opensource/teleport
3
0
Fork 0
mirror of https://github.com/gravitational/teleport.git synced 2026-10-24 02:25:42 +08:00
Code Issues Packages Projects Releases Wiki Activity

Update tests to inject modules instead of relying on modulestest.SetTestModules (#65976)

Browse Source 
This is a pass on replacing modulestest.SetTestModules with supplying modules
where already possible. Some additional uses of modules.GetModules were also
replaced with localized modules injection to permit the removal of
modulestest.SetTestModules in tests. Most of the changes here are mechanical,
the one notable change is in TestSSHCommands. The test was not passing locally
because the shell (fish) builtin echo behaves differently. The easiest way
to produce expected output was to change the command invocation to use
/bin/echo to bypass any shell builtins for consistent behavior.

Inject modules into tool tests

Inject modules into integration tests

Inject modules into join server

Remove superflous enterprise modules in TestAuthenticationConfig_Parse_deviceTrustPB

Inject modules into signature algorithm config tests

Inject modules into TestGithubConnectorCRUDEventsEmitted

Inject modules into TestGetHierarchyForUser

Inject modules into kube proxy tests

Inject modules into controller tests

make fix-imports

add integration/app/fixture as test package
This commit is contained in:
rosstimothy
2026-04-22 17:38:51 +00:00
committed by GitHub
parent e892451c6d
commit fc72fdcdc2
42 changed files with 189 additions and 219 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.golangci.yml
+1 -2
View File
@@ -227,8 +227,7 @@ linters:
- '!**/e/lib/jamf/testenv/**'
- '!**/e/lib/operatortest/**'
- '!**/e/tests/**'
- '!**/integration/db/fixture.go'
- '!**/integration/helpers/**'
- '!**/integration/**'
- '!**/integrations/lib/testing/**'
- '!**/integrations/operator/controllers/resources/testlib/**.go'
- '!**/lib/auth/authtest/**'
integration/appaccess/appaccess_test.go
-11
View File
@@ -41,12 +41,9 @@ import (
"github.com/gravitational/teleport"
"github.com/gravitational/teleport/api/types"
apievents "github.com/gravitational/teleport/api/types/events"
"github.com/gravitational/teleport/entitlements"
"github.com/gravitational/teleport/integration/helpers"
"github.com/gravitational/teleport/lib/events"
"github.com/gravitational/teleport/lib/httplib/reverseproxy"
"github.com/gravitational/teleport/lib/modules"
"github.com/gravitational/teleport/lib/modules/modulestest"
"github.com/gravitational/teleport/lib/service"
"github.com/gravitational/teleport/lib/service/servicecfg"
"github.com/gravitational/teleport/lib/srv/app/common"
@@ -287,14 +284,6 @@ func testForwardModes(p *Pack, t *testing.T) {
// testClientCert tests mutual TLS authentication flow with application
// access typically used in CLI by curl and other clients.
func testClientCert(p *Pack, t *testing.T) {
modulestest.SetTestModules(t, modulestest.Modules{
TestBuildType: modules.BuildEnterprise,
TestFeatures: modules.Features{
Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
entitlements.App: {Enabled: true},
},
},
})
evilUser, _ := p.CreateUser(t)
rootWs := p.CreateAppSession(t, CreateAppSessionParams{
Username: p.username,
integration/appaccess/fixtures.go
+5
View File
@@ -38,6 +38,7 @@ import (
"github.com/gravitational/teleport/api/breaker"
"github.com/gravitational/teleport/integration/helpers"
"github.com/gravitational/teleport/lib/auth/testauthority"
"github.com/gravitational/teleport/lib/modules/modulestest"
"github.com/gravitational/teleport/lib/service/servicecfg"
"github.com/gravitational/teleport/lib/utils"
"github.com/gravitational/teleport/lib/utils/log/logtest"
@@ -320,6 +321,7 @@ func SetupWithOptions(t *testing.T, opts AppTestOptions) *Pack {
Priv: privateKey,
Pub: publicKey,
Logger: log,
Modules: modulestest.EnterpriseModules(),
}
if opts.RootClusterListeners != nil {
rootCfg.Listeners = opts.RootClusterListeners(t, &rootCfg.Fds)
@@ -335,6 +337,7 @@ func SetupWithOptions(t *testing.T, opts AppTestOptions) *Pack {
Priv: privateKey,
Pub: publicKey,
Logger: log,
Modules: modulestest.EnterpriseModules(),
}
if opts.LeafClusterListeners != nil {
leafCfg.Listeners = opts.LeafClusterListeners(t, &leafCfg.Fds)
@@ -344,6 +347,7 @@ func SetupWithOptions(t *testing.T, opts AppTestOptions) *Pack {
rcConf := servicecfg.MakeDefaultConfig()
// Insecure development mode needs to be set because the web proxy uses a
// self-signed certificate during tests.
rcConf.Modules = rootCfg.Modules
rcConf.InsecureMode = true
rcConf.Logger = log
rcConf.DataDir = t.TempDir()
@@ -362,6 +366,7 @@ func SetupWithOptions(t *testing.T, opts AppTestOptions) *Pack {
rcConf.Clock = opts.Clock
lcConf := servicecfg.MakeDefaultConfig()
lcConf.Modules = leafCfg.Modules
// Insecure development mode needs to be set because the web proxy uses a
// self-signed certificate during tests.
lcConf.InsecureMode = true
integration/db/db_integration_test.go
+2 -11
View File
@@ -36,12 +36,10 @@ import (
"golang.org/x/sync/errgroup"
"github.com/gravitational/teleport/api/types"
"github.com/gravitational/teleport/entitlements"
"github.com/gravitational/teleport/integration/helpers"
"github.com/gravitational/teleport/lib/auth"
"github.com/gravitational/teleport/lib/defaults"
"github.com/gravitational/teleport/lib/events"
"github.com/gravitational/teleport/lib/modules"
"github.com/gravitational/teleport/lib/modules/modulestest"
"github.com/gravitational/teleport/lib/service/servicecfg"
"github.com/gravitational/teleport/lib/services"
@@ -63,10 +61,12 @@ func TestDatabaseAccess(t *testing.T) {
pack := SetupDatabaseTest(t,
// set tighter rotation intervals
WithLeafConfig(func(config *servicecfg.Config) {
config.Modules = modulestest.EnterpriseModules()
config.PollingPeriod = 5 * time.Second
config.RotationConnectionInterval = 2 * time.Second
}),
WithRootConfig(func(config *servicecfg.Config) {
config.Modules = modulestest.EnterpriseModules()
config.PollingPeriod = 5 * time.Second
config.RotationConnectionInterval = 2 * time.Second
config.Proxy.MySQLServerVersion = "8.0.1"
@@ -104,15 +104,6 @@ func TestDatabaseAccessSeparateListeners(t *testing.T) {
// testIPPinning tests a scenario where a user with IP pinning
// connects to a database
func (p *DatabasePack) testIPPinning(t *testing.T) {
modulestest.SetTestModules(t, modulestest.Modules{
TestBuildType: modules.BuildEnterprise,
TestFeatures: modules.Features{
Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
entitlements.DB: {Enabled: true},
},
},
})
type testCase struct {
desc string
targetCluster databaseClusterPack
integration/helpers/instance.go
+1
View File
@@ -455,6 +455,7 @@ func NewInstance(t *testing.T, cfg InstanceConfig) *TeleInstance {
Log: cfg.Logger,
InstanceListeners: *cfg.Listeners,
Fds: cfg.Fds,
Modules: cfg.Modules,
}
secrets := InstanceSecrets{
integration/integration_test.go
+16 -15
View File
@@ -91,7 +91,6 @@ import (
"github.com/gravitational/teleport/lib/events"
"github.com/gravitational/teleport/lib/events/eventstest"
"github.com/gravitational/teleport/lib/events/filesessions"
"github.com/gravitational/teleport/lib/modules"
"github.com/gravitational/teleport/lib/modules/modulestest"
"github.com/gravitational/teleport/lib/multiplexer"
"github.com/gravitational/teleport/lib/reversetunnelclient"
@@ -210,12 +209,11 @@ func TestIntegrations(t *testing.T) {
// testDifferentPinnedIP tests connection is rejected when source IP doesn't match the pinned one
func testDifferentPinnedIP(t *testing.T, suite *integrationTestSuite) {
modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
tr := utils.NewTracer(utils.ThisFunction()).Start()
defer tr.Stop()
tconf := suite.defaultServiceConfig()
tconf.Modules = modulestest.EnterpriseModules()
tconf.Auth.Enabled = true
tconf.Proxy.Enabled = true
tconf.SSH.Enabled = true
@@ -7657,15 +7655,17 @@ func isNilOrEOFErr(t *testing.T, err error) {
}
func testModeratedSFTP(t *testing.T, suite *integrationTestSuite) {
modulestest.SetTestModules(t, modulestest.Modules{
TestBuildType: modules.BuildEnterprise,
})
// Create Teleport instance
instance := suite.newTeleport(t, nil, true)
t.Cleanup(func() {
instance.StopAll()
})
tconf := suite.defaultServiceConfig()
tconf.Modules = modulestest.EnterpriseModules()
tconf.Auth.Enabled = true
tconf.Proxy.Enabled = true
tconf.SSH.Enabled = true
instance := suite.NewTeleportInstance(t)
require.NoError(t, instance.CreateEx(t, nil, tconf))
require.NoError(t, instance.Start())
t.Cleanup(func() { instance.StopAll() })
ctx := context.Background()
authServer := instance.Process.GetAuthServer()
@@ -8575,8 +8575,6 @@ func TestProxySSHPortMultiplexing(t *testing.T) {
// can/cannot be established with an existing certificate
// based on cluster configuration or roles.
