This is currently failing due to `yarn` not being on the build image. I am disabling the UI part of the build until we can develop a long term solution.
* docs: Machine ID with ansible, use CanonicalDomain
* Mark as code block
* Add canonicalize to cspell
---------
Co-authored-by: Florian Perrot <[email protected]>
* Add initial servicenow plugin
* Add missing servicenow plugin checks
* Make omit empty fields in servicenow incident type
* Enforce https for servicenow requests
* Make servicenow plugin always pass clustername
* Add in missing returned errors in servicenow plugin
* Remove unused code form servicenow plugin
* Add missing godocs to servicenow types
* Use parseint over Sscanf in decodeplugindata
* Fix minor formating issues in servicenow bot
* Fix min version for servicenow plugin
* Rename servicenow to serviceNow
* Add more context to servicenow logs and send time as utc
* Fix misleading comment in servicenow plugin
* Add more context to servicenow plugin logging
* Refactor servicenow plugin to reduce indentation
* Refactor resolution tag check to use a switch case
* Change from sscanf anf sprintf for int formating and parsing
* Add missing close code logic to servicenow bot
* Add tests for servicenow plugin and mocked servicenow
* Refactor servicenow plugin to use slice.Contains
* Enforce https only for non localhost in servicenow plugin
* Add more context to servicenow close code comments
* Fix typo in error message and encode systemAnnotations in plugindata
* Match host for servicenow client as whole instead of via prefix
And fix capitalisation in some error messages.
* Merge denied and approved cases in servicenow on watcher event
* Lower excessive timeout in servicenow tests
* Swap to using apiurl.hostname of net.splithostport
* Fix access_request plugindata test, rename servicenow rota
* Move close code configuration to plugin instead of role
* Remove unused fields and fix minor linting issues
* Remove unused code to fix linting
* Remove unused assignment to fix linting
* Fix assignment error in servicenow tests
When backports are opened with `make backport`, the resulting
PR has very little information about the actual change. The
title and body just say "Backport XYZ".
Update the tool to open PRs with a title that is the same as the
original PR (with the correct version prefix). Also ensure that
the body of the original PR is preserved, along with a reference
to the original PR so it's easy to track that this was a backport.
This test uses a broken approach to try and allocate a local port
for the auth service. It starts a listener without specifying a port,
grabs the port that the OS allocates, and then closes the listener
and assumes that the port that was free at the time of this check will
remain free by the time the test needs to open a 2nd listener.
Instead, start the auth service first, allow the OS to allocate a free
port, and *use that port* in the SSH service's config. This ensures
that the port remains free since we keep the listener open the whole
time.
Fixes#19752
* Add JWKS baseed kubernetes toekn validator
* Add types for static_jwks kubernetes join type
* Add validation for new fields on Provisiontoken
* SPAG
* Add support into tbot for kubernetes join method
* Wire static_jwks implementation into auth.Server.checkKubernetesJoinRequest
* fix-imports
* Add JWKS tests for `kubernetestoken`
* Fix TestIDTokenValidator_Validate
* Ensure token is bound
* Fix mistakenely renamed comments
* Tidier return type
* Refactor tests for slicker UI
* Inject jwks token validator for test substitution
* Add test cases for static_jwks to lib/auth kube joining test
* Remove TODO
* Add more test cases to token validation
* Add enforcement of maximum TTL
* Regenerate operator crd
* Improve comments on proto
* Rerun ?? generation ?? of ?? operator ?? protos ??
* Remove outdated comment
* Add the What and Why
* Add explanation of alternative design
* Add example configuration
* Roughly outline process
* Add notes on short TTL and expand expalanation of audience
* Add note on auto discovery
* Rough proto spec for confgiuration
* Remove TODO: re more detail
* Tidy up security considerations section
* Add space for protos for rpcs
* Rename `kubernetes-jwks` to `kubernetes-remote`
* Add note on Kubernetes Ca compromise
* Add example protos for the flow
* Correct RPC name
* Make `jentfoo` a required reviewer
Co-authored-by: Mike Jensen <[email protected]>
* Explain dual service account layering
* Propose simplified RFD
* Rename incluster -> in_cluster
* Add example audit event
* Add clarification on TTL limit
---------
Co-authored-by: Mike Jensen <[email protected]>
When the Kubernetes cluster has no nodes, the metrics pod cannot run and
`metrics.k8s.io` API group isn't available.
It's safe to ignore this error and continue
Signed-off-by: Tiago Silva <[email protected]>
* return an error when attempting to join a session of an OpenSSH node
* remove item from test plan and note to docs
* add test coverage to integration test
* fix integration test
* fixed linter issue
* Update documentation for max duration feature in access requests
Documentation for the access request feature has been expanded to describe the 'max_duration' property in role requests. The change explains how to override the default behaviour (where a user can request access to a role until the session expires) by setting a 'max_duration'. Details include how to set this in the web UI or CLI, the need to define the setting in the role definition, and its interaction with the 'max_session_ttl'. The update provides necessary guidance for users requiring elevated access beyond their current session.
* Apply code review suggestions.
The Golang Docker images used in 'build.assets/Dockerfile-grpcbox' and 'examples/teleport-usage/Dockerfile' have been updated from version 1.20 to version 1.21.
* Remove internal access list object members field in spec.
The members field in the internal access list object has been removed. This
has been replaced by top level AccessListMember objects, which will scale
better on DynamoDB.
* Remove members from access list tests.
* Remove members from events test.
The transport used by app service was using a sync.Map keyed by
the resource id to store app servers. However, the id of a resource
is not guaranteed to be unique which could cause apps to be missed.
The sync.Map was removed in favor of a mutex and iterating over the
configured servers slice directly.
The version shown in the UI's Help & Support page is populated by
querying for all auth servers in the cluster and taking the first
one. It's possible that after an upgrade the old auth server hasn't
expired, so we may incorrectly report the old version for several
minutes.
Fix this by:
- using the version from the newest auth server
- using the embedded version for the proxy version
* Test vercel-deploy workflow
* Specify the Vercel environment
Co-authored-by: Ada <[email protected]>
* Tweak the Vercel workflow
- Include a more user-friendly URL in the preview message that points to
the version of the docs site that shows the user's changes.
- Add write permissions for PRs to the Vercel worfklow.
* Respond to zmb3 feedback
---------
Co-authored-by: dumez-k <[email protected]>
Co-authored-by: Kenneth DuMez <[email protected]>
Co-authored-by: Ada <[email protected]>
Since all supported versions of Teleport now support tracing we can
drop opening a specific channel to evaluate if tracing is supported
and just rely on the SSH server version.
* AWS OIDC - List SecurityGroups: add Inbound and Outbound Rules
This PR adds the SecurityGroups Inbound and Outbound Rules to the
Teleport representation of SecurityGroups.
This will allow the user configuring the SGs for DeployService and EICE
access to quickly understand what rules are available for each
SecurityGroup.
This way, they can pick the ones that match their security requirements.
* document -1 protocol and add description field
The user login state is being generated properly but not being used for
the various sessions. UserLoginState is now properly integrated into
sessions. Additionally, it was noticed that user login state was not being
used for Github logins, so it's been added there as well.
Additionally, getUserOrLoginState has been exposed for use by the
enterprise repo.
Co-authored-by: Lisa Kim <[email protected]>
* Increase timeout for waiting for label update
* Advance clock more often
* Make TestReconcileLabels a unit test
* Fix imports
* Fix test
* Increase require.Eventually wait time
* Mock control stream
fheinecke