This work is not production ready yet. While this work makes the
operator support running with a scoped token, this is not enough for a
public release.
Several failure modes must be addressed, including scoped name
conflicts, and operators fighting for ownership of a resource.
* Add a docs linter for unused partials and images
Check whether any images in the `docs/img` directory or partials in the
`docs/pages/includes` directory are unused within the docs. This
prevents situations such as the following:
- An author unknowingly removes the only inclusion of a partial with
important information, which should remain in the docs.
- An author introduces an image, thinking they might use it, but ends up
using a different image, unnecessarily increasing repo size.
- An author forgets to remove unused assets, causing cluster that adds
friction for other authors trying to navigate the `docs` directory.
Implementation details:
- Add a script to `build.assets` to list unused docs assets, including
images and partials.
- Add a step to the `Lint (Docs)` workflow that checks whether the list
is nonempty and, if so, exits with an error.
* Remove unused docs partials and images
* Refactor custom installer partials
The current approach injects a parameter into partial paths within
`custom-installer.mdx` in order to load one of several partials based on
the cloud provider and whether the installer is created statically or
dynamically.
However, if we use the automated approach in
`build.assets/unused-docs-assets.sh` to check for unused partials, it is
impossible to determine whether the partials we keep in
`docs/pages/includes` are included in the docs. This change refactors
the custom installer partials so we can use only static partial paths,
rather than dynamic ones.
* Apply suggestion from **hugoShaka**
Co-authored-by: Hugo Shaka <[email protected]>
---------
Co-authored-by: Hugo Shaka <[email protected]>
* Add a conceptual introduction to Beams
Expand the Agentic Identity Framework section of the docs with a
conceptual guide to the architectural principles behind Beams. The guide
is for prospective Teleport users who may be solving the same problems
as Beams independently with their own solution. This guide explains the
principles behind Beams by emphasizing that Teleport builds Beams on top
of its existing infrastructure identity foundations, and that the
overall approach is deeply integrated into Teleport's longstanding
approach to infrastructure security.
Implementation details:
- Create an Agentic Identity Framework section.
- Assume that we have moved to VNet for egress controls (e.g., #66074).
- Mention the possibility of scoped delegation based on the current
architecture of Beams.
- Link to the guide in the "security model" section of beams.mdx.
- Add a sidebar item for the new guide, but don't add it to the section
index page yet, as there is no natural place for it. Decouple this
change from a reorganization of the Agentic Identity Framework page.
* Clean up Beams guidance
Responds to **kurktchiev**
- Remove the mentions of "Firecracker", as this is an implementation
detail that is more likely to change than the use of a microVM.
- Add a link to the tbot introduction and VNet in the "Sandboxing"
section of the "Reference implementation" H2
- Indicate in the Beams guide that they are a reference implementation
of the Agentic Identity Framework
- Remove the specific TTL of a beam, which is an implementation detail.
Move the first mention of the TTL to where we explain how Teleport
uses it.
* Update spellcheck config
Add "sandboxing" and "indeterministic" and sort the list.
* Edit introductory Beams documentation
- Remove descriptions of functionality that is not yet available from
beams.mdx.
- Replace "indeterministic" with "non-deterministic".
- Remove the Beams discussion from the conceptual introduction. Link to
the Beams docs instead.
* Remove implementation language around Beams
Use softer language around Beams implementing the agentic identity
framework or a secure agentic environment.
* Remove redundant sentence
Respond to zmb3 feedback.
* Migrate from mfa v1 to v2.
Signed-off-by: Chris Thach <[email protected]>
* Set deprecated proto option and update migration comment.
Signed-off-by: Chris Thach <[email protected]>
* Reduce nolint directives.
Signed-off-by: Chris Thach <[email protected]>
* Tag Ryan for the Desktop TODO.
---------
Signed-off-by: Chris Thach <[email protected]>
Beams runs an app_service, configured to look for apps with
the "teleport.internal/beams/app-type" label.
Users should not be able to create apps with this label - we expect
these apps are only created via static beams config or via the
`tsh beams publish` command.
It's safe to block these requests at the RPC layer because beam
apps are written directly to storage and don't go through these
auth RPCs.
* Fix typo in T1014W (`headdless` -> `headless`)
* Use snapshot tests in gen-event-reference.test.ts
* audit-events.mdx: Update instructions on how to regenerate file
Fixes#66931
We use the `discovery-service-troubleshooting.mdx` partial in docs
guides for multiple cloud providers, but it has some AWS-specific
language. Use a parameter so it applies to other cloud providers.
Replaces the per-type clusterrole/secret handlers with a generic
in-memory store keyed by GVR and namespace/name. Registers
standard CRUD routes for serviceaccounts, configmaps, secrets,
services, roles, rolebindings, clusterroles, clusterrolebindings,
deployments, statefulsets, daemonsets, replicasets, jobs,
networkpolicies, and poddisruptionbudgets. Advertises the apps,
batch, networking.k8s.io, and policy API groups via discovery.
Updates handler errors metav1.StatusReason so client-go can
classify NotFound/AlreadyExists/BadRequest responses.
* kube: handle goaway test fixture conns concurrently
* kube: wait for goaway handler goroutines on close
* kube: drop late-arriving goaway conns after close
* Use `clipboardchange` when available for clipboard sync
* Fix check for clipboard change event
---------
Co-authored-by: Grzegorz Zdunek <[email protected]>
* Add secondary index for database server lookup by database name
Adds a new function, RangeDatabaseServersWithName, to the cache and
presence APIs that returns an iterator over database servers
matching a given database name.
Replaces the full scan in IsMFARequiredRequest_Database, which fetched
all database servers and filtered in-memory, with a range scan over a
secondary index keyed by database name.
