* Add MaxKubernetesConnections to the AccessChecker interface
* Don't fetch the role list again in the Kube forwarder
* Move tracing span to acquireConnectionLock
* Add TODO for scoped identities
* Benchmark authz.Context.LockTargets
* Make LockTarget comparable
* Add a test against the addition of non-simple fields to LockTarget
* Clarify comment about gogoproto options
* Fix TestSSHAccessLockTargets tests
* Clarify the comparable assertion
* DSQL backend docs
* Add a minimum version note
* Warn against possible additional permissions
* Make the warning against more than two auths an admonition
* Avoid the wrath of cspell
* Change to kinesis_stream_name
* Add link to AWS config file docs
* Add retag filter for protoc-gen-go
* Delete .pb.go and make grpc
find . -not -path './e/*' -name '*.pb.go' -delete && make grpc
* make gen-resource-docs
* Add comment listing the current consumers of open or hybrid api
* Fix CRUD expiry behavior in dynamodbbk
* Fix AtomicWrite expiry behavior in dynamodbbk
* DynamoDB relies on server-side TTL expiry so it can't use a fake clock
* fixup! Fix CRUD expiry behavior in dynamodbbk
* Allow Delete to delete expired items
* Remove some unnecessary whitespace
* Take the time before the backend call in Get and Delete
* Shrink the interface needed by GetMembersFor
* Avoid reentrancy in Cache.GetAccessListOwners
* Try deadlocking in TestGetAccessListOwners
* Use a struct for accessListMembersListerStore
Co-authored-by: Marek Smoliński <[email protected]>
---------
Co-authored-by: Marek Smoliński <[email protected]>
* Run the connection upgrade test with reversetunnelv2
* Use unwrapped connections to the auth in multiplex listener mode
* Clarify wording in debug log
* Add a test for ALPN used in direct and proxy mode
* Update godocs
* Change struct names for better clarity
* Bump gravitational/predicate to WIP commit
* Remove some allocations in predicate expressions
* Optimize contains(split()) in resource expression parser
* Do a type-safe assert on the result of astutil.Apply
* Keep the full value argument in the early exit of optimizeSplitContains
* Handle degenerate cases in splitContains
* Expand on the benchmark
* Rename LazyStringSlice to StringSlice
* Document StringSlice
* Fix test
* Fix handling of split on empty string
* Bump gravitational/predicate to 1.4.0
* Optimize multibyte delimiters too
* Update godoc for optimizeSplitContains
* Clarify the logic in splitContainsAffix
* Actually use multi-byte delimiters in BenchmarkSplitContains
* Revert "Actually use multi-byte delimiters in BenchmarkSplitContains"
This reverts commit 595bb85ba9.
* Revert "Optimize multibyte delimiters too"
This reverts commit f285928e99.
* Add some tests with overlap of target and delimiter
* Clarify the return value of the AST optimization visitors
* Add unit test just for the new string splitting
* Add some broken utf8 coverage too
* Split the approver map away from FileTransferRequest
* Move or copy files in session/reexec/sftputils and session/reexec/reexecsftp
* Split up copied files and clean up the new session packages
* Use custom types for SFTP audit log events
* Clean up imports and run sftp in RunAndExit
* Finish renaming types and functions
* Streamline reexec in main and tests
* Add test with the legacy SFTP event implementation
* Move the reexec parts of lib/srv to session/reexec
* Update references to the moved bits of lib/srv
* Avoid testutils in session/reexec
* Shuffle some constants around to avoid imports in session/reexec
* Vendor in the relevant parts of logutils in session/reexec
* Remove unnecessary symlink checks when opening files
* Inline the last two things from lib/utils in session/reexec
* Inline moved constants
* Deprecate group name consts and fix missed inlines
* Add missing session/reexec.TestMain with reexec check
* Reuse existing constants from the log constants package in session
* Fix broken godoc link
* Depguard rules for the session submodule
* Move lib/auditd to session/auditd
* Move lib/loginuid to session/loginuid
* Reduce dependencies of lib/utils/envutils
* Move lib/utils/envutils to session/envutils
* Split the SSH utilities of sshutils/x11 into sshutils/x11forward
* Move lib/sshutils/x11 to session/networking/x11
* Move lib/sshutils/networking to session/networking
* Move lib/shell to session/shell
* Move lib/utils/uds to session/uds
* Move lib/utils/host to session/host
* Move lib/pam to session/pam
* Avoid lib/utils/log in session/pam
* Move lib/service/servicecfg.PAMConfig to session/pam/pamcfg.PAMConfig
* Move lib/srv/uacc to session/uacc
* Avoid importing lib/utils in session/uacc
* Move lib/selinux to session/selinux
* Avoid lib/utils and lib/utils/log in session/selinux
* make go-mod-tidy-all
* Update oss-fuzz path for session/networking/x11
* Clean up message and layout of MFARequiredUnknownError
* Mark rate limits and connection problems as MFARequiredUnknown
* Debug log the ConnectToNode error that was ignored
* Add a limiter.RateLimiter helper for peer addresses
* Add custom rate limit for CreateAuthenticateChallenge
* Remove endpoint-based rate limit for CreateAuthenticateChallenge
* Tweak existing rate limit test to use synctest
* Hide rate limit details from error response
* Make the limiter configurable for TestAdminActionMFA
* Use a regular require.Greater check instead of a static assertion
* Update lib/auth/grpcserver_test.go
Co-authored-by: Alan Parra <[email protected]>
* Treat a nil request as a ContextUser request
* Undo changes to make the limiter configurable
* fix TestCustomRateLimiting
---------
Co-authored-by: Alan Parra <[email protected]>
* Forbid semver.New in forbidigo
