From fc72fdcdc2eb0abc40acd2cafa7287a72dfc2558 Mon Sep 17 00:00:00 2001 From: rosstimothy <39066650+rosstimothy@users.noreply.github.com> Date: Wed, 22 Apr 2026 13:38:51 -0400 Subject: [PATCH] Update tests to inject modules instead of relying on modulestest.SetTestModules (#65976) This is a pass on replacing modulestest.SetTestModules with supplying modules where already possible. Some additional uses of modules.GetModules were also replaced with localized modules injection to permit the removal of modulestest.SetTestModules in tests. Most of the changes here are mechanical, the one notable change is in TestSSHCommands. The test was not passing locally because the shell (fish) builtin echo behaves differently. The easiest way to produce expected output was to change the command invocation to use /bin/echo to bypass any shell builtins for consistent behavior. Inject modules into tool tests Inject modules into integration tests Inject modules into join server Remove superflous enterprise modules in TestAuthenticationConfig_Parse_deviceTrustPB Inject modules into signature algorithm config tests Inject modules into TestGithubConnectorCRUDEventsEmitted Inject modules into TestGetHierarchyForUser Inject modules into kube proxy tests Inject modules into controller tests make fix-imports add integration/app/fixture as test package --- .golangci.yml | 3 +- integration/appaccess/appaccess_test.go | 11 ------ integration/appaccess/fixtures.go | 5 +++ integration/db/db_integration_test.go | 13 +------ integration/helpers/instance.go | 1 + integration/integration_test.go | 31 +++++++-------- integration/kube_integration_test.go | 13 +------ .../proxy/proxy_tunnel_strategy_test.go | 22 +++++------ .../controllers/resources/testlib/env.go | 6 ++- lib/accesslists/hierarchy_user_test.go | 6 +-- lib/auth/auth_test.go | 9 ++++- lib/auth/grpcserver.go | 1 + lib/auth/join_github.go | 2 +- lib/auth/join_spacelift.go | 2 +- lib/auth/join_terraformcloud.go | 2 +- lib/auth/join_tpm.go | 2 +- lib/config/configuration.go | 5 +-- lib/config/configuration_test.go | 12 +++--- lib/config/fileconf_test.go | 8 +--- lib/join/githubactions/githubactions.go | 4 +- lib/join/join_bitbucket_test.go | 11 +++--- lib/join/join_github_test.go | 11 +++--- lib/join/join_spacelift_test.go | 11 +++--- lib/join/join_terraformcloud_test.go | 9 +++-- lib/join/server.go | 2 + lib/join/server_github.go | 2 +- lib/join/server_spacelift.go | 2 +- lib/join/server_terraformcloud.go | 2 +- lib/join/server_tpm.go | 2 +- lib/join/spacelift/spacelift.go | 3 +- lib/join/terraformcloud/terraform.go | 3 +- lib/join/tpmjoin/join_test.go | 8 +++- lib/join/tpmjoin/tpm.go | 4 +- lib/kube/proxy/moderated_sessions_test.go | 18 ++------- lib/kube/proxy/utils_test.go | 4 ++ tool/tctl/common/admin_action_test.go | 18 ++++----- tool/tctl/common/edit_command_test.go | 38 +++++++++++-------- tool/tctl/common/resource_command_test.go | 27 ++++++------- tool/tsh/common/access_request_test.go | 13 +------ tool/tsh/common/db_test.go | 16 ++------ tool/tsh/common/kube_test.go | 14 +------ tool/tsh/common/tsh_test.go | 32 ++++++++++------ 42 files changed, 189 insertions(+), 219 deletions(-) diff --git a/.golangci.yml b/.golangci.yml index 30b219b3725..fc7e5d75ca6 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -227,8 +227,7 @@ linters: - '!**/e/lib/jamf/testenv/**' - '!**/e/lib/operatortest/**' - '!**/e/tests/**' - - '!**/integration/db/fixture.go' - - '!**/integration/helpers/**' + - '!**/integration/**' - '!**/integrations/lib/testing/**' - '!**/integrations/operator/controllers/resources/testlib/**.go' - '!**/lib/auth/authtest/**' diff --git a/integration/appaccess/appaccess_test.go b/integration/appaccess/appaccess_test.go index f9c1a39f996..5bd77988f2a 100644 --- a/integration/appaccess/appaccess_test.go +++ b/integration/appaccess/appaccess_test.go @@ -41,12 +41,9 @@ import ( "github.com/gravitational/teleport" "github.com/gravitational/teleport/api/types" apievents "github.com/gravitational/teleport/api/types/events" - "github.com/gravitational/teleport/entitlements" "github.com/gravitational/teleport/integration/helpers" "github.com/gravitational/teleport/lib/events" "github.com/gravitational/teleport/lib/httplib/reverseproxy" - "github.com/gravitational/teleport/lib/modules" - "github.com/gravitational/teleport/lib/modules/modulestest" "github.com/gravitational/teleport/lib/service" "github.com/gravitational/teleport/lib/service/servicecfg" "github.com/gravitational/teleport/lib/srv/app/common" @@ -287,14 +284,6 @@ func testForwardModes(p *Pack, t *testing.T) { // testClientCert tests mutual TLS authentication flow with application // access typically used in CLI by curl and other clients. func testClientCert(p *Pack, t *testing.T) { - modulestest.SetTestModules(t, modulestest.Modules{ - TestBuildType: modules.BuildEnterprise, - TestFeatures: modules.Features{ - Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{ - entitlements.App: {Enabled: true}, - }, - }, - }) evilUser, _ := p.CreateUser(t) rootWs := p.CreateAppSession(t, CreateAppSessionParams{ Username: p.username, diff --git a/integration/appaccess/fixtures.go b/integration/appaccess/fixtures.go index 553f57b2a00..3d508282b51 100644 --- a/integration/appaccess/fixtures.go +++ b/integration/appaccess/fixtures.go @@ -38,6 +38,7 @@ import ( "github.com/gravitational/teleport/api/breaker" "github.com/gravitational/teleport/integration/helpers" "github.com/gravitational/teleport/lib/auth/testauthority" + "github.com/gravitational/teleport/lib/modules/modulestest" "github.com/gravitational/teleport/lib/service/servicecfg" "github.com/gravitational/teleport/lib/utils" "github.com/gravitational/teleport/lib/utils/log/logtest" @@ -320,6 +321,7 @@ func SetupWithOptions(t *testing.T, opts AppTestOptions) *Pack { Priv: privateKey, Pub: publicKey, Logger: log, + Modules: modulestest.EnterpriseModules(), } if opts.RootClusterListeners != nil { rootCfg.Listeners = opts.RootClusterListeners(t, &rootCfg.Fds) @@ -335,6 +337,7 @@ func SetupWithOptions(t *testing.T, opts AppTestOptions) *Pack { Priv: privateKey, Pub: publicKey, Logger: log, + Modules: modulestest.EnterpriseModules(), } if opts.LeafClusterListeners != nil { leafCfg.Listeners = opts.LeafClusterListeners(t, &leafCfg.Fds) @@ -344,6 +347,7 @@ func SetupWithOptions(t *testing.T, opts AppTestOptions) *Pack { rcConf := servicecfg.MakeDefaultConfig() // Insecure development mode needs to be set because the web proxy uses a // self-signed certificate during tests. + rcConf.Modules = rootCfg.Modules rcConf.InsecureMode = true rcConf.Logger = log rcConf.DataDir = t.TempDir() @@ -362,6 +366,7 @@ func SetupWithOptions(t *testing.T, opts AppTestOptions) *Pack { rcConf.Clock = opts.Clock lcConf := servicecfg.MakeDefaultConfig() + lcConf.Modules = leafCfg.Modules // Insecure development mode needs to be set because the web proxy uses a // self-signed certificate during tests. lcConf.InsecureMode = true diff --git a/integration/db/db_integration_test.go b/integration/db/db_integration_test.go index 8d8e6f572d2..318e6547d41 100644 --- a/integration/db/db_integration_test.go +++ b/integration/db/db_integration_test.go @@ -36,12 +36,10 @@ import ( "golang.org/x/sync/errgroup" "github.com/gravitational/teleport/api/types" - "github.com/gravitational/teleport/entitlements" "github.com/gravitational/teleport/integration/helpers" "github.com/gravitational/teleport/lib/auth" "github.com/gravitational/teleport/lib/defaults" "github.com/gravitational/teleport/lib/events" - "github.com/gravitational/teleport/lib/modules" "github.com/gravitational/teleport/lib/modules/modulestest" "github.com/gravitational/teleport/lib/service/servicecfg" "github.com/gravitational/teleport/lib/services" @@ -63,10 +61,12 @@ func TestDatabaseAccess(t *testing.T) { pack := SetupDatabaseTest(t, // set tighter rotation intervals WithLeafConfig(func(config *servicecfg.Config) { + config.Modules = modulestest.EnterpriseModules() config.PollingPeriod = 5 * time.Second config.RotationConnectionInterval = 2 * time.Second }), WithRootConfig(func(config *servicecfg.Config) { + config.Modules = modulestest.EnterpriseModules() config.PollingPeriod = 5 * time.Second config.RotationConnectionInterval = 2 * time.Second config.Proxy.MySQLServerVersion = "8.0.1" @@ -104,15 +104,6 @@ func TestDatabaseAccessSeparateListeners(t *testing.T) { // testIPPinning tests a scenario where a user with IP pinning // connects to a database func (p *DatabasePack) testIPPinning(t *testing.T) { - modulestest.SetTestModules(t, modulestest.Modules{ - TestBuildType: modules.BuildEnterprise, - TestFeatures: modules.Features{ - Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{ - entitlements.DB: {Enabled: true}, - }, - }, - }) - type testCase struct { desc string targetCluster databaseClusterPack diff --git a/integration/helpers/instance.go b/integration/helpers/instance.go index 3ef4c75d7d1..f77170c4828 100644 --- a/integration/helpers/instance.go +++ b/integration/helpers/instance.go @@ -455,6 +455,7 @@ func NewInstance(t *testing.T, cfg InstanceConfig) *TeleInstance { Log: cfg.Logger, InstanceListeners: *cfg.Listeners, Fds: cfg.Fds, + Modules: cfg.Modules, } secrets := InstanceSecrets{ diff --git a/integration/integration_test.go b/integration/integration_test.go index 923c5b2a58a..7475a0fb090 100644 --- a/integration/integration_test.go +++ b/integration/integration_test.go @@ -91,7 +91,6 @@ import ( "github.com/gravitational/teleport/lib/events" "github.com/gravitational/teleport/lib/events/eventstest" "github.com/gravitational/teleport/lib/events/filesessions" - "github.com/gravitational/teleport/lib/modules" "github.com/gravitational/teleport/lib/modules/modulestest" "github.com/gravitational/teleport/lib/multiplexer" "github.com/gravitational/teleport/lib/reversetunnelclient" @@ -210,12 +209,11 @@ func TestIntegrations(t *testing.T) { // testDifferentPinnedIP tests connection is rejected when source IP doesn't match the pinned one func testDifferentPinnedIP(t *testing.T, suite *integrationTestSuite) { - modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise}) - tr := utils.NewTracer(utils.ThisFunction()).Start() defer tr.Stop() tconf := suite.defaultServiceConfig() + tconf.Modules = modulestest.EnterpriseModules() tconf.Auth.Enabled = true tconf.Proxy.Enabled = true tconf.SSH.Enabled = true @@ -7657,15 +7655,17 @@ func isNilOrEOFErr(t *testing.T, err error) { } func testModeratedSFTP(t *testing.T, suite *integrationTestSuite) { - modulestest.SetTestModules(t, modulestest.Modules{ - TestBuildType: modules.BuildEnterprise, - }) - // Create Teleport instance - instance := suite.newTeleport(t, nil, true) - t.Cleanup(func() { - instance.StopAll() - }) + tconf := suite.defaultServiceConfig() + tconf.Modules = modulestest.EnterpriseModules() + tconf.Auth.Enabled = true + tconf.Proxy.Enabled = true + tconf.SSH.Enabled = true + + instance := suite.NewTeleportInstance(t) + require.NoError(t, instance.CreateEx(t, nil, tconf)) + require.NoError(t, instance.Start()) + t.Cleanup(func() { instance.StopAll() }) ctx := context.Background() authServer := instance.Process.GetAuthServer() @@ -8575,8 +8575,6 @@ func TestProxySSHPortMultiplexing(t *testing.T) { // can/cannot be established with an existing certificate // based on cluster configuration or roles. func TestConnectivityWithoutAuth(t *testing.T) { - modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise}) - tests := []struct { name string adjustRole func(r types.Role) @@ -8637,6 +8635,7 @@ func TestConnectivityWithoutAuth(t *testing.T) { // Create auth config. authCfg := servicecfg.MakeDefaultConfig() + authCfg.Modules = modulestest.EnterpriseModules() authCfg.Logger = logtest.NewLogger() authCfg.CircuitBreakerConfig = breaker.NoopBreakerConfig() authCfg.InstanceMetadataClient = imds.NewDisabledIMDSClient() @@ -8656,6 +8655,7 @@ func TestConnectivityWithoutAuth(t *testing.T) { Priv: privateKey, Pub: publicKey, Logger: logtest.NewLogger(), + Modules: authCfg.Modules, }) // Create a user and role. @@ -8691,10 +8691,12 @@ func TestConnectivityWithoutAuth(t *testing.T) { Priv: privateKey, Pub: publicKey, Logger: logtest.NewLogger(), + Modules: authCfg.Modules, }) // Create node config. nodeCfg := servicecfg.MakeDefaultConfig() + nodeCfg.Modules = authCfg.Modules nodeCfg.SetAuthServerAddress(authCfg.Auth.ListenAddr) nodeCfg.SetToken("token") nodeCfg.CachePolicy.Enabled = true @@ -8937,8 +8939,6 @@ func TestConnectivityDuringAuthRestart(t *testing.T) { } func testModeratedSessions(t *testing.T, suite *integrationTestSuite) { - modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise}) - const password = "supersecretpassword" inputReader := prompt.NewFakeReader(). AddString(password). @@ -8969,6 +8969,7 @@ func testModeratedSessions(t *testing.T, suite *integrationTestSuite) { // Enable web service. cfg := suite.defaultServiceConfig() + cfg.Modules = modulestest.EnterpriseModules() cfg.Auth.Enabled = true cfg.Auth.Preference.SetSecondFactors(types.SecondFactorType_SECOND_FACTOR_TYPE_WEBAUTHN) cfg.Auth.Preference.(*types.AuthPreferenceV2).Spec.RequireMFAType = types.RequireMFAType_SESSION diff --git a/integration/kube_integration_test.go b/integration/kube_integration_test.go index 554bdf258e4..b6e1e08225e 100644 --- a/integration/kube_integration_test.go +++ b/integration/kube_integration_test.go @@ -71,7 +71,6 @@ import ( "github.com/gravitational/teleport/api/constants" "github.com/gravitational/teleport/api/profile" "github.com/gravitational/teleport/api/types" - "github.com/gravitational/teleport/entitlements" "github.com/gravitational/teleport/integration/helpers" "github.com/gravitational/teleport/integration/kube" "github.com/gravitational/teleport/lib/auth/authclient" @@ -80,7 +79,6 @@ import ( "github.com/gravitational/teleport/lib/cloud/imds" "github.com/gravitational/teleport/lib/defaults" kubeutils "github.com/gravitational/teleport/lib/kube/utils" - "github.com/gravitational/teleport/lib/modules" "github.com/gravitational/teleport/lib/modules/modulestest" "github.com/gravitational/teleport/lib/service" "github.com/gravitational/teleport/lib/service/servicecfg" @@ -1545,16 +1543,8 @@ func testKubeTransportProtocol(t *testing.T, suite *KubeSuite) { // TODO: test against tsh kubectl func testKubeEphemeralContainers(t *testing.T, suite *KubeSuite) { - modulestest.SetTestModules(t, modulestest.Modules{ - TestBuildType: modules.BuildEnterprise, - TestFeatures: modules.Features{ - Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{ - entitlements.K8s: {Enabled: true}, - }, - }, - }) - tconf := suite.teleKubeConfig(Host) + tconf.Modules = modulestest.EnterpriseModules() teleport := helpers.NewInstance(t, helpers.InstanceConfig{ ClusterName: helpers.Site, HostID: helpers.HostID, @@ -1562,6 +1552,7 @@ func testKubeEphemeralContainers(t *testing.T, suite *KubeSuite) { Priv: suite.priv, Pub: suite.pub, Logger: suite.log, + Modules: tconf.Modules, }) username := suite.me.Username diff --git a/integration/proxy/proxy_tunnel_strategy_test.go b/integration/proxy/proxy_tunnel_strategy_test.go index 351cf00bee0..dc164ba2fb1 100644 --- a/integration/proxy/proxy_tunnel_strategy_test.go +++ b/integration/proxy/proxy_tunnel_strategy_test.go @@ -32,14 +32,12 @@ import ( apidefaults "github.com/gravitational/teleport/api/defaults" "github.com/gravitational/teleport/api/types" - "github.com/gravitational/teleport/entitlements" "github.com/gravitational/teleport/integration/helpers" "github.com/gravitational/teleport/lib/auth/authclient" "github.com/gravitational/teleport/lib/auth/authtest" "github.com/gravitational/teleport/lib/auth/testauthority" "github.com/gravitational/teleport/lib/cloud/imds" "github.com/gravitational/teleport/lib/defaults" - "github.com/gravitational/teleport/lib/modules" "github.com/gravitational/teleport/lib/modules/modulestest" "github.com/gravitational/teleport/lib/service" "github.com/gravitational/teleport/lib/service/servicecfg" @@ -150,6 +148,8 @@ func TestProxyTunnelStrategyAgentMesh(t *testing.T) { // TestProxyTunnelStrategyProxyPeering tests the proxy-peer tunnel strategy. func TestProxyTunnelStrategyProxyPeering(t *testing.T) { + t.Parallel() + // NOTE(eriktate): Testing database tunnels appears to be flaky (or possibly never works?) // so we currently skip adding a database altogether in order to ensure peered tunnels have // some automatic test coverage. Gating this behind a flag in case we want to restore the @@ -159,16 +159,6 @@ func TestProxyTunnelStrategyProxyPeering(t *testing.T) { } func testProxyTunnelStrategyProxyPeering(t *testing.T, withDB bool) { - // This test cannot run in parallel as set module changes the global state. - modulestest.SetTestModules(t, modulestest.Modules{ - TestBuildType: modules.BuildEnterprise, - TestFeatures: modules.Features{ - Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{ - entitlements.DB: {Enabled: true}, - }, - }, - }) - p := newProxyTunnelStrategy(t, "proxy-tunnel-proxy-peer", &types.TunnelStrategyV1{ Strategy: &types.TunnelStrategyV1_ProxyPeering{ @@ -313,11 +303,13 @@ func (p *proxyTunnelStrategy) makeAuth(t *testing.T) { Priv: privateKey, Pub: publicKey, Logger: logtest.NewLogger(), + Modules: modulestest.EnterpriseModules(), }) auth.AddUser(p.username, []string{p.username}) conf := servicecfg.MakeDefaultConfig() + conf.Modules = auth.Modules conf.DataDir = t.TempDir() conf.Logger = auth.Log @@ -342,11 +334,13 @@ func (p *proxyTunnelStrategy) makeProxy(t *testing.T) { HostID: uuid.New().String(), NodeName: helpers.Loopback, Logger: logtest.NewLogger(), + Modules: modulestest.EnterpriseModules(), }) authAddr := utils.MustParseAddr(p.auth.Auth) conf := servicecfg.MakeDefaultConfig() + conf.Modules = proxy.Modules conf.DebugService.Enabled = false conf.SetAuthServerAddress(*authAddr) conf.SetToken("token") @@ -391,9 +385,11 @@ func (p *proxyTunnelStrategy) makeNode(t *testing.T) { HostID: uuid.New().String(), NodeName: helpers.Loopback, Logger: logtest.NewLogger(), + Modules: modulestest.EnterpriseModules(), }) conf := servicecfg.MakeDefaultConfig() + conf.Modules = node.Modules conf.Version = types.V3 conf.SetToken("token") conf.DataDir = t.TempDir() @@ -439,9 +435,11 @@ func (p *proxyTunnelStrategy) makeDatabase(t *testing.T) { HostID: uuid.New().String(), NodeName: helpers.Loopback, Logger: logtest.NewLogger(), + Modules: modulestest.EnterpriseModules(), }) conf := servicecfg.MakeDefaultConfig() + conf.Modules = db.Modules conf.DebugService.Enabled = false conf.Version = types.V3 conf.SetToken("token") diff --git a/integrations/operator/controllers/resources/testlib/env.go b/integrations/operator/controllers/resources/testlib/env.go index 7c4488a8043..38d60a3f59f 100644 --- a/integrations/operator/controllers/resources/testlib/env.go +++ b/integrations/operator/controllers/resources/testlib/env.go @@ -80,7 +80,7 @@ func ValidRandomResourceName(prefix string) string { } func defaultTeleportServiceConfig(t *testing.T, insecureMode bool) (*helpers.TeleInstance, string) { - modulestest.SetTestModules(t, modulestest.Modules{ + testModules := &modulestest.Modules{ TestBuildType: modules.BuildEnterprise, TestFeatures: modules.Features{ Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{ @@ -88,16 +88,18 @@ func defaultTeleportServiceConfig(t *testing.T, insecureMode bool) (*helpers.Tel entitlements.SAML: {Enabled: true}, }, }, - }) + } teleportServer := helpers.NewInstance(t, helpers.InstanceConfig{ ClusterName: "root.example.com", HostID: uuid.New().String(), NodeName: helpers.Loopback, Logger: slog.Default(), + Modules: testModules, }) rcConf := servicecfg.MakeDefaultConfig() + rcConf.Modules = testModules rcConf.DataDir = t.TempDir() rcConf.Auth.Enabled = true rcConf.Proxy.Enabled = true diff --git a/lib/accesslists/hierarchy_user_test.go b/lib/accesslists/hierarchy_user_test.go index 2476ca3cd3c..ae98c733aad 100644 --- a/lib/accesslists/hierarchy_user_test.go +++ b/lib/accesslists/hierarchy_user_test.go @@ -37,9 +37,7 @@ import ( ) func TestGetHierarchyForUser(t *testing.T) { - testModules := modulestest.EnterpriseModules() - - modulestest.SetTestModules(t, *testModules) + t.Parallel() clock := clockwork.NewFakeClock() tests := []struct { @@ -393,7 +391,7 @@ func TestGetHierarchyForUser(t *testing.T) { require.NoError(t, err) svc, err := local.NewAccessListServiceV2(local.AccessListServiceConfig{ Backend: bk, - Modules: testModules, + Modules: modulestest.EnterpriseModules(), }) require.NoError(t, err) diff --git a/lib/auth/auth_test.go b/lib/auth/auth_test.go index 1e7d0516e7c..a25a08091e2 100644 --- a/lib/auth/auth_test.go +++ b/lib/auth/auth_test.go @@ -1385,8 +1385,13 @@ func TestTrustedClusterCRUDEventEmitted(t *testing.T) { } func TestGithubConnectorCRUDEventsEmitted(t *testing.T) { - modulestest.SetTestModules(t, *modulestest.EnterpriseModules()) - s := newAuthSuite(t) + t.Parallel() + s, err := newTestPack(t.Context(), testPackOptions{ + DataDir: t.TempDir(), + Modules: modulestest.EnterpriseModules(), + }) + require.NoError(t, err) + t.Cleanup(func() { require.NoError(t, s.a.Close()) }) clientAddr := &net.TCPAddr{IP: net.IPv4(10, 255, 0, 0)} ctx := authz.ContextWithClientSrcAddr(context.Background(), clientAddr) diff --git a/lib/auth/grpcserver.go b/lib/auth/grpcserver.go