Render `/webapi/scripts/installer/:name` responses with the text
template engine instead of the HTML template engine. The endpoint emits
shell script content, so HTML entity escaping can corrupt rendered values
containing characters such as `&`, `<`, or `>`.
Resolves https://github.com/gravitational/pressure-washing/issues/195.
AWS SSO sessions return assumed-role ARNs from GetCallerIdentity
(e.g. arn:aws:sts::ACCOUNT:assumed-role/AWSReservedSSO_Admin_.../session)
but the corresponding IAM role lives at a path that includes the SSO
home region:
arn:aws:iam::ACCOUNT:role/aws-reserved/sso.amazonaws.com/REGION/AWSReservedSSO_Admin_...
The region component is not present in the STS ARN and cannot be
inferred by string manipulation, so the previous convertAssumedRoleToIAMRole
approach produced an incorrect ARN for SSO credentials, causing EKS
access entry creation to fail.
Fix this by adding iam:GetRole to the AWSClientGetter interface and
calling it with the role name extracted from the assumed-role ARN.
IAM accepts just the role name (no path required) and returns the
full ARN including the correct path. convertAssumedRoleToIAMRole is
retained as a fallback for cases where iam:GetRole is unavailable.
Signed-off-by: Tiago Silva <[email protected]>
* Refactor duplicated CA override logic into lib/subca
* Make getClientCert resilient to trailing PEM whitespace
* Drop a.subCAEnabled from lib/auth/ca_override.go
During a graceful restart (SIGHUP), the shutdown context passed to
StartShutdown has a very long timeout (MaxCertDuration). This means
ExitContext does not close until that timeout elapses, while
GracefulExitContext closes immediately when graceful shutdown begins.
reconnectToAuthService was selecting on ExitContext().Done(), so the
retry loop kept firing (with growing backoff) even after graceful
shutdown started — because ExitContext stays open throughout. Meanwhile,
connectToAuthService uses GracefulExitContext internally and returns
"context canceled" on every attempt. The net effect: register.discovery
and discovery.init never exited, Supervisor.Wait blocked indefinitely,
and the pod was stuck for the full 5m terminationGracePeriodSeconds
before Kubernetes sent SIGKILL.
Switching the select to GracefulExitContext().Done() makes the retry
loop exit as soon as graceful shutdown is initiated, unblocking the
supervisor and allowing the pod to terminate cleanly.
Signed-off-by: Tiago Silva <[email protected]>
Fix a self-deadlock in `(*Server).startDynamicWatcherUpdater`. When the
watcher receives an `OpPut` event for an already-tracked `DiscoveryConfig`
whose `DiscoveryGroup` no longer matches the local server, the `OpPut`
handler acquires `dynamicDiscoveryConfigMu.RLock()` for the existence
check, never releases it on the fall-through path, then calls
`dynamicDiscoveryConfigMu.Lock()`. Go's `sync.RWMutex` does not allow a
same-goroutine upgrade from read to write, so `Lock()` blocks forever.
The dynamic-config watcher goroutine wedges and no further
`DiscoveryConfig` events are processed until the process is restarted.
Mirror the sibling `OpDelete` handler: take `RLock`, read, `RUnlock`,
then branch on the membership flag, then acquire the write lock. Also
drop a duplicate "part" in the adjacent comment.
Add `TestDiscoveryServer_dynamicMatcherGroupReassign`, which drives an
`OpPut` event for an already-tracked config with a non-matching group,
then sends an unrelated event and asserts forward progress. Without
the fix the test times out at 30s with the watcher goroutine blocked
on `Lock()`.
* Add vulnerability management page to docs
* Fix some typos and improve language
* clarify cadence for updates, fix stylistic issues
* add govulncheck to cspell
* Add Troubleshooting notes to Azure join guide
Fixes#61191
- Add table of required endpoints to the Prerequisites section
- Add a Troubleshooting section that illustrates error messages that
occur if Teleport services cannot reach the required endpoints
* Clarify the Azure join guide
- Split a long Prerequisites item (per mmcallister feedback).
- Add a URL to the table of required URLs.
In #65190, we inadvertently introduced two small issues, which this
change fixes:
- Remove a reference to a nonexistent role. This was a mistake due to a
find/replace operation.
