* Added proxy-only helm chart
* dleted unused text fixtures
* Deleted empty snapshots
* unused helmignore
* deleted debugging
* Switch empty join_params from values file to set to avoid lint-helm make target bug
* Put static join tokens in secert
* Remove PSP support
* Added token secret to validation hook
* fixed hook name in test
* Made example use more realistic kube+oidc token
* Set correct hook weight for secret
* Better validation of token secerts
* Fixed cluster ref in readme example
* Fixed typo in Account
* Preserve all join params
* Make tmp secret for install only
* Fixed wrong context for volumes calls
* Don't support creating token secret for upgrades
* Added optional audience to projected SA token
* Deleted unneeded snapshot
* Fixed merged proxy values for join token secret
* Ensures hook secret is created for proxy override
* Wrote docs
* Allowed empty value for proxyProtocol
* Fixed doc spelling errors
* Wrote index page for teleport-proxy chart
* Ensure bound keypair values are only in secrets
* Fixed extra whitespace
* fixed auth-token path and related tests
* Removed token and bound_keypair support
* Fixed lint version after rebase to helm4 link fix
* Corrected overrides for serviceAccountToken* settings
* corrected doc links
* Documented validation intent
* Fix doc links
* Fixed tls-routing doc link
* Fix arch doc ref
* arch link fix again
* forgot to checking vales
* Fix vale findings
* Update examples/chart/teleport-proxy/values.yaml
Co-authored-by: Hugo Shaka <[email protected]>
* Fixed missing docs secions due to -- vs -
* Address code review comments
* Switched helm values to camelCase
* Removed legacy proxy key
* Remove legacy replica count munging
* Added Azure support to joinParams
* Fix unescaped doc chars
* Fixed doc heading and link
* fixed heading
* fixed vale checks
* code review fixes for values
* Added updated generated doc page
* Updated for helm unittest 1.0.3
* Fixed config version for scratch chart mode
* Remove unneeded license from proxy chart
* Clarified Anycast support in comment
* Clarified cluster name docs
* Noted limited purpose of chart
* Made various bits of docs admonitions
* Advised against using serviceAccountToken values
* Removed ACME support
* Fixed incorrect link
* fixed mdx/mxd doc extention conflation
* Fixed doc lint issues
* Removed serviceAccountToken custom fields
* Corrected docs on join token creation
* Corrected example token expiry in docs and unneded doc link in README
* Fixed spelling
* Fixed tctl create command
---------
Co-authored-by: Hugo Shaka <[email protected]>
* Add LogBackends module
* Add basic demonstration of simple log handler
* Dial in formatting of the ConsoleLogHandler
* Naively update loggers from OSLog to swift-log
* Update log statements to use structured metadata
* Update complex types to expose log metadata instead of debug descriptions
* Add comment explaining why we evaluate originTimestamp in ConsoleLogHandler's init
* Move Logger.Level formatting into its own file
* Update formatting in VerifyApp.swift
* Update timestamp formatting for ConsoleLogHandler
* Add TeleportKit package
* Add TeleportKit as a package dependency
* Update Package.swift to set swift settings all at once at the end
* Add new SystemClients module to TeleportKit
* Move the SerialNumberClient into SystemClients
* Collect device data inside of EnrollClient.swift
* Remove TeleportKit target
* Change the way e2e logs in for tests, enable unauthenticated tests
* Change the SSH clipboard test to use the browser selector instead of skipping
* Remove workaround in darktheme test
* Share login state for connect tests
* Keep the DisposableTempDir instead of the path
* MFA service stores and propagates the device ID used to satisfy a challenge.
Signed-off-by: Chris Thach <[email protected]>
* Wrap device ID with MFADevice.
Signed-off-by: Chris Thach <[email protected]>
---------
Signed-off-by: Chris Thach <[email protected]>
* support `where` RBAC on application session recordings
application session recordings are backed by AppSessionChunk events, but
those events were never wired into the session recording RBAC path, so
`where` clauses on `kind: session` rules could not match them.
