* Update diagrams in the docs
Closes#31324
We introduced a new Lucidchart library for adding diagrams to docs
pages. This change:
- Replaces all MermaidJS diagrams with ones that use the new library,
which enables us to phase out the `remark-mermaid` plugin.
- Replaces some other diagrams with the new library.
* Minor tweaks to diagram images
Responds to strongeron feedback
This commit fixes the S3 bucket creation for External Audit Storage when
the region is us-east-1.
It's currently broken because we unconditionally set a location
constraint on the bucket so that it will be in our desired region.
This fails when the region is us-east-1.
Because that's the default region for S3 buckets, and AWS has decided
that explicitly asking for the default is wrong.
Changelog: fixes resource bootstrap for External Audit Storage in us-east-1.
* RFD 0150 placeholder
* what/why and goals
* Bad explanation of the protocol, needs rewording
* Better protocol explanation including some changes
* all the security concerns i could come up with
* introduce the security section
* tweak
* future work
* Clarify direct dial mode
* proxy-terminated connection resumption
* warn against using the wire protocol in general
* Update rfd/0150-ssh-connection-resumption.md
Co-authored-by: Mike Jensen <[email protected]>
* Update protocol
* Update limits recommendation
* Complete phrase.
* confirm that locks work at a higher level already
* Diffie-Hellman for the resumption token xchg
* v0 -> v1 in description
* Update approvers
---------
Co-authored-by: Mike Jensen <[email protected]>
* Database Automatic User Provisioning support for self-hosted MongoDB
* Use user's customData instead of teleport-auto-user role
* cache admin connections
* add UT in db/mongodb
* add UT in db/autousers_test
* check version for showCustomData
* remove command comment to compat with older versions
* address comments round 1
* update new license
* ensure shared client is diabled during CI
* Add PromptMFA to tshd event service.
* Add custom MFA prompt using the tshd event service PromptMFA method.
* Generalize and reuse mfa prompt goroutine logic.
* Use important modal sempahore for MFA prompts.
* Update lib/client/api.go
Co-authored-by: Lisa Kim <[email protected]>
* Fix file name.
* Fix lint.
---------
Co-authored-by: Lisa Kim <[email protected]>
During some unrelated troubleshooting I noticed a number of cases
where we log an error that is guaranteed to be nil. Replace this
error with the session ID to make the logs more useful.
New labels have been added to Okta apps and user groups to allow the UI to
display the names and descriptions separately. Some tweaks were made to the
UI endpoints that extract these labels and use them for friendly names and
descriptions. Additionally, the unified resources have been updated to use
the friendly name where appropriate for apps and user groups.
While the api client already had support for the new upsert method
it was unimplemented server side and would always fallback to the
legacy UpsertOIDCConnector RPC. This implements the RPC handler
and updates the signature of UpsertOIDCConnector to return the
upserted connector in the same manner that Create and Update do.
* Add team and igs flag to web config
* Use isTeam and igs flag in TeleportContext
* Update ButtonLockedFeature
* Update IntegrationTiles
* Update Sessions
* Update Support
* Fix grammar
* Add clarifying comment on isUsageBasedBilling flag
* dronegen: enumerate linux tag build pipelines
Unroll the loops over architectures, fips and package type and just list
all the pipelines explicitly. This makes it a bit easier to understand
the combinations and to replace them with GitHub actions workflows.
Running `make dronegen` results in no changes to `.drone.yml`.
* dronegen: Convert some linux tag pipelines to GitHub Actions
Convert some of the linux-based tag build pipelines to run on GitHub
Actions. The following pipelines have been converted:
build-linux-amd64
build-linux-amd64-centos7
build-linux-amd64-centos7-fips
build-linux-386
build-linux-arm
build-linux-amd64-deb
build-linux-amd64-deb-fips
build-linux-amd64-centos7-rpm
build-linux-amd64-centos7-fips-rpm
build-linux-386-deb
build-linux-386-rpm
build-linux-arm-deb
build-linux-arm-rpm
The GHA workflows builds tarballs as well as deb/rpm packages in the one
workflow, so the `-deb` and `-rpm` pipelines will need to be manually
removed from `.drone.yml`. The amd64 centos7 and non-centos7 pipelines
have been combined as they were calling the same `make` target
duplicating work. The amd64 build is always done on centos7. As a
result, we do not name the pipeline with -centos7 any more, but we do
still specify it as the build.assets `Makefile` still has a centos7
target which is called, and we do still release an asset named with
"centos7".
