* Initial implementation of an HTTP Proxy implementation for TBot
* Added caching feature, caching config option & tests
* Rework httpClient; Rework insecureSkipVerify; Remove whitelist; Improved Error Handling;
* Move proxyPing to startProxy
* Remove old Application whitelist reference
* Review comments
* fix header issue, improve tests a bit
* Fix passing path; Improve testing
* add query passing; add tests for it
* Merge contexts of request
* Use service ctx as base context for http server
* Simplify creation of upstream request
* Add TODO around determing correct URL to use when connecting upstream
* Add TODO on checking ALPN upgrade
* Block CONNECT requests
* Add TODO around caching whole http client
* Add note on public address of app
* Fix upstream request host/scheme
* Tidy
* Fix logging to guidelines
* Add support for ALPN upgrade
* A little tidying
* Add GoDocs for the service config
* Setup fncache with correct interval
* Add GoDoc
* Remove redundant otel tracer
* Add tests for config
* Fix lint issues
* Update config golden file
* Fix test
* Add license headers
* proxy_service_config.go -> proxy_config.go
* Update lib/tbot/services/application/proxy_service_test.go
Co-authored-by: Dan Upton <[email protected]>
* Add note on h2c/http2
* Remove spurious line
* Add godocs
* Replace context.Background() with t.Context() in test
* Add GoDOc for ProxyServiceType
* Update ports in example to not clash with postgres
* Add CLI command
---------
Co-authored-by: Thijs Cramer <[email protected]>
Co-authored-by: Dan Upton <[email protected]>
* Add version and hostname indexes to cache
* Add `ListBotInstancesV2` rpc and use request options
* Add v2 bot instance list endpoint
* Use v2 endpoint in web UI
* Pass signal through to support aborting requests
* Fix comment typo
* Rename util func
* Deprecate `ListBotInstances` rpc
* Encode hostname in cache key
* Address pre-release sorting in version numbers
* Rename bot instance cache utils
* Fix lint deprecation warnings
* Extract filter fields to message
* Replace `fmt.Sprintf("%06d", ...)`
* Update invalid sort field error
* Fallback to v1 endpoint if possible
* Use `strcase` for case-insensitive compare
* Backend results are filtered by bot name so no need to re-filter in `MatchBotInstance`
* Revert "Replace `fmt.Sprintf("%06d", ...)`"
This reverts commit 2fbd79742a.
* MWI: Customizable Argo CD cluster name template
Resolves#58551, by reproducing `tsh`'s `--set-context-name` flag's behavior.
changelog: MWI: The `kubernetes/argocd` output now supports customizing cluster names with a template
* Fix linting issue
This commits deperecates GetTrustedClusters, which
should be replaced by a paginated counterpart:
ListTrustedClusters
Towards: gravitational/teleport.e/issues/6759
Changelog: Add paginated API ListTrustedClusters, deprecate GetTrustedClusters
* Add ScheduleEditor component
* Use !important to override select creatable styles
* Init ordered record of shifts
* Fix lint
* Use lowercase exports
* Avoid useTheme
* Use 12-hour labels
* Show border on hover and focus
* Add test case for custom time input
* Move to shared/components dir
* Fix lint
* Add a caching OIDC validator for use with Kubernetes OIDC
This adds a generic caching OIDC validator which is initially used
to cache Kubernetes OIDC requests. This takes a simpler approach to
the one explored in #57789 and explicitly caches the two resources
in question:
- We cache the OIDC discovery configuration for an hour
- We cache the JWKS keyset for 24 hours, and additionally allow the
library to cache internally. It currently has no internal method
for invalidating old keys, so we purge the `oidc.KeySet` regularly.
However, upon encountering an unknown `kid`, the library will
attempt to fetch new keys on its own.
This validator is designed to be generic and should be easy to
apply to other users of our existing OIDC helper.
* Manage validator instances by issuer; use in Kubernetes validator
This adds an indirection layer to automatically manage validator
instances as cached data is specific to a particular (issuer,
audience) combination.
Additionally, this swaps the new caching validator in in place of the
standard non-caching validator.
* Fix comments and add missing mutex lock
* Add tests for the caching validator
* Fix lints
* Add logging
* Fix imports
* Code review suggestions: atomic expiry, misc fixes
This changes `validatorExpires` to be an atomic int64, which removes
a locks from `Expires()` / `IsStale()` and ensures an ongoing pruning
won't block `ValidateToken()`.
* Replace validator cache and pruning with `utils.FnCache`
This swaps the hand-rolled cache for validators with utils.FnCache,
since it's more robust and its TTL mechanism works properly for our
needs.
