||||
|
||||
// RegisterUsingTPMMethodRequest is the streaming request type for the
|
||||
// RegisterUsingTPMMethod RPC.
|
||||
message RegisterUsingTPMMethodRequest {
|
||||
oneof payload {
|
||||
// Initial information sent from the client to the server.
|
||||
RegisterUsingTPMMethodInitialRequest init = 1;
|
||||
// The challenge response required to complete the TPM join process. This is
|
||||
// sent in response to the servers challenge.
|
||||
RegisterUsingTPMMethodChallengeResponse challenge_response = 2;
|
||||
}
|
||||
}
|
||||
|
||||
// RegisterUsingTPMMethodResponse is the streaming response type for the
|
||||
// RegisterUsingTPMMethod RPC.
|
||||
message RegisterUsingTPMMethodResponse {
|
||||
oneof payload {
|
||||
// The challenge required to complete the TPM join process. This is sent to
|
||||
// the client in response to the initial request.
|
||||
TPMEncryptedCredential challenge_request = 1;
|
||||
// The signed certificates resulting from the join process.
|
||||
Certs certs = 2;
|
||||
}
|
||||
}
|
||||
|
||||
// The attestation key and the parameters necessary to remotely verify it as
|
||||
// related to the endorsement key.
|
||||
// See https://pkg.go.dev/github.com/google/go-attestation/attest#AttestationParameters.
|
||||
// This message excludes the `UseTCSDActivationFormat` field from the link above
|
||||
// as it is TMP 1.x specific and always false.
|
||||
message TPMAttestationParameters {
|
||||
// The encoded TPMT_PUBLIC structure containing the attestation public key
|
||||
// and signing parameters.
|
||||
bytes public = 1;
|
||||
// The properties of the attestation key, encoded as a TPMS_CREATION_DATA
|
||||
// structure.
|
||||
bytes create_data = 2;
|
||||
// An assertion as to the details of the key, encoded as a TPMS_ATTEST
|
||||
// structure.
|
||||
bytes create_attestation = 3;
|
||||
// A signature of create_attestation, encoded as a TPMT_SIGNATURE structure.
|
||||
bytes create_signature = 4;
|
||||
}
|
||||
|
||||
// These values are used by the TPM2.0 `ActivateCredential` command to produce
|
||||
// the solution which proves possession of the EK and AK.
|
||||
//
|
||||
// For a more in-depth description see:
|
||||
// - https://pkg.go.dev/github.com/google/go-attestation/attest#EncryptedCredential
|
||||
// - https://trustedcomputinggroup.org/wp-content/uploads/TCG_TPM2_r1p59_Part3_Commands_code_pub.pdf (Heading 12.5.1 "TPM2_ActivateCredential" "General Description")
|
||||
// - https://github.com/google/go-attestation/blob/v0.4.3/attest/activation.go#L199
|
||||
// - https://github.com/google/go-tpm/blob/v0.3.3/tpm2/credactivation/credential_activation.go#L61
|
||||
message TPMEncryptedCredential {
|
||||
// The `credential_blob` parameter to be used with the `ActivateCredential`
|
||||
// command. This is used with the decrypted value of `secret` in a
|
||||
// cryptographic process to decrypt the solution.
|
||||
bytes credential_blob = 1;
|
||||
// The `secret` parameter to be used with `ActivateCredential`. This is a
|
||||
// seed which can be decrypted with the EK. The decrypted seed is then used
|
||||
// when decrypting `credential_blob`.
|
||||
bytes secret = 2;
|
||||
}
|
||||
|
||||
// OracleSignedRequest holds the headers and payload for a signed request to
|
||||
// the Oracle API.
|
||||
message OracleSignedRequest {
|
||||
// Headers is the signed headers for a request to the Oracle authorizeClient
|
||||
// endpoint.
|
||||
map<string, string> headers = 1;
|
||||
// PayloadHeaders is the signed headers that are the payload to the authorizeClient
|
||||
// request signified by Headers.
|
||||
map<string, string> payload_headers = 2;
|
||||
}
|
||||
|
||||
// RegisterUsingOracleMethodRequest is the request for registration via the
|
||||
// Oracle join method.
|
||||
message RegisterUsingOracleMethodRequest {
|
||||
oneof request {
|
||||
// RegisterUsingTokenRequest holds registration parameters common to all join
|
||||
// methods.
|
||||
types.RegisterUsingTokenRequest register_using_token_request = 1;
|
||||
// OracleRequest holds the headers and payload for a signed request to
|
||||
// the Oracle API.
|
||||
OracleSignedRequest oracle_request = 2;
|
||||
}
|
||||
}
|
||||
|
||||
// RegisterUsingOracleMethodResponse is a stream response and will contain either
|
||||
// a Challenge or signed Certs to join the cluster.
|
||||
message RegisterUsingOracleMethodResponse {
|
||||
oneof response {
|
||||
// Challenge is a crypto-random string that should be included in the signed
|
||||
// headers.
