* Added proxy-only helm chart
* dleted unused text fixtures
* Deleted empty snapshots
* unused helmignore
* deleted debugging
* Switch empty join_params from values file to set to avoid lint-helm make target bug
* Put static join tokens in secert
* Remove PSP support
* Added token secret to validation hook
* fixed hook name in test
* Made example use more realistic kube+oidc token
* Set correct hook weight for secret
* Better validation of token secerts
* Fixed cluster ref in readme example
* Fixed typo in Account
* Preserve all join params
* Make tmp secret for install only
* Fixed wrong context for volumes calls
* Don't support creating token secret for upgrades
* Added optional audience to projected SA token
* Deleted unneeded snapshot
* Fixed merged proxy values for join token secret
* Ensures hook secret is created for proxy override
* Wrote docs
* Allowed empty value for proxyProtocol
* Fixed doc spelling errors
* Wrote index page for teleport-proxy chart
* Ensure bound keypair values are only in secrets
* Fixed extra whitespace
* fixed auth-token path and related tests
* Removed token and bound_keypair support
* Fixed lint version after rebase to helm4 link fix
* Corrected overrides for serviceAccountToken* settings
* corrected doc links
* Documented validation intent
* Fix doc links
* Fixed tls-routing doc link
* Fix arch doc ref
* arch link fix again
* forgot to checking vales
* Fix vale findings
* Update examples/chart/teleport-proxy/values.yaml
Co-authored-by: Hugo Shaka <[email protected]>
* Fixed missing docs secions due to -- vs -
* Address code review comments
* Switched helm values to camelCase
* Removed legacy proxy key
* Remove legacy replica count munging
* Added Azure support to joinParams
* Fix unescaped doc chars
* Fixed doc heading and link
* fixed heading
* fixed vale checks
* code review fixes for values
* Added updated generated doc page
* Updated for helm unittest 1.0.3
* Fixed config version for scratch chart mode
* Remove unneeded license from proxy chart
* Clarified Anycast support in comment
* Clarified cluster name docs
* Noted limited purpose of chart
* Made various bits of docs admonitions
* Advised against using serviceAccountToken values
* Removed ACME support
* Fixed incorrect link
* fixed mdx/mxd doc extention conflation
* Fixed doc lint issues
* Removed serviceAccountToken custom fields
* Corrected docs on join token creation
* Corrected example token expiry in docs and unneded doc link in README
* Fixed spelling
* Fixed tctl create command
---------
Co-authored-by: Hugo Shaka <[email protected]>
* Add LogBackends module
* Add basic demonstration of simple log handler
* Dial in formatting of the ConsoleLogHandler
* Naively update loggers from OSLog to swift-log
* Update log statements to use structured metadata
* Update complex types to expose log metadata instead of debug descriptions
* Add comment explaining why we evaluate originTimestamp in ConsoleLogHandler's init
* Move Logger.Level formatting into its own file
* Update formatting in VerifyApp.swift
* Update timestamp formatting for ConsoleLogHandler
* Add TeleportKit package
* Add TeleportKit as a package dependency
* Update Package.swift to set swift settings all at once at the end
* Add new SystemClients module to TeleportKit
* Move the SerialNumberClient into SystemClients
* Collect device data inside of EnrollClient.swift
* Remove TeleportKit target
* Change the way e2e logs in for tests, enable unauthenticated tests
* Change the SSH clipboard test to use the browser selector instead of skipping
* Remove workaround in darktheme test
* Share login state for connect tests
* Keep the DisposableTempDir instead of the path
* MFA service stores and propagates the device ID used to satisfy a challenge.
Signed-off-by: Chris Thach <[email protected]>
* Wrap device ID with MFADevice.
Signed-off-by: Chris Thach <[email protected]>
---------
Signed-off-by: Chris Thach <[email protected]>
* support `where` RBAC on application session recordings
application session recordings are backed by AppSessionChunk events, but
those events were never wired into the session recording RBAC path, so
`where` clauses on `kind: session` rules could not match them.
