Replaces `(AccessListMember) IsEqual` with a local goderived
implementation in local/services. All reconcilers
have been previously updated to specify their own comparison
function to prevent this change from breaking enterprise in
https://github.com/gravitational/teleport.e/pull/8233.
IsEqual was not updated to use the goderived implementation because
different use cases have different ideas about equality. A single
API to support them all is untenable and confusing. As a result the
callers are now responsible for adhering to their own equality
definitions. If in the future another use case arises that requires
full equality IsEqual may be reconsidered.
* Move `tests` to `tests/web`
* Enable building Connect
* Prepare Playwright test setup
* Add `browse` mode
* Replace `foo-` with `connect-e2e-test-`
* Merge if statements together
* `--browse-web` -> `--browse`
* Build Connect if requested path is `tests`
* Make imports more readable
* Attach logs to failed tests
* Link to docs about `use`
* Include "." in slashPath comparison
* Properly clean up app when `launchApp` throws before returning async disposer
Added a new env var `TELEPORT_FIRESTORE_TEST_DATABASE` used
to configure the database ID to use in the tests. This is useful
as when unspecified this defaults to `(default)` which may not
be in the ideal region.
* Add a `bot_instance` reference page
Add `BotInstance` to the resource reference generator config and
generate the page. Add a missing comment on the `UpdaterStatus`
declaration to fill in an otherwise empty section.
Make minor edits to protobuf message types to fit docs messaging
conventions.
* Add a custom intro to the bot_instance reference
Respond to **strideynet** feedback.
Indicate that the resource is read only.
Make it clear in generated CLI reference docs that they were generated
so authors do not attempt to edit them directly. Edit the template for
generated CLI docs to add a message.
Regenerate CLI references to include the message. This also updates the
references.
Note that the CLI reference doc generation is not yet fully idempotent,
so we cannot enforce generation.
To pass linting, edit the `teleport` CLI to use "Amazon Bedrock" (the
correct product name) in an error message instead of "AWS Bedrock".
Fixes#59649
Explain that the guide requires CRUDL permissions on
`access_monitoring_rule` resources. Also include some minor edits to the
section: make all bullets noun phrases so all items in the list have the
same grammatical structure. Fix an incorrect use of "setup" as a verb.
* Add a limiter.RateLimiter helper for peer addresses
* Add custom rate limit for CreateAuthenticateChallenge
* Remove endpoint-based rate limit for CreateAuthenticateChallenge
* Tweak existing rate limit test to use synctest
* Hide rate limit details from error response
* Make the limiter configurable for TestAdminActionMFA
* Use a regular require.Greater check instead of a static assertion
* Update lib/auth/grpcserver_test.go
Co-authored-by: Alan Parra <[email protected]>
* Treat a nil request as a ContextUser request
* Undo changes to make the limiter configurable
* fix TestCustomRateLimiting
---------
Co-authored-by: Alan Parra <[email protected]>
Fixes#60008
Explain that the Teleport ECS service shown in the guide runs a
distroless image that does not include a shell. Include the Teleport
Application Service in the base configuration, rather than the SSH
Service.
Fixes#64598
This commit fixes an issue with Instance identity "self-healing".
When starting up with additional enabled services which have no
corresponding role in the current Instance identity, the node attempts a
new cluster join request with the currently configured join token to get
an Instance identity with all required roles.
There's currently a bug if:
- the node is new enough to attempt joining via the new join service and
fall back to the legacy join service
- the Auth is old enough it doesn't support the new join service
- the token used for the rejoin includes all of the original instance
cert roles and the newly required roles
The bug exists because `state.IdentityID.HostUUID` is overloaded. When
originally joining, it is expected to be populated with a plain UUID.
When it is parsed from an existing certificate, it includes a suffix of
`.<clustername>`. So when the rejoin attempt passes in the current
`IdentityID` from the existing identity, it includes the clustername
suffix, and then when rejoining auth adds the suffix again, and you end
up with a double suffix.
This doesn't affect joining via the new join service because the node
doesn't explicitly pass its desired HostUUID at all, Auth extracts it
from the authenticated identity used for the rejoin request.
The fix is to call `state.IdentityID.HostID()` which strips the
clustername suffix. This will fix new 18.7.x+ nodes rejoining to older
18.2.10- auth servers.
Added test coverage for four cases:
1. rejoing with new join service with token including all required roles
2. rejoing with new join service with token including only the newly
required role
3. rejoing with legacy join service with token including all required roles
4. rejoing with legacy join service with token including only the newly
required role
The bug currently effects case 3, all others still work.
changelog: fixed a bug affecting nodes on v18.3.0+ rejoining with new system roles to clusters with Auth services on v18.2.10-
* Add Access Request permission troubleshooting note
Closes#48955
Add a note that Access Request plugin identities need permissions to
list and read the resources included in an Access Request. Include this
information in a standard Troubleshooting section at the end of each
Access Request plugin guide.