- Add full permissions to the access-plugin-update role. The Jira Access
Request plugin needs to list and read `access_plugin_data`, not just
create it.
* Make `VnetContext` tests depend on action order rather than no of calls
* Explain the idea behind acknowledgement/dismissal being "sticky"
* Update Jest mock outside of `act`
This work is not production ready yet. While this work makes the
operator support running with a scoped token, this is not enough for a
public release.
Several failure modes must be addressed, including scoped name
conflicts, and operators fighting for ownership of a resource.
* Add a docs linter for unused partials and images
Check whether any images in the `docs/img` directory or partials in the
`docs/pages/includes` directory are unused within the docs. This
prevents situations such as the following:
- An author unknowingly removes the only inclusion of a partial with
important information, which should remain in the docs.
- An author introduces an image, thinking they might use it, but ends up
using a different image, unnecessarily increasing repo size.
- An author forgets to remove unused assets, causing cluster that adds
friction for other authors trying to navigate the `docs` directory.
Implementation details:
- Add a script to `build.assets` to list unused docs assets, including
images and partials.
- Add a step to the `Lint (Docs)` workflow that checks whether the list
is nonempty and, if so, exits with an error.
* Remove unused docs partials and images
* Refactor custom installer partials
The current approach injects a parameter into partial paths within
`custom-installer.mdx` in order to load one of several partials based on
the cloud provider and whether the installer is created statically or
dynamically.
However, if we use the automated approach in
`build.assets/unused-docs-assets.sh` to check for unused partials, it is
impossible to determine whether the partials we keep in
`docs/pages/includes` are included in the docs. This change refactors
the custom installer partials so we can use only static partial paths,
rather than dynamic ones.
* Apply suggestion from **hugoShaka**
Co-authored-by: Hugo Shaka <[email protected]>
---------
Co-authored-by: Hugo Shaka <[email protected]>
* Add a conceptual introduction to Beams
Expand the Agentic Identity Framework section of the docs with a
conceptual guide to the architectural principles behind Beams. The guide
is for prospective Teleport users who may be solving the same problems
as Beams independently with their own solution. This guide explains the
principles behind Beams by emphasizing that Teleport builds Beams on top
of its existing infrastructure identity foundations, and that the
overall approach is deeply integrated into Teleport's longstanding
approach to infrastructure security.
Implementation details:
- Create an Agentic Identity Framework section.
- Assume that we have moved to VNet for egress controls (e.g., #66074).
- Mention the possibility of scoped delegation based on the current
architecture of Beams.
- Link to the guide in the "security model" section of beams.mdx.
- Add a sidebar item for the new guide, but don't add it to the section
index page yet, as there is no natural place for it. Decouple this
change from a reorganization of the Agentic Identity Framework page.
* Clean up Beams guidance
Responds to **kurktchiev**
- Remove the mentions of "Firecracker", as this is an implementation
detail that is more likely to change than the use of a microVM.
- Add a link to the tbot introduction and VNet in the "Sandboxing"
section of the "Reference implementation" H2
- Indicate in the Beams guide that they are a reference implementation
of the Agentic Identity Framework
- Remove the specific TTL of a beam, which is an implementation detail.
Move the first mention of the TTL to where we explain how Teleport
uses it.
* Update spellcheck config
Add "sandboxing" and "indeterministic" and sort the list.
* Edit introductory Beams documentation
- Remove descriptions of functionality that is not yet available from
beams.mdx.
- Replace "indeterministic" with "non-deterministic".
- Remove the Beams discussion from the conceptual introduction. Link to
the Beams docs instead.
* Remove implementation language around Beams
Use softer language around Beams implementing the agentic identity
framework or a secure agentic environment.
* Remove redundant sentence
Respond to zmb3 feedback.
* Migrate from mfa v1 to v2.
Signed-off-by: Chris Thach <[email protected]>
* Set deprecated proto option and update migration comment.
Signed-off-by: Chris Thach <[email protected]>
* Reduce nolint directives.
Signed-off-by: Chris Thach <[email protected]>
* Tag Ryan for the Desktop TODO.
---------
Signed-off-by: Chris Thach <[email protected]>
rosstimothy