* Add a dedicated login e2e test
* Remove authenticated setup tests from summary
* Change Roles assertion to a header assertion
* pnpm format
* Avoid collisions during report merging
* Use global setup to avoid authentication tests appearing in report
* Add browser name back to auth state file
* Make the default export nicer
* Surface non-test errors and fix stat tally in runner report
* Generate auth state via global setup for browse/codegen
* Report flaky test details and name failing tests
* Persist trace attachments for --test-results
* Make signup test retry-safe and tolerate login rate limit
* pnpm format
* Skip global setup when there are no bootstrapped users
* Make darktheme test retry-safe and tolerate login rate limit
Relocates client.ParseLabelSpec to lib/utils/parse. This results in
a net 5MB reduction in the weight of lib/config. This may not
have a correlation in binary size since lib/client is heavily consumed
by other packages.
```bash
$ goda cut './lib/config:all' | rg '^github.com/gravitational/teleport/lib/client\b|^ID'
github.com/gravitational/teleport/lib/client InDegree=1 Cut.PackageCount=75 Cut.AllFiles.Size=5.3MB Cut.Go.Lines=129512
```
* Apply `pnpx codemod run pnpm-v10-to-v11`
* Remove `eslint` hoisting, it's in the root package.json anyway
* `pnpm install`
* Bump Node.js to 24.15
* Bump pnpm to 11.1.1
* Update pnpm to 11.3.0
* Update `electron` to 42.2.0, `electron-builder` to 26.11.1
* Update `node-abi` to 4.31.0
* Override `yauzl` to workaround Electron not being installed on Node.js 24.16
* Update Node.js to 24.16
* Bump Playwright to 1.60.0
* Separate logging out and forgetting profile
* Store `proxyHost` in the workspace and decouple workspace existence from profile existence
* Display workspaces instead of profiles in identity list
* Only activate workspace on launch when cluster exists
* Handle cluster disappearing when `ClusterLogin` is open
* Fix e2e tests
* Add comments
* Clean up rendering workspaces
* Make test name more obvious
* Make workspace state the source of truth for activation
* Adjust callsites to updated `addWorkspace` and `setActiveWorkspace` behavior
* Add `makeWorkspace` and `makePersistedWorkspace` test helpers
* Fix mistakenly passed `cluster.uri` instead of `cluster.proxyHost`
* Read `activeClusterUri` from `useStoreSelector`
* Update `proxyHost` in workspace whenever it changes in profile
* Use `proxyHost` in notification
* Introduce `rootClusterProxyHost`
* Get rid of `getActiveRootCluster()`
* Rename `identityItems`
* Improve comment for `setActiveWorkspace` init action
* Fix `Identity` story
* Previously used -> Saved in Connect
* Clear app updates managing cluster only when forgetting cluster
* Wrap `hasAnyWorkspaces` in boolean
* Expired session -> Session expired, Saved in Connect -> In history
* Fix e2e test
* Bump gravitational/predicate to WIP commit
* Remove some allocations in predicate expressions
* Optimize contains(split()) in resource expression parser
* Do a type-safe assert on the result of astutil.Apply
* Keep the full value argument in the early exit of optimizeSplitContains
* Handle degenerate cases in splitContains
* Expand on the benchmark
* Rename LazyStringSlice to StringSlice
* Document StringSlice
* Fix test
* Fix handling of split on empty string
* Bump gravitational/predicate to 1.4.0
* Optimize multibyte delimiters too
* Update godoc for optimizeSplitContains
* Clarify the logic in splitContainsAffix
* Actually use multi-byte delimiters in BenchmarkSplitContains
* Revert "Actually use multi-byte delimiters in BenchmarkSplitContains"
This reverts commit 595bb85ba9.
* Revert "Optimize multibyte delimiters too"
This reverts commit f285928e99.
* Add some tests with overlap of target and delimiter
* Clarify the return value of the AST optimization visitors
* Add unit test just for the new string splitting
* Add some broken utf8 coverage too
* Move the e2e workflow to be composable
* Add support for tctl applying resources on Teleport start
* Always run playwright from OSS directory
* Copy session summaries over, adjusting end event/inference times
* Do not fix the viewport when browsing
* Fix bad rebase
* pnpm format
* Use a unique role per test, clean up after
* Make TableRow stable between renders
* Add stable key to DataTable
* Throw any tctl error that doesn't contain not found
Imports yassine's RBAC tests for navigation/visibility, recordings playback,
and role CRUD, alongside the supporting Recordings/Roles/SideNav/TrustedClusters
page objects. The recording fixture is renamed from a raw UUID to
ssh-recording-1 so test authors can reference it by a friendly name; consumers
on this branch declare it via `recordings: ['ssh-recording-1']` so the runner
seeds per-user copies through the bootstrap pipeline.
