* Split the approver map away from FileTransferRequest
* Move or copy files in session/reexec/sftputils and session/reexec/reexecsftp
* Split up copied files and clean up the new session packages
* Use custom types for SFTP audit log events
* Clean up imports and run sftp in RunAndExit
* Finish renaming types and functions
* Streamline reexec in main and tests
* Add test with the legacy SFTP event implementation
* Add cache collection for beams
* Add protobuf definitions for `BeamService`
* Expose method for building bot user and role
* Add constants for beam labels
* Wire up the delegation sessions service
* Add `IterateBeams` method to `BeamReader` interface
* Add filters message to `ListBeamsRequest`
* Fix `BeamAliasLabel` doc comment
* Clarify that filters are ANDed together
* Fix constant godoc comment
* Add test coverage for `GetBeamByAlias`
* Fix import formatting
Move DNS requirement into the Prerequisites section and renumber the
steps accordingly. This is a more appropriate section, since there are
no example commands to follow and the precise steps depend on the
reader's DNS solution.
This change also removes a source of friction (for both human and agent
readers), since there is no longer a potentially surprising need to
create external resources for which the guide offers no instructions.
Using a local Docker container is a clearer alternative to creating DNS
records.
* Write CLI --help text to stdout instead of stderr
* Display only one level of subcommands in help text
* Prevent a hidden command from increasing indentation level
* Add entry to changelog explaining updates to --help output
* Add support for removing shared directories to Windows Desktop Service (TDPB only)
* Advertise support for shared directory removal
* Gracefully handle unknown device errors when removing RDPDR devices, but log a warning as this is probably caused by a bug.
* Add `DelegationSessionService` protobuf definition
* Implement `GenerateCerts` RPC
* Prevent restricted delegation sessions from inheriting administrative privileges
Previously, the `resources` list on a delegation session would restrict regular
access to resources that weren't explicitly included, but not administrative
actions.
Now, we explicitly deny all administrative (rule-authorized) actions for
delegation sessions unless you include a wildcard in `resources`.
* Only permit list/read/readnosecrets for allow-listed resource kinds
* Fix reused extension OID
* Add a small amount of tolerance for clock skew
* Make the "expires must be in the future" message clearer
* Fix linter errors
* Access to a windows desktop implies access to the desktop service
* Add `DelegationSessionID` to the decision package's `SSHIdentity` and `TLSIdentity`
* Wrap `ExtractConditionForIdentifier` for delegation sessions too
* Prevent calling `GenerateCerts` inside a delegation session
* No need for indirection with GenerateUserCerts method now
* Fix import ordering
* Stop delegation service from returning CA certificates
Per @strideynet's request, to avoid replicating existing bad patterns around
conflating the user and host CAs.
* Error messages should start with lowercase letters
* Add `RouteToKubernetes` wrapping message
* Replace expires parameter with TTL
* Remove unnesasary error check
* Fix `AgentScope` extension type assertion
* ensure all bpf events are processed before stopping, refactor tests a bit to make the stress test much more consistent
* prevent startSession/endSession blocking during shutdown
* make lost event tracking in tests work correctly between sub-tests
* Remove accidental extra wg.Wait call
* simplify LostEventTracker
* improved log message and switched to use a time.Timer
* fix not building without bpf tag
* drop events if the buffer is full
* Make Renovate use GitHub app token.
Signed-off-by: Chris Thach <[email protected]>
* Use test branch to test Go upgrade.
Signed-off-by: Chris Thach <[email protected]>
* Use repo name without owner.
Signed-off-by: Chris Thach <[email protected]>
* Try force override to test with test branch.
Signed-off-by: Chris Thach <[email protected]>
* Revert "Use test branch to test Go upgrade."
This reverts commit bc1de8ccae.
* Revert "Try force override to test with test branch."
This reverts commit 3b35992553.
* Add teleport-renovate[bot] to CLA allowlist.
Signed-off-by: Chris Thach <[email protected]>
---------
Signed-off-by: Chris Thach <[email protected]>
* fix role trust policy when `trust_role` is set
* fix `for` expressions that range over a null value, which is not
supported in terraform v1.5.7
* fix broken validation block condition to catch
`use_oidc_integration=false` when `trust_role` is not set
* fix nonsensitive(null) warning when `create=false`
* set nullable=false for match_aws_* variables
* add a precondition to enforce `use_oidc_integration=true` when using
`teleport_discovery_group_name="cloud-discovery-group"`, because cloud
cluster discovery services must use OIDC credentials
* describe the allowed values for var.aws_matchers.types
The CA rotation guide referenced `certificate_authority` as the resource
name for RBAC rules, but the correct resource kind is `cert_authority`.