Fixes https://github.com/gravitational/teleport/issues/67775
Signed-off-by: Tiago Silva <[email protected]>
* fix unit test
* handle feedback
---------
Signed-off-by: Tiago Silva <[email protected]>
* Add kube fixture
* Make items in unified resources more semantically accurate so they are easier to find
* Add shell utility that executes a command and waits for its completion
* Add kube tests
* Use unique pod name
* Use `tsh kubectl`
* Ignore kubeconfigs in git
* Set up kube cluster only for Connect
* Remove stale kind cluster before calling create
* Handle Docker networking
* Use stable image
* Fix race condition on launch
* Do not download `busybox` image, exec into kind's internal pod
* Disable tests to avoid hitting rate limiter
* Disable kube fixture for now
* Lint
* proto: add UsageApp to IssueScopedBotCertsRequest proto
* issuance: add UsageApp support to IssueScopedBotCerts
Implement the server-side handling for the UsageApp usage in
IssueScopedBotCerts. When a scoped bot requests app-routed certificates,
the service now:
- Validates the requested app scope against the caller's scope pin
- Resolves the app via RangeApplicationServersWithName, ensuring it
exists in the exact scope claimed
- Rejects Identity Center account apps (not routable, no scoped role
support for account assignments)
- Creates a scoped app session via CreateAppSessionFromReq
- Annotates the output certificate with app routing and session info
* issuance: ensure field error messages are consistent
* issuance: remove unnecessay TestIssueScopedBotCerts_UsageApp_ScopeHierarchy test cases
These tests were a left over when previous code was fetching and
validating exact scope matching.
Since that code was removed, I've removed the exact match cases and
moved the other 2 up to the TestIssueScopedBotCerts_UsageApp tests.
* linter: Fix imports
* tests: Use t.Context in internal t.Run calls
* issuance: Validate the PublicAddr is present in UsageApp
* tests: convert scoped IssueScopedBotCerts failure tests for UsageApp to table tests
* issuance: UsageApp validates the PublicAddr against ScopedAppPublicAddrValid
* test: add explicit test in IssueScopedBotCerts to check scope presence
Exercise `maybeDowngradeRoleVersionToV8` with property tests so the
guarantee holds for arbitrary roles, not just the handful of hand-written
roles the example test checks. The downgrade is a security control. A
pre-v19 agent cannot enforce a v9 role's `app_resources` restriction, so
the downgraded v8 copy must move the role's allow app selector to the
deny side and never leave one of its own apps reachable. The
allow-to-deny move branches on whether a deny selector already exists,
which is where a fail-open bug would go unnoticed.
Generate random allow and deny label selectors and candidate apps, then
assert three properties. Every app the role allowed before the downgrade
is denied after. Every app it already denied stays denied. The input role
comes back unmodified, because the caller passes the cache's shared role.
Add apps matching each selector, and the deny expression, to every
generated set, because random apps match a keyed selector in under a
tenth of draws and the assertion body is otherwise skipped. Draw globs as
selector values, since `services.MatchLabels` matches them as regular
expressions and a downgrade that dropped them would serve a copy denying
nothing.
Cover the AND-to-OR downgrade in a second property, which adds a label
expression on each side. An allow rule needs both `app_labels` and
`app_labels_expression` to match while a deny rule needs either, so
moving them across separately denies more apps than the role allowed. Add
an example test for that over-deny, where a wildcard label set moved to
the deny side blocks apps outside the allow rule.
Use `pgregory.net/rapid`, already a direct dependency of this branch.
* docs: address codex feedback for username trait in PingFederate role example
* codex feedback, updating version necessary for user.metadata.name
* Update docs/pages/zero-trust-access/sso/integrate-idp/ping-federate-oidc.mdx
Co-authored-by: Paul Gottschling <[email protected]>
---------
Co-authored-by: Paul Gottschling <[email protected]>
This PR adds audit queue observability to tctl. It allows you to view
the audit queue depth and also sort records based on number of events in
each queue.
