* Add `ssh_config` option to control generation of SSH config by Identity Output
* Update lib/tbot/config/output_identity.go
Co-authored-by: Alan Parra <[email protected]>
---------
Co-authored-by: Alan Parra <[email protected]>
* fix: prevent deleting AWS OIDC integration used by EAS
The External Audit Storage feature for Teleport Cloud depends on an AWS
OIDC integration to exist in order to get credentials for the customer
AWS account.
It's currently possible for a customer to delete the AWS OIDC
integration referenced by the EAS configuration, leading to the EAS
integration breaking and the Auth service crashing the next time it's
started up.
This commit prevents deleting an AWS OIDC integration currently
referenced by and EAS integration, and prevents creating an EAS
integration referencing an unknown AWS OIDC integration.
* use PreDeleteCheck instead of calling EAS service
* reorder tests and add missing cleanup
* create integrations svc on the fly
* switch to AtomicWrite
* set revision of returned resources
* deprecate gRPC DeleteAllIntegrations and use more general cacheMode
* rebase with master
* only retrieve logs on a specific error
* fix cache test again and a linter issue
* only look for ephemeral container name when waiting for the container to start
* address feedback
* add support for other merge strategies
* handle case
* reorganize gomod
* address feedback
* fix missing patchtype
* propagate errors
* Update lib/kube/proxy/sess.go
Co-authored-by: Tiago Silva <[email protected]>
* add hint of exec process into session tracker
* address feedback
* optionally filter listed waiting conts server-side
* add TODO to test against tsh kubectl
* Revert "optionally filter listed waiting conts server-side"
This reverts commit 9a33868363e427f52bba8d95ead2bfc0d939e6e7.
* fix failing integration test, undo accidental dep update
---------
Co-authored-by: Tiago Silva <[email protected]>
* Remove goinstall make target
This target hasn't been updated in 7+ years and installs a version
of Teleport that won't actually run due to missing build tags.
* Use 'go run' to invoke addlicense
The go tool is smart enough not to download and build the tool if
the correct version is available, and this eliminates the need for
us to ask what the GOPATH is.
* Misc Makefile cleanup
Several new targets were added in the middle of sections that should
not have been broken up.
* Remove outdated comment
make all _does_ include webassets
* Remove old reference to GIT variable
* Add validation func to check access monitoring rules are valid
* Split validation and defaulting for access monitoring rules
* Add more checks to access monitoring rule validation
* Update sample access monitoring rule in tests
* Add resource kind to access monitoring rules in tests
* Add check to access rules validation for notification field
* Fix Formating
* Add clientside elements of TPM joining
* Update lib/auth/register.go
Co-authored-by: Alan Parra <[email protected]>
* Update api/client/joinservice.go
Co-authored-by: Alan Parra <[email protected]>
* Update lib/auth/register.go
Co-authored-by: Alan Parra <[email protected]>
* Tidy up RegisterUsingTPMMethod method
* Add default case
* Rename CheckAndSetDefaults to validate
* Add basic success test for JoinServiceClient_RegisterUsingTPMMethod
* Add final touches to client joinservice test
* Add license header to joinservice_test.go
* Add server-side elements of TPM joining
* Turn SAN extension code into helper func
* Add `ok` check to provision token casting
* Improve test name
* Update lib/auth/join_tpm.go
Co-authored-by: Alan Parra <[email protected]>
* Update lib/auth/join_tpm.go
Co-authored-by: Alan Parra <[email protected]>
* Unexported registerUsingTPMMethod
* Refactor enterprise error
* tidy up test
* Update lib/tpm/validate.go
Co-authored-by: Alan Parra <[email protected]>
* Update lib/auth/join_tpm.go
Co-authored-by: Alan Parra <[email protected]>
* Update lib/auth/join_tpm_test.go
Co-authored-by: Alan Parra <[email protected]>
* Fix StripSANExtensionOIDs and add test
* Improve joinserver.go, use simpler proto getter methods and use slog
* Tidy up join_tpm_test.go
* Tidy up joinserver_test
* Add join failure audit event
---------
Co-authored-by: Alan Parra <[email protected]>
* Add clientside elements of TPM joining
* Update lib/auth/register.go
Co-authored-by: Alan Parra <[email protected]>
* Update api/client/joinservice.go
Co-authored-by: Alan Parra <[email protected]>
* Update lib/auth/register.go
Co-authored-by: Alan Parra <[email protected]>
* Tidy up RegisterUsingTPMMethod method
* Add default case
* Rename CheckAndSetDefaults to validate
* Add basic success test for JoinServiceClient_RegisterUsingTPMMethod
* Add final touches to client joinservice test
* Add license header to joinservice_test.go
---------
Co-authored-by: Alan Parra <[email protected]>
* Move connection list popover mgmt to context
* Add defaultStepIndex to StepSlider
* Control default connections step through context
* Launch VNet when connecting to a TCP app
Lots of going on in this commit.
