diff --git a/.golangci.yml b/.golangci.yml index 30b219b3725..fc7e5d75ca6 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -227,8 +227,7 @@ linters: - '!**/e/lib/jamf/testenv/**' - '!**/e/lib/operatortest/**' - '!**/e/tests/**' - - '!**/integration/db/fixture.go' - - '!**/integration/helpers/**' + - '!**/integration/**' - '!**/integrations/lib/testing/**' - '!**/integrations/operator/controllers/resources/testlib/**.go' - '!**/lib/auth/authtest/**' diff --git a/integration/appaccess/appaccess_test.go b/integration/appaccess/appaccess_test.go index f9c1a39f996..5bd77988f2a 100644 --- a/integration/appaccess/appaccess_test.go +++ b/integration/appaccess/appaccess_test.go @@ -41,12 +41,9 @@ import ( "github.com/gravitational/teleport" "github.com/gravitational/teleport/api/types" apievents "github.com/gravitational/teleport/api/types/events" - "github.com/gravitational/teleport/entitlements" "github.com/gravitational/teleport/integration/helpers" "github.com/gravitational/teleport/lib/events" "github.com/gravitational/teleport/lib/httplib/reverseproxy" - "github.com/gravitational/teleport/lib/modules" - "github.com/gravitational/teleport/lib/modules/modulestest" "github.com/gravitational/teleport/lib/service" "github.com/gravitational/teleport/lib/service/servicecfg" "github.com/gravitational/teleport/lib/srv/app/common" @@ -287,14 +284,6 @@ func testForwardModes(p *Pack, t *testing.T) { // testClientCert tests mutual TLS authentication flow with application // access typically used in CLI by curl and other clients. func testClientCert(p *Pack, t *testing.T) { - modulestest.SetTestModules(t, modulestest.Modules{ - TestBuildType: modules.BuildEnterprise, - TestFeatures: modules.Features{ - Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{ - entitlements.App: {Enabled: true}, - }, - }, - }) evilUser, _ := p.CreateUser(t) rootWs := p.CreateAppSession(t, CreateAppSessionParams{ Username: p.username, diff --git a/integration/appaccess/fixtures.go b/integration/appaccess/fixtures.go index 553f57b2a00..3d508282b51 100644 --- a/integration/appaccess/fixtures.go +++ b/integration/appaccess/fixtures.go @@ -38,6 +38,7 @@ import ( "github.com/gravitational/teleport/api/breaker" "github.com/gravitational/teleport/integration/helpers" "github.com/gravitational/teleport/lib/auth/testauthority" + "github.com/gravitational/teleport/lib/modules/modulestest" "github.com/gravitational/teleport/lib/service/servicecfg" "github.com/gravitational/teleport/lib/utils" "github.com/gravitational/teleport/lib/utils/log/logtest" @@ -320,6 +321,7 @@ func SetupWithOptions(t *testing.T, opts AppTestOptions) *Pack { Priv: privateKey, Pub: publicKey, Logger: log, + Modules: modulestest.EnterpriseModules(), } if opts.RootClusterListeners != nil { rootCfg.Listeners = opts.RootClusterListeners(t, &rootCfg.Fds) @@ -335,6 +337,7 @@ func SetupWithOptions(t *testing.T, opts AppTestOptions) *Pack { Priv: privateKey, Pub: publicKey, Logger: log, + Modules: modulestest.EnterpriseModules(), } if opts.LeafClusterListeners != nil { leafCfg.Listeners = opts.LeafClusterListeners(t, &leafCfg.Fds) @@ -344,6 +347,7 @@ func SetupWithOptions(t *testing.T, opts AppTestOptions) *Pack { rcConf := servicecfg.MakeDefaultConfig() // Insecure development mode needs to be set because the web proxy uses a // self-signed certificate during tests. + rcConf.Modules = rootCfg.Modules rcConf.InsecureMode = true rcConf.Logger = log rcConf.DataDir = t.TempDir() @@ -362,6 +366,7 @@ func SetupWithOptions(t *testing.T, opts AppTestOptions) *Pack { rcConf.Clock = opts.Clock lcConf := servicecfg.MakeDefaultConfig() + lcConf.Modules = leafCfg.Modules // Insecure development mode needs to be set because the web proxy uses a // self-signed certificate during tests. lcConf.InsecureMode = true diff --git a/integration/db/db_integration_test.go b/integration/db/db_integration_test.go index 8d8e6f572d2..318e6547d41 100644 --- a/integration/db/db_integration_test.go +++ b/integration/db/db_integration_test.go @@ -36,12 +36,10 @@ import ( "golang.org/x/sync/errgroup" "github.com/gravitational/teleport/api/types" - "github.com/gravitational/teleport/entitlements" "github.com/gravitational/teleport/integration/helpers" "github.com/gravitational/teleport/lib/auth" "github.com/gravitational/teleport/lib/defaults" "github.com/gravitational/teleport/lib/events" - "github.com/gravitational/teleport/lib/modules" "github.com/gravitational/teleport/lib/modules/modulestest" "github.com/gravitational/teleport/lib/service/servicecfg" "github.com/gravitational/teleport/lib/services" @@ -63,10 +61,12 @@ func TestDatabaseAccess(t *testing.T) { pack := SetupDatabaseTest(t, // set tighter rotation intervals WithLeafConfig(func(config *servicecfg.Config) { + config.Modules = modulestest.EnterpriseModules() config.PollingPeriod = 5 * time.Second config.RotationConnectionInterval = 2 * time.Second }), WithRootConfig(func(config *servicecfg.Config) { + config.Modules = modulestest.EnterpriseModules() config.PollingPeriod = 5 * time.Second config.RotationConnectionInterval = 2 * time.Second config.Proxy.MySQLServerVersion = "8.0.1" @@ -104,15 +104,6 @@ func TestDatabaseAccessSeparateListeners(t *testing.T) { // testIPPinning tests a scenario where a user with IP pinning // connects to a database func (p *DatabasePack) testIPPinning(t *testing.T) { - modulestest.SetTestModules(t, modulestest.Modules{ - TestBuildType: modules.BuildEnterprise, - TestFeatures: modules.Features{ - Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{ - entitlements.DB: {Enabled: true}, - }, - }, - }) - type testCase struct { desc string targetCluster databaseClusterPack diff --git a/integration/helpers/instance.go b/integration/helpers/instance.go index 3ef4c75d7d1..f77170c4828 100644 --- a/integration/helpers/instance.go +++ b/integration/helpers/instance.go @@ -455,6 +455,7 @@ func NewInstance(t *testing.T, cfg InstanceConfig) *TeleInstance { Log: cfg.Logger, InstanceListeners: *cfg.Listeners, Fds: cfg.Fds, + Modules: cfg.Modules, } secrets := InstanceSecrets{ diff --git a/integration/integration_test.go b/integration/integration_test.go index 923c5b2a58a..7475a0fb090 100644 --- a/integration/integration_test.go +++ b/integration/integration_test.go @@ -91,7 +91,6 @@ import ( "github.com/gravitational/teleport/lib/events" "github.com/gravitational/teleport/lib/events/eventstest" "github.com/gravitational/teleport/lib/events/filesessions" - "github.com/gravitational/teleport/lib/modules" "github.com/gravitational/teleport/lib/modules/modulestest" "github.com/gravitational/teleport/lib/multiplexer" "github.com/gravitational/teleport/lib/reversetunnelclient" @@ -210,12 +209,11 @@ func TestIntegrations(t *testing.T) { // testDifferentPinnedIP tests connection is rejected when source IP doesn't match the pinned one func testDifferentPinnedIP(t *testing.T, suite *integrationTestSuite) { - modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise}) - tr := utils.NewTracer(utils.ThisFunction()).Start() defer tr.Stop() tconf := suite.defaultServiceConfig() + tconf.Modules = modulestest.EnterpriseModules() tconf.Auth.Enabled = true tconf.Proxy.Enabled = true tconf.SSH.Enabled = true @@ -7657,15 +7655,17 @@ func isNilOrEOFErr(t *testing.T, err error) { } func testModeratedSFTP(t *testing.T, suite *integrationTestSuite) { - modulestest.SetTestModules(t, modulestest.Modules{ - TestBuildType: modules.BuildEnterprise, - }) - // Create Teleport instance - instance := suite.newTeleport(t, nil, true) - t.Cleanup(func() { - instance.StopAll() - }) + tconf := suite.defaultServiceConfig() + tconf.Modules = modulestest.EnterpriseModules() + tconf.Auth.Enabled = true + tconf.Proxy.Enabled = true + tconf.SSH.Enabled = true + + instance := suite.NewTeleportInstance(t) + require.NoError(t, instance.CreateEx(t, nil, tconf)) + require.NoError(t, instance.Start()) + t.Cleanup(func() { instance.StopAll() }) ctx := context.Background() authServer := instance.Process.GetAuthServer() @@ -8575,8 +8575,6 @@ func TestProxySSHPortMultiplexing(t *testing.T) { // can/cannot be established with an existing certificate // based on cluster configuration or roles. func TestConnectivityWithoutAuth(t *testing.T) { - modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise}) - tests := []struct { name string adjustRole func(r types.Role) @@ -8637,6 +8635,7 @@ func TestConnectivityWithoutAuth(t *testing.T) { // Create auth config. authCfg := servicecfg.MakeDefaultConfig() + authCfg.Modules = modulestest.EnterpriseModules() authCfg.Logger = logtest.NewLogger() authCfg.CircuitBreakerConfig = breaker.NoopBreakerConfig() authCfg.InstanceMetadataClient = imds.NewDisabledIMDSClient() @@ -8656,6 +8655,7 @@ func TestConnectivityWithoutAuth(t *testing.T) { Priv: privateKey, Pub: publicKey, Logger: logtest.NewLogger(), + Modules: authCfg.Modules, }) // Create a user and role. @@ -8691,10 +8691,12 @@ func TestConnectivityWithoutAuth(t *testing.T) { Priv: privateKey, Pub: publicKey, Logger: logtest.NewLogger(), + Modules: authCfg.Modules, }) // Create node config. nodeCfg := servicecfg.MakeDefaultConfig() + nodeCfg.Modules = authCfg.Modules nodeCfg.SetAuthServerAddress(authCfg.Auth.ListenAddr) nodeCfg.SetToken("token") nodeCfg.CachePolicy.Enabled = true @@ -8937,8 +8939,6 @@ func TestConnectivityDuringAuthRestart(t *testing.T) { } func testModeratedSessions(t *testing.T, suite *integrationTestSuite) { - modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise}) - const password = "supersecretpassword" inputReader := prompt.NewFakeReader(). AddString(password). @@ -8969,6 +8969,7 @@ func testModeratedSessions(t *testing.T, suite *integrationTestSuite) { // Enable web service. cfg := suite.defaultServiceConfig() + cfg.Modules = modulestest.EnterpriseModules() cfg.Auth.Enabled = true cfg.Auth.Preference.SetSecondFactors(types.SecondFactorType_SECOND_FACTOR_TYPE_WEBAUTHN) cfg.Auth.Preference.(*types.AuthPreferenceV2).Spec.RequireMFAType = types.RequireMFAType_SESSION diff --git a/integration/kube_integration_test.go b/integration/kube_integration_test.go index 554bdf258e4..b6e1e08225e 100644 --- a/integration/kube_integration_test.go +++ b/integration/kube_integration_test.go @@ -71,7 +71,6 @@ import ( "github.com/gravitational/teleport/api/constants" "github.com/gravitational/teleport/api/profile" "github.com/gravitational/teleport/api/types" - "github.com/gravitational/teleport/entitlements" "github.com/gravitational/teleport/integration/helpers" "github.com/gravitational/teleport/integration/kube" "github.com/gravitational/teleport/lib/auth/authclient" @@ -80,7 +79,6 @@ import ( "github.com/gravitational/teleport/lib/cloud/imds" "github.com/gravitational/teleport/lib/defaults" kubeutils "github.com/gravitational/teleport/lib/kube/utils" - "github.com/gravitational/teleport/lib/modules" "github.com/gravitational/teleport/lib/modules/modulestest" "github.com/gravitational/teleport/lib/service" "github.com/gravitational/teleport/lib/service/servicecfg" @@ -1545,16 +1543,8 @@ func testKubeTransportProtocol(t *testing.T, suite *KubeSuite) { // TODO: test against tsh kubectl func testKubeEphemeralContainers(t *testing.T, suite *KubeSuite) { - modulestest.SetTestModules(t, modulestest.Modules{ - TestBuildType: modules.BuildEnterprise, - TestFeatures: modules.Features{ - Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{ - entitlements.K8s: {Enabled: true}, - }, - }, - }) - tconf := suite.teleKubeConfig(Host) + tconf.Modules = modulestest.EnterpriseModules() teleport := helpers.NewInstance(t, helpers.InstanceConfig{ ClusterName: helpers.Site, HostID: helpers.HostID, @@ -1562,6 +1552,7 @@ func testKubeEphemeralContainers(t *testing.T, suite *KubeSuite) { Priv: suite.priv, Pub: suite.pub, Logger: suite.log, + Modules: tconf.Modules, }) username := suite.me.Username diff --git a/integration/proxy/proxy_tunnel_strategy_test.go b/integration/proxy/proxy_tunnel_strategy_test.go index 351cf00bee0..dc164ba2fb1 100644 --- a/integration/proxy/proxy_tunnel_strategy_test.go +++ b/integration/proxy/proxy_tunnel_strategy_test.go @@ -32,14 +32,12 @@ import ( apidefaults "github.com/gravitational/teleport/api/defaults" "github.com/gravitational/teleport/api/types" - "github.com/gravitational/teleport/entitlements" "github.com/gravitational/teleport/integration/helpers" "github.com/gravitational/teleport/lib/auth/authclient" "github.com/gravitational/teleport/lib/auth/authtest" "github.com/gravitational/teleport/lib/auth/testauthority" "github.com/gravitational/teleport/lib/cloud/imds" "github.com/gravitational/teleport/lib/defaults" - "github.com/gravitational/teleport/lib/modules" "github.com/gravitational/teleport/lib/modules/modulestest" "github.com/gravitational/teleport/lib/service" "github.com/gravitational/teleport/lib/service/servicecfg" @@ -150,6 +148,8 @@ func TestProxyTunnelStrategyAgentMesh(t *testing.T) { // TestProxyTunnelStrategyProxyPeering tests the proxy-peer tunnel strategy. func TestProxyTunnelStrategyProxyPeering(t *testing.T) { + t.Parallel() + // NOTE(eriktate): Testing database tunnels appears to be flaky (or possibly never works?) // so we currently skip adding a database altogether in order to ensure peered tunnels have // some automatic test coverage. Gating this behind a flag in case we want to restore the @@ -159,16 +159,6 @@ func TestProxyTunnelStrategyProxyPeering(t *testing.T) { } func testProxyTunnelStrategyProxyPeering(t *testing.T, withDB bool) { - // This test cannot run in parallel as set module changes the global state. - modulestest.SetTestModules(t, modulestest.Modules{ - TestBuildType: modules.BuildEnterprise, - TestFeatures: modules.Features{ - Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{ - entitlements.DB: {Enabled: true}, - }, - }, - }) - p := newProxyTunnelStrategy(t, "proxy-tunnel-proxy-peer", &types.TunnelStrategyV1{ Strategy: &types.TunnelStrategyV1_ProxyPeering{ @@ -313,11 +303,13 @@ func (p *proxyTunnelStrategy) makeAuth(t *testing.T) { Priv: privateKey, Pub: publicKey, Logger: logtest.NewLogger(), + Modules: modulestest.EnterpriseModules(), }) auth.AddUser(p.username, []string{p.username}) conf := servicecfg.MakeDefaultConfig() + conf.Modules = auth.Modules conf.DataDir = t.TempDir() conf.Logger = auth.Log @@ -342,11 +334,13 @@ func (p *proxyTunnelStrategy) makeProxy(t *testing.T) { HostID: uuid.New().String(), NodeName: helpers.Loopback, Logger: logtest.NewLogger(), + Modules: modulestest.EnterpriseModules(), }) authAddr := utils.MustParseAddr(p.auth.Auth) conf := servicecfg.MakeDefaultConfig() + conf.Modules = proxy.Modules conf.DebugService.Enabled = false conf.SetAuthServerAddress(*authAddr) conf.SetToken("token") @@ -391,9 +385,11 @@ func (p *proxyTunnelStrategy) makeNode(t *testing.T) { HostID: uuid.New().String(), NodeName: helpers.Loopback, Logger: logtest.NewLogger(), + Modules: modulestest.EnterpriseModules(), }) conf := servicecfg.MakeDefaultConfig() + conf.Modules = node.Modules conf.Version = types.V3 conf.SetToken("token") conf.DataDir = t.TempDir() @@ -439,9 +435,11 @@ func (p *proxyTunnelStrategy) makeDatabase(t *testing.T) { HostID: uuid.New().String(), NodeName: helpers.Loopback, Logger: logtest.NewLogger(), + Modules: modulestest.EnterpriseModules(), }) conf := servicecfg.MakeDefaultConfig() + conf.Modules = db.Modules conf.DebugService.Enabled = false conf.Version = types.V3 conf.SetToken("token") diff --git a/integrations/operator/controllers/resources/testlib/env.go b/integrations/operator/controllers/resources/testlib/env.go index 7c4488a8043..38d60a3f59f 100644 --- a/integrations/operator/controllers/resources/testlib/env.go +++ b/integrations/operator/controllers/resources/testlib/env.go @@ -80,7 +80,7 @@ func ValidRandomResourceName(prefix string) string { } func defaultTeleportServiceConfig(t *testing.T, insecureMode bool) (*helpers.TeleInstance, string) { - modulestest.SetTestModules(t, modulestest.Modules{ + testModules := &modulestest.Modules{ TestBuildType: modules.BuildEnterprise, TestFeatures: modules.Features{ Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{ @@ -88,16 +88,18 @@ func defaultTeleportServiceConfig(t *testing.T, insecureMode bool) (*helpers.Tel entitlements.SAML: {Enabled: true}, }, }, - }) + } teleportServer := helpers.NewInstance(t, helpers.InstanceConfig{ ClusterName: "root.example.com", HostID: uuid.New().String(), NodeName: helpers.Loopback, Logger: slog.Default(), + Modules: testModules, }) rcConf := servicecfg.MakeDefaultConfig() + rcConf.Modules = testModules rcConf.DataDir = t.TempDir() rcConf.Auth.Enabled = true rcConf.Proxy.Enabled = true diff --git a/lib/accesslists/hierarchy_user_test.go b/lib/accesslists/hierarchy_user_test.go index 2476ca3cd3c..ae98c733aad 100644 --- a/lib/accesslists/hierarchy_user_test.go +++ b/lib/accesslists/hierarchy_user_test.go @@ -37,9 +37,7 @@ import ( ) func TestGetHierarchyForUser(t *testing.T) { - testModules := modulestest.EnterpriseModules() - - modulestest.SetTestModules(t, *testModules) + t.Parallel() clock := clockwork.NewFakeClock() tests := []struct { @@ -393,7 +391,7 @@ func TestGetHierarchyForUser(t *testing.T) { require.NoError(t, err) svc, err := local.NewAccessListServiceV2(local.AccessListServiceConfig{ Backend: bk, - Modules: testModules, + Modules: modulestest.EnterpriseModules(), }) require.NoError(t, err) diff --git a/lib/auth/auth_test.go b/lib/auth/auth_test.go index 1e7d0516e7c..a25a08091e2 100644 --- a/lib/auth/auth_test.go +++ b/lib/auth/auth_test.go @@ -1385,8 +1385,13 @@ func TestTrustedClusterCRUDEventEmitted(t *testing.T) { } func TestGithubConnectorCRUDEventsEmitted(t *testing.T) { - modulestest.SetTestModules(t, *modulestest.EnterpriseModules()) - s := newAuthSuite(t) + t.Parallel() + s, err := newTestPack(t.Context(), testPackOptions{ + DataDir: t.TempDir(), + Modules: modulestest.EnterpriseModules(), + }) + require.NoError(t, err) + t.Cleanup(func() { require.NoError(t, s.a.Close()) }) clientAddr := &net.TCPAddr{IP: net.IPv4(10, 255, 0, 0)} ctx := authz.ContextWithClientSrcAddr(context.Background(), clientAddr) diff --git a/lib/auth/grpcserver.go b/lib/auth/grpcserver.go index 8f026c9662c..71296ebc482 100644 --- a/lib/auth/grpcserver.go +++ b/lib/auth/grpcserver.go @@ -6394,6 +6394,7 @@ func NewGRPCServer(cfg GRPCServerConfig) (*GRPCServer, error) { FIPS: cfg.AuthServer.fips, ScopedTokenService: cfg.AuthServer.Services, OracleHTTPClient: cfg.OracleHTTPClient, + Modules: cfg.AuthServer.modules, })) } diff --git a/lib/auth/join_github.go b/lib/auth/join_github.go index 124dc2bc88c..4882ee13d17 100644 --- a/lib/auth/join_github.go +++ b/lib/auth/join_github.go @@ -60,7 +60,7 @@ func (a *Server) checkGitHubJoinRequest( req *types.RegisterUsingTokenRequest, pt types.ProvisionToken, ) (*githubactions.IDTokenClaims, error) { - claims, err := githubactions.CheckGithubIDToken(ctx, &githubactions.CheckGithubIDTokenParams{ + claims, err := githubactions.CheckGithubIDToken(ctx, a.modules, &githubactions.CheckGithubIDTokenParams{ ProvisionToken: pt, IDToken: []byte(req.IDToken), Clock: a.GetClock(), diff --git a/lib/auth/join_spacelift.go b/lib/auth/join_spacelift.go index 891808fd176..ddee343b6d7 100644 --- a/lib/auth/join_spacelift.go +++ b/lib/auth/join_spacelift.go @@ -44,7 +44,7 @@ func (a *Server) checkSpaceliftJoinRequest( req *types.RegisterUsingTokenRequest, pt types.ProvisionToken, ) (*spacelift.IDTokenClaims, error) { - claims, err := spacelift.CheckIDToken(ctx, &spacelift.CheckIDTokenParams{ + claims, err := spacelift.CheckIDToken(ctx, a.modules, &spacelift.CheckIDTokenParams{ ProvisionToken: pt, IDToken: []byte(req.IDToken), Validator: a.spaceliftIDTokenValidator, diff --git a/lib/auth/join_terraformcloud.go b/lib/auth/join_terraformcloud.go index a1f5ef06081..cb3a12ff985 100644 --- a/lib/auth/join_terraformcloud.go +++ b/lib/auth/join_terraformcloud.go @@ -49,7 +49,7 @@ func (a *Server) checkTerraformCloudJoinRequest( return nil, trace.Wrap(err) } - claims, err := terraformcloud.CheckIDToken(ctx, &terraformcloud.CheckIDTokenParams{ + claims, err := terraformcloud.CheckIDToken(ctx, a.modules, &terraformcloud.CheckIDTokenParams{ ProvisionToken: pt, IDToken: []byte(req.IDToken), Validator: a.terraformIDTokenValidator, diff --git a/lib/auth/join_tpm.go b/lib/auth/join_tpm.go index b6f54d71aa8..365d0fb4a15 100644 --- a/lib/auth/join_tpm.go +++ b/lib/auth/join_tpm.go @@ -77,7 +77,7 @@ func (a *Server) RegisterUsingTPMMethod( return solution.Solution, nil } - validatedEK, err := tpmjoin.CheckTPMRequest(ctx, tpmjoin.CheckTPMRequestParams{ + validatedEK, err := tpmjoin.CheckTPMRequest(ctx, a.modules, tpmjoin.CheckTPMRequestParams{ Token: ptv2, TPMValidator: a.GetTPMValidator(), EKCert: initReq.GetEkCert(), diff --git a/lib/config/configuration.go b/lib/config/configuration.go index 7a538188403..3a8585e4ff6 100644 --- a/lib/config/configuration.go +++ b/lib/config/configuration.go @@ -63,7 +63,6 @@ import ( "github.com/gravitational/teleport/lib/integrations/externalauditstorage/easconfig" "github.com/gravitational/teleport/lib/integrations/samlidp/samlidpconfig" "github.com/gravitational/teleport/lib/limiter" - "github.com/gravitational/teleport/lib/modules" "github.com/gravitational/teleport/lib/multiplexer" "github.com/gravitational/teleport/lib/service/servicecfg" "github.com/gravitational/teleport/lib/services" @@ -2762,7 +2761,7 @@ func Configure(clf *CommandLineFlags, cfg *servicecfg.Config, legacyAppFlags boo return trace.BadParameter("non-FIPS compliant proxy settings: \"proxy_checks_host_keys\" must be true") } - if err := services.ValidateSessionRecordingConfig(cfg.Auth.SessionRecordingConfig, clf.FIPS, modules.GetModules().Features().Cloud); err != nil { + if err := services.ValidateSessionRecordingConfig(cfg.Auth.SessionRecordingConfig, clf.FIPS, cfg.Modules.Features().Cloud); err != nil { return trace.Wrap(err) } } @@ -2776,7 +2775,7 @@ func Configure(clf *CommandLineFlags, cfg *servicecfg.Config, legacyAppFlags boo if err := cfg.Auth.Preference.CheckSignatureAlgorithmSuite(types.SignatureAlgorithmSuiteParams{ FIPS: clf.FIPS, UsingHSMOrKMS: cfg.Auth.KeyStore != servicecfg.KeystoreConfig{}, - Cloud: modules.GetModules().Features().Cloud, + Cloud: cfg.Modules.Features().Cloud, }); err != nil { return trace.Wrap(err) } diff --git a/lib/config/configuration_test.go b/lib/config/configuration_test.go index f0d3ea36b8b..55af2c6405a 100644 --- a/lib/config/configuration_test.go +++ b/lib/config/configuration_test.go @@ -5605,6 +5605,7 @@ debug_service: } func TestSignatureAlgorithmSuite(t *testing.T) { + t.Parallel() for desc, tc := range map[string]struct { fips bool hsm bool @@ -5659,15 +5660,16 @@ func TestSignatureAlgorithmSuite(t *testing.T) { }, } { t.Run(desc, func(t *testing.T) { - modulestest.SetTestModules(t, modulestest.Modules{ - TestFeatures: modules.Features{ - Cloud: tc.cloud, - }, - }) + t.Parallel() clf := &CommandLineFlags{ FIPS: tc.fips, } cfg := servicecfg.MakeDefaultConfig() + cfg.Modules = &modulestest.Modules{ + TestFeatures: modules.Features{ + Cloud: tc.cloud, + }, + } if tc.fips { servicecfg.ApplyFIPSDefaults(cfg) } diff --git a/lib/config/fileconf_test.go b/lib/config/fileconf_test.go index 4c4636854e7..2b9c37f7022 100644 --- a/lib/config/fileconf_test.go +++ b/lib/config/fileconf_test.go @@ -41,8 +41,6 @@ import ( "github.com/gravitational/teleport/api/types" apiutils "github.com/gravitational/teleport/api/utils" "github.com/gravitational/teleport/lib/defaults" - "github.com/gravitational/teleport/lib/modules" - "github.com/gravitational/teleport/lib/modules/modulestest" "github.com/gravitational/teleport/lib/scopes/joining" "github.com/gravitational/teleport/lib/service/servicecfg" "github.com/gravitational/teleport/session/networking/x11" @@ -996,11 +994,7 @@ func TestAuthenticationConfig_RequireSessionMFA(t *testing.T) { } func TestAuthenticationConfig_Parse_deviceTrustPB(t *testing.T) { - // Device trust mode=required is an Enterprise feature. - modulestest.SetTestModules(t, modulestest.Modules{ - TestBuildType: modules.BuildEnterprise, - }) - + t.Parallel() tpmEKCertPath := "testdata/tpm_ekcert_ca.pem" tpmEKCertPEM, err := os.ReadFile(tpmEKCertPath) require.NoError(t, err) diff --git a/lib/join/githubactions/githubactions.go b/lib/join/githubactions/githubactions.go index 02e7da6b5c0..cf8fb07b09e 100644 --- a/lib/join/githubactions/githubactions.go +++ b/lib/join/githubactions/githubactions.go @@ -190,7 +190,7 @@ func (p *CheckGithubIDTokenParams) checkAndSetDefaults() error { // CheckGithubIDToken checks a Github OIDC token against a provision token. // If the token is valid and its claims match at least one allow rule, the // claims are returned. -func CheckGithubIDToken(ctx context.Context, params *CheckGithubIDTokenParams) (*IDTokenClaims, error) { +func CheckGithubIDToken(ctx context.Context, m modules.Modules, params *CheckGithubIDTokenParams) (*IDTokenClaims, error) { if err := params.checkAndSetDefaults(); err != nil { return nil, trace.AccessDenied("%s", err.Error()) } @@ -205,7 +205,7 @@ func CheckGithubIDToken(ctx context.Context, params *CheckGithubIDTokenParams) ( enterpriseOverride := token.Spec.GitHub.EnterpriseServerHost enterpriseSlug := token.Spec.GitHub.EnterpriseSlug if enterpriseOverride != "" || enterpriseSlug != "" { - if modules.GetModules().BuildType() != modules.BuildEnterprise { + if m.BuildType() != modules.BuildEnterprise { return nil, trace.Wrap(services.ErrRequiresEnterprise, "github enterprise server joining") } } diff --git a/lib/join/join_bitbucket_test.go b/lib/join/join_bitbucket_test.go index 949e717d310..92c4c955378 100644 --- a/lib/join/join_bitbucket_test.go +++ b/lib/join/join_bitbucket_test.go @@ -87,9 +87,11 @@ func TestJoinBitbucket(t *testing.T) { ctx := t.Context() + testModules := modulestest.OSSModules() authServer, err := authtest.NewTestServer(authtest.ServerConfig{ Auth: authtest.AuthServerConfig{ - Dir: t.TempDir(), + Dir: t.TempDir(), + Modules: testModules, }, }) require.NoError(t, err) @@ -275,10 +277,9 @@ func TestJoinBitbucket(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { if tt.setEnterprise { - modulestest.SetTestModules( - t, - modulestest.Modules{TestBuildType: modules.BuildEnterprise}, - ) + testModules.TestBuildType = modules.BuildEnterprise + } else { + testModules.TestBuildType = modules.BuildOSS } token, err := types.NewProvisionTokenFromSpec( diff --git a/lib/join/join_github_test.go b/lib/join/join_github_test.go index 5e637e07204..ecea7f92228 100644 --- a/lib/join/join_github_test.go +++ b/lib/join/join_github_test.go @@ -116,9 +116,11 @@ func TestJoinGHA(t *testing.T) { }, } + testModules := modulestest.OSSModules() authServer, err := authtest.NewTestServer(authtest.ServerConfig{ Auth: authtest.AuthServerConfig{ - Dir: t.TempDir(), + Dir: t.TempDir(), + Modules: testModules, }, }) require.NoError(t, err) @@ -692,10 +694,9 @@ func TestJoinGHA(t *testing.T) { t.Run(tt.name, func(t *testing.T) { t.Cleanup(idTokenValidator.reset) if tt.setEnterprise { - modulestest.SetTestModules( - t, - modulestest.Modules{TestBuildType: modules.BuildEnterprise}, - ) + testModules.TestBuildType = modules.BuildEnterprise + } else { + testModules.TestBuildType = modules.BuildOSS } token, err := types.NewProvisionTokenFromSpec( tt.name, time.Now().Add(time.Minute), tt.tokenSpec, diff --git a/lib/join/join_spacelift_test.go b/lib/join/join_spacelift_test.go index 15084fdae76..8e669fc624c 100644 --- a/lib/join/join_spacelift_test.go +++ b/lib/join/join_spacelift_test.go @@ -75,9 +75,11 @@ func TestJoinSpacelift(t *testing.T) { ctx := t.Context() + testModules := modulestest.OSSModules() authServer, err := authtest.NewTestServer(authtest.ServerConfig{ Auth: authtest.AuthServerConfig{ - Dir: t.TempDir(), + Dir: t.TempDir(), + Modules: testModules, }, }) require.NoError(t, err) @@ -331,10 +333,9 @@ func TestJoinSpacelift(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { if tt.setEnterprise { - modulestest.SetTestModules( - t, - modulestest.Modules{TestBuildType: modules.BuildEnterprise}, - ) + testModules.TestBuildType = modules.BuildEnterprise + } else { + testModules.TestBuildType = modules.BuildOSS } token, err := types.NewProvisionTokenFromSpec( diff --git a/lib/join/join_terraformcloud_test.go b/lib/join/join_terraformcloud_test.go index b6dba89e692..e90f8768627 100644 --- a/lib/join/join_terraformcloud_test.go +++ b/lib/join/join_terraformcloud_test.go @@ -82,10 +82,12 @@ func TestJoinTerraformCloud(t *testing.T) { ctx := t.Context() + testModules := modulestest.OSSModules() authServer, err := authtest.NewTestServer(authtest.ServerConfig{ Auth: authtest.AuthServerConfig{ ClusterName: "test.localhost", Dir: t.TempDir(), + Modules: testModules, }, }) require.NoError(t, err) @@ -406,10 +408,9 @@ func TestJoinTerraformCloud(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { if tt.setEnterprise { - modulestest.SetTestModules( - t, - modulestest.Modules{TestBuildType: modules.BuildEnterprise}, - ) + testModules.TestBuildType = modules.BuildEnterprise + } else { + testModules.TestBuildType = modules.BuildOSS } token, err := types.NewProvisionTokenFromSpec( diff --git a/lib/join/server.go b/lib/join/server.go index 9e5b24e3c9c..a3918f89c04 100644 --- a/lib/join/server.go +++ b/lib/join/server.go @@ -65,6 +65,7 @@ import ( "github.com/gravitational/teleport/lib/join/terraformcloud" "github.com/gravitational/teleport/lib/join/tpmjoin" kubetoken "github.com/gravitational/teleport/lib/kube/token" + "github.com/gravitational/teleport/lib/modules" "github.com/gravitational/teleport/lib/scopes/joining" "github.com/gravitational/teleport/lib/services" "github.com/gravitational/teleport/lib/services/readonly" @@ -123,6 +124,7 @@ type ServerConfig struct { ScopedTokenService services.ScopedTokenService OracleHTTPClient utils.HTTPDoClient Logger *slog.Logger + Modules modules.Modules } // Server implements cluster joining for nodes and bots. diff --git a/lib/join/server_github.go b/lib/join/server_github.go index 526bd585593..4c15d99d41a 100644 --- a/lib/join/server_github.go +++ b/lib/join/server_github.go @@ -33,7 +33,7 @@ func (a *Server) validateGithubToken( pt provision.Token, idToken []byte, ) (any, *workloadidentityv1.JoinAttrs, error) { - claims, err := githubactions.CheckGithubIDToken(ctx, &githubactions.CheckGithubIDTokenParams{ + claims, err := githubactions.CheckGithubIDToken(ctx, a.cfg.Modules, &githubactions.CheckGithubIDTokenParams{ ProvisionToken: pt, IDToken: idToken, Validator: a.cfg.AuthService.GetGHAIDTokenValidator(), diff --git a/lib/join/server_spacelift.go b/lib/join/server_spacelift.go index 628a195af14..b11d76a5814 100644 --- a/lib/join/server_spacelift.go +++ b/lib/join/server_spacelift.go @@ -33,7 +33,7 @@ func (a *Server) validateSpaceliftToken( pt provision.Token, idToken []byte, ) (any, *workloadidentityv1.JoinAttrs, error) { - claims, err := spacelift.CheckIDToken(ctx, &spacelift.CheckIDTokenParams{ + claims, err := spacelift.CheckIDToken(ctx, a.cfg.Modules, &spacelift.CheckIDTokenParams{ ProvisionToken: pt, IDToken: idToken, Validator: a.cfg.AuthService.GetSpaceliftIDTokenValidator(), diff --git a/lib/join/server_terraformcloud.go b/lib/join/server_terraformcloud.go index 6258272af7d..8186f0cb503 100644 --- a/lib/join/server_terraformcloud.go +++ b/lib/join/server_terraformcloud.go @@ -40,7 +40,7 @@ func (a *Server) validateTerraformCloudToken( return nil, nil, trace.Wrap(err) } - claims, err := terraformcloud.CheckIDToken(ctx, &terraformcloud.CheckIDTokenParams{ + claims, err := terraformcloud.CheckIDToken(ctx, a.cfg.Modules, &terraformcloud.CheckIDTokenParams{ ProvisionToken: pt, IDToken: idToken, Validator: a.cfg.AuthService.GetTerraformIDTokenValidator(), diff --git a/lib/join/server_tpm.go b/lib/join/server_tpm.go index 8b6f28327a3..c636cbc0e72 100644 --- a/lib/join/server_tpm.go +++ b/lib/join/server_tpm.go @@ -77,7 +77,7 @@ func (s *Server) handleTPMJoin( return solutionMsg.Solution, nil } - validatedEK, err := tpmjoin.CheckTPMRequest(stream.Context(), tpmjoin.CheckTPMRequestParams{ + validatedEK, err := tpmjoin.CheckTPMRequest(stream.Context(), s.cfg.Modules, tpmjoin.CheckTPMRequestParams{ Token: ptv2, TPMValidator: s.cfg.AuthService.GetTPMValidator(), EKCert: tpmInit.EKCert, diff --git a/lib/join/spacelift/spacelift.go b/lib/join/spacelift/spacelift.go index 5d22c54c778..c9523e722e1 100644 --- a/lib/join/spacelift/spacelift.go +++ b/lib/join/spacelift/spacelift.go @@ -113,6 +113,7 @@ func (p *CheckIDTokenParams) validate() error { // rules in the provided provision token. func CheckIDToken( ctx context.Context, + m modules.Modules, params *CheckIDTokenParams, ) (*IDTokenClaims, error) { if err := params.validate(); err != nil { @@ -124,7 +125,7 @@ func CheckIDToken( return nil, trace.BadParameter("spacelift join method only supports ProvisionTokenV2, '%T' was provided", params.ProvisionToken) } - if modules.GetModules().BuildType() != modules.BuildEnterprise { + if m.BuildType() != modules.BuildEnterprise { return nil, trace.Wrap(services.ErrRequiresEnterprise, "spacelift joining") } diff --git a/lib/join/terraformcloud/terraform.go b/lib/join/terraformcloud/terraform.go index fe5f669096d..58184c1dac0 100644 --- a/lib/join/terraformcloud/terraform.go +++ b/lib/join/terraformcloud/terraform.go @@ -117,6 +117,7 @@ func (p *CheckIDTokenParams) checkAndSetDefaults() error { // rules in the provided provision token. func CheckIDToken( ctx context.Context, + m modules.Modules, params *CheckIDTokenParams, ) (*IDTokenClaims, error) { if err := params.checkAndSetDefaults(); err != nil { @@ -129,7 +130,7 @@ func CheckIDToken( } hostnameOverride := token.Spec.TerraformCloud.Hostname - if hostnameOverride != "" && modules.GetModules().BuildType() != modules.BuildEnterprise { + if hostnameOverride != "" && m.BuildType() != modules.BuildEnterprise { return nil, trace.Wrap( services.ErrRequiresEnterprise, "terraform_cloud joining for Terraform Enterprise", diff --git a/lib/join/tpmjoin/join_test.go b/lib/join/tpmjoin/join_test.go index ee8bab3b2bb..79d505ae1e0 100644 --- a/lib/join/tpmjoin/join_test.go +++ b/lib/join/tpmjoin/join_test.go @@ -46,9 +46,11 @@ import ( ) func TestJoinTPM(t *testing.T) { + testModules := modulestest.OSSModules() server, err := authtest.NewTestServer(authtest.ServerConfig{ Auth: authtest.AuthServerConfig{ - Dir: t.TempDir(), + Dir: t.TempDir(), + Modules: testModules, }, }) require.NoError(t, err) @@ -275,7 +277,9 @@ func TestJoinTPM(t *testing.T) { } { t.Run(tc.desc, func(t *testing.T) { if !tc.oss { - modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise}) + testModules.TestBuildType = modules.BuildEnterprise + } else { + testModules.TestBuildType = modules.BuildOSS } token, err := types.NewProvisionTokenFromSpec("mytoken", time.Now().Add(time.Minute), types.ProvisionTokenSpecV2{ diff --git a/lib/join/tpmjoin/tpm.go b/lib/join/tpmjoin/tpm.go index 621a6c4318b..809eaf07e3d 100644 --- a/lib/join/tpmjoin/tpm.go +++ b/lib/join/tpmjoin/tpm.go @@ -55,8 +55,8 @@ type CheckTPMRequestParams struct { } // CheckTPMRequest checks a TPM method join request. -func CheckTPMRequest(ctx context.Context, params CheckTPMRequestParams) (*tpm.ValidatedTPM, error) { - if modules.GetModules().BuildType() != modules.BuildEnterprise { +func CheckTPMRequest(ctx context.Context, m modules.Modules, params CheckTPMRequestParams) (*tpm.ValidatedTPM, error) { + if m.BuildType() != modules.BuildEnterprise { return nil, trace.Wrap( services.ErrRequiresEnterprise, "tpm joining", diff --git a/lib/kube/proxy/moderated_sessions_test.go b/lib/kube/proxy/moderated_sessions_test.go index beb6de61621..b169048a39d 100644 --- a/lib/kube/proxy/moderated_sessions_test.go +++ b/lib/kube/proxy/moderated_sessions_test.go @@ -43,22 +43,15 @@ import ( "github.com/gravitational/teleport/api/constants" "github.com/gravitational/teleport/api/types" apievents "github.com/gravitational/teleport/api/types/events" - "github.com/gravitational/teleport/entitlements" "github.com/gravitational/teleport/lib/auth/authclient" "github.com/gravitational/teleport/lib/events" testingkubemock "github.com/gravitational/teleport/lib/kube/proxy/testing/kube_server" - "github.com/gravitational/teleport/lib/modules" "github.com/gravitational/teleport/lib/modules/modulestest" sessionpkg "github.com/gravitational/teleport/lib/session" ) func TestModeratedSessions(t *testing.T) { - // enable enterprise features to have access to ModeratedSessions. - modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise, TestFeatures: modules.Features{ - Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{ - entitlements.K8s: {Enabled: true}, - }, - }}) + t.Parallel() const ( moderatorUsername = "moderator_user" moderatorRoleName = "mod_role" @@ -90,6 +83,7 @@ func TestModeratedSessions(t *testing.T) { context.Background(), t, TestConfig{ + Modules: modulestest.EnterpriseModules(), Clusters: []KubeClusterConfig{{Name: kubeCluster, APIEndpoint: kubeMock.URL}}, // onEvent is called each time a new event is produced. We only care about // sessionEnd events. @@ -512,12 +506,7 @@ func validateSessionTracker(testCtx *TestContext, sessionID string, reason strin // covered by the integration test mentioned above because we need to fake the // Lock watcher connection to be stale and it takes ~5 minutes to happen. func TestInteractiveSessionsNoAuth(t *testing.T) { - // enable enterprise features to have access to ModeratedSessions. - modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise, TestFeatures: modules.Features{ - Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{ - entitlements.K8s: {Enabled: true}, - }, - }}) + t.Parallel() const ( moderatorUsername = "moderator_user" moderatorRoleName = "mod_role" @@ -547,6 +536,7 @@ func TestInteractiveSessionsNoAuth(t *testing.T) { context.Background(), t, TestConfig{ + Modules: modulestest.EnterpriseModules(), Clusters: []KubeClusterConfig{{Name: kubeCluster, APIEndpoint: kubeMock.URL}}, WrapAuthClient: func(client authclient.ClientI) authclient.ClientI { authClient.ClientI = client diff --git a/lib/kube/proxy/utils_test.go b/lib/kube/proxy/utils_test.go index ea12b31f64f..94dd04582a2 100644 --- a/lib/kube/proxy/utils_test.go +++ b/lib/kube/proxy/utils_test.go @@ -19,6 +19,7 @@ package proxy import ( + "cmp" "context" "crypto/ecdsa" "crypto/tls" @@ -64,6 +65,7 @@ import ( "github.com/gravitational/teleport/lib/kube/proxy/streamproto" "github.com/gravitational/teleport/lib/limiter" "github.com/gravitational/teleport/lib/modules" + "github.com/gravitational/teleport/lib/modules/modulestest" "github.com/gravitational/teleport/lib/multiplexer" "github.com/gravitational/teleport/lib/reversetunnel" "github.com/gravitational/teleport/lib/reversetunnelclient" @@ -103,6 +105,7 @@ type KubeClusterConfig struct { // TestConfig defines the suite options. type TestConfig struct { + Modules *modulestest.Modules Clusters []KubeClusterConfig ResourceMatchers []services.ResourceMatcher OnReconcile func(types.KubeClusters) @@ -143,6 +146,7 @@ func SetupTestContext(ctx context.Context, t *testing.T, cfg TestConfig) *TestCo Streamer: streamer, UploadHandler: testCtx.UploadHandler, Dir: t.TempDir(), + Modules: cmp.Or(cfg.Modules, modulestest.OSSModules()), }) require.NoError(t, err) t.Cleanup(func() { require.NoError(t, authServer.Close()) }) diff --git a/tool/tctl/common/admin_action_test.go b/tool/tctl/common/admin_action_test.go index d28d03e3b86..6c7b5afe16a 100644 --- a/tool/tctl/common/admin_action_test.go +++ b/tool/tctl/common/admin_action_test.go @@ -1056,15 +1056,6 @@ func newAdminActionTestSuite(t *testing.T) *adminActionTestSuite { t.Helper() ctx := context.Background() - modulestest.SetTestModules(t, modulestest.Modules{ - TestBuildType: modules.BuildEnterprise, - TestFeatures: modules.Features{ - Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{ - entitlements.OIDC: {Enabled: true}, - entitlements.SAML: {Enabled: true}, - }, - }, - }) authPref, err := types.NewAuthPreference(types.AuthPreferenceSpecV2{ Type: constants.Local, @@ -1080,6 +1071,15 @@ func newAdminActionTestSuite(t *testing.T) *adminActionTestSuite { process, err := testserver.NewTeleportProcess(t.TempDir(), testserver.WithAuthPreference(authPref), testserver.WithConfig(func(cfg *servicecfg.Config) { + cfg.Modules = &modulestest.Modules{ + TestBuildType: modules.BuildEnterprise, + TestFeatures: modules.Features{ + Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{ + entitlements.OIDC: {Enabled: true}, + entitlements.SAML: {Enabled: true}, + }, + }, + } proxyPublicAddr = cfg.Proxy.WebAddr proxyPublicAddr.Addr = fmt.Sprintf("localhost:%v", proxyPublicAddr.Port(0)) cfg.Proxy.PublicAddrs = []utils.NetAddr{proxyPublicAddr} diff --git a/tool/tctl/common/edit_command_test.go b/tool/tctl/common/edit_command_test.go index 65eacc54d58..8f7fc5dc87c 100644 --- a/tool/tctl/common/edit_command_test.go +++ b/tool/tctl/common/edit_command_test.go @@ -51,6 +51,7 @@ import ( "github.com/gravitational/teleport/lib/defaults" "github.com/gravitational/teleport/lib/modules" "github.com/gravitational/teleport/lib/modules/modulestest" + "github.com/gravitational/teleport/lib/service/servicecfg" "github.com/gravitational/teleport/lib/services" "github.com/gravitational/teleport/lib/utils/log/logtest" "github.com/gravitational/teleport/tool/tctl/common/resources" @@ -58,10 +59,13 @@ import ( ) func TestEditResources(t *testing.T) { - modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise}) - + t.Parallel() log := logtest.NewLogger() - process, err := testenv.NewTeleportProcess(t.TempDir(), testenv.WithLogger(log)) + process, err := testenv.NewTeleportProcess(t.TempDir(), + testenv.WithConfig(func(cfg *servicecfg.Config) { + cfg.Modules = modulestest.EnterpriseModules() + }), + testenv.WithLogger(log)) require.NoError(t, err) t.Cleanup(func() { require.NoError(t, process.Close()) @@ -375,22 +379,24 @@ func testEditSessionRecordingConfig(t *testing.T, clt *authclient.Client) { } // TestEditEnterpriseResources asserts that tctl edit -// behaves as expected for enterprise resources. These resources cannot -// be tested in parallel because they alter the modules to enable features. -// The tests are grouped to amortize the cost of creating and auth server since +// behaves as expected for enterprise resources. The tests are +// grouped to amortize the cost of creating and auth server since // that is the most expensive part of testing editing the resource. func TestEditEnterpriseResources(t *testing.T) { - modulestest.SetTestModules(t, modulestest.Modules{ - TestBuildType: modules.BuildEnterprise, - TestFeatures: modules.Features{ - Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{ - entitlements.OIDC: {Enabled: true}, - entitlements.SAML: {Enabled: true}, - }, - }, - }) log := logtest.NewLogger() - process, err := testenv.NewTeleportProcess(t.TempDir(), testenv.WithLogger(log)) + process, err := testenv.NewTeleportProcess(t.TempDir(), + testenv.WithConfig(func(cfg *servicecfg.Config) { + cfg.Modules = &modulestest.Modules{ + TestBuildType: modules.BuildEnterprise, + TestFeatures: modules.Features{ + Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{ + entitlements.OIDC: {Enabled: true}, + entitlements.SAML: {Enabled: true}, + }, + }, + } + }), + testenv.WithLogger(log)) require.NoError(t, err) t.Cleanup(func() { require.NoError(t, process.Close()) diff --git a/tool/tctl/common/resource_command_test.go b/tool/tctl/common/resource_command_test.go