* Remove commented out test code
* Fix build errors and enable ReloadOnErr
* Code review suggestions
* Add `teleport-tools` package to be used by client tools managed updates
* Add runtime check
* Update lib/autoupdate/tools/utils.go
Co-authored-by: Edoardo Spadolini <[email protected]>
* Use general `version.EnsureSemver` for semantic version parsing
---------
Co-authored-by: Edoardo Spadolini <[email protected]>
The main intent of refactoring is to provide health check extensibility for Kubernetes while supporting the existing DB health checks. A `HealthChecker` interface is added to support the different health check approaches of DBs and Kubernetes. Existing DB TCP health check logic is moved to a new `TargetDialer` struct.
Changes:
- Added `HealthChecker` interface with two functions:
- `CheckHealth(ctx context.Context) ([]string, error)`
- `GetProtocol() types.TargetHealthProtocol`
- Added `TargetDialer` struct which encapsulates existing TCP health check logic
- Changed `Target` struct to use the `HealthChecker` interface
- Changed `worker.checkHealth` to call the new `CheckHealth` function
- Removed a `protocol` field from `healthCheckConfig`
- Added `TargetHealthProtocolHTTP` for use with Kubernetes health checks
- Moved and renamed test `Test_dialEndpoints` to `TestTargetDialer_dialEndpoints`
- Added files `net.go` and `net_test.go` for `TargetDialer`
Part of #58413
Use the commit that corresponds to gravitational/shared-workflows#393,
which fixes a bug in the workflow that rejects a PR that changes a
section index page to a regular docs page.
Using Teleport for just-in-time Access Requests is a common use case.
Tag pages with this use case so users can find related pages when
looking for Access Request-related content.
* Pin tool versions using Go tool deps
Use versioned tools rather than installing @latest on every run.
This ensures consistency across developer machines and can also
help protect against supply chain attacks.
Updates usages of gci, goda, and gotestsum.
* make go-generate
Prepare the docs for the intro paragraph linter proposed by
gravitational/docs-website#383. This replaces the Vale-based intro
paragraph linter, which cannot be ignored in comments due to the `raw`
scope, with one based on `remark`, which can.
- Add an intro paragraph to each Terraform data source reference. To do
so, edit the data source template to use the approach of the resource
template, including an intro paragraph with the data source's name.
- Ignore the page-structure linter in the changelog. This needs to
happen before the frontmatter block, since, because of the way
`remark-includes` works, AST node line numbering is preserved within
included partials.
- Get the Device Trust Concepts guide to conform to the expected
structure. Currently, it begins with an Admonition, leaving it unclear
what the guide is about.
- Remove the Vale linter for intro paragraphs, since we will add a
`remark`-based linter in gravitational/docs-website#383.
* Fix usage of node server ID and proxy host UUID in the forwarding server.
* Make GetInfo and TargetMetadata consistent between the forwarding and regular server.
* Rename TargetMetadata to EventMetadata and only use it for events' ServerMetadata.
* Remove unused method.
* Resolves comments on test.
* Remove unused fields.
* Update lib/srv/ctx.go
Co-authored-by: Zac Bergquist <[email protected]>
* Update integration/integration_test.go
Co-authored-by: rosstimothy <[email protected]>
---------
Co-authored-by: Zac Bergquist <[email protected]>
Co-authored-by: rosstimothy <[email protected]>
* Fix stack overflow that occurs when the audit compactor encounters a shared directory read/write event of length zero, which commonly occurs when the client returns an IO error.
* Add some clarity to zero-length audit compaction test case
* In the case that we combine enough read/write events such that the length exceeds the maximum value of a uint32, emit an audit event where length is math.MaxUint32 rather than whatever a raw cast might give us.
* Apply suggestions from code review
Co-authored-by: Zac Bergquist <[email protected]>
---------
Co-authored-by: Zac Bergquist <[email protected]>
* proto: relay tunnel messages
* make grpc
* Relay tunnel server and client
* Explain tls and yamux configs
* clarify logger adapter
* clarify reserved fields
* Clarify serverConn selection logic
* add a todo to handle the control stream messages more efficiently
The SCIM integration lived at `/docs/zero-trust-access/management/guides/scim/` under zero trust access. But these docs are about Access Lists so should live under Identity Governance as an integration. This PR moves this section into identity governance at `/identity-governance/scim/`, fixes a few breaking links due to the change, and add the appropriate redirects.
* Move autoupdate version resolving logic in a separate package
* fixup! Move autoupdate version resolving logic in a separate package
* apply edoardo's feedback
Using Teleport as an IdP is a use case we want to promote. Tag pages
with this use case so users can find related pages when looking for
Teleport-as-IdP content.
Using Teleport to protect CI/CD pipelines is a common use case. Tag
pages with this use case so users can find related pages when looking
for CI/CD content.
Use the following command to find and delete partials that are not
included in any page in the docs:
```
find docs/pages/includes -name "*.mdx" -exec \
bash -c 'grep -Rq {} docs/pages || git rm {}' \;
```
The current list of guides is long and difficult to navigate. Instead,
include a description of the section, recommend reading the Managing
Resources guides for typical patterns, and indicate that there is one
guide per resource version.