connectToApp used to take launchInBrowserIfWebApp. This is because
connectToApp was used by both the search bar and the unified resources
to handle connecting to an app.
In the unified resources, it set up a gateway since opening the app
in the browser was handled through clicking a link. In the search bar,
it launched the app in the browser since that's what we want to happen
when selecting a web app through the search bar.
Now connectToApp always launches web apps in the browser and creating
app gateways has been moved to setUpAppGateway in the same file.
* Explain advanced lore behind apps in protobuf comments
* Fix VNet addr for leaf apps
* Emit audit event on instance/bot join failure
* Add audit log on failure to azure and iam join methods
* Tidy up a lil bit
* Add missing icon to EventTypeCell.tsx
* Regenerate snapshot
* Correct status code
* Add host_id and node_name to the join audit log
* Remove "unknown" default values
Fix the `DEVELOPER_ID_INSTALLER` environment variable for the old
`promote` and `build` environments for signing darwin packages. It was
accidentally set to the APPLICATION ID which made `productsign` break
when signing mac packages. The new `build-prod` and `build-stage`
environments are unaffected.
Exhibit-a: https://github.com/gravitational/teleport.e/actions/runs/8759563303/job/24044196635#step:11:42
* Don't watch web sessions with secrets by default; Deny users from watching web session secrets.
* Add backwards compatibility logic for old proxies
Fallback to web session permissions for users watching with secrets
Fix uncaught merge conflict
* CopyWithoutSecrets without proto.Clone to avoid gogoproto issue.
* Revert WebSession.CopyWithoutSecrets rename and instead add special case in fanoutv2.go since WebSessions can not implement ResourceWithSecrets without affecting upstream consumers negatively.
* Address slice iteration comment.
Extends a few windows targets to build and sign tctl now that we
officially support it on windows. Release builds do NOT use the
Makefile and instead use buid.assets/windows/build.ps1 so this
should have no impact outside of building a release locally.
* Require capitalizing "Access (List|Request)"
Closes#38767
Standardize the docs on capitalizing features and major components of
Teleport. Edit the vale rule for capitalizing service names to include
features as well, and require capitalizing "access list" and "access
request".
Also sort the list of tokens in the vale rule.
* Add "access graph" to the capitalization linter
Responds to ryanclark feedback
* Bump vite to 5.0.13
* Force use of esbuild ^0.20.2
[email protected] (and 2.1.0 too) depends on esbuild ^0.19.8. vite 5.0.13
depends on esbuild ^0.20.1.
esbuild 0.20.0 contains only a single breaking change and it affects only
Deno users, so we should be safe with forcing ^0.20.0 to avoid incorrectly
hoisted deps. https://github.com/evanw/esbuild/blob/70893e4d89bab1dbf2d512593f9e4d5bcb1f76bf/CHANGELOG.md#0200
Otherwise yarn.lock would contain two versions of all packages under
the `@esbuild` scope and might incorrectly hoist them.
* Dedupe postcss
Przemko Robakowski