|
||||
string challenge = 1;
|
||||
// Certs is the returned signed certs.
|
||||
Certs certs = 2;
|
||||
}
|
||||
}
|
||||
|
||||
// JoinService provides methods which allow Teleport nodes, proxies, and other
|
||||
// services to join the Teleport cluster by fetching signed cluster
|
||||
// certificates. It is implemented on both the Auth and Proxy servers to serve
|
||||
// the needs of both nodes connecting directly to the Auth server and IoT mode
|
||||
// nodes connecting only to the Proxy.
|
||||
service JoinService {
|
||||
// RegisterUsingIAMMethod is used to register a new node to the cluster using
|
||||
// the IAM join method.
|
||||
rpc RegisterUsingIAMMethod(stream RegisterUsingIAMMethodRequest) returns (stream RegisterUsingIAMMethodResponse);
|
||||
// RegisterUsingAzureMethod is used to register a new node to the cluster
|
||||
// using the Azure join method.
|
||||
rpc RegisterUsingAzureMethod(stream RegisterUsingAzureMethodRequest) returns (stream RegisterUsingAzureMethodResponse);
|
||||
// RegisterUsingTPMMethod allows registration of a new agent or Bot to the
|
||||
// cluster using a known TPM.
|
||||
rpc RegisterUsingTPMMethod(stream RegisterUsingTPMMethodRequest) returns (stream RegisterUsingTPMMethodResponse);
|
||||
// RegisterUsingOracleMethod allows registration of a new node to the cluster
|
||||
// using the Oracle join method.
|
||||
rpc RegisterUsingOracleMethod(stream RegisterUsingOracleMethodRequest) returns (stream RegisterUsingOracleMethodResponse);
|
||||
// RegisterUsingToken is used to register a new node to the cluster using one
|
||||
// of the legacy join methods which do not yet have their own gRPC method.
|
||||
rpc RegisterUsingToken(types.RegisterUsingTokenRequest) returns (Certs);
|
||||
}
|
||||
Vendored
-72
@@ -1,72 +0,0 @@
|
||||
// Copyright 2022 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package proto;
|
||||
|
||||
import "gogoproto/gogo.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/client/proto";
|
||||
|
||||
// ProxyPeerService is a proxy to proxy api.
|
||||
service ProxyService {
|
||||
// DialNode opens a bidrectional stream to the requested node.
|
||||
rpc DialNode(stream Frame) returns (stream Frame);
|
||||
|
||||
// Ping checks if the peer is reachable and responsive.
|
||||
rpc Ping(ProxyServicePingRequest) returns (ProxyServicePingResponse);
|
||||
}
|
||||
|
||||
// Frame wraps different message types to be sent over a stream.
|
||||
message Frame {
|
||||
oneof Message {
|
||||
DialRequest DialRequest = 1;
|
||||
ConnectionEstablished ConnectionEstablished = 2;
|
||||
Data Data = 3;
|
||||
}
|
||||
}
|
||||
|
||||
// DialRequest contains details for connecting to a node.
|
||||
message DialRequest {
|
||||
// NodeID is the {UUID}.{ClusterName} of the node to connect to.
|
||||
string NodeID = 1;
|
||||
// TunnelType is the type of service being accessed. This differentiates agents that
|
||||
// create multiple reverse tunnels for different services.
|
||||
string TunnelType = 2 [(gogoproto.casttype) = "github.com/gravitational/teleport/api/types.TunnelType"];
|
||||
// Source is the original source address of the client.
|
||||
NetAddr Source = 3;
|
||||
// Destination is the destination address to connect to over the reverse tunnel.
|
||||
NetAddr Destination = 4;
|
||||
}
|
||||
|
||||
// Addr is a network address.
|
||||
message NetAddr {
|
||||
// Network is the type of network socket. For example tcp or udp.
|
||||
string Network = 1;
|
||||
// Addr is the host:port address. For example 'localhost:22'
|
||||
string Addr = 2;
|
||||
}
|
||||
|
||||
// Data contains the raw bytes of a connection.
|
||||
message Data {
|
||||
bytes Bytes = 1;
|
||||
}
|
||||
|
||||
// ConnectionEstablished signals to the client a connection to the node has been established.
|
||||
message ConnectionEstablished {}
|
||||
|
||||
message ProxyServicePingRequest {}
|
||||
|
||||
message ProxyServicePingResponse {}
|
||||
-153
@@ -1,153 +0,0 @@
|
||||
// Copyright 2023 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package types;
|
||||
|
||||
import "gogoproto/gogo.proto";
|
||||
import "google/protobuf/timestamp.proto";
|
||||
import "teleport/legacy/types/types.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/types";
|
||||
option (gogoproto.goproto_getters_all) = false;
|
||||
option (gogoproto.marshaler_all) = true;
|
||||
option (gogoproto.unmarshaler_all) = true;
|
||||
|
||||
// DeviceV1 is the resource representation of teleport.devicetrust.v1.Device.
