Replace the functions in the scopes package to infer if scoped features
are enabled with a concrete struct that is injected to consumers. This
permits tests to toggle scopes features without having to specify environment
variables.
This work is not production ready yet. While this work makes the
operator support running with a scoped token, this is not enough for a
public release.
Several failure modes must be addressed, including scoped name
conflicts, and operators fighting for ownership of a resource.
* Add disconnect expired cert and lock mode for scoped role
Update IAC docs
* respond to code review
Add a scoped authorizer in the forwarder_test
fix up proto comments
Update forwarder.go
* fix forwarder setting nil disconnectExpiredCert
* Update validate lock to accept empty string - will be treated as best_effort down the line
add comment
* Add protos
* implement validation and matching support
* generated integrations stuff
* De Morgan, and his faithful followers, have once again defeated me in battle
* Udpate tests in lib/kube/token
* Extend join_kubernetes_test.go
* Fix missing param
* Extend validation tests
* Fix minor nits
* qF1001: CoUld aPpLY de MORgan'S LaW (stAticCHEck)
* Remove redundant database configuration references
This:
1. Adds documentation for the mysql_server_version field of proxy_service
to the general config reference and improves formatting for a couple
of fields there.
2. Removes database config/resource references that are redundant due to
being covered by auto-generated docs or the more centralized teleport
config docs.
* Update docs redirects
* Update internal links pointing to deleted pages
* Update DatabaseSpecV3.Protocol comment with allowed database protocol types
- This PR is removing the old `db` resource reference.
- The new `db` resource reference is generated from the DatabaseV3
protobuf type.
- The old `db` resource reference defined the allowed values of the
protocol field, whereas this information is not in the `DatabaseV3` type.
- docs/pages/identity-security/session-summaries.mdx links to the `db`
resource reference, using it as a source of information on which values
are allowed for the protocol field.
Therefore, we must update the DatabaseV3 protobuf type with information
on which values are allowed for the protocol field.
Adds Kubernetes operator support for the RetrievalModel singleton. The
controller implements Get/Create/Update/Delete backed by the summarizer
gRPC service. Because RetrievalModel is a singleton, Get and Delete
ignore the name parameter and always operate on the fixed Teleport
resource.
Introduces withSingletonName(name string) as a typed CRD schema option that
emits a CEL x-kubernetes-validations rule enforcing metadata.name == name at
admission time. This is wired up for TeleportRetrievalModelV1, which must be
a cluster singleton named "retrieval-model".
On Kubernetes < 1.25, x-kubernetes-validations is not a recognized field in
JSONSchemaProps and causes helm to fail with a validation error. The Helm
CRD template now checks .Capabilities.KubeVersion against >= 1.25.0 and
strips the field from every CRD version's openAPIV3Schema before rendering
when the cluster does not support it.
A Mutate hook enforces that the Kubernetes CR must be named
"retrieval-model" before any Teleport call is made, surfacing a clear
status condition on wrongly-named CRs.
* add scoped role assignments for k8s
Fix tests and retrieving the scoped role assignments by adding subkind
Add additional catch to treat comparefailed error as not found for scoped role assignments
* fix merge conflict
* add scoped roles to k8s operator
scoped role reorg
fix build
Update scopedrole_controller_test.go
fix tests
Remove unneded kind constant in constants.go in favor of the one in access.go
Deleted DeleteTeleportResouce
update to readnosecrets
* update deletion logic to look for not found error
Update teleport_reconciler_tests.go
Add back missing comment
* Update scopedrole_controller.go
* Remove unnecessary string matching
This is a pass on replacing modulestest.SetTestModules with supplying modules
where already possible. Some additional uses of modules.GetModules were also
replaced with localized modules injection to permit the removal of
modulestest.SetTestModules in tests. Most of the changes here are mechanical,
the one notable change is in TestSSHCommands. The test was not passing locally
because the shell (fish) builtin echo behaves differently. The easiest way
to produce expected output was to change the command invocation to use
/bin/echo to bypass any shell builtins for consistent behavior.
Inject modules into tool tests
Inject modules into integration tests
Inject modules into join server
Remove superflous enterprise modules in TestAuthenticationConfig_Parse_deviceTrustPB
Inject modules into signature algorithm config tests
Inject modules into TestGithubConnectorCRUDEventsEmitted
Inject modules into TestGetHierarchyForUser
Inject modules into kube proxy tests
Inject modules into controller tests
make fix-imports
add integration/app/fixture as test package
All existing template usage was converted to make use of
github.com/DataDog/datadog-agent/pkg/template. The DataDog package
is a fork of the stdlib template packages with method calling
removed so that reflect.MethodByName does not prevent DCE.
There were a handful of method calls in our templates that were trivially
changed to use custom functions defined via FuncMaps or specifying the
calculated value to the template instead of calling a function in the template.