Fixes#65575
Signed-off-by: Tiago Silva <[email protected]>
This commit removes the first checkpoint from this guide.
These checkpoints display troubleshooting tips when a user clicks "No it
didn't work." However, the first checkpoint title of "Confirm that the
Windows computer has restarted and the Teleport authentication package
is loaded" can't be done without knowing the troubleshooting tip that is
only displayed when the "No, it didn't work" is clicked. Given this, and
the fact that there is only one troubleshooting step, it seems better to
remove this checkpoint altogether and mention the check after restarting the computer, instead.
This commit is addressing
https://github.com/gravitational/teleport/issues/65135
* Update docker dependency to moby v1.29
* go mod tidy all
* Update go.mod
* Fix up linting issues
* Fix cosign test broken due to ssrf protections in patched go-containerregistry
Adds two proto files that together define the session summary search
feature.
proto/accessgraph/v1/session_search.proto — internal, Auth->Access Graph
Used exclusively by the Auth server. Defines SessionRecordingService
with two RPCs:
- SearchSessionSummaries: a bidirectional streaming RPC the Auth
server uses to paginate through session summaries stored in the
Access Graph. The Auth server sends search_params on the first
message, receives batches of SessionSummary results each
terminated by a PageComplete, and sends FetchMore to advance pages.
Each SessionSummary includes session_end_event — the raw audit
event the Auth server evaluates against the requesting user's RBAC
permissions before deciding whether to forward the result to client.
- StoreSessionSummary: used by the summarizer pipeline to persist
session summaries and their vector embeddings to the Access Graph.
api/proto/teleport/sessionsearch/v1/session_search.proto — public, Client->Auth
Used by Teleport clients (tsh, web UI handler, etc.). Defines
SessionSearchService.SearchSessionSummaries as a unary-request /
server-streaming RPC. The Auth server implements this service: it
receives the client's filter criteria, fans out to the Access Graph
via the internal bidi stream above (handling all pagination
internally), filters each result using session_end_event, and streams
only the permitted SessionSummary results back. Clients see a single
continuous stream with no pagination mechanics exposed to them.
Signed-off-by: Tiago Silva <[email protected]>
Adds cache support for all summarizer resources (InferenceModel,
InferenceSecret, InferencePolicy, and RetrievalModel) by implementing
event parsers, cache collections, and read-through methods.
Part of https://github.com/gravitational/teleport.e/pull/8046
Signed-off-by: Tiago Silva <[email protected]>
Introduces the RetrievalModel proto resource, which configures the
embeddings provider (OpenAI or Amazon Bedrock) and inference model used
for session search. Adds Create/Get/Update/Upsert/Delete RPCs to
SummarizerService.
Part of https://github.com/gravitational/teleport.e/pull/8046
Signed-off-by: Tiago Silva <[email protected]>
* app: Fix context leak in handleConnection
Move context creation from handleConnection to its caller
HandleConnection, which unconditionally defers cancel(nil). Pass ctx
and cancel as parameters to handleConnection and remove the cancel
calls that were previously scattered across the TCP, MCP, and HTTP
branches.
Six error return paths in handleConnection created a child context via
context.WithCancelCause but returned without calling cancel, leaving
the child registered in the parent's children map until server
shutdown. Under connection churn this caused monotonic memory growth.
* app: Add comments clarifying context ownership and handler paths
Clarify that HandleConnection owns the context and that
TrackingReadConn may call cancel first with io.EOF. Also clarify
that TCP and MCP handlers block until the session is done, while
the HTTP handler returns immediately after handing the conn to
http.Server.
Replace deprecated github.com/aws/aws-sdk-go-v2/feature/s3/manager
(Uploader/Downloader) with the new transfermanager package across all
call sites. The old manager types were superceded per
https://github.com/aws/aws-sdk-go-v2/discussions/3306.
Signed-off-by: Tiago Silva <[email protected]>
Edoardo Spadolini