Fixes https://github.com/gravitational/teleport/issues/67775
Signed-off-by: Tiago Silva <[email protected]>
* fix unit test
* handle feedback
---------
Signed-off-by: Tiago Silva <[email protected]>
* Add kube fixture
* Make items in unified resources more semantically accurate so they are easier to find
* Add shell utility that executes a command and waits for its completion
* Add kube tests
* Use unique pod name
* Use `tsh kubectl`
* Ignore kubeconfigs in git
* Set up kube cluster only for Connect
* Remove stale kind cluster before calling create
* Handle Docker networking
* Use stable image
* Fix race condition on launch
* Do not download `busybox` image, exec into kind's internal pod
* Disable tests to avoid hitting rate limiter
* Disable kube fixture for now
* Lint
* proto: add UsageApp to IssueScopedBotCertsRequest proto
* issuance: add UsageApp support to IssueScopedBotCerts
Implement the server-side handling for the UsageApp usage in
IssueScopedBotCerts. When a scoped bot requests app-routed certificates,
the service now:
- Validates the requested app scope against the caller's scope pin
- Resolves the app via RangeApplicationServersWithName, ensuring it
exists in the exact scope claimed
- Rejects Identity Center account apps (not routable, no scoped role
support for account assignments)
- Creates a scoped app session via CreateAppSessionFromReq
- Annotates the output certificate with app routing and session info
* issuance: ensure field error messages are consistent
* issuance: remove unnecessay TestIssueScopedBotCerts_UsageApp_ScopeHierarchy test cases
These tests were a left over when previous code was fetching and
validating exact scope matching.
Since that code was removed, I've removed the exact match cases and
moved the other 2 up to the TestIssueScopedBotCerts_UsageApp tests.
* linter: Fix imports
* tests: Use t.Context in internal t.Run calls
* issuance: Validate the PublicAddr is present in UsageApp
* tests: convert scoped IssueScopedBotCerts failure tests for UsageApp to table tests
* issuance: UsageApp validates the PublicAddr against ScopedAppPublicAddrValid
* test: add explicit test in IssueScopedBotCerts to check scope presence
Exercise `maybeDowngradeRoleVersionToV8` with property tests so the
guarantee holds for arbitrary roles, not just the handful of hand-written
roles the example test checks. The downgrade is a security control. A
pre-v19 agent cannot enforce a v9 role's `app_resources` restriction, so
the downgraded v8 copy must move the role's allow app selector to the
deny side and never leave one of its own apps reachable. The
allow-to-deny move branches on whether a deny selector already exists,
which is where a fail-open bug would go unnoticed.
Generate random allow and deny label selectors and candidate apps, then
assert three properties. Every app the role allowed before the downgrade
is denied after. Every app it already denied stays denied. The input role
comes back unmodified, because the caller passes the cache's shared role.
Add apps matching each selector, and the deny expression, to every
generated set, because random apps match a keyed selector in under a
tenth of draws and the assertion body is otherwise skipped. Draw globs as
selector values, since `services.MatchLabels` matches them as regular
expressions and a downgrade that dropped them would serve a copy denying
nothing.
Cover the AND-to-OR downgrade in a second property, which adds a label
expression on each side. An allow rule needs both `app_labels` and
`app_labels_expression` to match while a deny rule needs either, so
moving them across separately denies more apps than the role allowed. Add
an example test for that over-deny, where a wildcard label set moved to
the deny side blocks apps outside the allow rule.
Use `pgregory.net/rapid`, already a direct dependency of this branch.
* docs: address codex feedback for username trait in PingFederate role example
* codex feedback, updating version necessary for user.metadata.name
* Update docs/pages/zero-trust-access/sso/integrate-idp/ping-federate-oidc.mdx
Co-authored-by: Paul Gottschling <[email protected]>
---------
Co-authored-by: Paul Gottschling <[email protected]>
This PR adds audit queue observability to tctl. It allows you to view
the audit queue depth and also sort records based on number of events in
each queue.
In preparation for 19.0.0 this removes all references
to legacy or broken record keys. The background key
conversion will have already converted all legacy or broken
keys thus allowing the removal of the migration and the key types.
rosstimothy