index 8f026c9662c..71296ebc482 100644 --- a/lib/auth/grpcserver.go +++ b/lib/auth/grpcserver.go @@ -6394,6 +6394,7 @@ func NewGRPCServer(cfg GRPCServerConfig) (*GRPCServer, error) { FIPS: cfg.AuthServer.fips, ScopedTokenService: cfg.AuthServer.Services, OracleHTTPClient: cfg.OracleHTTPClient, + Modules: cfg.AuthServer.modules, })) } diff --git a/lib/auth/join_github.go b/lib/auth/join_github.go index 124dc2bc88c..4882ee13d17 100644 --- a/lib/auth/join_github.go +++ b/lib/auth/join_github.go @@ -60,7 +60,7 @@ func (a *Server) checkGitHubJoinRequest( req *types.RegisterUsingTokenRequest, pt types.ProvisionToken, ) (*githubactions.IDTokenClaims, error) { - claims, err := githubactions.CheckGithubIDToken(ctx, &githubactions.CheckGithubIDTokenParams{ + claims, err := githubactions.CheckGithubIDToken(ctx, a.modules, &githubactions.CheckGithubIDTokenParams{ ProvisionToken: pt, IDToken: []byte(req.IDToken), Clock: a.GetClock(), diff --git a/lib/auth/join_spacelift.go b/lib/auth/join_spacelift.go index 891808fd176..ddee343b6d7 100644 --- a/lib/auth/join_spacelift.go +++ b/lib/auth/join_spacelift.go @@ -44,7 +44,7 @@ func (a *Server) checkSpaceliftJoinRequest( req *types.RegisterUsingTokenRequest, pt types.ProvisionToken, ) (*spacelift.IDTokenClaims, error) { - claims, err := spacelift.CheckIDToken(ctx, &spacelift.CheckIDTokenParams{ + claims, err := spacelift.CheckIDToken(ctx, a.modules, &spacelift.CheckIDTokenParams{ ProvisionToken: pt, IDToken: []byte(req.IDToken), Validator: a.spaceliftIDTokenValidator, diff --git a/lib/auth/join_terraformcloud.go b/lib/auth/join_terraformcloud.go index a1f5ef06081..cb3a12ff985 100644 --- a/lib/auth/join_terraformcloud.go +++ b/lib/auth/join_terraformcloud.go @@ -49,7 +49,7 @@ func (a *Server) checkTerraformCloudJoinRequest( return nil, trace.Wrap(err) } - claims, err := terraformcloud.CheckIDToken(ctx, &terraformcloud.CheckIDTokenParams{ + claims, err := terraformcloud.CheckIDToken(ctx, a.modules, &terraformcloud.CheckIDTokenParams{ ProvisionToken: pt, IDToken: []byte(req.IDToken), Validator: a.terraformIDTokenValidator, diff --git a/lib/auth/join_tpm.go b/lib/auth/join_tpm.go index b6f54d71aa8..365d0fb4a15 100644 --- a/lib/auth/join_tpm.go +++ b/lib/auth/join_tpm.go @@ -77,7 +77,7 @@ func (a *Server) RegisterUsingTPMMethod( return solution.Solution, nil } - validatedEK, err := tpmjoin.CheckTPMRequest(ctx, tpmjoin.CheckTPMRequestParams{ + validatedEK, err := tpmjoin.CheckTPMRequest(ctx, a.modules, tpmjoin.CheckTPMRequestParams{ Token: ptv2, TPMValidator: a.GetTPMValidator(), EKCert: initReq.GetEkCert(), diff --git a/lib/config/configuration.go b/lib/config/configuration.go index 7a538188403..3a8585e4ff6 100644 --- a/lib/config/configuration.go +++ b/lib/config/configuration.go @@ -63,7 +63,6 @@ import ( "github.com/gravitational/teleport/lib/integrations/externalauditstorage/easconfig" "github.com/gravitational/teleport/lib/integrations/samlidp/samlidpconfig" "github.com/gravitational/teleport/lib/limiter" - "github.com/gravitational/teleport/lib/modules" "github.com/gravitational/teleport/lib/multiplexer" "github.com/gravitational/teleport/lib/service/servicecfg" "github.com/gravitational/teleport/lib/services" @@ -2762,7 +2761,7 @@ func Configure(clf *CommandLineFlags, cfg *servicecfg.Config, legacyAppFlags boo return trace.BadParameter("non-FIPS compliant proxy settings: \"proxy_checks_host_keys\" must be true") } - if err := services.ValidateSessionRecordingConfig(cfg.Auth.SessionRecordingConfig, clf.FIPS, modules.GetModules().Features().Cloud); err != nil { + if err := services.ValidateSessionRecordingConfig(cfg.Auth.SessionRecordingConfig, clf.FIPS, cfg.Modules.Features().Cloud); err != nil { return trace.Wrap(err) } } @@ -2776,7 +2775,7 @@ func Configure(clf *CommandLineFlags, cfg *servicecfg.Config, legacyAppFlags boo if err := cfg.Auth.Preference.CheckSignatureAlgorithmSuite(types.SignatureAlgorithmSuiteParams{ FIPS: clf.FIPS, UsingHSMOrKMS: cfg.Auth.KeyStore != servicecfg.KeystoreConfig{}, - Cloud: modules.GetModules().Features().Cloud, + Cloud: cfg.Modules.Features().Cloud, }); err != nil { return trace.Wrap(err) } diff --git a/lib/config/configuration_test.go b/lib/config/configuration_test.go index f0d3ea36b8b..55af2c6405a 100644 --- a/lib/config/configuration_test.go +++ b/lib/config/configuration_test.go @@ -5605,6 +5605,7 @@ debug_service: } func TestSignatureAlgorithmSuite(t *testing.T) { + t.Parallel() for desc, tc := range map[string]struct { fips bool hsm bool @@ -5659,15 +5660,16 @@ func TestSignatureAlgorithmSuite(t *testing.T) { }, } { t.Run(desc, func(t *testing.T) { - modulestest.SetTestModules(t, modulestest.Modules{ - TestFeatures: modules.Features{ - Cloud: tc.cloud, - }, - }) + t.Parallel() clf := &CommandLineFlags{ FIPS: tc.fips, } cfg := servicecfg.MakeDefaultConfig() + cfg.Modules = &modulestest.Modules{ + TestFeatures: modules.Features{ + Cloud: tc.cloud, + }, + } if tc.fips { servicecfg.ApplyFIPSDefaults(cfg) } diff --git a/lib/config/fileconf_test.go b/lib/config/fileconf_test.go index 4c4636854e7..2b9c37f7022 100644 --- a/lib/config/fileconf_test.go +++ b/lib/config/fileconf_test.go @@ -41,8 +41,6 @@ import ( "github.com/gravitational/teleport/api/types" apiutils "github.com/gravitational/teleport/api/utils" "github.com/gravitational/teleport/lib/defaults" - "github.com/gravitational/teleport/lib/modules" - "github.com/gravitational/teleport/lib/modules/modulestest" "github.com/gravitational/teleport/lib/scopes/joining" "github.com/gravitational/teleport/lib/service/servicecfg" "github.com/gravitational/teleport/session/networking/x11" @@ -996,11 +994,7 @@ func TestAuthenticationConfig_RequireSessionMFA(t *testing.T) { } func TestAuthenticationConfig_Parse_deviceTrustPB(t *testing.T) { - // Device trust mode=required is an Enterprise feature. - modulestest.SetTestModules(t, modulestest.Modules{ - TestBuildType: modules.BuildEnterprise, - }) - + t.Parallel() tpmEKCertPath := "testdata/tpm_ekcert_ca.pem" tpmEKCertPEM, err := os.ReadFile(tpmEKCertPath) require.NoError(t, err) diff --git a/lib/join/githubactions/githubactions.go b/lib/join/githubactions/githubactions.go index 02e7da6b5c0..cf8fb07b09e 100644 --- a/lib/join/githubactions/githubactions.go +++ b/lib/join/githubactions/githubactions.go @@ -190,7 +190,7 @@ func (p *CheckGithubIDTokenParams) checkAndSetDefaults() error { // CheckGithubIDToken checks a Github OIDC token against a provision token. // If the token is valid and its claims match at least one allow rule, the // claims are returned. -func CheckGithubIDToken(ctx context.Context, params *CheckGithubIDTokenParams) (*IDTokenClaims, error) { +func CheckGithubIDToken(ctx context.Context, m modules.Modules, params *CheckGithubIDTokenParams) (*IDTokenClaims, error) { if err := params.checkAndSetDefaults(); err != nil { return nil, trace.AccessDenied("%s", err.Error()) } @@ -205,7 +205,7 @@ func CheckGithubIDToken(ctx context.Context, params *CheckGithubIDTokenParams) ( enterpriseOverride := token.Spec.GitHub.EnterpriseServerHost enterpriseSlug := token.Spec.GitHub.EnterpriseSlug if enterpriseOverride != "" || enterpriseSlug != "" { - if modules.GetModules().BuildType() != modules.BuildEnterprise { + if m.BuildType() != modules.BuildEnterprise { return nil, trace.Wrap(services.ErrRequiresEnterprise, "github enterprise server joining") } } diff --git a/lib/join/join_bitbucket_test.go b/lib/join/join_bitbucket_test.go index 949e717d310..92c4c955378 100644 --- a/lib/join/join_bitbucket_test.go +++ b/lib/join/join_bitbucket_test.go @@ -87,9 +87,11 @@ func TestJoinBitbucket(t *testing.T) { ctx := t.Context() + testModules := modulestest.OSSModules() authServer, err := authtest.NewTestServer(authtest.ServerConfig{ Auth: authtest.AuthServerConfig{ - Dir: t.TempDir(), + Dir: t.TempDir(), + Modules: testModules, }, }) require.NoError(t, err) @@ -275,10 +277,9 @@ func TestJoinBitbucket(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { if tt.setEnterprise { - modulestest.SetTestModules( - t, - modulestest.Modules{TestBuildType: modules.BuildEnterprise}, - ) + testModules.TestBuildType = modules.BuildEnterprise + } else { + testModules.TestBuildType = modules.BuildOSS } token, err := types.NewProvisionTokenFromSpec( diff --git a/lib/join/join_github_test.go b/lib/join/join_github_test.go index 5e637e07204..ecea7f92228 100644 --- a/lib/join/join_github_test.go +++ b/lib/join/join_github_test.go @@ -116,9 +116,11 @@ func TestJoinGHA(t *testing.T) { }, } + testModules := modulestest.OSSModules() authServer, err := authtest.NewTestServer(authtest.ServerConfig{ Auth: authtest.AuthServerConfig{ - Dir: t.TempDir(), + Dir: t.TempDir(), + Modules: testModules, }, }) require.NoError(t, err) @@ -692,10 +694,9 @@ func TestJoinGHA(t *testing.T) { t.Run(tt.name, func(t *testing.T) { t.Cleanup(idTokenValidator.reset) if tt.setEnterprise { - modulestest.SetTestModules( - t, - modulestest.Modules{TestBuildType: modules.BuildEnterprise}, - ) + testModules.TestBuildType = modules.BuildEnterprise + } else { + testModules.TestBuildType = modules.BuildOSS } token, err := types.NewProvisionTokenFromSpec( tt.name, time.Now().Add(time.Minute), tt.tokenSpec, diff --git a/lib/join/join_spacelift_test.go b/lib/join/join_spacelift_test.go index 15084fdae76..8e669fc624c 100644 --- a/lib/join/join_spacelift_test.go +++ b/lib/join/join_spacelift_test.go @@ -75,9 +75,11 @@ func TestJoinSpacelift(t *testing.T) { ctx := t.Context() + testModules := modulestest.OSSModules() authServer, err := authtest.NewTestServer(authtest.ServerConfig{ Auth: authtest.AuthServerConfig{ - Dir: t.TempDir(), + Dir: t.TempDir(), + Modules: testModules, }, }) require.NoError(t, err) @@ -331,10 +333,9 @@ func TestJoinSpacelift(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { if tt.setEnterprise { - modulestest.SetTestModules( - t, - modulestest.Modules{TestBuildType: modules.BuildEnterprise}, - ) + testModules.TestBuildType = modules.BuildEnterprise + } else { + testModules.TestBuildType = modules.BuildOSS } token, err := types.NewProvisionTokenFromSpec( diff --git a/lib/join/join_terraformcloud_test.go b/lib/join/join_terraformcloud_test.go index b6dba89e692..e90f8768627 100644 --- a/lib/join/join_terraformcloud_test.go +++ b/lib/join/join_terraformcloud_test.go @@ -82,10 +82,12 @@ func TestJoinTerraformCloud(t *testing.T) { ctx := t.Context() + testModules := modulestest.OSSModules() authServer, err := authtest.NewTestServer(authtest.ServerConfig{ Auth: authtest.AuthServerConfig{ ClusterName: "test.localhost", Dir: t.TempDir(), + Modules: testModules, }, }) require.NoError(t, err) @@ -406,10 +408,9 @@ func