A future change will add linter rules to prevent new text/template or
html/imports from landing. They have not been included here so as
to not to break enterprise code while it is migrated.
* Add APIs for handling Entra ID groups overage on SAML connectors
* Restore redacted client secret on connector update
* Add test case for missing creds
* Regenerate resource docs
* Regenerate derived functions
* Overide IsEqual for SAMLConnectorSpecV2
* Update generated CRD and docs
* Update generated TF
* Remove junk from failed command
* Add API comments and update docs
* Exclude client_secret from Terraform schema
* Exclude client_secret from Terraform schema
* Update Terraform docs
* Reorder refill and validate
* Strip client secret in user path
* Add marshaler for SAMLConnectorSpecV2 type
* Add tests for stripping client secret on all paths
* Tidy up tests a bit
* Use protojson+protoadapt instead of jsonpb
* Ignore unknown fields on unmarshal
* Use Empty instead of Equal
* Add custom marshaling methods for SAML connector
* Add comment for use of nolint:depguard
* Fix core issue with marshaling oneof fields
* Refactor credentials oneof handling
* Add comments to connector methods
* Add comments for custom marshaler/unmarshaler
* Fix spelling mistakes in comments
* Refactor credentials handling so future additions don't silently fail
* Ensure consistent marshaling/unmarshaling of empty credentials
* Don't ensure non-empty client secret
* Refactor to enumerating field instead of oneof
* Add comment around validation
* Align validation on Upsert (create) with Create paths
* Defer to Fill.. methods determination of SAML connector existence
* Disable follow URLs validation
* Update proto comment to remove extra spaces from generated docs
* Mark client secret as sensitive in TF schema/docs
* Combine credentials and signing key refills
* Tidy up
* Regenerate types and docs
* Add TODO for credential availability when provider is enabled
* Update error messages for missing skp and creds
* Return connector without secrets
* Revert "Return connector without secrets"
This reverts commit 2ab4aae7d4.
* Add comment on validation callsite for empty argument
* Add godoc for connector with secrets validation
* Add godoc for error consts in secret refill
* Fix spelling in comment
* Fix spelling in error
* MWI: Support scoped join tokens in the bound keypair join method
* Bot fields for scoped tokens
* Check bot scope
* Allow bound keypair tokens to pass scope validation
* Support bots
* Fix outstanding references to ProvisionTokenV2
* Zero check on MustRegisterBefore due to proto impl differences
* Properly pass through nil must_register_before
* Also fix nil timestamps in bound keypair status
* And fix rotate_after
* Add BotInternal certificate field
* Add 'bot' TokenUsageMode value and require for bot joins
* Fix mutator execution for scoped bound keypair joining
* Implement more ScopedToken StrongValidateToken checks for bots
Adds a few more of the bot-specific RFD validation checks for bots.
* Improve bot join checks for scoped joining
* Fix build after rebase and add additional RFD checks
This fixes builds after upstream updates and implements a few more
validations required by the RFD:
- AssignedScope field for bots must be empty
- Moved original AssignedScope check to validateNonBot() since it was
checked unconditionally before.
- BotScope must be a presumably-valid scope at creation time
* Use scope-aware access checker for initial bot certs
* Fix WeakValidateToken() for scoped tokens for bots
WeakValidateToken() was not updated to match the new checks in
StrongValidateToken(); this adds minimal bot-related exemptions
around `assigned_scope` for bots to allow it to be read without
error.
* Add tests for scoped bot tokens, fix role bug
This adds a set of additional token tests for scoped bot tokens, and
fixes an issue where WeakValidateToken() was erroneously rejecting
invalid system roles.
* Properly initialize bound keypair scoped tokens on creation/upsert
We weren't applying the same initialization logic for scoped tokens
that we did for ProvisionTokenV2; this is required for registration
secrets to work properly.
* Update CRDs
* Fix failing test
* Specify types for bound keypair timestamp fields
* Update terraform resources
* Fix lint
* Include bot scope in BotJoin audit events
This includes the bot scope in audit events. It includes the user
label bot scope for successful joins where the user has been fetched,
and otherwise includes the bot scope configured on the token.
* Reject `token` join method for scoped bot tokens
Bot joining should use `bound_keypair`, so reject scoped bot tokens
that attempt to join with the traditional `token` join method.
* Fix failing test due to BotInternal cert parameter
TestRegisterBotInstance wasn't updated to include the BotInternal
flag on initial identity, so this includes it.
* Actually include Scope in bot audit events
* Mutate correct token status in `patchToken`
The mutate result was discarded because the wrong status object was
passed to `mutateScopedToken`.
* Use ScopedAuthorizer in join/Server.authenticate()
`authenticate()` currently rejects scoped identities which prevented
clients from reauthenticating with an existing identity, which is
important for bot renewal and bound keypair joining.
