* Simplify Azure matchers from dynamic configs
Dedup, normalize of Azure matchers for dynamic config.
* Stop mutating caller's regions in Azure matcher
SimplifyAzureMatchers now normalizes regions into a freshly allocated
slice rather than writing back through the caller's input slice, since
Deduplicate may return its input unchanged for short inputs.
* Reuse existing util for Azure region normalization
* Make test parallel
Co-authored-by: Marek Smoliński <[email protected]>
* Dedupe Azure regions after normalization
---------
Co-authored-by: Marek Smoliński <[email protected]>
Add a resource reference generator config for `db_service` and `db`, and
generate pages for those resources.
Configure an introduction for the `db_server` page so that all
database-related resource reference docs have introductions that point
to related pages.
Closes#66104
Replace language about installing a Teleport Agent with language about
installing Teleport binaries. This is more consistent with the purpose
of the partial (instructions for an installation script for Teleport
binaries) and allows us to use it in `tbot` guides.
Closes#62251
Edit the Jira plugin guide to note that the role given to the Access
Request plugin must be able to update Access Requests.
- Use the existing `rbac-update.mdx` plugin to explain how to create a
role that can update Access Requests and impersonate a user with that
role.
- Inline the Machine ID partial in Step 2 and edit the content to
include a custom role.
* initial draft refactor of Spanner db guide
* heading and formatting changes
* updated examples per variable linter warning
* post-feedback: intro for service account section, formatting
* fixing var entries for linter
* casing issue for linter
* codex issues - db service account description and typo
* changing grep statement to find token role for service act
* moved images to strapi, + some clarification changes
* moved cloudsql db images to strapi, removed images from github
* review edits for consistency and clarity
* cleaning up the troubleshooting section
* cleaning up the troubleshooting section
* restore troubleshooting include
* updating the query to find service account and role
* post-feedback from Gavin
Adds a separate PEM-encoded TLS certificate on KeyRing
(AccessGraphTLSCert) used to authenticate directly to the proxy's
Access Graph API. It reuses TLSPrivateKey and is persisted alongside
the other per-proxy artifacts at
<baseDir>/keys/<proxy>/<username>-access-graph.crt.
Included wiring:
- KeyRing helpers: AccessGraphTLSCertificate,
AccessGraphTLSCertValidBefore, and AccessGraphClientTLSConfig.
AccessGraphClientTLSConfig builds a tls.Config that trusts system
CAs rather than the cluster CA, since the client is speaking
directly to the public proxy.
- FSKeyStore: read, write, and delete of the new cert file. The
write and read go through a small helper that holds the same
write/read lock on the TLS key file used by writeTLSCredential,
so the AccessGraph cert cannot drift from TLSPrivateKey under a
concurrent key rotation. Load is optional, so keyrings without
the cert still work.
- MemKeyStore.GetKeyRing propagates AccessGraphTLSCert for parity
with the FS store.
- Store.GetKeyRing parse-validates the AccessGraph cert when
present, mirroring the existing TeleportTLSCertValidBefore call
for the main TLS cert. Expired certs round-trip unchanged, matching
the main TLSCert contract ("it's the responsibility of the
TeleportClient to perform cleanup").
Note:
- The identity file format was not updated to carry an AccessGraph
TLS cert, which would be a breaking change to a long-lived,
externalizable artifact. The tctl access graph workflow mints the
cert against the proxy on demand and persists it in the client
keystore, so identity-file portability isn't needed.
Tests:
- keypaths.AccessGraphTLSCertPath path formatter.
- FSKeyStore + MemKeyStore round trip of a distinct AccessGraph cert,
minted via a new signAccessGraphCert helper that mirrors the
production identity shape (Usage=UsageAccessGraphAPIOnly plus a
WebSessionID). Plus delete behaviour for present and absent cert
files on the FS store.
- Store.GetKeyRing: absent, valid, expired, and unparseable
AccessGraph cert paths. Expired round-trips; only unparseable is
rejected.
- KeyRing AccessGraph helpers: NotFound paths and tls.Config
construction (system-CA trust, ServerName=ProxyHost, MinVersion
TLS 1.2).
This is the client-side plumbing required by the tctl access graph
commands to obtain, persist, and reuse a proxy-facing TLS cert across
runs. Server-side session lifetime decoupling will follow in a
separate change.
* [scopes] feat: filter scoped roles by name
* fix typo in comment
Co-authored-by: Erik Tate <[email protected]>
---------
Co-authored-by: Erik Tate <[email protected]>
* sessionsearch[17]: Add tctl recordings TUI for browsing session summaries
Introduces a `tctl recordings search` subcommand backed by a Bubble Tea
TUI. The list pane shows sessions fetched via the SessionSearchService
(with pagination and filter flags), and the detail pane renders full
session metadata, resource properties, severity colouring, and summary popup.
