* Add skip inactivity and timeline time updates to the desktop session player
* rAF -> requestAnimationFrame
* Avoid redrawing the timeline/events whilst not playing
* kube: validate every ephemeral container added by a debug patch
* kube: marshal base pod in ephemeral container test
* kube: use ErrorAs for access-denied checks in ephemeral container test
* kube: make ephemeral container test table-driven
* reversetunnel: support tracker discovery ttl and disconnects
This adds agent side support for tracker ttl to be configured
per proxy over discovery requests.
This gives us flexibility of lowering the tracker ttl server side.
Lowering the ttl has the benefit of dropping proxies from the tracker
sooner allowing the agent to attempt to reconnect to proxies sooner.
This change also adds agent disconnects. This only occurs if a disconnect
threshold is configured in the cluster network config.
A proxy is only ever considered for disconnect if its in the desired
set and the agent has more connections than configured.
The agent will disconnect from proxies with the highest smoothed rtt.
The agent will not disconnect from proxies during a rollout where
the group/generation is changed or from unhealthy proxies which
are no longer tracked.
* fix lint
* stop agent in background and use testsync
* remove gogoproto and move to disconnect_threshold_seconds
* remove fake clock from tracker
* simplify conditions and nesting
* update comment about proxy disconnects
* generate terraform
* move now inside lock
* add else for smoothedRTT calculation
* rename disconnect to disconnectCandidate for clarity
* add comment for tryDisconnect usage
* rearange some checks in tryDisconnect
* fix test comment
* preserve cloud managed cnf fields on update/upsert
* docs: reflect linux vnet support
* some improvements
* Adjust `<details>` with first launch on macOS
The second <details> block with running tsh vnet on Linux renders correctly,
but this one didn't seem to render <summary> properly. That blank line
after <summary> seems to be the only difference, so let's see if it helps.
* drop Linux note, add macOS to header
---------
Co-authored-by: Maja Cieślak <[email protected]>
* Update Jamf docs with new conf fields and how to sync mobile devices
* Mention in Jamf docs how to update the plugin
* Mention iOS and iPadOS devices in Intune docs
* Mention that "Read Mobile Devices" is needed for mobile devices only
* Use subheadings rather than tabs
* Add an example serial number to docs/cspell.json
* Hide non-interactive sessions by default
* Add badge and decorator slots to list session recordings
* Update test assertion
* Flip the search params to the new hide non-interactive state
* Fixes for the non-interactive flip
* Remove duplicate BadgeComponent check
* Move plugin CheckAndSetDefaults from marshal to write path
CheckAndSetDefaults was being called inside MarshalPlugin as a side
effect of serialization, which caused defaults (e.g. Namespace) to be
applied to the in-memory object after roundtrip but not at construction
time. Move the call to CreatePlugin and updateAndSwap where mutations
belong, and call setStaticFields in NewPluginV1 so constructed objects
are consistent from the start.
Signed-off-by: Tiago Silva <[email protected]>
* add test coverage
---------
Signed-off-by: Tiago Silva <[email protected]>
* Refactor Azure VM discovery metadata and status
Move immutable Azure VM discovery metadata into a dedicated embedded
AzureInstancesMetadata type. This lets enrollment, status, audit, usage event,
and user-task paths pass metadata separately from the mutable Instances slice,
which is filtered during enrollment.
Change the resource status from a primitive map type into a struct. This
will make the status map more flexible for further changes that
introduce parallel installation and status updates.
This also logs the instance count after filtering enrolled instances.
* Update AzureInstances godoc
* Make metadata an unembedded field
* rename loop var from group to status
* revert failed azure enrollment func to lambda
* re-eval VMs log value iff some VMs were filtered
* Add a Configuring Teleport docs section
Make the how-to guides for managing Teleport resources with
Infrastructure as Code tools more prominent by placing them in a
Configuring Teleport section next to other foundational docs sections,
e.g., Installation and Upgrading. Frame the task of managing Teleport
with IaC as part of the broader task of configuring Teleport.