func TestConnectivityWithoutAuth(t *testing.T) {
modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
tests := []struct {
name string
adjustRole func(r types.Role)
@@ -8637,6 +8635,7 @@ func TestConnectivityWithoutAuth(t *testing.T) {
// Create auth config.
authCfg := servicecfg.MakeDefaultConfig()
authCfg.Modules = modulestest.EnterpriseModules()
authCfg.Logger = logtest.NewLogger()
authCfg.CircuitBreakerConfig = breaker.NoopBreakerConfig()
authCfg.InstanceMetadataClient = imds.NewDisabledIMDSClient()
@@ -8656,6 +8655,7 @@ func TestConnectivityWithoutAuth(t *testing.T) {
Priv: privateKey,
Pub: publicKey,
Logger: logtest.NewLogger(),
Modules: authCfg.Modules,
})
// Create a user and role.
@@ -8691,10 +8691,12 @@ func TestConnectivityWithoutAuth(t *testing.T) {
Priv: privateKey,
Pub: publicKey,
Logger: logtest.NewLogger(),
Modules: authCfg.Modules,
})
// Create node config.
nodeCfg := servicecfg.MakeDefaultConfig()
nodeCfg.Modules = authCfg.Modules
nodeCfg.SetAuthServerAddress(authCfg.Auth.ListenAddr)
nodeCfg.SetToken("token")
nodeCfg.CachePolicy.Enabled = true
@@ -8937,8 +8939,6 @@ func TestConnectivityDuringAuthRestart(t *testing.T) {
}
func testModeratedSessions(t *testing.T, suite *integrationTestSuite) {
modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
const password = "supersecretpassword"
inputReader := prompt.NewFakeReader().
AddString(password).
@@ -8969,6 +8969,7 @@ func testModeratedSessions(t *testing.T, suite *integrationTestSuite) {
// Enable web service.
cfg := suite.defaultServiceConfig()
cfg.Modules = modulestest.EnterpriseModules()
cfg.Auth.Enabled = true
cfg.Auth.Preference.SetSecondFactors(types.SecondFactorType_SECOND_FACTOR_TYPE_WEBAUTHN)
cfg.Auth.Preference.(*types.AuthPreferenceV2).Spec.RequireMFAType = types.RequireMFAType_SESSION
integration/kube_integration_test.go
+2 -11
View File
@@ -71,7 +71,6 @@ import (
"github.com/gravitational/teleport/api/constants"
"github.com/gravitational/teleport/api/profile"
"github.com/gravitational/teleport/api/types"
"github.com/gravitational/teleport/entitlements"
"github.com/gravitational/teleport/integration/helpers"
"github.com/gravitational/teleport/integration/kube"
"github.com/gravitational/teleport/lib/auth/authclient"
@@ -80,7 +79,6 @@ import (
"github.com/gravitational/teleport/lib/cloud/imds"
"github.com/gravitational/teleport/lib/defaults"
kubeutils "github.com/gravitational/teleport/lib/kube/utils"
"github.com/gravitational/teleport/lib/modules"
"github.com/gravitational/teleport/lib/modules/modulestest"
"github.com/gravitational/teleport/lib/service"
"github.com/gravitational/teleport/lib/service/servicecfg"
@@ -1545,16 +1543,8 @@ func testKubeTransportProtocol(t *testing.T, suite *KubeSuite) {
// TODO: test against tsh kubectl
func testKubeEphemeralContainers(t *testing.T, suite *KubeSuite) {
modulestest.SetTestModules(t, modulestest.Modules{
TestBuildType: modules.BuildEnterprise,
TestFeatures: modules.Features{
Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
entitlements.K8s: {Enabled: true},
},
},
})
tconf := suite.teleKubeConfig(Host)
tconf.Modules = modulestest.EnterpriseModules()
teleport := helpers.NewInstance(t, helpers.InstanceConfig{
ClusterName: helpers.Site,
HostID: helpers.HostID,
@@ -1562,6 +1552,7 @@ func testKubeEphemeralContainers(t *testing.T, suite *KubeSuite) {
Priv: suite.priv,
Pub: suite.pub,
Logger: suite.log,
Modules: tconf.Modules,
})
username := suite.me.Username
integration/proxy/proxy_tunnel_strategy_test.go
+10 -12
View File
@@ -32,14 +32,12 @@ import (
apidefaults "github.com/gravitational/teleport/api/defaults"
"github.com/gravitational/teleport/api/types"
"github.com/gravitational/teleport/entitlements"
"github.com/gravitational/teleport/integration/helpers"
"github.com/gravitational/teleport/lib/auth/authclient"
"github.com/gravitational/teleport/lib/auth/authtest"
"github.com/gravitational/teleport/lib/auth/testauthority"
"github.com/gravitational/teleport/lib/cloud/imds"
"github.com/gravitational/teleport/lib/defaults"
"github.com/gravitational/teleport/lib/modules"
"github.com/gravitational/teleport/lib/modules/modulestest"
"github.com/gravitational/teleport/lib/service"
"github.com/gravitational/teleport/lib/service/servicecfg"
@@ -150,6 +148,8 @@ func TestProxyTunnelStrategyAgentMesh(t *testing.T) {
// TestProxyTunnelStrategyProxyPeering tests the proxy-peer tunnel strategy.
func TestProxyTunnelStrategyProxyPeering(t *testing.T) {
t.Parallel()
// NOTE(eriktate): Testing database tunnels appears to be flaky (or possibly never works?)