* Add metadata/thumbnail generation for desktop recordings
* Rename isPTYSession to metadataParamsForSessionEnd
* go mod tidy
* Disable the processor if RDP decoder is not available
* Reuse png.Encoder and buffer instead of creating new per screenshot
* Add clarifying comment about returning nil, nil when no decoder
* Add Windows desktop end events
* Set the session start time from end event if we don't already have it
* Break import cycle by extracting MFA JSON types to lib/client/mfatypes
* pnpm format
* go mod tidy all
* Remove flakey test that's covered through other paths
* Use a different interval for desktop sessions, make frames smaller than thumbnail
* Set correct flags when resuming mid-upload
* go.sum
* Handle desktop events in session post processor
* Add a semaphore to desktop recording processing
* Populate metadata from end event if start event not present
* Formatting
* Pass session start time to the metadata processor
* Reduce image sizes in tests
* Add user/role scanner and bootstrap library to e2e runner
* Clarify why missing files are non-fatal in scanFileUsers
* Warn if there are duplicate roles
* Trim test verbosity and tighten scan.go regex declarations
All existing template usage was converted to make use of
github.com/DataDog/datadog-agent/pkg/template. The DataDog package
is a fork of the stdlib template packages with method calling
removed so that reflect.MethodByName does not prevent DCE.
There were a handful of method calls in our templates that were trivially
changed to use custom functions defined via FuncMaps or specifying the
calculated value to the template instead of calling a function in the template.
A future change will add linter rules to prevent new text/template or
html/imports from landing. They have not been included here so as
to not to break enterprise code while it is migrated.
* Update kingpin
* Convert CLI formatting to use kingpin UsageRenderers
Avoiding the legacy kingpin text/templates allows for DCE to be used
by the linker. The existing formatting has been matched with a
pure Go UsageRenderer.
The library has had a number of CVEs recently and uses shady
dependencies. https://github.com/gravitational/teleport.e/pull/8513
removed the dependency pulled in via teleport.e. This updates the
e_imports.go to reflect that change which moved buger/jsonparser to
an indirect dependency.
To remove the dependency entirely, mark3labs/mcp-go was updated to
the latest version. In that version they have replaced
github.com/invopop/jsonschema, which brough in buger/jsonparser,
with github.com/google/jsonschema-go. As a result buger/jsonparser
is no longer in our dependency tree.
* Detect EC2 join failures and surface via readyz
* Replace readyz join check with systemd log capture
* Add JoinFailureTimeout constant
The installer's readyz polling timeout is referenced by both
the autodiscover installer and the SSM waiter. A shared constant
avoids drift between the two values and keeps the user-facing
status message in sync with the actual wait duration.
* Replace two-attempt join check with poll loop
The join health check now polls the readyz endpoint in a loop
until the node reports ready or a five-minute timeout elapses.
Previously the check ran at most twice with a fixed delay of
thirty seconds, which missed nodes that needed longer to join
and could not distinguish a slow start from a permanent failure.
On timeout the error includes a best-effort systemd service
snapshot gathered via systemctl show. This replaces the earlier
systemctl is-active gate that blocked readyz from being checked
at all when the service was in a non-active or transient state.
The readyz function returns a simple (ready, error) pair instead
of the earlier four-value tuple, and per-attempt timeouts that
hit deadline-exceeded are treated as transient so that polling
continues. A clockwork.Clock field enables deterministic time
control in tests.
* Align SSM waiter timeout with poll timeout
The SSM command waiter used a hardcoded 100-second wait that was
inherited from the v1 SDK default. The installer now polls readyz
for up to five minutes, so the SSM waiter must outlast that to
avoid reporting a stale in-progress state as the final outcome.
The new timeout is the join-failure timeout plus a ten-minute pad.
* Update docs for readyz poll loop errors
Error patterns, status messages, and the example event code now
reflect the polling-based join health check. The event code moves
from TDS01E to TDS00W, and the user task description no longer
assumes an IAM join handshake rejection as the sole failure mode.
* Trim SSM stdout/stderr in audit events
SSMRun audit events can carry unbounded stdout/stderr from
command invocations, risking the 64 KB stream message limit.