Still remaining of the linux-based tag build pipelines are the arm64
pipelines which are already converted using a different workflow and the
non-native windows build.
* dronegen: Convert linux-arm64 pipeline to common pipeline
Convert the build-linux-arm64 and push-build-linux-arm64 pipelines to
use the common `release-linux` workflow instead of the arm64-specific
`release-linux-arm64` workflow. This aligns it with the other linux
build pipelines and allows us to get rid of the specific workflow.
The pipelines for building the arm64 rpm and deb packages have not been
generated by dronegen for some time now - since the arm64 build was
converted to GitHub Actions. The OS packages were still built as
dronegen does not remove pipelines, so the existing pipelines from
before the GHA migration remained in `.drone.yml` and continued to run.
These os packaging pipelines will be manually removed in a subsequent
commit.
* dronegen: Add pipeline for building legacy AMIs
Generate a pipeline for calling a GitHub Actions workflow to generate
the legacy AMIs. There were two existing manually added pipelines -
`build-oss-amis` and `build-ent-amis` - that are replaced by this.
The new pipeline needs to be manually added and the old ones manually
removed.
* dronegen: Replace oci build with GitHub Actions workflow
Replace the `teleport-container-images-branch-tag` workflow that builds
the legacy and operator OCI images with a call to the GitHub Actions
workflow that does the same on GitHub Actions.
This requires the manual addition of the `build-oci` pipeline and manual
removal of the `teleport-container-images-branch-tag` pipeline, followed
by running `make dronegen` to flesh out `build-oci` and sign .drone.yml.
* dronegen: Remove now-unused functions and vars
Remove the now-unused functions and vars after converting pipelines to
calling GitHub Actions instead of running stuff on Drone.
* drone: Update .drone.yml for GHA workflows
Update .drone.yml by running `make dronegen` to update the following
pipelines to call GitHub Actions to build instead of building on Drone:
build-linux-amd64
build-linux-amd64-fips
build-linux-386
build-linux-arm64
build-linux-arm
Add two new pipelines for building AMIs and OCIs on GHA:
build-legacy-amis
build-oci
Remove the following pipelines as the build of deb/rpm packages are done
within the above pipelines on GitHub Actions now and the ami/oci
pipelines have been replaced:
build-linux-amd64-deb
build-linux-amd64-fips-deb
build-linux-amd64-centos7-rpm
build-linux-amd64-centos7-fips-rpm
build-linux-386-deb
build-linux-386-rpm
build-linux-arm64-deb
build-linux-arm64-rpm
build-linux-arm-deb
build-linux-arm-rpm
build-oss-amis
build-ent-amis
teleport-container-images-branch-tag
Remove the following pipelines as AMD64 builds are always centos7 builds, but
we were just doing it twice. No need for these any more, as the GHA workflow
will build the release artifacts for these with the centos7 targets:
build-linux-amd64-centos7
build-linux-amd64-centos7-fips
The pipelines were added/removed using the following script, followed by
`make dronegen`:
AWK_SCRIPT='
/^---$/ { printf "%s", accumulator; accumulator = "" }
/^---$/ || accumulator { accumulator = accumulator $0 "\n" }
/^name: / {
drop = $2 == to_remove
if ($2 == before && to_add) {
printf "---\nname: %s\n", to_add
}
if (!drop) { printf "%s", accumulator }
accumulator = ""
next
}
!drop && !accumulator { print }
ENDFILE { printf "%s", accumulator }'
toremove=(
build-linux-amd64-{centos7,centos7-fips}
build-linux-amd64-{deb,fips-deb,centos7-rpm,centos7-fips-rpm}
build-linux-386-{deb,rpm}
build-linux-arm64-{deb,rpm}
build-linux-arm-{deb,rpm}
build-{oss,ent}-amis
teleport-container-images-branch-tag
)
add_before=build-buildboxes
toadd=(
build-legacy-amis
build-oci
)
for pipeline in "${toremove[@]}"; do
gawk -i inplace -v to_remove=$pipeline "$AWK_SCRIPT" .drone.yml
done
for pipeline in "${toadd[@]}"; do
gawk -i inplace -v to_add=$pipeline -v before=$add_before "$AWK_SCRIPT" .drone.yml
done
* Correctly clone RoleV6 when downgrading
Fix panic caused by improper clone of `RoleV6` when downgrading.