|
||||
message DeviceV1 {
|
||||
// Header is the common resource header.
|
||||
//
|
||||
// - Kind is always "device".
|
||||
// - SubKind is unused.
|
||||
// - Version is equivalent to teleport.devicetrust.v1.Device.api_version.
|
||||
// - Metadata.Name is equivalent to teleport.devicetrust.v1.Device.Id.
|
||||
ResourceHeader Header = 1 [
|
||||
(gogoproto.nullable) = false,
|
||||
(gogoproto.jsontag) = "",
|
||||
(gogoproto.embed) = true
|
||||
];
|
||||
// Specification of the device.
|
||||
DeviceSpec spec = 5 [(gogoproto.jsontag) = "spec"];
|
||||
}
|
||||
|
||||
// DeviceSpec is a device specification.
|
||||
// Roughly matches teleport.devicetrust.v1.Device, with some fields changed for
|
||||
// better UX.
|
||||
message DeviceSpec {
|
||||
string os_type = 1 [(gogoproto.jsontag) = "os_type"];
|
||||
string asset_tag = 2 [(gogoproto.jsontag) = "asset_tag"];
|
||||
google.protobuf.Timestamp create_time = 3 [
|
||||
(gogoproto.stdtime) = true,
|
||||
(gogoproto.jsontag) = "create_time"
|
||||
];
|
||||
google.protobuf.Timestamp update_time = 4 [
|
||||
(gogoproto.stdtime) = true,
|
||||
(gogoproto.jsontag) = "update_time"
|
||||
];
|
||||
string enroll_status = 5 [(gogoproto.jsontag) = "enroll_status"];
|
||||
DeviceCredential credential = 6 [(gogoproto.jsontag) = "credential,omitempty"];
|
||||
repeated DeviceCollectedData collected_data = 7 [(gogoproto.jsontag) = "collected_data,omitempty"];
|
||||
DeviceSource source = 8 [(gogoproto.jsontag) = "source,omitempty"];
|
||||
DeviceProfile profile = 9 [(gogoproto.jsontag) = "profile,omitempty"];
|
||||
string owner = 10 [(gogoproto.jsontag) = "owner,omitempty"];
|
||||
}
|
||||
|
||||
// DeviceCredential is the resource representation of
|
||||
// teleport.devicetrust.v1.DeviceCredential.
|
||||
message DeviceCredential {
|
||||
string id = 1 [(gogoproto.jsontag) = "id"];
|
||||
bytes public_key_der = 2 [(gogoproto.jsontag) = "public_key_der,omitempty"];
|
||||
string device_attestation_type = 3 [(gogoproto.jsontag) = "device_attestation_type,omitempty"];
|
||||
string tpm_ekcert_serial = 4 [(gogoproto.jsontag) = "tpm_ekcert_serial,omitempty"];
|
||||
bytes tpm_ak_public = 5 [(gogoproto.jsontag) = "tpm_ak_public,omitempty"];
|
||||
}
|
||||
|
||||
// DeviceCollectedData is the resource representation of
|
||||
// teleport.devicetrust.v1.DeviceCollectedData.
|
||||
message DeviceCollectedData {
|
||||
google.protobuf.Timestamp collect_time = 1 [
|
||||
(gogoproto.stdtime) = true,
|
||||
(gogoproto.jsontag) = "collect_time"
|
||||
];
|
||||
google.protobuf.Timestamp record_time = 2 [
|
||||
(gogoproto.stdtime) = true,
|
||||
(gogoproto.jsontag) = "record_time"
|
||||
];
|
||||
string os_type = 3 [(gogoproto.jsontag) = "os_type"];
|
||||
string serial_number = 4 [(gogoproto.jsontag) = "serial_number,omitempty"];
|
||||
string model_identifier = 5 [(gogoproto.jsontag) = "model_identifier,omitempty"];
|
||||
string os_version = 6 [(gogoproto.jsontag) = "os_version,omitempty"];
|
||||
string os_build = 7 [(gogoproto.jsontag) = "os_build,omitempty"];
|
||||
string os_username = 8 [(gogoproto.jsontag) = "os_username,omitempty"];
|
||||
string jamf_binary_version = 9 [(gogoproto.jsontag) = "jamf_binary_version,omitempty"];
|
||||
string macos_enrollment_profiles = 10 [(gogoproto.jsontag) = "macos_enrollment_profiles,omitempty"];
|
||||
string reported_asset_tag = 11 [(gogoproto.jsontag) = "reported_asset_tag,omitempty"];
|
||||
string system_serial_number = 12 [(gogoproto.jsontag) = "system_serial_number,omitempty"];
|
||||
string base_board_serial_number = 13 [(gogoproto.jsontag) = "base_board_serial_number,omitempty"];
|
||||
TPMPlatformAttestation tpm_platform_attestation = 14 [(gogoproto.jsontag) = "tpm_platform_attestation,omitempty"];
|
||||
string os_id = 15 [(gogoproto.jsontag) = "os_id,omitempty"];
|
||||
}
|
||||
|
||||
// TPMPCR is the resource representation of teleport.devicetrust.v1.TPMPCR.