* Fix type in require.Greater
* Fix missed semver.New in build.assets
* Restore whitespace in Test_formatAzureIdentities
* Re-fix TestAzure
* RFD 0244 - Teleport SSHd helper binary
* Call the helper teleport-session
* Link to the LWN article on memfd sealing
* Preliminary performance results
* Rename RFD file to session-helper
* Mention the instance size where the tests were ran
* Mention the resulting increase in size
* Update RFD to mention compressing the embedded helper
* Update 0244-session-helper.md
Co-authored-by: rosstimothy <[email protected]>
* Explicitly list the fcntl F_ADD_SEALS flags
* update cspell.json
---------
Co-authored-by: rosstimothy <[email protected]>
* Display early debug logging for autoupdate tools in tsh
* Avoid reporting success on exec failure
* Use a shared lock in GetToolsConfig
* Return the selected tool from Updater.CheckLocal if available and ready
* Reexecute locally available client tools immediately
* Add a test for the fast reexec path
* fix expected, actual order in require
* Run the readiness logic synchronously
* Document special event handling in BroadcastEvent
* Make NewSupervisor fallible
* Move logging out of the processState state machine
* Add UnconditionalUpdateApplicationServer to PresenceInternal
* Support resetting subintervals in Multi
* Skip app_server heartbeats with no changes
* Don't rely on the order of Equal, OnlyTimestampsDifferent and Different
* Add helper function for kuberelay SNI
* Support the kube relay in tbot's kubernetes/v2
* Use the relay in tsh kube login
* Support connecting through a relay in the kube proxy
* Support the relay in kube forwarding in Connect
* Split clusters in generated kubeconfig files
* Fail on WebProxyAddr parsing error unless it is empty
* fix Test_maybeStartKubeLocalProxy
* add comment for old and new config in LocalProxyClustersFromDefaultConfig
* Add signaling for supported tunnel types to relay tunnel
* Enable relay tunnel client for kubernetes_service
* Add kube_server to the relay cache
* Add passive forwarder for kubernetes access through the relay
* Add wildcard SNI suffix to kube service SANs if a relay is configured
* Add SNI-dispatching grpc transport for the relay transport server
* Enable kubernetes forwarding in the relay service
* Advertise support for kube tunnels in the relay
* Add tests
* Avoid race conditions in getHostUsers
* Actually remove old implementation
* Copy pw_name once
Co-authored-by: Alan Parra <[email protected]>
---------
Co-authored-by: Alan Parra <[email protected]>
* Relay service architecture reference
* Finish unfinished sentence
* Reword docs for relay_server tbot option
Co-authored-by: Chris Thach <[email protected]>
* Reword relay service description
Co-authored-by: Chris Thach <[email protected]>
* Add tsh usage examples
* Link to config reference and clarify networking a bit more
* Wording
* Apply suggestions from code review
Co-authored-by: Chris Thach <[email protected]>
* Expand and move network protocol description
* remove author from TODO to appease cspell
* Update docs/pages/reference/architecture/relay.mdx
Co-authored-by: Chris Thach <[email protected]>
---------
Co-authored-by: Chris Thach <[email protected]>
Co-authored-by: Chris Thach <[email protected]>
* Chart yaml, values and helpers
* address comments
* autogenerated reference docs
* add missing extra labels and annotations for the service
* admonition formatting
* version and image helpers
* join secret name helper
* resources
* update reference
* add linting
* Add helm unittests
* Allow custom key for the trusted CA bundle secret
* Remove check for negative replicaCount value
* Clean up .lint/full.yaml and fill it in a bit more
* Fix selector labels indentation in PDB
* Redo tests avoiding snapshots
* Update exercise-configmap to render the whole chart for linting
* proto: relay tunnel messages
* make grpc
* Relay tunnel server and client
* Explain tls and yamux configs
* clarify logger adapter
* clarify reserved fields
* Clarify serverConn selection logic
* add a todo to handle the control stream messages more efficiently
* Support relay transport in the proxy client
* Support generating client options at login time
* Support storing, overriding and using the relay in tsh
* Set the default relay address based on a trait
* Display relay info from the profile in tsh status
* Add relay support to tbot ssh multiplexer
* use relay_server like proxy_server
* Make the trait name similar to other internal traits
* Simplify default status, add info in debug
* Only show relay address in status if set
* proto: relay tunnel grpc discovery service
* make grpc
* Tunnel discover server implementation
* Describe ALPN protocol name constant
* Fix double import
* Avoid false positive in unused linter
* explicit trace.Wrap in discover
* avoid unnecessary pointer conversions
* prioritize tunnel protocol in ALPN
* make the server credentials a separate struct
* avoid false positive in unused linter again
* proto: relay server heartbeat fields
* make grpc
* Update relay_service config section
* Fill in the Relay heartbeat
* Add relay info holder for the SSH server heartbeat
* add clarifying TODO
* proto: Relay group and IDs fields in ServerSpecV2
* make grpc
* Add Relay group and IDs to CompareServers
* make -C integrations/operator crd
* make -C integrations/terraform docs
* Add Relay system role
* Add relay_service skeleton
* Proto definitions for relay heartbeats in the inventory stream
* make grpc
* Relay heartbeats through the inventory
* Allow RoleRelay to not have audit log write permissions for now
* godoc for top level config structs
Edoardo Spadolini