// so we currently skip adding a database altogether in order to ensure peered tunnels have
// some automatic test coverage. Gating this behind a flag in case we want to restore the
@@ -159,16 +159,6 @@ func TestProxyTunnelStrategyProxyPeering(t *testing.T) {
}
func testProxyTunnelStrategyProxyPeering(t *testing.T, withDB bool) {
// This test cannot run in parallel as set module changes the global state.
modulestest.SetTestModules(t, modulestest.Modules{
TestBuildType: modules.BuildEnterprise,
TestFeatures: modules.Features{
Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
entitlements.DB: {Enabled: true},
},
},
})
p := newProxyTunnelStrategy(t, "proxy-tunnel-proxy-peer",
&types.TunnelStrategyV1{
Strategy: &types.TunnelStrategyV1_ProxyPeering{
@@ -313,11 +303,13 @@ func (p *proxyTunnelStrategy) makeAuth(t *testing.T) {
Priv: privateKey,
Pub: publicKey,
Logger: logtest.NewLogger(),
Modules: modulestest.EnterpriseModules(),
})
auth.AddUser(p.username, []string{p.username})
conf := servicecfg.MakeDefaultConfig()
conf.Modules = auth.Modules
conf.DataDir = t.TempDir()
conf.Logger = auth.Log
@@ -342,11 +334,13 @@ func (p *proxyTunnelStrategy) makeProxy(t *testing.T) {
HostID: uuid.New().String(),
NodeName: helpers.Loopback,
Logger: logtest.NewLogger(),
Modules: modulestest.EnterpriseModules(),
})
authAddr := utils.MustParseAddr(p.auth.Auth)
conf := servicecfg.MakeDefaultConfig()
conf.Modules = proxy.Modules
conf.DebugService.Enabled = false
conf.SetAuthServerAddress(*authAddr)
conf.SetToken("token")
@@ -391,9 +385,11 @@ func (p *proxyTunnelStrategy) makeNode(t *testing.T) {
HostID: uuid.New().String(),
NodeName: helpers.Loopback,
Logger: logtest.NewLogger(),
Modules: modulestest.EnterpriseModules(),
})
conf := servicecfg.MakeDefaultConfig()
conf.Modules = node.Modules
conf.Version = types.V3
conf.SetToken("token")
conf.DataDir = t.TempDir()
@@ -439,9 +435,11 @@ func (p *proxyTunnelStrategy) makeDatabase(t *testing.T) {
HostID: uuid.New().String(),
NodeName: helpers.Loopback,
Logger: logtest.NewLogger(),
Modules: modulestest.EnterpriseModules(),
})
conf := servicecfg.MakeDefaultConfig()
conf.Modules = db.Modules
conf.DebugService.Enabled = false
conf.Version = types.V3
conf.SetToken("token")
integrations/operator/controllers/resources/testlib/env.go
+4 -2
View File
@@ -80,7 +80,7 @@ func ValidRandomResourceName(prefix string) string {
}
func defaultTeleportServiceConfig(t *testing.T, insecureMode bool) (*helpers.TeleInstance, string) {
modulestest.SetTestModules(t, modulestest.Modules{
testModules := &modulestest.Modules{
TestBuildType: modules.BuildEnterprise,
TestFeatures: modules.Features{
Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
@@ -88,16 +88,18 @@ func defaultTeleportServiceConfig(t *testing.T, insecureMode bool) (*helpers.Tel
entitlements.SAML: {Enabled: true},
},
},
})
}
teleportServer := helpers.NewInstance(t, helpers.InstanceConfig{
ClusterName: "root.example.com",
HostID: uuid.New().String(),
NodeName: helpers.Loopback,
Logger: slog.Default(),
Modules: testModules,
})
rcConf := servicecfg.MakeDefaultConfig()
rcConf.Modules = testModules
rcConf.DataDir = t.TempDir()
rcConf.Auth.Enabled = true
rcConf.Proxy.Enabled = true
lib/accesslists/hierarchy_user_test.go
+2 -4
View File
@@ -37,9 +37,7 @@ import (
)
func TestGetHierarchyForUser(t *testing.T) {
testModules := modulestest.EnterpriseModules()
modulestest.SetTestModules(t, *testModules)
t.Parallel()
clock := clockwork.NewFakeClock()
tests := []struct {
@@ -393,7 +391,7 @@ func TestGetHierarchyForUser(t *testing.T) {
require.NoError(t, err)
svc, err := local.NewAccessListServiceV2(local.AccessListServiceConfig{
Backend: bk,
Modules: testModules,
Modules: modulestest.EnterpriseModules(),
})
require.NoError(t, err)
lib/auth/auth_test.go
+7 -2
View File
@@ -1385,8 +1385,13 @@ func TestTrustedClusterCRUDEventEmitted(t *testing.T) {
}
func TestGithubConnectorCRUDEventsEmitted(t *testing.T) {
modulestest.SetTestModules(t, *modulestest.EnterpriseModules())
s := newAuthSuite(t)
t.Parallel()
s, err := newTestPack(t.Context(), testPackOptions{
DataDir: t.TempDir(),
Modules: modulestest.EnterpriseModules(),
})
require.NoError(t, err)
t.Cleanup(func() { require.NoError(t, s.a.Close()) })
clientAddr := &net.TCPAddr{IP: net.IPv4(10, 255, 0, 0)}
ctx := authz.ContextWithClientSrcAddr(context.Background(), clientAddr)
lib/auth/grpcserver.go
+1
View File
@@ -6394,6 +6394,7 @@ func NewGRPCServer(cfg GRPCServerConfig) (*GRPCServer, error) {
FIPS: cfg.AuthServer.fips,
ScopedTokenService: cfg.AuthServer.Services,
OracleHTTPClient: cfg.OracleHTTPClient,
Modules: cfg.AuthServer.modules,
}))
}
lib/auth/join_github.go
+1 -1
View File
@@ -60,7 +60,7 @@ func (a *Server) checkGitHubJoinRequest(
req *types.RegisterUsingTokenRequest,
pt types.ProvisionToken,
) (*githubactions.IDTokenClaims, error) {
claims, err := githubactions.CheckGithubIDToken(ctx, &githubactions.CheckGithubIDTokenParams{
claims, err := githubactions.CheckGithubIDToken(ctx, a.modules, &githubactions.CheckGithubIDTokenParams{
ProvisionToken: pt,
IDToken: []byte(req.IDToken),
Clock: a.GetClock(),
lib/auth/join_spacelift.go
+1 -1
View File
@@ -44,7 +44,7 @@ func (a *Server) checkSpaceliftJoinRequest(
req *types.RegisterUsingTokenRequest,
pt types.ProvisionToken,
) (*spacelift.IDTokenClaims, error) {
claims, err := spacelift.CheckIDToken(ctx, &spacelift.CheckIDTokenParams{
claims, err := spacelift.CheckIDToken(ctx, a.modules, &spacelift.CheckIDTokenParams{
ProvisionToken: pt,
IDToken: []byte(req.IDToken),
Validator: a.spaceliftIDTokenValidator,
lib/auth/join_terraformcloud.go
+1 -1
View File
@@ -49,7 +49,7 @@ func (a *Server) checkTerraformCloudJoinRequest(
return nil, trace.Wrap(err)
}
claims, err := terraformcloud.CheckIDToken(ctx, &terraformcloud.CheckIDTokenParams{
claims, err := terraformcloud.CheckIDToken(ctx, a.modules, &terraformcloud.CheckIDTokenParams{
ProvisionToken: pt,
IDToken: []byte(req.IDToken),
Validator: a.terraformIDTokenValidator,
lib/auth/join_tpm.go
+1 -1
View File
@@ -77,7 +77,7 @@ func (a *Server) RegisterUsingTPMMethod(
return solution.Solution, nil
}
validatedEK, err := tpmjoin.CheckTPMRequest(ctx, tpmjoin.CheckTPMRequestParams{
validatedEK, err := tpmjoin.CheckTPMRequest(ctx, a.modules, tpmjoin.CheckTPMRequestParams{
Token: ptv2,
TPMValidator: a.GetTPMValidator(),
EKCert: initReq.GetEkCert(),
lib/config/configuration.go
+2 -3
View File
@@ -63,7 +63,6 @@ import (
"github.com/gravitational/teleport/lib/integrations/externalauditstorage/easconfig"
"github.com/gravitational/teleport/lib/integrations/samlidp/samlidpconfig"
"github.com/gravitational/teleport/lib/limiter"
"github.com/gravitational/teleport/lib/modules"
"github.com/gravitational/teleport/lib/multiplexer"
"github.com/gravitational/teleport/lib/service/servicecfg"
"github.com/gravitational/teleport/lib/services"
@@ -2762,7 +2761,7 @@ func Configure(clf *CommandLineFlags, cfg *servicecfg.Config, legacyAppFlags boo
return trace.BadParameter("non-FIPS compliant proxy settings: \"proxy_checks_host_keys\" must be true")
}