|
||||
message TPMPCR {
|
||||
int32 index = 1 [(gogoproto.jsontag) = "index"];
|
||||
bytes digest = 2 [(gogoproto.jsontag) = "digest"];
|
||||
uint64 digest_alg = 3 [(gogoproto.jsontag) = "digest_alg"];
|
||||
}
|
||||
|
||||
// TPMQuote is the resource representation of teleport.devicetrust.v1.TPMQuote.
|
||||
message TPMQuote {
|
||||
bytes quote = 1 [(gogoproto.jsontag) = "quote"];
|
||||
bytes signature = 2 [(gogoproto.jsontag) = "signature"];
|
||||
}
|
||||
|
||||
// TPMPlatformParameters is the resource representation of
|
||||
// teleport.devicetrust.v1.TPMPlatformParameters.
|
||||
message TPMPlatformParameters {
|
||||
repeated TPMQuote quotes = 1 [(gogoproto.jsontag) = "quotes"];
|
||||
repeated TPMPCR pcrs = 2 [(gogoproto.jsontag) = "pcrs"];
|
||||
bytes event_log = 3 [(gogoproto.jsontag) = "event_log"];
|
||||
}
|
||||
|
||||
// TPMPlatformAttestation is the resource representation of
|
||||
// teleport.devicetrust.v1.TPMPlatformAttestation.
|
||||
message TPMPlatformAttestation {
|
||||
bytes nonce = 1 [(gogoproto.jsontag) = "nonce,omitempty"];
|
||||
TPMPlatformParameters platform_parameters = 2 [(gogoproto.jsontag) = "platform_parameters,omitempty"];
|
||||
}
|
||||
|
||||
// DeviceSource is the resource representation of
|
||||
// teleport.devicetrust.v1.DeviceSource..
|
||||
message DeviceSource {
|
||||
string name = 1 [(gogoproto.jsontag) = "name"];
|
||||
string origin = 2 [(gogoproto.jsontag) = "origin"];
|
||||
}
|
||||
|
||||
// DeviceProfile is the resource representation of
|
||||
// teleport.devicetrust.v1.DeviceProfile.
|
||||
message DeviceProfile {
|
||||
google.protobuf.Timestamp update_time = 1 [
|
||||
(gogoproto.stdtime) = true,
|
||||
(gogoproto.jsontag) = "update_time,omitempty"
|
||||
];
|
||||
string model_identifier = 2 [(gogoproto.jsontag) = "model_identifier,omitempty"];
|
||||
string os_version = 3 [(gogoproto.jsontag) = "os_version,omitempty"];
|
||||
string os_build = 4 [(gogoproto.jsontag) = "os_build,omitempty"];
|
||||
repeated string os_usernames = 5 [(gogoproto.jsontag) = "os_usernames,omitempty"];
|
||||
string jamf_binary_version = 6 [(gogoproto.jsontag) = "jamf_binary_version,omitempty"];
|
||||
string external_id = 7 [(gogoproto.jsontag) = "external_id,omitempty"];
|
||||
string os_build_supplemental = 8 [(gogoproto.jsontag) = "os_build_supplemental,omitempty"];
|
||||
string os_id = 9 [(gogoproto.jsontag) = "os_id,omitempty"];
|
||||
}
|
||||
-29
@@ -1,29 +0,0 @@
|
||||
// Copyright 2023 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package events;
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/types/events";
|
||||
|
||||
// AthenaS3EventPayload is used as payload for sending large events to SQS.
|
||||
message AthenaS3EventPayload {
|
||||
// Path on S3.
|
||||
string path = 1;
|
||||
// VersionID is versionID of file on s3, if versioning is enabled.
|
||||
string version_id = 2;
|
||||
// Custom KMS key for server-side encryption.
|
||||
string ckms = 3;
|
||||
}
|
||||
-8287
File diff suppressed because it is too large
Load Diff
-37
@@ -1,37 +0,0 @@
|
||||
// Copyright 2024 Gravitational, Inc.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package types;
|
||||
|
||||
import "gogoproto/gogo.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/types";
|
||||
option (gogoproto.goproto_getters_all) = false;
|
||||
option (gogoproto.marshaler_all) = true;
|
||||
option (gogoproto.unmarshaler_all) = true;
|
||||
|
||||
// TrustedDeviceRequirement indicates whether access may be hindered by the lack
|
||||
// of a trusted device.
|
||||
enum TrustedDeviceRequirement {
|
||||
// Device requirement not determined.
|
||||
// Does not mean that a device is not required, only that the necessary data
|
||||
// was not considered.
|
||||
TRUSTED_DEVICE_REQUIREMENT_UNSPECIFIED = 0;
|
||||
// Trusted device not required.
|
||||
TRUSTED_DEVICE_REQUIREMENT_NOT_REQUIRED = 1;
|
||||
// Trusted device required by either cluster mode or user roles.