Another possibility would be to make the list of reference docs easier
to navigate by formatting it as a table of resource names and
descriptions. However, we currently do not include descriptions of
resources when generating CRDs from resource proto messages.
* Update session summaries docs for Enterprise editions
Clarifies that Session Recording Summaries are currently available only to Teleport Enterprise (Self-Hosted) customers, with Cloud support coming soon. Updates prerequisites and feature notes to distinguish between Self-Hosted and Cloud editions, and adds information about early preview availability for Cloud customers. Also clarifies that the feature uses a Large Language Model.
* tpyo
* Clarify that this is feature is disabled by default
* s/AWS Bedrock/Amazon Bedrock
* Automatically append `@<project-id>.iam` suffix to
the username for GCP Postgres databases (CloudSQL, AlloyDB).
* Apply project ID suffix in the engine
* drop engine-side fix
* add web UI fix
* extract common helper
* sort imports
* feat: add initial config generation for vscode and claude code
* chore: fix lint
* refactor(tsh): move vscode and claude-code to a separate flag
* refactor(mcp): update format flag work to raise error on format mismatch
* refactor(mcp): revert run mcp changes
* refactor(mcp): code review suggestions
* fix(mcp): picking the incorrect config format
* chore(tsh): use raw config format string
* fix(config): match claude-code config file
* fix(tsh): solve format alias
* Refactor server session ID logic; Separate join and open session flows.
* Remove unused client node session ID.
* Fix backwards compatibility.
* Fix tests and lint.
* Update deprecation TODO.
* Fix failing test caused by delayed association with join session.
* fix session ID for git events
---------
Co-authored-by: STeve (Xin) Huang <[email protected]>
This PR adds a new param, `env` which will be used to inject environment
variables into the script.
This will be useful for injecting the TELEPORT_INSTALL_SUFFIX and
TELEPORT_UPDATE_GROUP used by `teleport-update` and, soon, `teleport
install autodiscover-node` command.
* Clarify self-hosted Enterprise starter guidance
Closes#8547
Make it more explicit in the self-hosted Teleport Enterprise index page
that self-hosted deployents start with outreach to the Teleport team,
and that the HA guide and multi-region blueprint are outlines to help a
team plan a deployment that a customer designs in conversation with the
Teleport team.
Otherwise, the implication is that the guides listed on the self-hosted
Teleport Enterprise index page are sufficient for deploying a
self-hosted cluster. There has been a longstanding request for Oracle
Cloud guidance, and rather than expect these users to be self
sufficient, explain that the recommended approach is to reach out to
Teleport and model a deployment based on our architectural outlines.
Some new text in the self-hosted Enterprise index page is based
on #57931.
* Edit the self-hosted Teleport Enterprise intro
Respond to internal feedback by **pschisa**. The multi-region blueprint
is recommended only for a select group of organizations with specific
needs. For the general introduction, link only to the single-region HA
guide.
* Edit self-hosted Event Handler guides
Closes#38184
Prevent users from using example Event Handler configurations without
modifying the placeholder values. Remove placeholder values from example
Event Handler configs and add them to the comments accompanying the
modified fields.
Exceptions are if the accompanying guide does not explain the
placeholder, e.g., `serviceType` and the `log` section. In these cases,
we expect users to copy the placeholders and use them as they are.
Skip purely hosted Event Handler guides, which don't include
instructions for configuring the Event Handler.
Note that in the MS Teams guide, the TOML example includes clear
placeholders to indicate format, and this change leaves these in.
Also note that some guides, like the PagerDuty guide, include an example
of the final config files after providing lists of instructions. This
change does not touch the example configs in this case.
* Respond to kopiczko feedback
- Fill in missing examples.
- Consistently place comments above configuration fields.
- Use Cloud domain in the email Helm example.
The Terraform starter guide, added in #44834, was meant to provide new
Teleport users with a comprehensive example of deploying agents,
configuring SSO, and managing RBAC. However, for a guide aimed at
educating a broad audience, it gets very little exposure on the docs
site. This change improves the visibility of the Terraform starter
guide.
- **Condense the two-part guide and its index page into a single
guide:** Currently, the index page for the two-part guide has little
substantial content and performs poorly in organic search. By
condensing all content of the guide into a single page, we can provide
a content-rich page that is more visible in search results.
- **Move the guide:** Make it the Getting Started page within the
`/docs/infrastructure-as-code/terraform-provider` section. This also
clarifies the structure of the Infrastructure as Code section, since
all Terraform-specific content is in a single subsection. To make this
work, rename the sidebar titles of the Terraform section and add a
link to the guide within the section index page.
- **Minor edits to the Terraform starter guide:** Move the SSO guide
links to the prerequisites section to avoid surprising the user with
the need to context-switch. Remove an unneeded `tctl.mdx` partial
inclusion. Remove prerequisite item re: following a Terraform setup
guide, since this guide already shows the local demo method.
Edoardo Spadolini