if err := services.ValidateSessionRecordingConfig(cfg.Auth.SessionRecordingConfig, clf.FIPS, modules.GetModules().Features().Cloud); err != nil {
if err := services.ValidateSessionRecordingConfig(cfg.Auth.SessionRecordingConfig, clf.FIPS, cfg.Modules.Features().Cloud); err != nil {
return trace.Wrap(err)
}
}
@@ -2776,7 +2775,7 @@ func Configure(clf *CommandLineFlags, cfg *servicecfg.Config, legacyAppFlags boo
if err := cfg.Auth.Preference.CheckSignatureAlgorithmSuite(types.SignatureAlgorithmSuiteParams{
FIPS: clf.FIPS,
UsingHSMOrKMS: cfg.Auth.KeyStore != servicecfg.KeystoreConfig{},
Cloud: modules.GetModules().Features().Cloud,
Cloud: cfg.Modules.Features().Cloud,
}); err != nil {
return trace.Wrap(err)
}
lib/config/configuration_test.go
+7 -5
View File
@@ -5605,6 +5605,7 @@ debug_service:
}
func TestSignatureAlgorithmSuite(t *testing.T) {
t.Parallel()
for desc, tc := range map[string]struct {
fips bool
hsm bool
@@ -5659,15 +5660,16 @@ func TestSignatureAlgorithmSuite(t *testing.T) {
},
} {
t.Run(desc, func(t *testing.T) {
modulestest.SetTestModules(t, modulestest.Modules{
TestFeatures: modules.Features{
Cloud: tc.cloud,
},
})
t.Parallel()
clf := &CommandLineFlags{
FIPS: tc.fips,
}
cfg := servicecfg.MakeDefaultConfig()
cfg.Modules = &modulestest.Modules{
TestFeatures: modules.Features{
Cloud: tc.cloud,
},
}
if tc.fips {
servicecfg.ApplyFIPSDefaults(cfg)
}
lib/config/fileconf_test.go
+1 -7
View File
@@ -41,8 +41,6 @@ import (
"github.com/gravitational/teleport/api/types"
apiutils "github.com/gravitational/teleport/api/utils"
"github.com/gravitational/teleport/lib/defaults"
"github.com/gravitational/teleport/lib/modules"
"github.com/gravitational/teleport/lib/modules/modulestest"
"github.com/gravitational/teleport/lib/scopes/joining"
"github.com/gravitational/teleport/lib/service/servicecfg"
"github.com/gravitational/teleport/session/networking/x11"
@@ -996,11 +994,7 @@ func TestAuthenticationConfig_RequireSessionMFA(t *testing.T) {
}
func TestAuthenticationConfig_Parse_deviceTrustPB(t *testing.T) {
// Device trust mode=required is an Enterprise feature.
modulestest.SetTestModules(t, modulestest.Modules{
TestBuildType: modules.BuildEnterprise,
})
t.Parallel()
tpmEKCertPath := "testdata/tpm_ekcert_ca.pem"
tpmEKCertPEM, err := os.ReadFile(tpmEKCertPath)
require.NoError(t, err)
lib/join/githubactions/githubactions.go
+2 -2
View File
@@ -190,7 +190,7 @@ func (p *CheckGithubIDTokenParams) checkAndSetDefaults() error {
// CheckGithubIDToken checks a Github OIDC token against a provision token.
// If the token is valid and its claims match at least one allow rule, the
// claims are returned.
func CheckGithubIDToken(ctx context.Context, params *CheckGithubIDTokenParams) (*IDTokenClaims, error) {
func CheckGithubIDToken(ctx context.Context, m modules.Modules, params *CheckGithubIDTokenParams) (*IDTokenClaims, error) {
if err := params.checkAndSetDefaults(); err != nil {
return nil, trace.AccessDenied("%s", err.Error())
}
@@ -205,7 +205,7 @@ func CheckGithubIDToken(ctx context.Context, params *CheckGithubIDTokenParams) (
enterpriseOverride := token.Spec.GitHub.EnterpriseServerHost
enterpriseSlug := token.Spec.GitHub.EnterpriseSlug
if enterpriseOverride != "" || enterpriseSlug != "" {
if modules.GetModules().BuildType() != modules.BuildEnterprise {
if m.BuildType() != modules.BuildEnterprise {
return nil, trace.Wrap(services.ErrRequiresEnterprise, "github enterprise server joining")
}
}
lib/join/join_bitbucket_test.go
+6 -5
View File
@@ -87,9 +87,11 @@ func TestJoinBitbucket(t *testing.T) {
ctx := t.Context()
testModules := modulestest.OSSModules()
authServer, err := authtest.NewTestServer(authtest.ServerConfig{
Auth: authtest.AuthServerConfig{
Dir: t.TempDir(),
Dir: t.TempDir(),
Modules: testModules,
},
})
require.NoError(t, err)
@@ -275,10 +277,9 @@ func TestJoinBitbucket(t *testing.T) {
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
if tt.setEnterprise {
modulestest.SetTestModules(
t,
modulestest.Modules{TestBuildType: modules.BuildEnterprise},
)
testModules.TestBuildType = modules.BuildEnterprise
} else {
testModules.TestBuildType = modules.BuildOSS
}
token, err := types.NewProvisionTokenFromSpec(
lib/join/join_github_test.go
+6 -5
View File
@@ -116,9 +116,11 @@ func TestJoinGHA(t *testing.T) {
},
}
testModules := modulestest.OSSModules()
authServer, err := authtest.NewTestServer(authtest.ServerConfig{
Auth: authtest.AuthServerConfig{
Dir: t.TempDir(),
Dir: t.TempDir(),
Modules: testModules,
},
})
require.NoError(t, err)
@@ -692,10 +694,9 @@ func TestJoinGHA(t *testing.T) {
t.Run(tt.name, func(t *testing.T) {
t.Cleanup(idTokenValidator.reset)
if tt.setEnterprise {
modulestest.SetTestModules(
t,
modulestest.Modules{TestBuildType: modules.BuildEnterprise},
)
testModules.TestBuildType = modules.BuildEnterprise
} else {
testModules.TestBuildType = modules.BuildOSS
}
token, err := types.NewProvisionTokenFromSpec(
tt.name, time.Now().Add(time.Minute), tt.tokenSpec,
lib/join/join_spacelift_test.go
+6 -5
View File
@@ -75,9 +75,11 @@ func TestJoinSpacelift(t *testing.T) {
ctx := t.Context()
testModules := modulestest.OSSModules()
authServer, err := authtest.NewTestServer(authtest.ServerConfig{
Auth: authtest.AuthServerConfig{
Dir: t.TempDir(),
Dir: t.TempDir(),
Modules: testModules,
},
})
require.NoError(t, err)
@@ -331,10 +333,9 @@ func TestJoinSpacelift(t *testing.T) {
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
if tt.setEnterprise {
modulestest.SetTestModules(
t,
modulestest.Modules{TestBuildType: modules.BuildEnterprise},
)
testModules.TestBuildType = modules.BuildEnterprise
} else {
testModules.TestBuildType = modules.BuildOSS
}
token, err := types.NewProvisionTokenFromSpec(
lib/join/join_terraformcloud_test.go
+5 -4
View File
@@ -82,10 +82,12 @@ func TestJoinTerraformCloud(t *testing.T) {
ctx := t.Context()
testModules := modulestest.OSSModules()
authServer, err := authtest.NewTestServer(authtest.ServerConfig{
Auth: authtest.AuthServerConfig{
ClusterName: "test.localhost",
Dir: t.TempDir(),
Modules: testModules,
},
})
require.NoError(t, err)
@@ -406,10 +408,9 @@ func TestJoinTerraformCloud(t *testing.T) {
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
if tt.setEnterprise {
modulestest.SetTestModules(
t,
modulestest.Modules{TestBuildType: modules.BuildEnterprise},
)
testModules.TestBuildType = modules.BuildEnterprise
} else {
testModules.TestBuildType = modules.BuildOSS
}
token, err := types.NewProvisionTokenFromSpec(
lib/join/server.go
+2
View File
@@ -65,6 +65,7 @@ import (
"github.com/gravitational/teleport/lib/join/terraformcloud"
"github.com/gravitational/teleport/lib/join/tpmjoin"
kubetoken "github.com/gravitational/teleport/lib/kube/token"
"github.com/gravitational/teleport/lib/modules"
"github.com/gravitational/teleport/lib/scopes/joining"
"github.com/gravitational/teleport/lib/services"
"github.com/gravitational/teleport/lib/services/readonly"
@@ -123,6 +124,7 @@ type ServerConfig struct {
ScopedTokenService services.ScopedTokenService
OracleHTTPClient utils.HTTPDoClient
Logger *slog.Logger
Modules modules.Modules
}
// Server implements cluster joining for nodes and bots.