Cap each field at 24 000 characters (matching the per-field
cap in the event schema) by keeping only the trailing portion
and aligning the cut to a full-line boundary so diagnostics
stay readable.
* Simplify output.
Co-authored-by: Roman Tkachenko <[email protected]>
* Expand RedactFlagArgs doc comment
* Add IsConnectionError to utils package
Move the socket-level connection check from the installer package
into the shared utils package. The readyz checker needs this to
distinguish transient socket errors from application failures,
and the existing helpers in utils already cover related network
error classification.
* Remove install-script binary-exists guard
The shell installer no longer skips the download when a Teleport
binary already exists on disk. Previously the guard would bypass
reinstallation, but the installer is now expected to always run so
that package-managed upgrades and configuration changes take effect.
* Remove readiness handler tests from lib/service
These tests covered the HTTP readyz handler that is no longer
exercised through the service-level test surface. Readyz check
behaviour is now validated through the installer readyz checker
tests, making these redundant.
* Simplify join-failure error output
The error writer no longer unpacks trace message slices or strips
standalone sentinel lines before printing. Errors now flow through
as plain strings, which is sufficient because the upstream assembly
was simplified to produce one coherent error message.
* Extract readyz checker and diagnostics helpers
Split readyz check logic and systemd diagnostics out of the large
autodiscover file into dedicated files. The readyz checker becomes
a standalone struct with its own per-attempt timeout, connection
error classification, and test suite. Diagnostics helpers such as
journal capture, service state gathering, and the systemctl runner
move into a diagnostics file alongside ErrJoinFailure and related
constants.
The poll loop in checkJoinHealth is restructured to perform an
immediate first check before entering the timer loop, and error
assembly is inlined instead of threading through append helpers.
Tests now use a fake clock and goroutines to exercise the timer
driven polling flow deterministically.
* Move JoinFailureTimeout to installer package
Relocate JoinFailureTimeout from installstatus/exitcodes.go
into installer/autodiscover.go where the readyz polling
logic that consumes it lives. The exit-code String() method
now returns a generic timeout message; ssm_install.go
appends the concrete duration for the join-failure case.
* Reuse poll timer in readyz health check loop
The readyz poll loop allocated a new timer on every iteration and
checked readiness only after waiting. The loop now runs the first
check immediately before entering the poll cycle and reuses a single
timer via Reset, reducing per-iteration allocations. The ready state
drives the loop condition directly, moving the success return after
the loop so the function ends with the diagnostic-failure path at
the bottom.
* Replace binary mocks with function overrides
Join-health timeout tests relied on bintest process mocks for both
systemctl and journalctl, requiring filesystem setup, path wiring,
and post-run invocation assertions for every test case. Diagnostics
and journal capture now use optional function-level overrides that
are injected through the installer config, with thin wrapper methods
that fall through to the real implementation when no override is set.
Previously each test needed six to eight lines of mock orchestration
that obscured the actual test logic.
* Update lib/srv/server/installer/autodiscover_test.go
Scope context to test.
Co-authored-by: Chris Thach <[email protected]>
* Update lib/srv/server/installer/autodiscover_test.go
Scope context to test.
Co-authored-by: Chris Thach <[email protected]>
* Update lib/srv/server/installer/autodiscover_test.go
Scope context to test.
Co-authored-by: Chris Thach <[email protected]>
* Update lib/srv/server/installer/autodiscover_test.go
nstaller/autodiscover_test.go
Co-authored-by: Chris Thach <[email protected]>
* Simplify arg redaction loop to use range
Co-authored-by: Chris Thach <[email protected]>
* Simplify override fields to defaults in config
Co-authored-by: Tiago Silva <[email protected]>
* Add JoinFailureError structured error type
Replace the ErrJoinFailure sentinel with a JoinFailureError struct
that carries message, service diagnostics, journal output, and last
readyz error as separate fields. Previously callers had to parse a
concatenated string to extract individual diagnostic sections, making
downstream formatting and programmatic inspection fragile.
* Surface unexpected readyz errors to caller
Return unexpected errors from the readyz check instead of swallowing
them and returning false. The polling loop in checkJoinHealth keeps
retrying on these errors but now records the last one so it appears
in the timeout diagnostics. Previously a transient HTTP or socket
error was silently discarded, making it impossible to distinguish
"not ready yet" from "endpoint unreachable."