|
||||
TRUSTED_DEVICE_REQUIREMENT_REQUIRED = 2;
|
||||
}
|
||||
-8300
File diff suppressed because it is too large
Load Diff
Vendored
-268
@@ -1,268 +0,0 @@
|
||||
// Copyright 2021 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
// Package WebAuthn maps WebAuthn messages to protocol buffers.
|
||||
//
|
||||
// The mapping is designed to match both the WebAuthn specification and the
|
||||
// capabilities of current browser implementations.
|
||||
//
|
||||
// REST-based Teleport APIs will make an effort to transmit or embed JSON
|
||||
// messages matching the github.com/go-webauthn/webauthn reference implementation,
|
||||
// to allow for easy browser integration. gRPC APIs are not meant for REST use
|
||||
// and thus make no such promises, although the correspondence should be
|
||||
// obvious.
|
||||
//
|
||||
// Note that, ordinarily, various fields in WebAuthn messages are encoded using
|
||||
// "RawURLEncoding" (aka, base64 URL encoding without padding). This is not the
|
||||
// case for _any_ of the fields mapped here, all bytes fields are transmitted
|
||||
// raw/unencoded.
|
||||
package webauthn;
|
||||
|
||||
import "gogoproto/gogo.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/types/webauthn;webauthnpb";
|
||||
option (gogoproto.marshaler_all) = true;
|
||||
option (gogoproto.unmarshaler_all) = true;
|
||||
|
||||
// -----------------------------------------------------------------------------
|
||||
// Assertion (aka login).
|
||||
// -----------------------------------------------------------------------------
|
||||
|
||||
// Credential assertion used for login ceremonies.
|
||||
message CredentialAssertion {
|
||||
PublicKeyCredentialRequestOptions public_key = 1;
|
||||
}
|
||||
|
||||
// Request options necessary for credential assertions, aka login ceremonies.
|
||||
// See https://www.w3.org/TR/webauthn-2/#dictionary-assertion-options or
|
||||
// refer to navigator.credentials.get in your browser.
|
||||
message PublicKeyCredentialRequestOptions {
|
||||
// Raw challenge used for assertion.
|
||||
bytes challenge = 1;
|
||||
// Timeout in milliseconds.
|
||||
int64 timeout_ms = 2;
|
||||
// Relying Party ID.
|
||||
string rp_id = 3;
|
||||
// Allowed credentials for assertion.
|
||||
repeated CredentialDescriptor allow_credentials = 4;
|
||||
// Extensions supplied by the Relying Party.
|
||||
AuthenticationExtensionsClientInputs extensions = 5;
|
||||
// User verification requirement.
|
||||
string user_verification = 6;
|
||||
}
|
||||
|
||||
// Assertion response returned by the authenticator.
|
||||
// Refer to navigator.credentials.get in your browser.
|
||||
message CredentialAssertionResponse {
|
||||
// Note: assertion responses return both "rawId" and "id" (RawURLEncoding of
|
||||
// "id"), but it seemed pointless to have both here.
|
||||
|
||||
// Type of the credential, usually "public-key".
|
||||
string type = 1;
|
||||
// Raw Credential ID.
|
||||
bytes raw_id = 2;
|
||||
// Assertion response from the authenticator.
|
||||
AuthenticatorAssertionResponse response = 3;
|
||||
// Extensions supplied by the authenticator.
|
||||
AuthenticationExtensionsClientOutputs extensions = 4;
|
||||
}
|
||||
|
||||
// Authenticator assertion response.
|
||||
// https://www.w3.org/TR/webauthn-2/#authenticatorassertionresponse
|
||||
message AuthenticatorAssertionResponse {
|
||||
// Raw client data JSON, exactly as signed by the authenticator.
|
||||
// https://www.w3.org/TR/webauthn-2/#dictdef-collectedclientdata.
|
||||
bytes client_data_json = 1;
|
||||
// Raw authenticator data, exactly as signed by the authenticator.
|
||||
// https://www.w3.org/TR/webauthn-2/#sctn-authenticator-data.
|
||||
bytes authenticator_data = 2;
|
||||
// Raw assertion signature performed authenticatorData|clientDataJSON.
|
||||
// https://www.w3.org/TR/webauthn-2/#assertion-signature.
|
||||
bytes signature = 3;
|
||||
// Raw user handle returned by the authenticator, if any.
|
||||
bytes user_handle = 4;
|
||||
}
|
||||
|
||||
// -----------------------------------------------------------------------------
|
||||
// Creation (aka registration).
|
||||
// -----------------------------------------------------------------------------
|
||||
|
||||
// Credential creation used for registration ceremonies.
|
||||
message CredentialCreation {
|
||||
PublicKeyCredentialCreationOptions public_key = 1;
|
||||
}
|
||||
|
||||
// Request options necessary for credential creation, aka registration
|
||||
// ceremonies.