* Pass `BoundHostID` through properly in `GetBoundKeypairStatus()`
* Add basic TestJoinBoundKeypair_ScopedToken test
* Fix lint
* Update join server comments, add note about feature flag edge case
* Target correct provision token for standard token mutations
* Return correct mutated token in patchToken()
* Hide bound keypair registration secrets when `WithSecrets` is unset
* Avoid possible nil pointer dereference
* Address proto comment suggestion from review
* Deduplicate bound keypair mutator validation logic
Validation logic has been pulled out into a `validate()` interface
function and unified for both token types; scoped token bound keypair
fields are converted to their equivalent ProvisionTokenV2 variant
using existing helper logic.
* Nil check in consumeRecoveryMutator.validate()
* Simplify lastRotatedAtMutator
This removes the confusing switch with fallthroughs in favor of 2
simple ifs and a helper function.
* Ensure bound keypair status is non-nil before mutating
* Note non-nil requirement for new lastRotatedAt value
* Update generated operator resources
* Also nil-check status for standard tokens
* Mirror secret censoring for bound keypair secrets in tctl
This mirrors the existing secret censoring in tctl. It doesn't
actually work since the conditional can never be true.
* Use StrongValidate() on BotScope in token StrongValidate()
`validateBotToken()` was incorrectly calling `scopes.WeakValidate()`
on the bot scope. This changes it to call `scopes.StrongValidate()`
instead.
* Mark scoped token bound keypair registration_secret field as sensitive
* Make lastRotatedAtMutator's `mutateScopedToken` nil-safe
* Tag mutator validation errors with a unique name of the mutator
Errors are tagged with the primary field that mutator modifies to
help identify the failing mutator without necessarily identifying
the specific failing check.
* Address code review feedback
* Wait for ScopedRoleAssignment to become available
SRAs don't always propagate immediately, so adds a
`require.EventuallyWithT()` check to ensure it exists before
continuing.
* Add test for scoped bot joining via kubernetes
* Fix formatting
We introduced this new option to implement RFD 160 but we forgot to add
it on a couple of resources. To rpevent this to happen again, the option
was inverted (legacy resoucres have to specify it).
The resourceSchemaConfig was also changed so its zero value does the
right thing by default.
This has no functional effect, CRDs are identical before and after the
change.
* add testing instructions
* Added additional troubleshooting for make image
* Enhance troubleshooting steps for local image build
Updated troubleshooting instructions for local image build in CONTRIBUTING.md.
* Add SAML IdP Service Provider support to k8s operator
changelog:
- Add SAML IdP Service Provider support to k8s operator
See integrations/operator/CONTRIBUTING.md for operator resource pattern.
* Fixed typo in comment and unnecessary log message change
* Added V1 to SAML IdP Servicce Provider k8s kind
Part 1 or removing InsecureDevMode - enterprise still relies on it
so a few TODOs were left around for clean up later. This global is
mostly leveraged in tests to permit trust when self-signed certificates
are used. These tests are often spinning up multiple teleport instances
and most of the time exercise trusted clusters which makes them slow.
Due to the global nature of InsecureDevMode these tests cannot be
run in parallel.
* Fix flaky operator update test
The synchronous update operator test was only comparing resource spec to
know if a resource got propagated into cache.
Some updates were not changing the spec (only bumping the revision),
this check did not wait for them properly. This allowed the test to
proceed while the cache was not up-to-date yet, causing the operator to
read stale data from the cache and face a conflict when calling the
update RPC.
This fix waits for the revision to change before allowing the test to
continue. With both the spec and revision change check, we are more
confident that the previous reconciliation change entered the cache.
* workaround revision-less resources
* Log in the operator test if something caused a conflict
Some resources seem edited by Teleport or something else in the
background. This break the operator tests and should not happen.
This commit adds more logging if this is detected.
* address feedback + fix a race in the standard test + fail if we see an unknown error
The upload steps are non-blocking, should they
fail the workflow status will not be affected.
This commit also changes the way the test logs are created,
now each Makefile accepts `TEST_LOG_DIR` as an optional parameter,
defaulting to `./test-logs`. This allows the top level Makefile
to propagate the location for the sub modules to write their
junit output, such that the CI jobs do not need to track
which top level make target corresponds to which directory.
Instead a simple glob is used to grab all the xml JUNIT files.
This approach also allows more targets to be added or removed in the future
without modifying the CI job definitons. Another benefit is allowing
the caller to modify the output destination should we want to bundle
the files as job artifacts in the future.
Makes `TEST_LOG_DIR` an order only dep for all targets.
* Support inference_model in k8s operator
* Support inference_policy in k8s operator
* Support inference_secret in k8s operator
* Add missing deletion tests to the k8s operator
The deletion drift tests didn't actually verify that the resource is
deleted; it tested a case where the resource is first deleted from the
Teleport cluster, and only then marked for deletion in Kubernetes.
Removing the entire the deletion method's logic didn't cause the
deletion drift tests to break.
* Don't change the e ref
Hugo Shaka