* Replace clock and overrides with function fields
Remove the clockwork dependency from the join-health check and use
the standard time package directly. Promote journalOverride and the
diagnosticsOverride to first-class diagnostics and journal function
fields initialized in checkAndSetDefaults. Build a JoinFailureError
on timeout instead of concatenating string parts. Tests switch from
fakeClock and BlockUntilContext to synctest.Test with time.Sleep,
removing the need for manual clock advancing.
* Use JoinFailureError in CLI error output
Switch the CLI join-failure path from errors.Is with the old sentinel
to errors.As with JoinFailureError. The writer function now accepts
the typed error and prints each diagnostic field on its own line.
Previously the error was printed as a single opaque string, making it
harder to scan in SSM console output.
* Normalize dash prefix in flag redaction
Add a lookupRedactor helper that maps both single-dash flags to their
double-dash redactor registration and vice versa, so callers need not
register both variants. Previously a -token=secret argument passed
through unredacted because only --token was registered in the redactor
map.
* Improve trace msg
Co-authored-by: Gavin Frazar <[email protected]>
* Minor refactor
Co-authored-by: Gavin Frazar <[email protected]>
* Minor refactor
Co-authored-by: Gavin Frazar <[email protected]>
* Minor refactor
Co-authored-by: Gavin Frazar <[email protected]>
* Minor refactor
Co-authored-by: Gavin Frazar <[email protected]>
* Minor refactor
Co-authored-by: Gavin Frazar <[email protected]>
* Minor log improvement
Co-authored-by: Gavin Frazar <[email protected]>
* Remove redundant check
Co-authored-by: Gavin Frazar <[email protected]>
* Quote command+args
Co-authored-by: Gavin Frazar <[email protected]>
* Remove token-redaction utility and its usage
Log node-configure arguments directly instead of redacting the join
token. The token is a short-lived secret issued by the auth server
for EC2 auto-discovery; it expires before log entries are typically
reviewed, so the redaction layer added complexity without meaningful
security benefit. Previously every call to the node-configure step
copied the argument slice through a redactor map and a flag-parsing
loop.
Replace hardcoded five-second sleeps in health-check tests with the
installer's readyzPollInterval field so the tests stay correct when
the interval changes. Remove a stray closing brace left over from a
prior edit.
* Improve diagnostics error messages and comments
Add a comment explaining the systemctl-show output format that the
property parser expects. Quote "systemctl show" in the log message
for the invocation-ID retrieval failure so it renders as a distinct
command name rather than bare words. Switch the infrastructure error
path to use the %q format verb with the full command object so the
message includes the complete binary path instead of manually joining
the argument list.
* Use server clock for EC2 installation SyncTime
Set SyncTime to the discovery server's clock instead of the SSM run
event timestamp. Previously the field carried the event time, which
reflects when SSM dispatched the command rather than when the server
recorded the installation result, causing user-task entries to show
stale timestamps that did not advance on re-evaluation.
* Expand trimToRecentTail godoc comment
* Bound diagnostics collection after join timeout
Diagnostics and journal capture now run under a dedicated five-second
timeout derived from the parent context. Previously they inherited the
caller's context with no independent deadline, so a hung systemctl or
journalctl call could block indefinitely after the readyz poll already
determined the node failed to join.
Journal capture errors are downgraded from a hard return to a warning
log entry. A transient journalctl failure was masking the underlying
join-failure error, causing the caller to receive a journal-capture
error instead of the structured JoinFailureError that carries the
diagnostics payload.
* Document waitTimeoutPad tradeoff and TODO
* Replace systemctl subprocess with D-Bus API
Diagnostics collection now queries systemd properties through the
native D-Bus connection rather than shelling out to systemctl show
and parsing stdout. The D-Bus interface needs fully-qualified unit
names, so the unit-name builder appends a ".service" suffix to each
returned value. This eliminates the systemctl binary-path dependency
during diagnostics and avoids subprocess-parsing fragility around
exit-code versus infrastructure error disambiguation.
* Fix go mod
* Bump how many journal lines we output
* Extract systemd client into lib/systemd package
The systemd D-Bus property lookups, invocation ID retrieval, and the
journalctl capture now live in a reusable lib/systemd package that
exposes a Client with ReadServiceState, InvocationID, and CaptureJournal
methods. Previously these helpers lived as unexported methods on the
AutoDiscoverNodeInstaller type, so any other call site that needed a
systemd state snapshot had to either duplicate the logic or import the
installer package just to reach them. Moving them to a dedicated package
keeps the shared integration layer free of installer-specific policy
and makes the code reusable by unrelated callers.
