* Proxy now heartbeats with Kind Proxy
* tidy
* Remove warning message (since it should never show and is therefore pointless)
* Add TODO comment
* Spell things the Americani/z/ed way
* Fix flaky TestLeaseBucketing.
Signed-off-by: Chris Thach <[email protected]>
* Stagger expiry times so items land in different lease buckets.
Signed-off-by: Chris Thach <[email protected]>
* Revert changes to count and lease bucket to minimize diff.
Signed-off-by: Chris Thach <[email protected]>
---------
Signed-off-by: Chris Thach <[email protected]>
* Cherry-pick in-band MFA support changes for VNet that do no depend on x/crypto/ssh.
Signed-off-by: Chris Thach <[email protected]>
* Use cached client.
Signed-off-by: Chris Thach <[email protected]>
* Migrate to mfav2 after rebase.
Signed-off-by: Chris Thach <[email protected]>
---------
Signed-off-by: Chris Thach <[email protected]>
* feat: updated side panel to be expanded for beams
* chore: updating tests to make it more readable as par suggestion
* chore: updated to use userpreference state to validate expand state
* chore: removed dead code definining unused nav categories
* chore: refactor nav item ordering logic for better readability
* chore: udpated default sticky mode value instead of updating user pref
Relocates client.ParseLabelSpec to lib/utils/parse. This results in
a net 5MB reduction in the weight of lib/config. This may not
have a correlation in binary size since lib/client is heavily consumed
by other packages.
```bash
$ goda cut './lib/config:all' | rg '^github.com/gravitational/teleport/lib/client\b|^ID'
github.com/gravitational/teleport/lib/client InDegree=1 Cut.PackageCount=75 Cut.AllFiles.Size=5.3MB Cut.Go.Lines=129512
```
Replace the functions in the scopes package to infer if scoped features
are enabled with a concrete struct that is injected to consumers. This
permits tests to toggle scopes features without having to specify environment
variables.
As an empty challenge is never legal, this patch tightens the `devicetrust`
signer and verifier to explicitly reject them.
Changelog: Tightened signature handling in Device Trust
* Add test for session setup failure paths.
* Fix session cleanup in failure paths.
* Fix lint.
* Fix exec party not added to session.
* Use defered close.
* Drop enterprise test modules.
* Use InDelta to avoid InEpsilon hack.
* Add ui interaction event protos
* make grpc
* Add userEventService method
* Fix signature
* Fix username field
it would have been logging the hash of ""
It was observed in cloud that proxies will hang on deletion if they lose
connection to auth prior to being terminated. This will cause pods to
hang until the termination grace period is hit which can be quite long
in some cases. Testing this in cloud allowed disconnected proxies to
exit quickly when terminated.
Adds a new function, RangeKubernetesServersWithName, to the cache and
presence APIs that returns an iterator over Kubernetes servers
matching a given cluster name.
Replaces the full scan in IsMFARequiredRequest_KubernetesCluster, which
fetched all Kubernetes servers and filtered in-memory, with a range scan
over a secondary index keyed by cluster name.
* Fix `userpreferences.Update` panic on nil request
* Recover from panic in gRPC middleware, add logging for stream handlers
* Use `trace.Errorf` to log stack trace, skip logging the actual panic
* Make panic recovery interceptor the last interceptor
* Replace incorrect `require.Errorf` usage with `require.ErrorContains`
* Use grpc getters instead of direct field access
* Allow IAM Join by specific Organizational Units
* fix for account not found scenario
* move checks to write paths instead of checkandsetdefaults
* fix cache
This is purely mechanical change to inject the build type as a
depency instead of relying on modules.GetModules().BuildType().
In addition to contributing to https://github.com/gravitational/teleport/issues/62799
this also serves as a prerequisite to future work that will provide
a user supplied build type that is not based on the modules to
retrieve the correct image.
Prevent access requests in APPROVED, DENIED, or PROMOTED states from
being updated through SetAccessRequestState, including same-state
updates that could otherwise mutate resolution metadata.
* fix(aws-sync): fix data race and wrong fallback in EC2 fetcher
Fix two bugs in the Access Graph AWS sync EC2 fetcher:
1. Data race in fetchAWSEC2Instances: goroutines were appending directly
to the shared `hosts` slice instead of accumulating into a per-goroutine
`lHosts` local slice and flushing it through the mutex-protected
collectHosts helper. This caused a data race when multiple regions were
fetched concurrently.
2. Incorrect fallback in fetchInstanceProfiles: on a pagination error the
function was returning append(profiles, existing...), mixing partial
new results with the previous sync's data. The correct behaviour is to
return only the previous sync's profiles unchanged.
Add tests covering both cases with multiple regions, verifiable with -race.
Fixes https://github.com/gravitational/pressure-washing/issues/265
Fixes https://github.com/gravitational/pressure-washing/issues/186
Signed-off-by: Tiago Silva <[email protected]>
* Apply suggestions from code review
Co-authored-by: Zac Bergquist <[email protected]>
---------
Signed-off-by: Tiago Silva <[email protected]>
Co-authored-by: Zac Bergquist <[email protected]>
* Avoid falling back to system CA when cert cannot be read
* Add test
* Fix flaky test
* Ensure cert is trusted by verifier
* Add explicit comment for non-nil `ClientCAs`
* Convert DeleteProxy RPC from HTTP to gRPC
* Use `t.Context()`
* Add more greppable TODO
* Fix usage of deprecated rpc
* Upsert RPC
* Use wrapper message for UpsertResponse
* gofmt
* Simplify godoc
* Update response message
* Update method names on public api client
* fix tests
* Introduce UpsertProxyWithoutServer
* Edoardo comments
* separate
* Change to UpsertProxyServer RPC handler
Render `/webapi/scripts/installer/:name` responses with the text
template engine instead of the HTML template engine. The endpoint emits
shell script content, so HTML entity escaping can corrupt rendered values
containing characters such as `&`, `<`, or `>`.
Resolves https://github.com/gravitational/pressure-washing/issues/195.
AWS SSO sessions return assumed-role ARNs from GetCallerIdentity
(e.g. arn:aws:sts::ACCOUNT:assumed-role/AWSReservedSSO_Admin_.../session)
but the corresponding IAM role lives at a path that includes the SSO
home region:
arn:aws:iam::ACCOUNT:role/aws-reserved/sso.amazonaws.com/REGION/AWSReservedSSO_Admin_...
The region component is not present in the STS ARN and cannot be
inferred by string manipulation, so the previous convertAssumedRoleToIAMRole
approach produced an incorrect ARN for SSO credentials, causing EKS
access entry creation to fail.
Fix this by adding iam:GetRole to the AWSClientGetter interface and
calling it with the role name extracted from the assumed-role ARN.
IAM accepts just the role name (no path required) and returns the
full ARN including the correct path. convertAssumedRoleToIAMRole is
retained as a fallback for cases where iam:GetRole is unavailable.
Signed-off-by: Tiago Silva <[email protected]>
* Refactor duplicated CA override logic into lib/subca
* Make getClientCert resilient to trailing PEM whitespace
* Drop a.subCAEnabled from lib/auth/ca_override.go
STeve (Xin) Huang