|
||||
// See
|
||||
// https://www.w3.org/TR/webauthn-2/#dictdef-publickeycredentialcreationoptions
|
||||
// or refer to navigator.credentials.create in your browser.
|
||||
message PublicKeyCredentialCreationOptions {
|
||||
// Raw challenge used for creation.
|
||||
bytes challenge = 1;
|
||||
// Relying party information.
|
||||
RelyingPartyEntity rp = 2;
|
||||
// User information.
|
||||
UserEntity user = 3;
|
||||
// Desired properties for the credential to be created, from most to least
|
||||
// preferred.
|
||||
repeated CredentialParameter credential_parameters = 4;
|
||||
// Timeout in milliseconds.
|
||||
int64 timeout_ms = 5;
|
||||
// Credentials excluded from the ceremony.
|
||||
repeated CredentialDescriptor exclude_credentials = 6;
|
||||
// Attestation requested, defaulting to "none".
|
||||
// https://www.w3.org/TR/webauthn-2/#enumdef-attestationconveyancepreference.
|
||||
string attestation = 7;
|
||||
// Extensions supplied by the Relying Party.
|
||||
AuthenticationExtensionsClientInputs extensions = 8;
|
||||
// Authenticator selection criteria for the new credential.
|
||||
AuthenticatorSelection authenticator_selection = 9;
|
||||
}
|
||||
|
||||
// Credential creation response returned by the authenticator.
|
||||
// Refer to navigator.credentials.create in your browser.
|
||||
message CredentialCreationResponse {
|
||||
// Note: creation responses return both "rawId" and "id" (RawURLEncoding of
|
||||
// "id"), but it seemed pointless to have both here.
|
||||
|
||||
// Type of the credential, usually "public-key".
|
||||
string type = 1;
|
||||
// Raw Credential ID.
|
||||
bytes raw_id = 2;
|
||||
// Attestation response from the authenticator.
|
||||
AuthenticatorAttestationResponse response = 3;
|
||||
// Extensions supplied by the authenticator.
|
||||
AuthenticationExtensionsClientOutputs extensions = 4;
|
||||
}
|
||||
|
||||
// Attestation response from the authentication, ie, the response to a
|
||||
// credential creation request.
|
||||
// https://www.w3.org/TR/webauthn-2/#authenticatorattestationresponse.
|
||||
message AuthenticatorAttestationResponse {
|
||||
// Raw client data JSON, exactly as signed by the authenticator.
|
||||
// https://www.w3.org/TR/webauthn-2/#dictdef-collectedclientdata.
|
||||
bytes client_data_json = 1;
|
||||
// Raw attestation object.
|
||||
// https://www.w3.org/TR/webauthn-2/#attestation-object
|
||||
bytes attestation_object = 2;
|
||||
}
|
||||
|
||||
// -----------------------------------------------------------------------------
|
||||
// Common WebAuthn objects.
|
||||
// -----------------------------------------------------------------------------
|
||||
|
||||
// Extensions supplied by the Relying Party during credential assertion or
|
||||
// creation.
|
||||
// https://www.w3.org/TR/webauthn-2/#client-extension-input
|
||||
message AuthenticationExtensionsClientInputs {
|
||||
// U2F application ID to be used by the authenticator, if any.
|
||||
// Only available if using U2F compatibility mode.
|
||||
// https://www.w3.org/TR/webauthn-2/#sctn-appid-extension.
|
||||
string app_id = 1;
|
||||
|
||||
// Enables the credProps extension.
|
||||
// https://w3c.github.io/webauthn/#sctn-authenticator-credential-properties-extension
|
||||
bool cred_props = 2;
|
||||
}
|
||||
|
||||
// Extensions supplied by the authenticator to the Relying Party, during
|
||||
// credential assertion or creation.
|
||||
// https://www.w3.org/TR/webauthn-2/#client-extension-output.
|
||||
message AuthenticationExtensionsClientOutputs {
|
||||
// If true, the AppID extension was used by the authenticator, which changes
|
||||
// the rpIdHash accordingly.
|
||||
// https://www.w3.org/TR/webauthn-2/#sctn-appid-extension.
|
||||
bool app_id = 1;
|
||||
|
||||
// Credential properties per credProps extension.
|
||||
// https://w3c.github.io/webauthn/#sctn-authenticator-credential-properties-extension.
|
||||
CredentialPropertiesOutput cred_props = 2;
|
||||
}
|
||||
|
||||
// CredentialPropertiesOutput is the output of the credProps extension.
|
||||
message CredentialPropertiesOutput {
|
||||
// If true, the created credential is a resident key (regardless of the
|
||||
// AuthenticatorSelection.require_resident_key value).
|
||||
// OPTIONAL by specification.
|
||||
bool rk = 1;
|
||||
}
|
||||
|
||||
// Authenticator selection criteria.
|
||||
// Restricts the choice of authenticator for credential creation.
|
||||
message AuthenticatorSelection {
|
||||
// Authenticator attachment, empty means no particular attachment is
|
||||
// required.