In preparation for 19.0.0 this removes all references
to legacy or broken record keys. The background key
conversion will have already converted all legacy or broken
keys thus allowing the removal of the migration and the key types.
* docs(upgrading/cloud-cluster): mention email notifications
Teleport Cloud has recently started supporting sending email
notifications to Teleport Cloud users running Teleport v17 and v18.
This adds a blurb about email notifications and link to adding new
business and security contacts.
* fix(docs/cloud-cluster-upgrade): use active voice
* Revert "fix(docs/cloud-cluster-upgrade): use active voice"
This reverts commit a85f2efcdd.
* Add audit events for approving & denying an `EnrollPairing`
* Add web changes
* Drop `device.enroll_pairing.approve` from `eventGroupTypes`
* "not approved" -> "denied"
* Update wording around `device.enroll_pairing.approve` emitted on failure
While working on the RPC handler implementation, I realized that
`TV011W` is not emitted on MFA failures. This commit updates the godoc
and the fixture accordingly.
* Update `deny` audit event wording around expiry
In a typical scenario there will be no one to observe expiry, so this
event won't be emitted on enroll pairing expiry. I'll update the RFD
accordingly soon. For now just putting this here since I have no other
outstanding OSS PRs.
* Remove no longer necessary TODO comment
"Retryability" will be implemented one level above the storage layer, in
the RPC handler, so the comment here is no longer necessary.
* Remove `error` field from `device.enroll_pairing.deny`
Now that it's only going to be used for an explicit user denial, there's
no need to carry the `error` field.
* Add tenant_id and client_id fields to Azure VM discovery tasks and update related handling
* Update lib/usertasks/descriptions/azure-vm-subscription-list-denied.md
Co-authored-by: alex hemard <[email protected]>
---------
Co-authored-by: alex hemard <[email protected]>
* types: Declare all app_resources fields in the proto
Declare the eight reserved AppResource fields (paths, methods, where,
allow_encoded, allow_code, allow_reason, deny_code_hint,
deny_reason_hint) and the AppResourcesExpressions role condition, and
regenerate the proto stubs, the role CRDs, the Terraform schema and
docs, and the derived equality functions. Declaring the fields before
the fine-grained matcher merges lets every client of this version name
them, so a client that round-trips a role written by a newer auth
preserves the fields instead of silently dropping them on write-back,
which would widen the rule.
Tighten IsAllowAllOnly to require every declared field besides
allow_all to be unset. Without this, a rule such as {allow_all: true,
methods: [GET]} written by a newer auth would pass the check once the
fields are named, and this version would treat a method-restricted
rule as unrestricted.
Add GetAppResourcesExpressions to the Role interface, and read it in
decideMinimalV9 so the app agent denies a request governed by a
predicate it cannot evaluate. A predicate restricts the rules it
accompanies, so a role that pairs allow_all with one is not
unrestricted, and a deny-side predicate blocks another role's
allow_all the same way a deny-side rule does. Auth already treats both
as restricting when it downgrades a role for a pre-v9 client, so
without this the agent and auth disagree about the same role.
Strip AppResourcesExpressions in the v9-to-v8 downgrade alongside
AppResources, and reject it at write, so a role can neither reach a
pre-v9 client with the restriction silently removed nor be stored
while this version cannot enforce it.
* docs: List the declared app_resources fields
Honour the docs review on the app-resources reference page. A run of
inline code-style field names inside a sentence is hard to scan, so the
eight rejected `app_resources` fields become a list, and
`app_resources_expressions` gets its own sentence rather than trailing
the same run.
* buf: Trim the reserved-deletion except comment
Drop the two sentences explaining why buf's ignore lists cannot scope the
except. The rule name and the removal condition are what a reader needs
here, and the scoping attempts are recorded on the pull request.
* types: Reword the app_resources_expressions and Methods docs
Honour the review on the proto field comments. Drop "desugared" from
`AppResourcesExpressions`, which needs the RFD to gloss, and state the
relation between the two forms directly instead. Open `Methods` with the
plural, matching `Paths` on the row above.