The installer diagnostics file retains only installer-facing types and
the enableAndRestartTeleportService logic. JoinFailureError doc comments
no longer hardcode the 5m0s timeout in the example, since the timeout
is now configurable and changes across releases. Two clarifying comments
on runSystemctlCommand document why context errors are preferred over
exec errors, and why ExitError branches include the exit code and the
captured stdout and stderr streams in the wrapped error message.
The installer-side test file drops the helpers' tests because they now
live alongside the package they cover in lib/systemd. The remaining
TestJoinFailureErrorString case derives its expected message from
JoinFailureTimeout rather than hardcoding a duration literal.
* Bound join-health polling and diagnostics collection
The join-health check now drives polling with retryutils.NewRetryV2
against a dedicated pollCtx bounded by readyzPollTimeout, and the
diagnostics collection step races the diagnostics and journal goroutines
against diagCtx using channels and a select loop. Previously the poll
loop used a hand-rolled timer with a remaining-duration calculation, and
the diagnostics step waited on a sync.WaitGroup, so a stuck diagnostics
or journal implementation blocked the join failure report indefinitely
even after the parent context was canceled. With the new structure,
context cancellation and the diagnostic timeout both unblock the join
failure path, and the journal output field now carries an explanatory
message when collection times out or is canceled instead of being
silently empty.
JoinFailureTimeout is reduced from five to three minutes to surface
join failures sooner in SSM invocation results, where the full five
minute wait previously delayed operator feedback without improving the
odds of recovery. LastError is no longer populated when the error from
readyzChecker originates from the poll context already expiring, so the
join failure message reflects the actual join outcome rather than a
context cancellation observed only after the poll deadline.
The installer now delegates diagnostics collection and journal capture
to a teleportsystemd.Client constructed from the installer config,
rather than calling unexported systemd helpers on the installer itself.
The local dbusConn interface and its sole usage are removed in favor of
teleportsystemd.NewConnFunc, which is now the test seam for injecting
fake D-Bus connections into the diagnostics client.
The autodiscover tests cover the new behaviors: a stuck diagnostics or
journal implementation does not block join failure reporting when the
parent context is canceled, a poll timeout does not populate LastError,
and a diagnostics timeout produces a human-readable journal substitute.
Existing tests switch from context.Background() to t.Context() so they
inherit the per-test deadline configured by the testing package.
The EC2 troubleshooting docs and ssm_install_test fixtures stop using
a hardcoded five-minute duration and instead derive it from exported
installer.JoinFailureTimeout, so they track future timeout changes
without manual edits across docs, tests, and error message snippets.
* Use t.Context in readyz checker tests
* Reduce join-failure timeout default from 3m to 2m
---------
Co-authored-by: Roman Tkachenko <[email protected]>
Co-authored-by: Chris Thach <[email protected]>
Co-authored-by: Tiago Silva <[email protected]>
Co-authored-by: Gavin Frazar <[email protected]>
* Update docker dependency to moby v1.29
* go mod tidy all
* Update go.mod
* Fix up linting issues
* Fix cosign test broken due to ssrf protections in patched go-containerregistry
Replace deprecated github.com/aws/aws-sdk-go-v2/feature/s3/manager
(Uploader/Downloader) with the new transfermanager package across all
call sites. The old manager types were superceded per
https://github.com/aws/aws-sdk-go-v2/discussions/3306.
Signed-off-by: Tiago Silva <[email protected]>
* Add session recordings to e2e runner
* teleport -> testenv
* Make session recordings start at midnight
* Add missing license
* Use the timezone of the machine
* go mod tidy
* Wait for audit log to exist before writing to it
* Seed recordings on the fly instead of using code generation
* enforce region validation on all AWS config loading
Replace direct uses of `github.com/aws/aws-sdk-go-v2/config.LoadDefaultConfig`
with the internal `lib/cloud/aws/config.LoadDefaultConfig` wrapper, which
validates any explicitly requested AWS region before use. Enforces this via a
new forbidigo linter rule.
Signed-off-by: Tiago Silva <[email protected]>
* Apply suggestions from code review
Co-authored-by: Nic Klaassen <[email protected]>
* fix unit tests
* include underscores and uppercase letters
* add ConfigureRegion
---------
Signed-off-by: Tiago Silva <[email protected]>
Co-authored-by: Nic Klaassen <[email protected]>
Ryan Clark