index ab6fd8778c0..3c6a777ed03 100644 --- a/tool/tctl/common/resource_command_test.go +++ b/tool/tctl/common/resource_command_test.go @@ -60,6 +60,7 @@ import ( "github.com/gravitational/teleport/lib/modules" "github.com/gravitational/teleport/lib/modules/modulestest" scopedaccess "github.com/gravitational/teleport/lib/scopes/access" + "github.com/gravitational/teleport/lib/service/servicecfg" "github.com/gravitational/teleport/lib/services" "github.com/gravitational/teleport/lib/utils/log/logtest" "github.com/gravitational/teleport/tool/tctl/common/databaseobject" @@ -2436,22 +2437,22 @@ version: v1 } // TestCreateEnterpriseResources asserts that tctl create -// behaves as expected for enterprise resources. These resources cannot -// be tested in parallel because they alter the modules to enable features. -// The tests are grouped to amortize the cost of creating and auth server since +// behaves as expected for enterprise resources. The tests are +// grouped to amortize the cost of creating and auth server since // that is the most expensive part of testing editing the resource. func TestCreateEnterpriseResources(t *testing.T) { - modulestest.SetTestModules(t, modulestest.Modules{ - TestBuildType: modules.BuildEnterprise, - TestFeatures: modules.Features{ - Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{ - entitlements.OIDC: {Enabled: true}, - entitlements.SAML: {Enabled: true}, + t.Parallel() + process, err := testenv.NewTeleportProcess(t.TempDir(), testenv.WithConfig(func(cfg *servicecfg.Config) { + cfg.Modules = &modulestest.Modules{ + TestBuildType: modules.BuildEnterprise, + TestFeatures: modules.Features{ + Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{ + entitlements.OIDC: {Enabled: true}, + entitlements.SAML: {Enabled: true}, + }, }, - }, - }) - - process, err := testenv.NewTeleportProcess(t.TempDir()) + } + })) require.NoError(t, err) t.Cleanup(func() { require.NoError(t, process.Close()) diff --git a/tool/tsh/common/access_request_test.go b/tool/tsh/common/access_request_test.go index b205eccc5a5..26d9b55b8b3 100644 --- a/tool/tsh/common/access_request_test.go +++ b/tool/tsh/common/access_request_test.go @@ -29,24 +29,13 @@ import ( "github.com/stretchr/testify/require" "github.com/gravitational/teleport/api/types" - "github.com/gravitational/teleport/entitlements" "github.com/gravitational/teleport/lib/asciitable" - "github.com/gravitational/teleport/lib/modules" "github.com/gravitational/teleport/lib/modules/modulestest" "github.com/gravitational/teleport/lib/service/servicecfg" "github.com/gravitational/teleport/lib/utils" ) func TestAccessRequestSearch(t *testing.T) { - modulestest.SetTestModules(t, modulestest.Modules{ - TestBuildType: modules.BuildEnterprise, - TestFeatures: modules.Features{ - Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{ - entitlements.K8s: {Enabled: true}, - }, - }, - }, - ) ctx := context.Background() const ( rootClusterName = "root-cluster" @@ -56,6 +45,7 @@ func TestAccessRequestSearch(t *testing.T) { ) s := newTestSuite(t, withRootConfigFunc(func(cfg *servicecfg.Config) { + cfg.Modules = modulestest.EnterpriseModules() cfg.InsecureMode = true cfg.Auth.ClusterName.SetClusterName(rootClusterName) cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex) @@ -67,6 +57,7 @@ func TestAccessRequestSearch(t *testing.T) { withLeafCluster(), withLeafConfigFunc( func(cfg *servicecfg.Config) { + cfg.Modules = modulestest.EnterpriseModules() cfg.InsecureMode = true cfg.Auth.ClusterName.SetClusterName(leafClusterName) cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex) diff --git a/tool/tsh/common/db_test.go b/tool/tsh/common/db_test.go index 8bbc2e4f646..a514d6d02c2 100644 --- a/tool/tsh/common/db_test.go +++ b/tool/tsh/common/db_test.go @@ -42,12 +42,10 @@ import ( apidefaults "github.com/gravitational/teleport/api/defaults" "github.com/gravitational/teleport/api/types" "github.com/gravitational/teleport/api/utils/keys" - "github.com/gravitational/teleport/entitlements" "github.com/gravitational/teleport/lib/client" "github.com/gravitational/teleport/lib/cryptosuites" "github.com/gravitational/teleport/lib/defaults" "github.com/gravitational/teleport/lib/fixtures" - "github.com/gravitational/teleport/lib/modules" "github.com/gravitational/teleport/lib/modules/modulestest" "github.com/gravitational/teleport/lib/observability/tracing" "github.com/gravitational/teleport/lib/service" @@ -77,16 +75,6 @@ func TestTshDB(t *testing.T) { // will fail. The fake engine registered are not functional. But other // Enterprise features like Access Request can still be tested. registerFakeEnterpriseDBEngines(t) - modulestest.SetTestModules(t, - modulestest.Modules{ - TestBuildType: modules.BuildEnterprise, - TestFeatures: modules.Features{ - Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{ - entitlements.DB: {Enabled: true}, - }, - }, - }, - ) // this speeds up test suite setup substantially, which is where // tests spend the majority of their time, especially when leaf @@ -150,6 +138,7 @@ func testDatabaseLogin(t *testing.T) { alice.SetRoles([]string{"dev-access", "autouser", "access-requestor"}) s := newTestSuite(t, withRootConfigFunc(func(cfg *servicecfg.Config) { + cfg.Modules = modulestest.EnterpriseModules() cfg.InsecureMode = true cfg.Auth.BootstrapResources = append( cfg.Auth.BootstrapResources, @@ -698,6 +687,7 @@ func testListDatabase(t *testing.T) { fullName := "root-postgres-rds-us-west-1-123456789012" s := newTestSuite(t, withRootConfigFunc(func(cfg *servicecfg.Config) { + cfg.Modules = modulestest.EnterpriseModules() cfg.InsecureMode = true cfg.Auth.StorageConfig.Params["poll_stream_period"] = 50 * time.Millisecond cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex) @@ -721,6 +711,7 @@ func testListDatabase(t *testing.T) { }), withLeafCluster(), withLeafConfigFunc(func(cfg *servicecfg.Config) { + cfg.Modules = modulestest.EnterpriseModules() cfg.Auth.StorageConfig.Params["poll_stream_period"] = 50 * time.Millisecond cfg.InsecureMode = true cfg.SSH.Enabled = false @@ -1592,6 +1583,7 @@ func testDatabaseSelection(t *testing.T) { alice.SetRoles([]string{"access"}) s := newTestSuite(t, withRootConfigFunc(func(cfg *servicecfg.Config) { + cfg.Modules = modulestest.EnterpriseModules() cfg.Auth.BootstrapResources = append(cfg.Auth.BootstrapResources, alice) cfg.InsecureMode = true cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex) diff --git a/tool/tsh/common/kube_test.go b/tool/tsh/common/kube_test.go index e721bdf47cc..04bf3d827ff 100644 --- a/tool/tsh/common/kube_test.go +++ b/tool/tsh/common/kube_test.go @@ -46,12 +46,10 @@ import ( "github.com/gravitational/teleport/api/types" apiutils "github.com/gravitational/teleport/api/utils" "github.com/gravitational/teleport/api/utils/keypaths" - "github.com/gravitational/teleport/entitlements" "github.com/gravitational/teleport/lib/asciitable" "github.com/gravitational/teleport/lib/defaults" "github.com/gravitational/teleport/lib/kube/kubeconfig" kubeserver "github.com/gravitational/teleport/lib/kube/proxy/testing/kube_server" - "github.com/gravitational/teleport/lib/modules" "github.com/gravitational/teleport/lib/modules/modulestest" "github.com/gravitational/teleport/lib/service/servicecfg" "github.com/gravitational/teleport/lib/services" @@ -320,17 +318,6 @@ func (p *kubeTestPack) testListKube(t *testing.T) { // Tests `tsh kube login`, `tsh proxy kube`. func TestKubeSelection(t *testing.T) { - modulestest.SetTestModules(t, - modulestest.Modules{ - TestBuildType: modules.BuildEnterprise, - TestFeatures: modules.Features{ - Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{ - entitlements.K8s: {Enabled: true}, - }, - }, - }, - ) - oldResyncInterval := defaults.ResyncInterval defaults.ResyncInterval = 100 * time.Millisecond // To detect tests that run in parallel incorrectly, call t.Setenv with a @@ -366,6 +353,7 @@ func TestKubeSelection(t *testing.T) { t.Cleanup(cancel) s := newTestSuite(t, withRootConfigFunc(func(cfg *servicecfg.Config) { + cfg.Modules = modulestest.EnterpriseModules() cfg.InsecureMode = true // reconfig the user to use the new role instead of the default ones // User is the second bootstrap resource. diff --git a/tool/tsh/common/tsh_test.go b/tool/tsh/common/tsh_test.go index 86d4727150a..e7df74e5cc9 100644 --- a/tool/tsh/common/tsh_test.go +++ b/tool/tsh/common/tsh_test.go @@ -2331,7 +2331,7 @@ func TestNoRelogin(t *testing.T) { // ssh server using a resource access request when "tsh ssh" fails with // AccessDenied. func TestSSHAccessRequest(t *testing.T) { - modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise}) + t.Parallel() ctx, cancel := context.WithCancel(context.Background()) defer cancel() @@ -2380,6 +2380,9 @@ func TestSSHAccessRequest(t *testing.T) { alice.SetTraits(traits) rootAuth, rootProxy := makeTestServers(t, + withConfig(func(cfg *servicecfg.Config) { + cfg.Modules = modulestest.EnterpriseModules() + }), withBootstrap(requester, searchOnlyRequester, nodeAccessRole, emptyRole, connector, alice), // Do not use a fake clock to better imitate real-world behavior. ) @@ -2776,8 +2779,7 @@ func TestAccessRequestOnLeaf(t *testing.T) { // TestSSHAccessRequestWait tests that "tsh ssh" automatically creates an // access request when required and properly waits for it to be approved. func TestSSHAccessRequestWait(t *testing.T) { - // Access requests require enterprise. - modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise}) + t.Parallel() ctx, cancel := context.WithCancel(context.Background()) defer cancel() @@ -2815,6 +2817,9 @@ func TestSSHAccessRequestWait(t *testing.T) { // Create the cluster with our user and roles. rootAuth, rootProxy := makeTestServers(t, + withConfig(func(cfg *servicecfg.Config) { + cfg.Modules = modulestest.EnterpriseModules() + }), withBootstrap(requester, nodeAccessRole, connector, alice), ) @@ -2913,7 +2918,7 @@ func TestSSHAccessRequestWait(t *testing.T) { // TestSSHCommand tests that a user can access a single SSH node and run commands. func TestSSHCommands(t *testing.T) { - modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise}) + t.Parallel() ctx := t.Context() accessRoleName := "access" @@ -2940,6 +2945,7 @@ func TestSSHCommands(t *testing.T) { testserver.WithSSHLabel(accessRoleName, "true"), testserver.WithSSHPublicAddrs("127.0.0.1:0"), testserver.WithConfig(func(cfg *servicecfg.Config) { + cfg.Modules = modulestest.EnterpriseModules() cfg.SSH.Enabled = true cfg.SSH.PublicAddrs = []utils.NetAddr{cfg.SSH.Addr} cfg.SSH.DisableCreateHostUser = true @@ -3008,7 +3014,8 @@ func TestSSHCommands(t *testing.T) { expected: "-- this is a test message", args: []string{ fmt.Sprintf("%s@%s", user.Username, sshHostname), - "echo", + // /bin/echo avoids shell builtins (fish, zsh) that strip a leading -- as end-of-options. + "/bin/echo", "--", "this is a test message", }, @@ -3040,7 +3047,8 @@ func TestSSHCommands(t *testing.T) { expected: "-- this is a test message", args: []string{ fmt.Sprintf("%s@%s", user.Username, sshHostname), - "echo", "-- this is a test message", + // /bin/echo avoids shell builtins (fish, zsh) that strip a leading -- as end-of-options. + "/bin/echo", "-- this is a test message", }, shouldErr: false, }, @@ -3418,8 +3426,6 @@ func TestSSHHeadlessCLIFlags(t *testing.T) { } func TestSSHHeadless(t *testing.T) { - modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise}) - ctx, cancel := context.WithCancel(context.Background()) t.Cleanup(cancel) @@ -3458,6 +3464,7 @@ func TestSSHHeadless(t *testing.T) { sshHostname := "test-ssh-host" server, err := testserver.NewTeleportProcess(t.TempDir(), testserver.WithConfig(func(cfg *servicecfg.Config) { + cfg.Modules = modulestest.EnterpriseModules() cfg.Hostname = sshHostname cfg.Auth.Enabled = true cfg.Proxy.Enabled = true @@ -3553,7 +3560,6 @@ func TestSSHHeadless(t *testing.T) { } func TestHeadlessDoesNotAddKeysToAgent(t *testing.T) { - modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise}) agentKeyring, _ := createAgent(t) ctx, cancel := context.WithCancel(context.Background()) @@ -3582,6 +3588,7 @@ func TestHeadlessDoesNotAddKeysToAgent(t *testing.T) { server, err := testserver.NewTeleportProcess(t.TempDir(), testserver.WithConfig(func(cfg *servicecfg.Config) { + cfg.Modules = modulestest.EnterpriseModules() cfg.Hostname = sshHostname cfg.Auth.Enabled = true cfg.Proxy.Enabled = true @@ -7247,7 +7254,7 @@ func TestRolesToString(t *testing.T) { // TestResolve tests that host resolution works for various inputs and // that proxy templates are respected. func TestResolve(t *testing.T) { - modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise}) + t.Parallel() ctx := t.Context() accessRoleName := "access" @@ -7273,6 +7280,7 @@ func TestResolve(t *testing.T) { testserver.WithClusterName("root"), testserver.WithSSHPublicAddrs("127.0.0.1:0"), testserver.WithConfig(func(cfg *servicecfg.Config) { + cfg.Modules = modulestest.EnterpriseModules() cfg.SSH.Enabled = true cfg.SSH.PublicAddrs = []utils.NetAddr{cfg.SSH.Addr} cfg.SSH.DisableCreateHostUser = true @@ -7291,6 +7299,7 @@ func TestResolve(t *testing.T) { node, err := testserver.NewTeleportProcess(t.TempDir(), testserver.WithConfig(func(cfg *servicecfg.Config) { + cfg.Modules = modulestest.EnterpriseModules() cfg.SetAuthServerAddresses(rootServer.Config.AuthServerAddresses()) cfg.Hostname = "second-node" cfg.Auth.Enabled = false @@ -7546,7 +7555,6 @@ func TestVersionCompatibilityFlags(t *testing.T) { // TestSCP validates that tsh scp correctly copy file content while also // ensuring that proxy templates are respected. func TestSCP(t *testing.T) { - modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise}) ctx := t.Context() accessRoleName := "access" @@ -7572,6 +7580,7 @@ func TestSCP(t *testing.T) { testserver.WithClusterName("root"), testserver.WithSSHPublicAddrs("127.0.0.1:0"), testserver.WithConfig(func(cfg *servicecfg.Config) { + cfg.Modules = modulestest.EnterpriseModules() cfg.SSH.Enabled = true cfg.SSH.PublicAddrs = []utils.NetAddr{cfg.SSH.Addr} cfg.SSH.DisableCreateHostUser = true @@ -7592,6 +7601,7 @@ func TestSCP(t *testing.T) { const secondServerHostname = "second-node" server, err := testserver.NewTeleportProcess(t.TempDir(), testserver.WithConfig(func(cfg *servicecfg.Config) { + cfg.Modules = modulestest.EnterpriseModules() cfg.SetAuthServerAddresses(rootServer.Config.AuthServerAddresses()) cfg.Hostname = secondServerHostname cfg.Auth.Enabled = false