Regenerate the proto stubs, the role CRDs, the Terraform schema and docs.
* buf: Drop the reserved-deletion except
The `RESERVED_MESSAGE_NO_DELETE` except covered one deletion, the
`app_resources` reservations on `AppResource` and `RoleConditions`.
`make protos/breaking` compares against `origin/master`, so the except
is needed only while master still holds those reservations. Once master
declares the fields, nothing is deleted relative to the baseline and the
rule passes on its own.
Restore the rule for every proto in the repo, since `except` is
repo-wide and cannot be scoped to one file or one module.
* types: Declare all app_resources fields in the proto
Declare the eight reserved AppResource fields (paths, methods, where,
allow_encoded, allow_code, allow_reason, deny_code_hint,
deny_reason_hint) and the AppResourcesExpressions role condition, and
regenerate the proto stubs, the role CRDs, the Terraform schema and
docs, and the derived equality functions. Declaring the fields before
the fine-grained matcher merges lets every client of this version name
them, so a client that round-trips a role written by a newer auth
preserves the fields instead of silently dropping them on write-back,
which would widen the rule.
Tighten IsAllowAllOnly to require every declared field besides
allow_all to be unset. Without this, a rule such as {allow_all: true,
methods: [GET]} written by a newer auth would pass the check once the
fields are named, and this version would treat a method-restricted
rule as unrestricted.
Add GetAppResourcesExpressions to the Role interface, and read it in
decideMinimalV9 so the app agent denies a request governed by a
predicate it cannot evaluate. A predicate restricts the rules it
accompanies, so a role that pairs allow_all with one is not
unrestricted, and a deny-side predicate blocks another role's
allow_all the same way a deny-side rule does. Auth already treats both
as restricting when it downgrades a role for a pre-v9 client, so
without this the agent and auth disagree about the same role.
Strip AppResourcesExpressions in the v9-to-v8 downgrade alongside
AppResources, and reject it at write, so a role can neither reach a
pre-v9 client with the restriction silently removed nor be stored
while this version cannot enforce it.
* docs: List the declared app_resources fields
Honour the docs review on the app-resources reference page. A run of
inline code-style field names inside a sentence is hard to scan, so the
eight rejected `app_resources` fields become a list, and
`app_resources_expressions` gets its own sentence rather than trailing
the same run.
* buf: Trim the reserved-deletion except comment
Drop the two sentences explaining why buf's ignore lists cannot scope the
except. The rule name and the removal condition are what a reader needs
here, and the scoping attempts are recorded on the pull request.
* types: Reword the app_resources_expressions and Methods docs
Honour the review on the proto field comments. Drop "desugared" from
`AppResourcesExpressions`, which needs the RFD to gloss, and state the
relation between the two forms directly instead. Open `Methods` with the
plural, matching `Paths` on the row above.
Regenerate the proto stubs, the role CRDs, the Terraform schema and docs.
Caching has become an integral part in functionality provided
by teleport. Allowing users to disable the cache was never something
that was a recomended configuration - it was predominately used
as a stopgap to address an outage. However, over time the cache
has become more stable and the need to bypass it should never
arise.
Additionally, this toggle causes several architectural difficulties
that increase complexity and maintainability of teleport. By always
enforcing that the cache is on, we can eventually separate the gRPC,
backend, and caching layers - a frequent developer experience nightmare.
Moving to a world where the cache is always guaranteed to be present
and available we will be able to remove layers of abstraction and
increase performance.
We do still honor `teleport.cache.max_backoff`. While it was tempting
to remove all teleport.cache knobs, it seemed that still allowing users
to control the backoff interval could alleviate any caching related
issues that lead to or are contributing to an outage. This seemed rather
important to still offer now that the ability to disable caching no
longer exists.
https://github.com/gravitational/teleport/pull/69282 incorrectly moved the
columns for recusrive listings which resulted in the data being presented
incorrectly. Equivalent golden tests for non-recursive listings have been
added to catch and prevent future regressions.
Angel Dionisio