Signed-off-by: Tiago Silva <[email protected]>
* handle review feedback
* add support for search mode
---------
Signed-off-by: Tiago Silva <[email protected]>
* [scopes] feat: tctl scoped assignments list
This commit adds a new command `tctl scoped assignments list` that lists
scoped role assignments and accepts the following params:
- `--user` filters assignments by the user they assign to
- `--role` filters assignments by assigned role
- `--format` prints text, json, or yaml
* fix typo in comment
Co-authored-by: williamong-tel <[email protected]>
* address comments from william
---------
Co-authored-by: williamong-tel <[email protected]>
This commit adds the EnterpriseFeatureWidget upsell component to the top of a few docs pages. It also adds a callout button for the Enterprise Cloud headings in the feature matrics docs page.
* reversetunnel: add opt-in proxy discovery compaction
This change adds a unstable envvar "TELEPORT_UNSTABLE_PROXY_COMPACT_DISCOVERY"
to opt-in to discovery compaction.
Discovery compaction sends only the subset of proxies that have been
updated since the last discovery request rather than the full list
of proxies on every discovery request.
To accomplish this a new discoPub struct is introduced which
wraps the generic proxy watcher. A discoSub struct replaces
the previous channel used for proxy discovery fanout.
This new approach also removes the risk of buffer overflow that
could occur with buffered channels.
The default behavior has two notable changes:
1. The initial discovery request is no longer blocked by the first
heartbeat.
2. Periodic resync are now returned from the last set of servers
received from the watcher rather than calling .CurrentResources()
* use synctest to fix pubsub test
its possible (and okay) for a subscriber to receive multiple
notify. using synctest.Wait() we can wait until the publisher
goroutine is blocked on the resourceC channel to guarentee it
is no longer sending events to subscribers.
* update sync interval
* skip empty updates on wait/get
* remove double import
* suggestions to improve readability
* enforce non-nil discoSub
* add logger
* defer locks
* add logging for failed proxy group generation parsing
also removes unused func
* refactor pb->dp
at some point I renamed the struct from proxyBroadcaster to discoPub
hence the lingering var naming in the receiver funcs
* replace rw mutext with atomic pointer
* lock free pub/sub
* rename disco pub/sub
* rename all other references to pub/sub
Adds Kubernetes operator support for the RetrievalModel singleton. The
controller implements Get/Create/Update/Delete backed by the summarizer
gRPC service. Because RetrievalModel is a singleton, Get and Delete
ignore the name parameter and always operate on the fixed Teleport
resource.
Introduces withSingletonName(name string) as a typed CRD schema option that
emits a CEL x-kubernetes-validations rule enforcing metadata.name == name at
admission time. This is wired up for TeleportRetrievalModelV1, which must be
a cluster singleton named "retrieval-model".
On Kubernetes < 1.25, x-kubernetes-validations is not a recognized field in
JSONSchemaProps and causes helm to fail with a validation error. The Helm
CRD template now checks .Capabilities.KubeVersion against >= 1.25.0 and
strips the field from every CRD version's openAPIV3Schema before rendering
when the cluster does not support it.
A Mutate hook enforces that the Kubernetes CR must be named
"retrieval-model" before any Teleport call is made, surfacing a clear
status condition on wrongly-named CRs.
Add Scoped role to terraform
Does not contain upsert rpc yet.
Add a wrapper over accessClient to reduce change blast radius
fix naming
test
deleted accidental commit
Add access client in terraform module
refactor terraform client - extract to client package
Add a terraform specific wrapper for access client
Update terraformclient.go
fix test
Update scoped_role.mdx
revert accidental change
Remove unneded constants
Update role_terraform.go
use new protoc generation
fix build
fix
fix test
fix build and tests
Update presets.go
Fixes#62957
Update the parenthetical note in the initial table to indicate that
Teleport supports only certain S3-compatible services.
In the body of the page, briefly explain the condition that compatible
services must meet before the Auth Service can support them by default,
and explain the environment variables to assign in order to return to
SDK's behavior prior to the new S3 data integrity protections.
Adds a `SearchMode` enum to session search protos, allowing clients to choose the search mode that best fits their keywords.
Some searches perform better with embeddings only, while others work better with strict keyword matching. This change lets clients opt into their preferred search method, while keeping hybrid search as the default.
Signed-off-by: Tiago Silva <[email protected]>
* feat: add VNetDNSName to DatabaseStatusV3 and implement hashing logic
* fix: fixed tests and linter errors
* refactor: to improve readability
* test: added unit test to test the auth server
* chore: updating based on PR feedback to set dns name during db server creation
* chore: minor test updates and refactor based on pr feedback
* Restrict validated MFA challenge replication to only remote proxy identities from the same source cluster.
Signed-off-by: Chris Thach <[email protected]>
* Catch empty source cluster. Provide more descriptive errors.
Signed-off-by: Chris Thach <[email protected]>
---------
Signed-off-by: Chris Thach <[email protected]>
Edit the `ssh_service` configuration reference partial and
troubleshooting guide for enrolling servers to address feedback that
came up after we merged #64632.