lib/join/server_github.go
+1 -1
View File
@@ -33,7 +33,7 @@ func (a *Server) validateGithubToken(
pt provision.Token,
idToken []byte,
) (any, *workloadidentityv1.JoinAttrs, error) {
claims, err := githubactions.CheckGithubIDToken(ctx, &githubactions.CheckGithubIDTokenParams{
claims, err := githubactions.CheckGithubIDToken(ctx, a.cfg.Modules, &githubactions.CheckGithubIDTokenParams{
ProvisionToken: pt,
IDToken: idToken,
Validator: a.cfg.AuthService.GetGHAIDTokenValidator(),
lib/join/server_spacelift.go
+1 -1
View File
@@ -33,7 +33,7 @@ func (a *Server) validateSpaceliftToken(
pt provision.Token,
idToken []byte,
) (any, *workloadidentityv1.JoinAttrs, error) {
claims, err := spacelift.CheckIDToken(ctx, &spacelift.CheckIDTokenParams{
claims, err := spacelift.CheckIDToken(ctx, a.cfg.Modules, &spacelift.CheckIDTokenParams{
ProvisionToken: pt,
IDToken: idToken,
Validator: a.cfg.AuthService.GetSpaceliftIDTokenValidator(),
lib/join/server_terraformcloud.go
+1 -1
View File
@@ -40,7 +40,7 @@ func (a *Server) validateTerraformCloudToken(
return nil, nil, trace.Wrap(err)
}
claims, err := terraformcloud.CheckIDToken(ctx, &terraformcloud.CheckIDTokenParams{
claims, err := terraformcloud.CheckIDToken(ctx, a.cfg.Modules, &terraformcloud.CheckIDTokenParams{
ProvisionToken: pt,
IDToken: idToken,
Validator: a.cfg.AuthService.GetTerraformIDTokenValidator(),
lib/join/server_tpm.go
+1 -1
View File
@@ -77,7 +77,7 @@ func (s *Server) handleTPMJoin(
return solutionMsg.Solution, nil
}
validatedEK, err := tpmjoin.CheckTPMRequest(stream.Context(), tpmjoin.CheckTPMRequestParams{
validatedEK, err := tpmjoin.CheckTPMRequest(stream.Context(), s.cfg.Modules, tpmjoin.CheckTPMRequestParams{
Token: ptv2,
TPMValidator: s.cfg.AuthService.GetTPMValidator(),
EKCert: tpmInit.EKCert,
lib/join/spacelift/spacelift.go
+2 -1
View File
@@ -113,6 +113,7 @@ func (p *CheckIDTokenParams) validate() error {
// rules in the provided provision token.
func CheckIDToken(
ctx context.Context,
m modules.Modules,
params *CheckIDTokenParams,
) (*IDTokenClaims, error) {
if err := params.validate(); err != nil {
@@ -124,7 +125,7 @@ func CheckIDToken(
return nil, trace.BadParameter("spacelift join method only supports ProvisionTokenV2, '%T' was provided", params.ProvisionToken)
}
if modules.GetModules().BuildType() != modules.BuildEnterprise {
if m.BuildType() != modules.BuildEnterprise {
return nil, trace.Wrap(services.ErrRequiresEnterprise, "spacelift joining")
}
lib/join/terraformcloud/terraform.go
+2 -1
View File
@@ -117,6 +117,7 @@ func (p *CheckIDTokenParams) checkAndSetDefaults() error {
// rules in the provided provision token.
func CheckIDToken(
ctx context.Context,
m modules.Modules,
params *CheckIDTokenParams,
) (*IDTokenClaims, error) {
if err := params.checkAndSetDefaults(); err != nil {
@@ -129,7 +130,7 @@ func CheckIDToken(
}
hostnameOverride := token.Spec.TerraformCloud.Hostname
if hostnameOverride != "" && modules.GetModules().BuildType() != modules.BuildEnterprise {
if hostnameOverride != "" && m.BuildType() != modules.BuildEnterprise {
return nil, trace.Wrap(
services.ErrRequiresEnterprise,
"terraform_cloud joining for Terraform Enterprise",
lib/join/tpmjoin/join_test.go
+6 -2
View File
@@ -46,9 +46,11 @@ import (
)
func TestJoinTPM(t *testing.T) {
testModules := modulestest.OSSModules()
server, err := authtest.NewTestServer(authtest.ServerConfig{
Auth: authtest.AuthServerConfig{
Dir: t.TempDir(),
Dir: t.TempDir(),
Modules: testModules,
},
})
require.NoError(t, err)
@@ -275,7 +277,9 @@ func TestJoinTPM(t *testing.T) {
} {
t.Run(tc.desc, func(t *testing.T) {
if !tc.oss {
modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
testModules.TestBuildType = modules.BuildEnterprise
} else {
testModules.TestBuildType = modules.BuildOSS
}
token, err := types.NewProvisionTokenFromSpec("mytoken", time.Now().Add(time.Minute), types.ProvisionTokenSpecV2{
lib/join/tpmjoin/tpm.go
+2 -2
View File
@@ -55,8 +55,8 @@ type CheckTPMRequestParams struct {
}
// CheckTPMRequest checks a TPM method join request.
