mirror of
https://github.com/gravitational/teleport.git
synced 2026-10-12 02:15:01 +00:00
Tim Buckley
5a22c83420
* MWI: Add certificate expiry check leeway for app tunnel service This adds some leeway to the application-tunnel service's certificate expiration check. For context, the app tunnel service does not follow Machine ID's usual certificate renewal cycle and instead opts to renew certificates just-in-time before completing a request if the certificate has expired per the local clock. Unfortunately, the local clock is not always accurate, and if the certificate or underlying app session has already expired from the server's perspective, client requests can still fail until the local clock catches up and the certificate is refreshed. To mitigate this, this change adds a `leeway` parameter to the service, configurable via YAML, with a default value of 1m. This is added to the current time when certificate validity is checked. This means that, in the worst case, certificates will be refreshed to early rather than too late. See also: #64284 * Remove duration pointer and ignore leeway if greater than cert TTL * Make tbot's leeway parameter global This makes the leeway parameter global, and additionally uses it in the main renewal loop (for the expired bot internal identity detection) and in the database tunnel service. Also adds some test coverage for app tunnel cert renewals. * Tweak doc comment for clarity * Remove unused code * Ignore excessive leeway values in identity service * Honor effective lifetime in leeway check * Fix leeway var reference * Update golden tests * Codex reviewer appeasement Factor in actual cert TTL in the leeway cap. * Fix failing test * Fix imports