To do so, move the introduction of the "Static and Dynamic Resources"
page to a landing page for the new Configuration section. Move the
remaining part of that page to the References section, since it's an
advanced guide and more of a reference than a set of how-to
instructions.
This change also structures the Infrastructure as Code landing page into
a Configure Teleport landing page by including links to guides for
static as well as dynamic configuration. This adds clarity to the docs
since users won't immediately know that Teleport exposes these two
configuration variants.
* Update internal links
* Fix issues with the Configuring Teleport section
- Update the static/dynamic field table to use the correct field name,
`spec.mode`.
- Change "Managing Resources" to "Resource Guides" for clarity, since
all sections in Configuring Teleport would be about managing
resources.
- Reorder Configuration sidebar sections to move Resource Guides last
and tctl before Terraform and Kubernetes.
* feat: text output, geo, and `--skill` support
Layer three orthogonal additions on top of the core command:
- Text rendering: period header, matches summary, wrapped facet
panel, events table. `--all-facets` opts out of the top-5
truncation.
- Geo filter (`--latitude`/`--longitude`/`--radius`, all three
required together). Geo applies to events only; the stats endpoint
has no geo params, so facet counts and `total` cover the
window+query without geo. Text output prints a Note when geo is
active.
- `--skill` prints an embedded Markdown skill for LLM agents and
skips the backend entirely.
* fix: update skill to follow RFD 0037e
* fix: small fixes reported in PR review
* fix: small suggestion about code comment
* feat: iteration based on notion/customer request
* feat: add sanitization to text rendering
* fix: small fix to the access request review
* fix: typos and PR suggestions
* fix: help message indentation
We are standardizing docs guides to add a `page_type` frontmatter field,
with values for how-to guides, references, etc. We can then use this
field to apply linting rules that ensure each guide type follows
type-specific docs site conventions. The first convention is that each
docs page must have an outcome statement, the structure of which depends
on the guide's type. Human and AI agent readers can determine from the
outcome statement whether to continue reading the guide or not.
This change assigns the `page_type` frontmatter field to 47 guides.
Where an outcome statement is missing, it adds one. Where an outcome
statement exists, it ensures that the statement matches the standard
structure so we can add a linter later on.
Of the 47 guides:
- 28 guides already included the expected outcome statement, but needed
a page_type frontmatter field.
- 11 guides included an outcome statement but required tweaking so it
followed the expected structure.
- 8 guides had no outcome statement at all
In the Jenkins guide, also change "Architecture" to "How it works" to
accommodate the page structure linter (instead of disabling it). In the
current plan, this linter will also run the outcome statement check.
* checkpoints for docker getting started guide
* adding verification commands with expected output preceeding the troubleshooting checkpoints
* adding a few more checkpoint tips
* lint error with heading
* lint error with heading
* removing duplicate suggestion and reorganizing
* pulled in master to resolve conflicts as the directory structure changed since I started drafting these updates
* edited checkpoints, formatting, and moved k8 content
* cut down the number of items in the checkpoints, rephrased some sentences, fixed link paths as they were added before the pages was moved
* created a section forcommon troubleshooting items vs so many checkpoints
* changing container to variable
* adding back the sidebar label, and added '-t' (tty) flag to docker exec command to improve text output/alignment
* post-feedback: formatting, troubleshooting content revisions
* post-feedback: formatting, and slimming down troubleshooting content
* post-feedback: formatting, and slimming down troubleshooting content
* rephrasing intro paragraph, as most prod Teleport deployments in containers are running on k8s
* followed AI suggestions and implemented suggestions on removing previous k8 content and streamlining
* cleanup, restored backup guidance
* linter flagged for list spacing - added lines
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <[email protected]>
---------
Co-authored-by: Paul Gottschling <[email protected]>
* feat: add `tctl investigate` command
Add a tctl subcommand that searches Teleport's Identity Security
activity logs. The command exposes structured filter flags mirroring
the Identity Security UI: ~19 include/exclude pairs mapping to Lucene
fields (user, resource, IP, country, etc.). Multiple values on the
same flag are OR'd; different flags are AND'd.