func CheckTPMRequest(ctx context.Context, params CheckTPMRequestParams) (*tpm.ValidatedTPM, error) {
if modules.GetModules().BuildType() != modules.BuildEnterprise {
func CheckTPMRequest(ctx context.Context, m modules.Modules, params CheckTPMRequestParams) (*tpm.ValidatedTPM, error) {
if m.BuildType() != modules.BuildEnterprise {
return nil, trace.Wrap(
services.ErrRequiresEnterprise,
"tpm joining",
lib/kube/proxy/moderated_sessions_test.go
+4 -14
View File
@@ -43,22 +43,15 @@ import (
"github.com/gravitational/teleport/api/constants"
"github.com/gravitational/teleport/api/types"
apievents "github.com/gravitational/teleport/api/types/events"
"github.com/gravitational/teleport/entitlements"
"github.com/gravitational/teleport/lib/auth/authclient"
"github.com/gravitational/teleport/lib/events"
testingkubemock "github.com/gravitational/teleport/lib/kube/proxy/testing/kube_server"
"github.com/gravitational/teleport/lib/modules"
"github.com/gravitational/teleport/lib/modules/modulestest"
sessionpkg "github.com/gravitational/teleport/lib/session"
)
func TestModeratedSessions(t *testing.T) {
// enable enterprise features to have access to ModeratedSessions.
modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise, TestFeatures: modules.Features{
Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
entitlements.K8s: {Enabled: true},
},
}})
t.Parallel()
const (
moderatorUsername = "moderator_user"
moderatorRoleName = "mod_role"
@@ -90,6 +83,7 @@ func TestModeratedSessions(t *testing.T) {
context.Background(),
t,
TestConfig{
Modules: modulestest.EnterpriseModules(),
Clusters: []KubeClusterConfig{{Name: kubeCluster, APIEndpoint: kubeMock.URL}},
// onEvent is called each time a new event is produced. We only care about
// sessionEnd events.
@@ -512,12 +506,7 @@ func validateSessionTracker(testCtx *TestContext, sessionID string, reason strin
// covered by the integration test mentioned above because we need to fake the
// Lock watcher connection to be stale and it takes ~5 minutes to happen.
func TestInteractiveSessionsNoAuth(t *testing.T) {
// enable enterprise features to have access to ModeratedSessions.
modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise, TestFeatures: modules.Features{
Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
entitlements.K8s: {Enabled: true},
},
}})
t.Parallel()
const (
moderatorUsername = "moderator_user"
moderatorRoleName = "mod_role"
@@ -547,6 +536,7 @@ func TestInteractiveSessionsNoAuth(t *testing.T) {
context.Background(),
t,
TestConfig{
Modules: modulestest.EnterpriseModules(),
Clusters: []KubeClusterConfig{{Name: kubeCluster, APIEndpoint: kubeMock.URL}},
WrapAuthClient: func(client authclient.ClientI) authclient.ClientI {
authClient.ClientI = client
lib/kube/proxy/utils_test.go
+4
View File
@@ -19,6 +19,7 @@
package proxy
import (
"cmp"
"context"
"crypto/ecdsa"
"crypto/tls"
@@ -64,6 +65,7 @@ import (
"github.com/gravitational/teleport/lib/kube/proxy/streamproto"
"github.com/gravitational/teleport/lib/limiter"
"github.com/gravitational/teleport/lib/modules"
"github.com/gravitational/teleport/lib/modules/modulestest"
"github.com/gravitational/teleport/lib/multiplexer"
"github.com/gravitational/teleport/lib/reversetunnel"
"github.com/gravitational/teleport/lib/reversetunnelclient"
@@ -103,6 +105,7 @@ type KubeClusterConfig struct {
// TestConfig defines the suite options.
type TestConfig struct {
Modules *modulestest.Modules
Clusters []KubeClusterConfig
ResourceMatchers []services.ResourceMatcher
OnReconcile func(types.KubeClusters)
@@ -143,6 +146,7 @@ func SetupTestContext(ctx context.Context, t *testing.T, cfg TestConfig) *TestCo
Streamer: streamer,
UploadHandler: testCtx.UploadHandler,
Dir: t.TempDir(),
Modules: cmp.Or(cfg.Modules, modulestest.OSSModules()),
})
require.NoError(t, err)
t.Cleanup(func() { require.NoError(t, authServer.Close()) })
tool/tctl/common/admin_action_test.go
+9 -9
View File
@@ -1056,15 +1056,6 @@ func newAdminActionTestSuite(t *testing.T) *adminActionTestSuite {
t.Helper()
ctx := context.Background()
modulestest.SetTestModules(t, modulestest.Modules{
TestBuildType: modules.BuildEnterprise,
TestFeatures: modules.Features{
Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
entitlements.OIDC: {Enabled: true},
entitlements.SAML: {Enabled: true},
},
},
})
authPref, err := types.NewAuthPreference(types.AuthPreferenceSpecV2{
Type: constants.Local,
@@ -1080,6 +1071,15 @@ func newAdminActionTestSuite(t *testing.T) *adminActionTestSuite {
process, err := testserver.NewTeleportProcess(t.TempDir(),
testserver.WithAuthPreference(authPref),
testserver.WithConfig(func(cfg *servicecfg.Config) {
cfg.Modules = &modulestest.Modules{
TestBuildType: modules.BuildEnterprise,
TestFeatures: modules.Features{
Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
entitlements.OIDC: {Enabled: true},
entitlements.SAML: {Enabled: true},
},
},
}
proxyPublicAddr = cfg.Proxy.WebAddr
proxyPublicAddr.Addr = fmt.Sprintf("localhost:%v", proxyPublicAddr.Port(0))
cfg.Proxy.PublicAddrs = []utils.NetAddr{proxyPublicAddr}
tool/tctl/common/edit_command_test.go
+22 -16
View File
@@ -51,6 +51,7 @@ import (
"github.com/gravitational/teleport/lib/defaults"
"github.com/gravitational/teleport/lib/modules"
"github.com/gravitational/teleport/lib/modules/modulestest"
"github.com/gravitational/teleport/lib/service/servicecfg"
"github.com/gravitational/teleport/lib/services"
"github.com/gravitational/teleport/lib/utils/log/logtest"
"github.com/gravitational/teleport/tool/tctl/common/resources"
@@ -58,10 +59,13 @@ import (
)
func TestEditResources(t *testing.T) {
modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
t.Parallel()
log := logtest.NewLogger()
process, err := testenv.NewTeleportProcess(t.TempDir(), testenv.WithLogger(log))
process, err := testenv.NewTeleportProcess(t.TempDir(),
testenv.WithConfig(func(cfg *servicecfg.Config) {
cfg.Modules = modulestest.EnterpriseModules()
}),
testenv.WithLogger(log))
require.NoError(t, err)
t.Cleanup(func() {
require.NoError(t, process.Close())
@@ -375,22 +379,24 @@ func testEditSessionRecordingConfig(t *testing.T, clt *authclient.Client) {
}
// TestEditEnterpriseResources asserts that tctl edit
// behaves as expected for enterprise resources. These resources cannot
// be tested in parallel because they alter the modules to enable features.
// The tests are grouped to amortize the cost of creating and auth server since
// behaves as expected for enterprise resources. The tests are
// grouped to amortize the cost of creating and auth server since
// that is the most expensive part of testing editing the resource.
func TestEditEnterpriseResources(t *testing.T) {
modulestest.SetTestModules(t, modulestest.Modules{
TestBuildType: modules.BuildEnterprise,
TestFeatures: modules.Features{
Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
entitlements.OIDC: {Enabled: true},
entitlements.SAML: {Enabled: true},
},
},
})
log := logtest.NewLogger()
process, err := testenv.NewTeleportProcess(t.TempDir(), testenv.WithLogger(log))
process, err := testenv.NewTeleportProcess(t.TempDir(),
testenv.WithConfig(func(cfg *servicecfg.Config) {
cfg.Modules = &modulestest.Modules{
TestBuildType: modules.BuildEnterprise,
TestFeatures: modules.Features{
Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
entitlements.OIDC: {Enabled: true},
entitlements.SAML: {Enabled: true},
},
},
}
}),
testenv.WithLogger(log))
require.NoError(t, err)
t.Cleanup(func() {
require.NoError(t, process.Close())
tool/tctl/common/resource_command_test.go
+14 -13
View File
@@ -60,6 +60,7 @@ import (
"github.com/gravitational/teleport/lib/modules"
"github.com/gravitational/teleport/lib/modules/modulestest"
scopedaccess "github.com/gravitational/teleport/lib/scopes/access"
"github.com/gravitational/teleport/lib/service/servicecfg"
"github.com/gravitational/teleport/lib/services"
"github.com/gravitational/teleport/lib/utils/log/logtest"
"github.com/gravitational/teleport/tool/tctl/common/databaseobject"
@@ -2436,22 +2437,22 @@ version: v1
}
// TestCreateEnterpriseResources asserts that tctl create
// behaves as expected for enterprise resources. These resources cannot
// be tested in parallel because they alter the modules to enable features.