Add generic server range test helpers so the same cache/fallback
behavior can be reused for other server resources that need
target-name range lookups.
* lint: fix imports
* use stream.Fail helper and fail quickly on validation error
* add comment for context
* add warning for wrong type
* split decoding into two stages and add error handling
* add defensive error handling for NextKey parsing
* add check to validate that the token database name matches the requested database name
* add comment explaining decision not to optimize further at this time
* fix: Account for private releases in appServerEffectiveFeatures
- Account for 18.7.4 and 18.7.5 private releases when calculating
appServerEffectiveFeatures in apiserver; previously not included as
versions advertising support prior to constraint parsing impl.
* fix: awsrole visibility uses appServerEffectiveFeatures result
* refac: Move effectiveFeatures helper to componentfeatures
AWS deprecated the CA that was used for Keyspaces and now recommends
using a cert bundle including four root CA certs and the deprecated CA
cert for backward compatibility.
This change also fixes the improper usage of filepath to parse URL paths.
* fix: Always populate AllowedResourceIDs on decoded Identity
- TLS and SSH cert decoders populated AllowedResourceAccessIDs but left
AllowedResourceIDs nil. Any path decoding an identity and re-encoding
via Subject() would result in the encoder injecting a sentinel value
into the legacy field, and storing all resources under the new
AllowedResourceAccessIDs field only.
This specifically broke database access in mixed-version clusters:
Proxy would decode user cert, build a CSR (Subject()), send it to Auth
for signing (FromSubject() then Subject() again). This dropped
AllowedResourceIDs, storing all under the new extension, so older
database agents received the cert with only the sentinel in the legacy
extension, and unaware of the new extension, denied access.
Fix by populating AllowedResourceIDs at decode time in both decoders
via UnwrapResourceAccessIDs, ensuring and unconstrained resources
persist across decode-re-encode cycles.
* refac: tidy ca_test encode/decode test
Fixes#66361.
Add more explicit language to the Usage and Billing page
to indicate that, since Teleport counts unique users by username and
treats SSO users the same as local ones for the purposes of billing, SSO
users who re-authenticate multiple times in the same billing period
count as a single users.
* Remove regression in GenerateCertificate that stomps on the certificate request's subject names.
* Add regression test
* Improve regression test.
* Add the Names -> ExtraNames copy back, but only in code path used for Windows Desktop certificates, and with a long explanation of the unexpected behaviors it may cause.
* Fix test
This adds a getting started guide with a a high level primer on
scopes, prequisites needed to test scopes today, and examples on how
to use the currently supported scoped features.
Ensures the backend table and events table use the same revision when
updating items during KeepAlive operations. Previously a revision was
generated for _both_ tables causing watchers and Get calls to observe
different revisions.
The backend test suite was updated to validate revisions in the event
stream match revisions in the backend.
Resolves https://github.com/gravitational/pressure-washing/issues/139.
* Adding guide to use PingFederate OIDC Auth Connector
* post-feedback from Gavin: changes to issuer URL information and OIDC phrasing
* post-feedback changes: administrative access clarification, OIDC client table render, and tctl sso test validation and placement
Prior to this patch `tctl` would create new AWS config files with filemode `0666`
globally readable). In most cases this is not a security issue as Teleport would
create the file's destinaton directory with `0700` (only readable by the owner).
This becomes an issue in the rare case where the destination directory already
exists AND has weak permissions; in this case the AWS config files may be read
by other users on the owner's machine.
This change bypasses the ini file library's `SaveTo` method and writes the file
with known permissions.
Converts non-pointer protobuf generated Go types to pointers
via `open2opaque rewrite -levels=red ./...`. This contributes to
https://github.com/gravitational/teleport/issues/66776 and was done
separately to isolate per proto file migrations in the future.
* lib/subca includes override CA in chain
* Calculate CA overrides on GenerateDatabaseCert
* Propagate CA override details to DatabaseSessionStart events
* Fix breakage on ./lib/srv/db
* Include only known CAs on CACerts
* Tweak getDatabaseCACerts error wrapping message
* Add godoc to dbAuth.WithSession
* Review: Deterministic PEM ordering
* Review: Fix session.caOverrideDetails assertion
* Review: Fix comment typo
* Review: Explain lack of TrustChain/CAOverride on generateDatabaseServerCert
* Remove unused func
* Fix build and tests after rebase
* Add CLI snippets to correspond to example configs
Remove varying levels of friction from how-to guides by including
example CLI commands that corresond with configuration examples. This is
part of an effort to standardize docs guides on including CLI examples
in how-to guide "Step..." headings.
Edit the auditd guide to include the configuration step before the
starting Teleport step, which makes more sequential sense.
In some guides, add `tctl create -f` commands to correspond to YAML
resource examples. This gives users a command to copy/paste, and
potentially helps AI agents by including the relevant CLI command so there
is no need to look it up.
For some guides, there is an example configuration but no command to
apply it. Add example commands to restart a Teleport instance with the
new configuration.
In the Identity Activity Center guide, correct the docs links included
in the Prerequisits section to accommodate the example commands for
restarting the self-hosted Access Graph service.
The Azure, GCP, Kubernetes, and OCI join guides include relevant
commands, but in separate sections from the example configurations. This
change brings the example configs closer to the example commands to
apply them by moving what used to be separate `## Step...` H2s into one
H2 with instructions in an ordered list.
* Improve command instructions in how-to guides
Address **mmcallister** feedback
- Move an admonition to the appropriate place in the auditd.mdx guide.
Connect it more explicitly to the instructions to start Teleport with
systemd.
- Replace a placeholder value with a `Var`.
- Use sentence case in a heading.
- Use correct syntax in a `Step` heading.
Steven Martin