`--query` accepts a raw Lucene expression for cases the structured
flags can't express (wildcards, regex, OR across fields) and is
mutually exclusive with the structured filters.
Facets and events are fetched in parallel via errgroup. `total` is
derived from the `event_type` facet on the stats endpoint, so it can
drift a few percent from `len(data)` on long windows.
This PR ships JSON/YAML output only. Text rendering, the geo filter,
and the `--skill` flag land in the next PR in the stack.
* fix: address codex suggestions
* fix: update flag description
* Update x/crypto to v0.53.0.
Signed-off-by: Chris Thach <[email protected]>
* Bump e. Add missing test cleanup from prev revert.
Signed-off-by: Chris Thach <[email protected]>
---------
Signed-off-by: Chris Thach <[email protected]>
* docs: add prereqs to selinux guide
* reduced verbiage, streamlined bullets, and split the agent requirement
* minor sentence edits. also removed dupe info, we already have the first header with the rhel requirements
* Update docs/pages/zero-trust-access/management/security/selinux.mdx
Co-authored-by: Noah Stride <[email protected]>
---------
Co-authored-by: Noah Stride <[email protected]>
* Run the connection upgrade test with reversetunnelv2
* Use unwrapped connections to the auth in multiplex listener mode
* Clarify wording in debug log
* Add a test for ALPN used in direct and proxy mode
* Update godocs
* Change struct names for better clarity
* hack on migrating list RPC
* Fix tests
* Tidy up/fix tests
* Use `clientutils.CollectWithFallback`
* Use clearer c.APIClient rather than rely on embeding
* Cover ListTunnelConnections in cache test
* tweak logging
* update deprecation version
* Move fallback impls
* fix span ctx prop
* fix pagination bug when unmarshal bad
* USe t.Context()
* fix ctx propagation
* Update tunn conns to use range pattern - thanks luke
* fix unneeded dependency
* fix deprecation
* env: dev
use opaque API
* Add property-based testing for thumbnails/metadata generation
* Convert the resize test to a normal table test
* Increase the timeouts
* Reduce dimensions to avoid CI from dying
* Factor teleport-proxy-lib library chart out of teleport-cluster helm chart
* Remove 'FQDN' suffix from variable name and clean up comments
* Restored $proxy in config templates to minimize differences in review.
* Restored unnecessary changes to ingress template
* Fix unnecessary change in predeploy job
* used deep copy for .Values
* Explain renter-time _validation in comment
* Set domain for proxy config test
* Fixed snapshot and test differences
* Cleaned up comments
* Replace mistakenly removed asserts
* Added forceHAReplicas tests
* Fixed edge case of replicas=0, preserving previous behavior
* Eliminated intermediate version/majorVersion templates and used util lib templates directly
* Update examples/chart/lib/teleport-proxy-lib/templates/_ingress.tpl
Co-authored-by: Hugo Shaka <[email protected]>
* Removed unneeded alias for teleport-proxy-lib
* Corrected teleport-cluster schema bugs and removed teleport-proxy-lib validation not also done by schema
---------
Co-authored-by: Hugo Shaka <[email protected]>
* docs: distinguish host user creation from host sudoers in SSH guides
* clarified conflicting language, added missing comma to yaml as it was causing syntax errors when testing, and clarified examples
* post-feedback: clarifications and corrections
* added note about insecure-drop users
Rename encodeSessionRecordingThumbnail and its result type
sessionRecordingThumbnailResponse to the exported
EncodeSessionRecordingThumbnail and SessionRecordingThumbnailResponse so
the enterprise session search web handler can reuse the proto-to-JSON
thumbnail conversion instead of duplicating it.
Signed-off-by: Tiago Silva <[email protected]>
Ryan Clark