// The tests are grouped to amortize the cost of creating and auth server since
// behaves as expected for enterprise resources. The tests are
// grouped to amortize the cost of creating and auth server since
// that is the most expensive part of testing editing the resource.
func TestCreateEnterpriseResources(t *testing.T) {
modulestest.SetTestModules(t, modulestest.Modules{
TestBuildType: modules.BuildEnterprise,
TestFeatures: modules.Features{
Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
entitlements.OIDC: {Enabled: true},
entitlements.SAML: {Enabled: true},
t.Parallel()
process, err := testenv.NewTeleportProcess(t.TempDir(), testenv.WithConfig(func(cfg *servicecfg.Config) {
cfg.Modules = &modulestest.Modules{
TestBuildType: modules.BuildEnterprise,
TestFeatures: modules.Features{
Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
entitlements.OIDC: {Enabled: true},
entitlements.SAML: {Enabled: true},
},
},
},
})
process, err := testenv.NewTeleportProcess(t.TempDir())
}
}))
require.NoError(t, err)
t.Cleanup(func() {
require.NoError(t, process.Close())
tool/tsh/common/access_request_test.go
+2 -11
View File
@@ -29,24 +29,13 @@ import (
"github.com/stretchr/testify/require"
"github.com/gravitational/teleport/api/types"
"github.com/gravitational/teleport/entitlements"
"github.com/gravitational/teleport/lib/asciitable"
"github.com/gravitational/teleport/lib/modules"
"github.com/gravitational/teleport/lib/modules/modulestest"
"github.com/gravitational/teleport/lib/service/servicecfg"
"github.com/gravitational/teleport/lib/utils"
)
func TestAccessRequestSearch(t *testing.T) {
modulestest.SetTestModules(t, modulestest.Modules{
TestBuildType: modules.BuildEnterprise,
TestFeatures: modules.Features{
Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
entitlements.K8s: {Enabled: true},
},
},
},
)
ctx := context.Background()
const (
rootClusterName = "root-cluster"
@@ -56,6 +45,7 @@ func TestAccessRequestSearch(t *testing.T) {
)
s := newTestSuite(t,
withRootConfigFunc(func(cfg *servicecfg.Config) {
cfg.Modules = modulestest.EnterpriseModules()
cfg.InsecureMode = true
cfg.Auth.ClusterName.SetClusterName(rootClusterName)
cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
@@ -67,6 +57,7 @@ func TestAccessRequestSearch(t *testing.T) {
withLeafCluster(),
withLeafConfigFunc(
func(cfg *servicecfg.Config) {
cfg.Modules = modulestest.EnterpriseModules()
cfg.InsecureMode = true
cfg.Auth.ClusterName.SetClusterName(leafClusterName)
cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
tool/tsh/common/db_test.go
+4 -12
View File
@@ -42,12 +42,10 @@ import (
apidefaults "github.com/gravitational/teleport/api/defaults"
"github.com/gravitational/teleport/api/types"
"github.com/gravitational/teleport/api/utils/keys"
"github.com/gravitational/teleport/entitlements"
"github.com/gravitational/teleport/lib/client"
"github.com/gravitational/teleport/lib/cryptosuites"
"github.com/gravitational/teleport/lib/defaults"
"github.com/gravitational/teleport/lib/fixtures"
"github.com/gravitational/teleport/lib/modules"
"github.com/gravitational/teleport/lib/modules/modulestest"
"github.com/gravitational/teleport/lib/observability/tracing"
"github.com/gravitational/teleport/lib/service"
@@ -77,16 +75,6 @@ func TestTshDB(t *testing.T) {
// will fail. The fake engine registered are not functional. But other
// Enterprise features like Access Request can still be tested.
registerFakeEnterpriseDBEngines(t)
modulestest.SetTestModules(t,
modulestest.Modules{
TestBuildType: modules.BuildEnterprise,
TestFeatures: modules.Features{
Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
entitlements.DB: {Enabled: true},
},
},
},
)
// this speeds up test suite setup substantially, which is where
// tests spend the majority of their time, especially when leaf
@@ -150,6 +138,7 @@ func testDatabaseLogin(t *testing.T) {
alice.SetRoles([]string{"dev-access", "autouser", "access-requestor"})
s := newTestSuite(t,
withRootConfigFunc(func(cfg *servicecfg.Config) {
cfg.Modules = modulestest.EnterpriseModules()
cfg.InsecureMode = true
cfg.Auth.BootstrapResources = append(
cfg.Auth.BootstrapResources,
@@ -698,6 +687,7 @@ func testListDatabase(t *testing.T) {
fullName := "root-postgres-rds-us-west-1-123456789012"
s := newTestSuite(t,
withRootConfigFunc(func(cfg *servicecfg.Config) {
cfg.Modules = modulestest.EnterpriseModules()
cfg.InsecureMode = true
cfg.Auth.StorageConfig.Params["poll_stream_period"] = 50 * time.Millisecond
cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
@@ -721,6 +711,7 @@ func testListDatabase(t *testing.T) {
}),
withLeafCluster(),
withLeafConfigFunc(func(cfg *servicecfg.Config) {
cfg.Modules = modulestest.EnterpriseModules()
cfg.Auth.StorageConfig.Params["poll_stream_period"] = 50 * time.Millisecond
cfg.InsecureMode = true
cfg.SSH.Enabled = false
@@ -1592,6 +1583,7 @@ func testDatabaseSelection(t *testing.T) {
alice.SetRoles([]string{"access"})
s := newTestSuite(t,
withRootConfigFunc(func(cfg *servicecfg.Config) {
cfg.Modules = modulestest.EnterpriseModules()
cfg.Auth.BootstrapResources = append(cfg.Auth.BootstrapResources, alice)
cfg.InsecureMode = true
cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex)
tool/tsh/common/kube_test.go
+1 -13
View File
@@ -46,12 +46,10 @@ import (
"github.com/gravitational/teleport/api/types"
apiutils "github.com/gravitational/teleport/api/utils"
"github.com/gravitational/teleport/api/utils/keypaths"
"github.com/gravitational/teleport/entitlements"
"github.com/gravitational/teleport/lib/asciitable"
"github.com/gravitational/teleport/lib/defaults"
"github.com/gravitational/teleport/lib/kube/kubeconfig"
kubeserver "github.com/gravitational/teleport/lib/kube/proxy/testing/kube_server"
"github.com/gravitational/teleport/lib/modules"
"github.com/gravitational/teleport/lib/modules/modulestest"
"github.com/gravitational/teleport/lib/service/servicecfg"
"github.com/gravitational/teleport/lib/services"
@@ -320,17 +318,6 @@ func (p *kubeTestPack) testListKube(t *testing.T) {
// Tests `tsh kube login`, `tsh proxy kube`.