|
||||
string authenticator_attachment = 1;
|
||||
// Resident key requirement, if true the authenticator must create a resident
|
||||
// key.
|
||||
bool require_resident_key = 2;
|
||||
// User verification requirement for authenticators.
|
||||
string user_verification = 3;
|
||||
}
|
||||
|
||||
// Public key credential descriptor.
|
||||
// https://www.w3.org/TR/webauthn-2/#dictdef-publickeycredentialdescriptor.
|
||||
message CredentialDescriptor {
|
||||
// Type of the credential, usually "public-key".
|
||||
string type = 1;
|
||||
// Raw Credential ID.
|
||||
bytes id = 2;
|
||||
|
||||
// Notes:
|
||||
// * Transport hints omitted (assume no restrictions).
|
||||
}
|
||||
|
||||
// Parameters for credential creation.
|
||||
// https://www.w3.org/TR/webauthn-2/#dictdef-publickeycredentialparameters.
|
||||
message CredentialParameter {
|
||||
// Credential type, usually "public-key".
|
||||
// https://www.w3.org/TR/webauthn-2/#enumdef-publickeycredentialtype.
|
||||
string type = 1;
|
||||
// COSE algorithm specifier.
|
||||
// Most authenticators support exclusively ES256(-7).
|
||||
// https://www.w3.org/TR/webauthn-2/#typedefdef-cosealgorithmidentifier.
|
||||
int32 alg = 2;
|
||||
}
|
||||
|
||||
// Relying Party information.
|
||||
// See https://www.w3.org/TR/webauthn-2/#dictdef-publickeycredentialrpentity and
|
||||
// https://developer.mozilla.org/en-US/docs/Web/API/PublicKeyCredentialCreationOptions/rp.
|
||||
message RelyingPartyEntity {
|
||||
string id = 1;
|
||||
string name = 2;
|
||||
|
||||
reserved 3; // string icon
|
||||
reserved "icon";
|
||||
}
|
||||
|
||||
// User information.
|
||||
// See https://www.w3.org/TR/webauthn-2/#dictdef-publickeycredentialuserentity
|
||||
// and
|
||||
// https://developer.mozilla.org/en-US/docs/Web/API/PublicKeyCredentialCreationOptions/user.
|
||||
message UserEntity {
|
||||
// Raw ID of the user.
|
||||
bytes id = 1;
|
||||
// Human-palatable name for a user account.
|
||||
// The Relying Party _may_ let the user choose this value.
|
||||
string name = 2;
|
||||
// Human-palatable name for the user account, intended only for display.
|
||||
// The Relying Party _should_ let the user choose this value.
|
||||
string display_name = 3;
|
||||
|
||||
reserved 4; // string icon
|
||||
reserved "icon";
|
||||
}
|
||||
Vendored
-46
@@ -1,46 +0,0 @@
|
||||
// Copyright 2021 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package wrappers;
|
||||
|
||||
import "gogoproto/gogo.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/types/wrappers";
|
||||
option (gogoproto.goproto_getters_all) = false;
|
||||
option (gogoproto.marshaler_all) = true;
|
||||
option (gogoproto.unmarshaler_all) = true;
|
||||
|
||||
// StringValues is a list of strings.
|
||||
message StringValues {
|
||||
repeated string Values = 1;
|
||||
}
|
||||
|
||||
// LabelValues is a list of key value pairs, where key is a string
|
||||
// and value is a list of string values.
|
||||
message LabelValues {
|
||||
// Values contains key value pairs.
|
||||
map<string, StringValues> Values = 1 [
|
||||
(gogoproto.nullable) = false,
|
||||
(gogoproto.jsontag) = "labels"
|
||||
];
|
||||
}
|
||||
|
||||
// CustomType is a json protobuf representation of a Go struct. This is
|
||||
// useful when defining customtypes for use with the (gogoproto.customtype) extension.
|
||||
message CustomType {
|
||||
// Bytes is the marshalled json data of a struct.
|
||||
bytes Bytes = 1 [(gogoproto.jsontag) = "json"];
|
||||
}
|
||||
-45
@@ -1,45 +0,0 @@
|
||||
// Copyright 2022 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.loginrule.v1;
|
||||
|
||||
import "teleport/legacy/types/types.proto";
|
||||
import "teleport/legacy/types/wrappers/wrappers.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/loginrule/v1;loginrulev1";
|
||||
|
||||
// LoginRule is a resource to configure rules and logic which should run during
|
||||
// Teleport user login.
|
||||
message LoginRule {
|
||||
// Metadata is resource metadata.
|
||||
types.Metadata metadata = 1;
|
||||
|
||||
// Version is the resource version.
|
||||
string version = 2;
|
||||
|
||||
// Priority is the priority of the login rule relative to other login rules
|
||||
// in the same cluster. Login rules with a lower numbered priority will be
|
||||
// evaluated first.
|
||||
int32 priority = 3;
|
||||
|
||||
// TraitsMap is a map of trait keys to lists of predicate expressions which
|
||||
// should evaluate to the desired values for that trait.