* Include example in Access Request troubleshooting
Show how to add the required API permissions for a resource mentioned in
the error message.
Closes#61573
Add a diagram showing how the components introduced in the How it Works
section relate to one another. Use the newly enabled MermaidJS plugin
for Docusaurus along with our allowed icon sets (which include a custom
Teleport icon). See gravitational/docs-website#552.
The modules are not yet consumed, and default to modules.GetModules(),
if not provided. Their existence is meant to bridge the transitional
period without breaking enterprise. Once this lands, enterprise will
be updated to both inject the modules to Auth and specify them via either
modules.SetModules or modulestest.SetTestModules. This will ensure
that enterprise does not break when Auth exclusively consumes the
dependency injected modules over the global modules. After the
enterprise update lands a follow up will convert Auth.
* Move from eslint to oxlint
* Run oxlint with the GitHub formatter in CI for PR annotations
* Bring back comments
* Add `--quiet` and report unused disable directives as errors
* Fix patterns for no-restricted-imports rules
* Configure no-unused-vars, remove unnecessary disables of it
The old version in ESLint was much more restrictive. The new config allows
things like dropping properties from an object with rest spread, see
web/packages/teleport/src/Roles/RoleEditor/StandardEditor/standardmodel.ts
for an example.
* Remove other unnecessary disable comments
* Remove duplicate `--quiet` flags
* Update link to jsx-no-useless-fragment docs
* Remove duplicate --quiet flag
* Prettier
* Move oxlint in package.json next to oxfmt
* Add the e2e eslint rules
* Scope e2e restricted imports to just the tests
* Split out the restricted imports for shared/ so they report correctly
* Also lint e2e directory
* Fix CI calling prettier instead of oxfmt
* Simplify pnpm format-check to use pnpm format with --check
---------
Co-authored-by: Rafał Cieślak <[email protected]>
* Refactor bound keypair join client interface
This refactors the bound keypair join client interface to reduce the
work needed for clients to manage local bound keypair state. Most
state management, aside from the initial load (from storage, static
keys, etc) is now handled internally by the join client.
The client state is now passed directly to the join client through its
params, after which the joining client no longer needs to perform any
join method-specific logic once joining completes.
This is part of adding support for bound keypair for standard agents
(#59617). Agents make several different calls to the joinclient for
different joining and rejoining scenarios. This would've required a
lot of duplicate code to manage the update/store calls, and not all
callsites lent well to additional post-join steps. This refactor
eliminates that entirely and simplifies the interface for all clients,
including `tbot`.
* Fix code review suggestions
* MWI: Add certificate expiry check leeway for app tunnel service
This adds some leeway to the application-tunnel service's certificate
expiration check.
For context, the app tunnel service does not follow Machine ID's
usual certificate renewal cycle and instead opts to renew
certificates just-in-time before completing a request if the
certificate has expired per the local clock.
Unfortunately, the local clock is not always accurate, and if the
certificate or underlying app session has already expired from the
server's perspective, client requests can still fail until the local
clock catches up and the certificate is refreshed.
To mitigate this, this change adds a `leeway` parameter to the
service, configurable via YAML, with a default value of 1m. This is
added to the current time when certificate validity is checked. This
means that, in the worst case, certificates will be refreshed to early
rather than too late.
See also: #64284
* Remove duration pointer and ignore leeway if greater than cert TTL
* Make tbot's leeway parameter global
This makes the leeway parameter global, and additionally uses it in
the main renewal loop (for the expired bot internal identity
detection) and in the database tunnel service.
Also adds some test coverage for app tunnel cert renewals.
* Tweak doc comment for clarity
* Remove unused code
* Ignore excessive leeway values in identity service
* Honor effective lifetime in leeway check
* Fix leeway var reference
* Update golden tests
* Codex reviewer appeasement
Factor in actual cert TTL in the leeway cap.
* Fix failing test
* Fix imports
`(UserV2) IsEqual` was added with a goderived implementation to
remove go-cmp comparisons outside test files. This was not as
straightforward as other resources due to a goderive not being able
to handle interfaces. Due to the Device oneof in LocalAuth goderive
would silently fail with a partially generated equality function for
users.
The TeleportEqual derive plugin was updated to ignore the devices
field. They are manually validated in `(UserV2) IsEqual` if all other
user fields match. `mfaDevicesEqual` manually validates device fields
and relies on goderived quality functions for each concrete device type.
* Add scope aware profiles after tsh login
Update tsh.go
fix some minor issues
Update client_store_test.go
fix rebase
Update client_store.go
Add scope changing feature
Update tsh.go
Update tsh.go
* Remove "none" descoping
Update tsh.go
clean up
* nil the scope pin when "" is in the profile instead of scope pin ""
rosstimothy