func TestKubeSelection(t *testing.T) {
modulestest.SetTestModules(t,
modulestest.Modules{
TestBuildType: modules.BuildEnterprise,
TestFeatures: modules.Features{
Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
entitlements.K8s: {Enabled: true},
},
},
},
)
oldResyncInterval := defaults.ResyncInterval
defaults.ResyncInterval = 100 * time.Millisecond
// To detect tests that run in parallel incorrectly, call t.Setenv with a
@@ -366,6 +353,7 @@ func TestKubeSelection(t *testing.T) {
t.Cleanup(cancel)
s := newTestSuite(t,
withRootConfigFunc(func(cfg *servicecfg.Config) {
cfg.Modules = modulestest.EnterpriseModules()
cfg.InsecureMode = true
// reconfig the user to use the new role instead of the default ones
// User is the second bootstrap resource.
tool/tsh/common/tsh_test.go
+21 -11
View File
@@ -2331,7 +2331,7 @@ func TestNoRelogin(t *testing.T) {
// ssh server using a resource access request when "tsh ssh" fails with
// AccessDenied.
func TestSSHAccessRequest(t *testing.T) {
modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
t.Parallel()
ctx, cancel := context.WithCancel(context.Background())
defer cancel()
@@ -2380,6 +2380,9 @@ func TestSSHAccessRequest(t *testing.T) {
alice.SetTraits(traits)
rootAuth, rootProxy := makeTestServers(t,
withConfig(func(cfg *servicecfg.Config) {
cfg.Modules = modulestest.EnterpriseModules()
}),
withBootstrap(requester, searchOnlyRequester, nodeAccessRole, emptyRole, connector, alice),
// Do not use a fake clock to better imitate real-world behavior.
)
@@ -2776,8 +2779,7 @@ func TestAccessRequestOnLeaf(t *testing.T) {
// TestSSHAccessRequestWait tests that "tsh ssh" automatically creates an
// access request when required and properly waits for it to be approved.
func TestSSHAccessRequestWait(t *testing.T) {
// Access requests require enterprise.
modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
t.Parallel()
ctx, cancel := context.WithCancel(context.Background())
defer cancel()
@@ -2815,6 +2817,9 @@ func TestSSHAccessRequestWait(t *testing.T) {
// Create the cluster with our user and roles.
rootAuth, rootProxy := makeTestServers(t,
withConfig(func(cfg *servicecfg.Config) {
cfg.Modules = modulestest.EnterpriseModules()
}),
withBootstrap(requester, nodeAccessRole, connector, alice),
)
@@ -2913,7 +2918,7 @@ func TestSSHAccessRequestWait(t *testing.T) {
// TestSSHCommand tests that a user can access a single SSH node and run commands.
func TestSSHCommands(t *testing.T) {
modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
t.Parallel()
ctx := t.Context()
accessRoleName := "access"
@@ -2940,6 +2945,7 @@ func TestSSHCommands(t *testing.T) {
testserver.WithSSHLabel(accessRoleName, "true"),
testserver.WithSSHPublicAddrs("127.0.0.1:0"),
testserver.WithConfig(func(cfg *servicecfg.Config) {
cfg.Modules = modulestest.EnterpriseModules()
cfg.SSH.Enabled = true
cfg.SSH.PublicAddrs = []utils.NetAddr{cfg.SSH.Addr}
cfg.SSH.DisableCreateHostUser = true
@@ -3008,7 +3014,8 @@ func TestSSHCommands(t *testing.T) {
expected: "-- this is a test message",
args: []string{
fmt.Sprintf("%s@%s", user.Username, sshHostname),
"echo",
// /bin/echo avoids shell builtins (fish, zsh) that strip a leading -- as end-of-options.
"/bin/echo",
"--",
"this is a test message",
},
@@ -3040,7 +3047,8 @@ func TestSSHCommands(t *testing.T) {
expected: "-- this is a test message",
args: []string{
fmt.Sprintf("%s@%s", user.Username, sshHostname),
"echo", "-- this is a test message",
// /bin/echo avoids shell builtins (fish, zsh) that strip a leading -- as end-of-options.
"/bin/echo", "-- this is a test message",
},
shouldErr: false,
},
@@ -3418,8 +3426,6 @@ func TestSSHHeadlessCLIFlags(t *testing.T) {
}
func TestSSHHeadless(t *testing.T) {
modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
ctx, cancel := context.WithCancel(context.Background())
t.Cleanup(cancel)
@@ -3458,6 +3464,7 @@ func TestSSHHeadless(t *testing.T) {
sshHostname := "test-ssh-host"
server, err := testserver.NewTeleportProcess(t.TempDir(),
testserver.WithConfig(func(cfg *servicecfg.Config) {
cfg.Modules = modulestest.EnterpriseModules()
cfg.Hostname = sshHostname
cfg.Auth.Enabled = true
cfg.Proxy.Enabled = true
@@ -3553,7 +3560,6 @@ func TestSSHHeadless(t *testing.T) {
}
func TestHeadlessDoesNotAddKeysToAgent(t *testing.T) {
modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
agentKeyring, _ := createAgent(t)
ctx, cancel := context.WithCancel(context.Background())
@@ -3582,6 +3588,7 @@ func TestHeadlessDoesNotAddKeysToAgent(t *testing.T) {
server, err := testserver.NewTeleportProcess(t.TempDir(),
testserver.WithConfig(func(cfg *servicecfg.Config) {
cfg.Modules = modulestest.EnterpriseModules()
cfg.Hostname = sshHostname
cfg.Auth.Enabled = true
cfg.Proxy.Enabled = true
@@ -7247,7 +7254,7 @@ func TestRolesToString(t *testing.T) {
// TestResolve tests that host resolution works for various inputs and
// that proxy templates are respected.
func TestResolve(t *testing.T) {
modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
t.Parallel()
ctx := t.Context()
accessRoleName := "access"
@@ -7273,6 +7280,7 @@ func TestResolve(t *testing.T) {
testserver.WithClusterName("root"),
testserver.WithSSHPublicAddrs("127.0.0.1:0"),
testserver.WithConfig(func(cfg *servicecfg.Config) {
cfg.Modules = modulestest.EnterpriseModules()
cfg.SSH.Enabled = true
cfg.SSH.PublicAddrs = []utils.NetAddr{cfg.SSH.Addr}
cfg.SSH.DisableCreateHostUser = true
@@ -7291,6 +7299,7 @@ func TestResolve(t *testing.T) {
node, err := testserver.NewTeleportProcess(t.TempDir(),
testserver.WithConfig(func(cfg *servicecfg.Config) {
cfg.Modules = modulestest.EnterpriseModules()
cfg.SetAuthServerAddresses(rootServer.Config.AuthServerAddresses())
cfg.Hostname = "second-node"
cfg.Auth.Enabled = false
@@ -7546,7 +7555,6 @@ func TestVersionCompatibilityFlags(t *testing.T) {
// TestSCP validates that tsh scp correctly copy file content while also
// ensuring that proxy templates are respected.
func TestSCP(t *testing.T) {
modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise})
ctx := t.Context()
accessRoleName := "access"
@@ -7572,6 +7580,7 @@ func TestSCP(t *testing.T) {
testserver.WithClusterName("root"),
testserver.WithSSHPublicAddrs("127.0.0.1:0"),
testserver.WithConfig(func(cfg *servicecfg.Config) {
cfg.Modules = modulestest.EnterpriseModules()
cfg.SSH.Enabled = true
cfg.SSH.PublicAddrs = []utils.NetAddr{cfg.SSH.Addr}
cfg.SSH.DisableCreateHostUser = true
@@ -7592,6 +7601,7 @@ func TestSCP(t *testing.T) {
const secondServerHostname = "second-node"
server, err := testserver.NewTeleportProcess(t.TempDir(),
testserver.WithConfig(func(cfg *servicecfg.Config) {
cfg.Modules = modulestest.EnterpriseModules()
cfg.SetAuthServerAddresses(rootServer.Config.AuthServerAddresses())
cfg.Hostname = secondServerHostname
cfg.Auth.Enabled = false