Teleport Auth server allows clients that do not present a certificate to access parts of its API. This deliberate bypass exists to support joining methods or password logins where a user or server does not have a certificate yet but has a secret that can be exchanged for a certificate.
In order to keep the system compatible and reduce the permutations required, Teleport assigned these unauthenticated connections a role called `Nop`. This role has no permissions and the only reason why it exists is so we can still build a context and checker.
This role was historically embedded in a structure called `BuiltinRole`. This struct implements the `Identity` interface and by its documentation is used by teleport services that belong to this particular cluster.
Some of the Auth server handlers are restricted to server identities and the check consists in something like:
```go
authCtx, err := s.authorizer.Authorize(ctx)
if err != nil {
return nil, trace.Wrap(err)
}
if b, ok := authCtx.Identity.(authz.BuiltinRole); !ok || !b.IsServer() {
return nil, trace.AccessDenied("only server identities can verify validated MFA challenges")
}
```
As seen above, part of the verification consists in type asserting the `authCtx.Identity` to confirm it belongs to a local server and then we check if the role belongs to an actual server.
In our codebase, we have a function called `IsLocalOrRemoteService` with the following body:
```go
// IsLocalOrRemoteService checks if the identity is either a local or remote service.
func IsLocalOrRemoteService(authContext Context) bool {
switch authContext.UnmappedIdentity.(type) {
case BuiltinRole, RemoteBuiltinRole:
return true
default:
return false
}
}
```
Given that unauthenticated users were wrapped in `BuiltinRole`, this function would return true for them. This caused the encrypted recordings service to authorize unauthenticated clients to access the upload handlers. This was the only access check applied, so the bug allowed any client to upload and replace files in the backend storage.
This change fixes that by enforcing proper RBAC checks in the encrypted recordings `CreateUpload`, `UploadPart` and `CompleteUpload` handlers. It also forbids `RemoteBuiltinRole` (remote/leaf cluster identity) from uploading files to root clusters.
This change also moves RoleNop out of the `SystemRole` type and into a new distinct type, `UnauthenticatedRole`, so the compiler prevents it from being used anywhere a real authenticated system role is expected. As a defence-in-depth measure, the middleware now rejects any TLS certificate that claims the Nop role in its Groups or SystemRoles fields.
This PR fixes a separate issue on top of the existing one where certificate rotation of encrypted sessions was available to unauthenticated users.
The protection introduced was `authCtx.AuthorizeAdminAction()`, which verifies if someone has completed the MFA challenge (if required). That was the intended idea, but given how Teleport handles unauthenticated users, they were marked with AdminActionAuthNotRequired, which bypassed MFA checks. Because of that, any client - authenticated or unauthenticated - with the ability to complete the MFA challenge (or if MFA was not required) could rotate the encryption keys for session recordings.
This doesn't significantly affect Teleport since the private keys are never exposed externally and previous keys always remain in the backend object, allowing old recordings to still be decrypted. The main concern is if the keys were rotated so many times that the backend item size exceeds the 400KB limit on DynamoDB. While this would cause the rotation to fail beforehand, it would also prevent any further rotations from succeeding.
This PR introduces proper RBAC for modifying types.KindRecordingEncryption and ensures that unauthenticated users are always assigned AdminActionAuthNotRequired.
Fixes https://github.com/gravitational/teleport-private/issues/2430
Fixes https://github.com/gravitational/teleport-private/issues/2429
Signed-off-by: Tiago Silva <[email protected]>
* app: Clean up orphaned app servers on startup
Delete stale app server heartbeat records on startup so that removed
apps disappear immediately instead of lingering until TTL expiry.
After a SIGHUP reload, the parent process exits with
deleteResources=false (it has a forked child), and the child only
heartbeats its own apps. Add a cleanup step that lists all app
server records for this host and deletes any that do not correspond
to a currently registered app. For agents with dynamic apps
(ResourceMatchers), wait for the first successful reconciliation
cycle before running cleanup so dynamic app records are not
mistakenly deleted. Skip integration-managed app servers (e.g. AWS
OIDC) that share the host UUID in all-in-one deployments.
* app: Improve cleanupOrphanedAppServers comments
Move the high-level explanation of why orphan cleanup exists
into the method godoc, and trim the inline comment to cover
only the timeout rationale.
* app: Address review feedback
Replace "15 minutes" with `[apidefaults.ServerAnnounceTTL]` in the cleanupOrphanedAppServers doc comment for accuracy (the TTL is 10 minutes, not 15). Drop the unused HostUUID field from suiteConfig.
* Add lib/subca.SupportedCATypes()
* Add the "tctl auth create-override-csr" command
* Rephrase comment on InitFunc
* Find min hash length before writing files
* Use slices.Clone
* Harden against unexpectedly small/uneven sized hashes
* Avoid using labels
* Output to stdout by default