|
||||
map<string, wrappers.StringValues> traits_map = 4;
|
||||
|
||||
// TraitsExpression is a predicate expression which should return the
|
||||
// desired traits for the user upon login.
|
||||
string traits_expression = 5;
|
||||
}
|
||||
Vendored
-110
@@ -1,110 +0,0 @@
|
||||
// Copyright 2022 Gravitational, Inc
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
package teleport.loginrule.v1;
|
||||
|
||||
import "google/protobuf/empty.proto";
|
||||
import "teleport/legacy/types/wrappers/wrappers.proto";
|
||||
import "teleport/loginrule/v1/loginrule.proto";
|
||||
|
||||
option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/loginrule/v1;loginrulev1";
|
||||
|
||||
// LoginRuleService provides CRUD methods for the LoginRule resource.
|
||||
service LoginRuleService {
|
||||
// CreateLoginRule creates a login rule if one with the same name does not
|
||||
// already exist, else it returns an error.
|
||||
rpc CreateLoginRule(CreateLoginRuleRequest) returns (LoginRule);
|
||||
|
||||
// UpsertLoginRule creates a login rule if one with the same name does not
|
||||
// already exist, else it replaces the existing login rule.
|
||||
rpc UpsertLoginRule(UpsertLoginRuleRequest) returns (LoginRule);
|
||||
|
||||
// GetLoginRule retrieves a login rule described by the given request.
|
||||
rpc GetLoginRule(GetLoginRuleRequest) returns (LoginRule);
|
||||
|
||||
// ListLoginRules lists all login rules.
|
||||
rpc ListLoginRules(ListLoginRulesRequest) returns (ListLoginRulesResponse);
|
||||
|
||||
// DeleteLoginRule deletes an existing login rule.
|
||||
rpc DeleteLoginRule(DeleteLoginRuleRequest) returns (google.protobuf.Empty);
|
||||
|
||||
// TestLoginRule evaluates login rules against provided user traits
|
||||
// to test that the output matches expectations prior to them being enforced and
|
||||
// potentially locking out users.
|
||||
rpc TestLoginRule(TestLoginRuleRequest) returns (TestLoginRuleResponse);
|
||||
}
|
||||
|
||||
// CreateLoginRuleRequest is a request to create a login rule.
|
||||
message CreateLoginRuleRequest {
|
||||
// LoginRule is the login rule to be created.
|
||||
LoginRule login_rule = 1;
|
||||
}
|
||||
|
||||
// UpsertLoginRuleRequest is a request to upsert a login rule.
|
||||
message UpsertLoginRuleRequest {
|
||||
// LoginRule is the login rule to be created.
|
||||
LoginRule login_rule = 1;
|
||||
}
|
||||
|
||||
// GetLoginRuleRequest is a request to get a single login rule.
|
||||
message GetLoginRuleRequest {
|
||||
// Name is the name of the login rule to get.
|
||||
string name = 1;
|
||||
}
|
||||
|
||||
// ListLoginRulesRequest is a paginated request to list all login rules.
|
||||
message ListLoginRulesRequest {
|
||||
// PageSize is The maximum number of login rules to return in a single
|
||||
// reponse.
|
||||
int32 page_size = 1;
|
||||
|
||||
// PageToken is the NextPageToken value returned from a previous
|
||||
// ListLoginRules request, if any.
|
||||
string page_token = 2;
|
||||
}
|
||||
|
||||
// ListLoginRulesResponse is a paginated response to a ListLoginRulesRequest.
|
||||
message ListLoginRulesResponse {
|
||||
// LoginRules is the list of login rules.
|
||||
repeated LoginRule login_rules = 1;
|
||||
|
||||
// NextPageToken is a token to retrieve the next page of results, or empty
|
||||
// if there are no more results.
|
||||
string next_page_token = 2;
|
||||
}
|
||||
|
||||
// DeleteLoginRuleRequest is a request to delete a login rule.
|
||||
message DeleteLoginRuleRequest {
|
||||
// Name is the name of the login rule to delete.
|
||||
string name = 1;
|
||||
}
|
||||
|
||||
// TestLoginRuleRequest is a request to test a login rule against traits.
|
||||
message TestLoginRuleRequest {
|
||||
// LoginRules is the list of the rules to evaluate.
|
||||
repeated LoginRule login_rules = 1;
|
||||
// Traits are the user traits to test the login rule against.
|
||||
map<string, wrappers.StringValues> traits = 4;
|
||||
// LoadFromCluster indicates if existing login rules should be included
|
||||
// when evaluating rules.
|
||||
bool load_from_cluster = 3;
|
||||
}
|
||||
|
||||
// TestLoginRuleResponse is a response to a login rule test.
|
||||
message TestLoginRuleResponse {
|
||||
// Traits contain the output from evaluating the login rules.
|
||||
map<string, wrappers.StringValues> traits = 4;
|
||||
}
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user