This PR forces a clone before downgrading it.
Fixes#35229
Signed-off-by: Tiago Silva <[email protected]>
* add test to ensure it was properly cloned
* clear comment
* make test fail without the fix
---------
Signed-off-by: Tiago Silva <[email protected]>
Co-authored-by: Nic Klaassen <[email protected]>
* Add product type to features and define feature limit helpers
* Add IGS check with access request monhtly verify
* Move limit getters to enterprise
* Simplify product type conversion
* Add clarifying comment
The syntax [unfortunately] differs when apps are defined in
teleport.yaml as compared to when they are defined as YAML
resources and applied with tctl.
While the api client already had support for the new upsert method
it was unimplemented server side and would always fallback to the
legacy UpsertSAMLConnector RPC. This implements the RPC handler
and updates the signature of UpsertSAMLConnector to return the
upserted connector in the same manner that Create and Update do.
* fix: sanitize error messages in EAS cluster alerts
External Audit Storage emits cluster alerts when elevated error rates
are observed, and includes a recently observed error message in the
alert, because cloud customers have no other access to logs that would
reveal these errors.
Cluster alerts do not allow control characters, so some of these alerts
were not being created during my manual testing. This commit sanitizes
and truncates the error messages before including them in the alert.
* remove all non-printing characters
Co-authored-by: Jakub Nyckowski <[email protected]>
* use explicit err in all test cases
---------
Co-authored-by: Jakub Nyckowski <[email protected]>
* fix: `tctl create` should not upsert EAS without -f
This commit adds a CreateDraftExternalAuditStorage RPC that will be used by
tctl when called without the -f flag, to avoid overwriting the current
draft without -f.
* update messaged
* remove draft prefix from message
Co-authored-by: rosstimothy <[email protected]>
---------
Co-authored-by: rosstimothy <[email protected]>
While the api client already had support for the new upsert method
it was unimplemented server side and would always fallback to the
legeacy UpsertGithubConnector RPC. This implements the RPC handler
and updates the signature of UpsertGithubConnector to return the
upserted connector in the same manner that Create and Update do.
* Make Opsgenie plugin update statussink on healthcheck
* Update integrations/access/opsgenie/client.go
Co-authored-by: Marco André Dinis <[email protected]>
* Simplify logger use in opsgenie client
---------
Co-authored-by: Marco André Dinis <[email protected]>
Improve handling of streaming events in response to non-chunked content-type from the Kubernetes API.
Previously, when dealing with streaming events, the code streamed the response into the target connection.
However, the Kubernetes API did not provide the content-type as chunked.
This lack of information caused the forwarder to be unaware that the connection was chunked.
Consequently, the forwarder delayed response writing by buffering it, intending to minimize the number of writes.
In scenarios where the connection stream was busy with events, users might not receive individual events as chunks,
leading to incomplete data. This could result in users receiving malformed JSON, triggering an abort of the process.
To address this issue, this commit introduces a modification. After each event, the response is now flushed to ensure
that users receive the event as a complete and well-formed chunk.
This adjustment improves the reliability and integrity of the data received by users during streaming events.
Fixes#34977
Signed-off-by: Tiago Silva <[email protected]>
* Rename existing component to LegacyTestConnection
* Set up new component with feature flag
* Copy server TestConnection to Connect My Computer
* ConnectionDiagnosticResult: Add prop for having step number and desc on same line
This will be needed in connection test for Connect My Computer to make
it consistent with the look of previous steps.
* Adjust TestConnection to Connect My Computer, add story
* Start test automatically if there's one login
* Remove unnecessary fragments
Fix the operator `Dockerfile.gha` to copy the correct paths from the
context for the build. These paths changed pretty much at the same time
as `Dockerfile.gha` was added - just an overlap in development - in
commit f31a90d4a4, which modified the
original `Dockerfile` on which `Dockerfile.gha` is based.
fheinecke