TestJoinTerraformCloud(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { if tt.setEnterprise { - modulestest.SetTestModules( - t, - modulestest.Modules{TestBuildType: modules.BuildEnterprise}, - ) + testModules.TestBuildType = modules.BuildEnterprise + } else { + testModules.TestBuildType = modules.BuildOSS } token, err := types.NewProvisionTokenFromSpec( diff --git a/lib/join/server.go b/lib/join/server.go index 9e5b24e3c9c..a3918f89c04 100644 --- a/lib/join/server.go +++ b/lib/join/server.go @@ -65,6 +65,7 @@ import ( "github.com/gravitational/teleport/lib/join/terraformcloud" "github.com/gravitational/teleport/lib/join/tpmjoin" kubetoken "github.com/gravitational/teleport/lib/kube/token" + "github.com/gravitational/teleport/lib/modules" "github.com/gravitational/teleport/lib/scopes/joining" "github.com/gravitational/teleport/lib/services" "github.com/gravitational/teleport/lib/services/readonly" @@ -123,6 +124,7 @@ type ServerConfig struct { ScopedTokenService services.ScopedTokenService OracleHTTPClient utils.HTTPDoClient Logger *slog.Logger + Modules modules.Modules } // Server implements cluster joining for nodes and bots. diff --git a/lib/join/server_github.go b/lib/join/server_github.go index 526bd585593..4c15d99d41a 100644 --- a/lib/join/server_github.go +++ b/lib/join/server_github.go @@ -33,7 +33,7 @@ func (a *Server) validateGithubToken( pt provision.Token, idToken []byte, ) (any, *workloadidentityv1.JoinAttrs, error) { - claims, err := githubactions.CheckGithubIDToken(ctx, &githubactions.CheckGithubIDTokenParams{ + claims, err := githubactions.CheckGithubIDToken(ctx, a.cfg.Modules, &githubactions.CheckGithubIDTokenParams{ ProvisionToken: pt, IDToken: idToken, Validator: a.cfg.AuthService.GetGHAIDTokenValidator(), diff --git a/lib/join/server_spacelift.go b/lib/join/server_spacelift.go index 628a195af14..b11d76a5814 100644 --- a/lib/join/server_spacelift.go +++ b/lib/join/server_spacelift.go @@ -33,7 +33,7 @@ func (a *Server) validateSpaceliftToken( pt provision.Token, idToken []byte, ) (any, *workloadidentityv1.JoinAttrs, error) { - claims, err := spacelift.CheckIDToken(ctx, &spacelift.CheckIDTokenParams{ + claims, err := spacelift.CheckIDToken(ctx, a.cfg.Modules, &spacelift.CheckIDTokenParams{ ProvisionToken: pt, IDToken: idToken, Validator: a.cfg.AuthService.GetSpaceliftIDTokenValidator(), diff --git a/lib/join/server_terraformcloud.go b/lib/join/server_terraformcloud.go index 6258272af7d..8186f0cb503 100644 --- a/lib/join/server_terraformcloud.go +++ b/lib/join/server_terraformcloud.go @@ -40,7 +40,7 @@ func (a *Server) validateTerraformCloudToken( return nil, nil, trace.Wrap(err) } - claims, err := terraformcloud.CheckIDToken(ctx, &terraformcloud.CheckIDTokenParams{ + claims, err := terraformcloud.CheckIDToken(ctx, a.cfg.Modules, &terraformcloud.CheckIDTokenParams{ ProvisionToken: pt, IDToken: idToken, Validator: a.cfg.AuthService.GetTerraformIDTokenValidator(), diff --git a/lib/join/server_tpm.go b/lib/join/server_tpm.go index 8b6f28327a3..c636cbc0e72 100644 --- a/lib/join/server_tpm.go +++ b/lib/join/server_tpm.go @@ -77,7 +77,7 @@ func (s *Server) handleTPMJoin( return solutionMsg.Solution, nil } - validatedEK, err := tpmjoin.CheckTPMRequest(stream.Context(), tpmjoin.CheckTPMRequestParams{ + validatedEK, err := tpmjoin.CheckTPMRequest(stream.Context(), s.cfg.Modules, tpmjoin.CheckTPMRequestParams{ Token: ptv2, TPMValidator: s.cfg.AuthService.GetTPMValidator(), EKCert: tpmInit.EKCert, diff --git a/lib/join/spacelift/spacelift.go b/lib/join/spacelift/spacelift.go index 5d22c54c778..c9523e722e1 100644 --- a/lib/join/spacelift/spacelift.go +++ b/lib/join/spacelift/spacelift.go @@ -113,6 +113,7 @@ func (p *CheckIDTokenParams) validate() error { // rules in the provided provision token. func CheckIDToken( ctx context.Context, + m modules.Modules, params *CheckIDTokenParams, ) (*IDTokenClaims, error) { if err := params.validate(); err != nil { @@ -124,7 +125,7 @@ func CheckIDToken( return nil, trace.BadParameter("spacelift join method only supports ProvisionTokenV2, '%T' was provided", params.ProvisionToken) } - if modules.GetModules().BuildType() != modules.BuildEnterprise { + if m.BuildType() != modules.BuildEnterprise { return nil, trace.Wrap(services.ErrRequiresEnterprise, "spacelift joining") } diff --git a/lib/join/terraformcloud/terraform.go b/lib/join/terraformcloud/terraform.go index fe5f669096d..58184c1dac0 100644 --- a/lib/join/terraformcloud/terraform.go +++ b/lib/join/terraformcloud/terraform.go @@ -117,6 +117,7 @@ func (p *CheckIDTokenParams) checkAndSetDefaults() error { // rules in the provided provision token. func CheckIDToken( ctx context.Context, + m modules.Modules, params *CheckIDTokenParams, ) (*IDTokenClaims, error) { if err := params.checkAndSetDefaults(); err != nil { @@ -129,7 +130,7 @@ func CheckIDToken( } hostnameOverride := token.Spec.TerraformCloud.Hostname - if hostnameOverride != "" && modules.GetModules().BuildType() != modules.BuildEnterprise { + if hostnameOverride != "" && m.BuildType() != modules.BuildEnterprise { return nil, trace.Wrap( services.ErrRequiresEnterprise, "terraform_cloud joining for Terraform Enterprise", diff --git a/lib/join/tpmjoin/join_test.go b/lib/join/tpmjoin/join_test.go index ee8bab3b2bb..79d505ae1e0 100644 --- a/lib/join/tpmjoin/join_test.go +++ b/lib/join/tpmjoin/join_test.go @@ -46,9 +46,11 @@ import ( ) func TestJoinTPM(t *testing.T) { + testModules := modulestest.OSSModules() server, err := authtest.NewTestServer(authtest.ServerConfig{ Auth: authtest.AuthServerConfig{ - Dir: t.TempDir(), + Dir: t.TempDir(), + Modules: testModules, }, }) require.NoError(t, err) @@ -275,7 +277,9 @@ func TestJoinTPM(t *testing.T) { } { t.Run(tc.desc, func(t *testing.T) { if !tc.oss { - modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise}) + testModules.TestBuildType = modules.BuildEnterprise + } else { + testModules.TestBuildType = modules.BuildOSS } token, err := types.NewProvisionTokenFromSpec("mytoken", time.Now().Add(time.Minute), types.ProvisionTokenSpecV2{ diff --git a/lib/join/tpmjoin/tpm.go b/lib/join/tpmjoin/tpm.go index 621a6c4318b..809eaf07e3d 100644 --- a/lib/join/tpmjoin/tpm.go +++ b/lib/join/tpmjoin/tpm.go @@ -55,8 +55,8 @@ type CheckTPMRequestParams struct { } // CheckTPMRequest checks a TPM method join request. -func CheckTPMRequest(ctx context.Context, params CheckTPMRequestParams) (*tpm.ValidatedTPM, error) { - if modules.GetModules().BuildType() != modules.BuildEnterprise { +func CheckTPMRequest(ctx context.Context, m modules.Modules, params CheckTPMRequestParams) (*tpm.ValidatedTPM, error) { + if m.BuildType() != modules.BuildEnterprise { return nil, trace.Wrap( services.ErrRequiresEnterprise, "tpm joining", diff --git a/lib/kube/proxy/moderated_sessions_test.go b/lib/kube/proxy/moderated_sessions_test.go index beb6de61621..b169048a39d 100644 --- a/lib/kube/proxy/moderated_sessions_test.go +++ b/lib/kube/proxy/moderated_sessions_test.go @@ -43,22 +43,15 @@ import ( "github.com/gravitational/teleport/api/constants" "github.com/gravitational/teleport/api/types" apievents "github.com/gravitational/teleport/api/types/events" - "github.com/gravitational/teleport/entitlements" "github.com/gravitational/teleport/lib/auth/authclient" "github.com/gravitational/teleport/lib/events" testingkubemock "github.com/gravitational/teleport/lib/kube/proxy/testing/kube_server" - "github.com/gravitational/teleport/lib/modules" "github.com/gravitational/teleport/lib/modules/modulestest" sessionpkg "github.com/gravitational/teleport/lib/session" ) func TestModeratedSessions(t *testing.T) { - // enable enterprise features to have access to ModeratedSessions. - modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise, TestFeatures: modules.Features{ - Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{ - entitlements.K8s: {Enabled: true}, - }, - }}) + t.Parallel() const ( moderatorUsername = "moderator_user" moderatorRoleName = "mod_role" @@ -90,6 +83,7 @@ func TestModeratedSessions(t *testing.T) { context.Background(), t, TestConfig{ + Modules: modulestest.EnterpriseModules(), Clusters: []KubeClusterConfig{{Name: kubeCluster, APIEndpoint: kubeMock.URL}}, // onEvent is called each time a new event is produced. We only care about // sessionEnd events. @@ -512,12 +506,7 @@ func validateSessionTracker(testCtx *TestContext, sessionID string, reason strin // covered by the integration test mentioned above because we need to fake the // Lock watcher connection to be stale and it takes ~5 minutes to happen. func TestInteractiveSessionsNoAuth(t *testing.T) { - // enable enterprise features to have access to ModeratedSessions. - modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise, TestFeatures: modules.Features{ - Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{ - entitlements.K8s: {Enabled: true}, - }, - }}) + t.Parallel() const ( moderatorUsername = "moderator_user" moderatorRoleName = "mod_role" @@ -547,6 +536,7 @@ func TestInteractiveSessionsNoAuth(t *testing.T) { context.Background(), t, TestConfig{ + Modules: modulestest.EnterpriseModules(), Clusters: []KubeClusterConfig{{Name: kubeCluster, APIEndpoint: kubeMock.URL}}, WrapAuthClient: func(client authclient.ClientI) authclient.ClientI { authClient.ClientI = client diff --git a/lib/kube/proxy/utils_test.go b/lib/kube/proxy/utils_test.go index ea12b31f64f..94dd04582a2 100644 --- a/lib/kube/proxy/utils_test.go +++ b/lib/kube/proxy/utils_test.go @@ -19,6 +19,7 @@ package proxy import ( + "cmp" "context" "crypto/ecdsa" "crypto/tls" @@ -64,6 +65,7 @@ import ( "github.com/gravitational/teleport/lib/kube/proxy/streamproto" "github.com/gravitational/teleport/lib/limiter" "github.com/gravitational/teleport/lib/modules" + "github.com/gravitational/teleport/lib/modules/modulestest" "github.com/gravitational/teleport/lib/multiplexer" "github.com/gravitational/teleport/lib/reversetunnel" "github.com/gravitational/teleport/lib/reversetunnelclient" @@ -103,6 +105,7 @@ type KubeClusterConfig struct { // TestConfig defines the suite options. type TestConfig struct { + Modules *modulestest.Modules Clusters []KubeClusterConfig ResourceMatchers []services.ResourceMatcher OnReconcile func(types.KubeClusters) @@ -143,6 +146,7 @@ func SetupTestContext(ctx context.Context, t *testing.T, cfg TestConfig) *TestCo Streamer: streamer, UploadHandler: testCtx.UploadHandler, Dir: t.TempDir(), + Modules: cmp.Or(cfg.Modules, modulestest.OSSModules()), }) require.NoError(t, err) t.Cleanup(func() { require.NoError(t, authServer.Close()) }) diff --git a/tool/tctl/common/admin_action_test.go b/tool/tctl/common/admin_action_test.go index d28d03e3b86..6c7b5afe16a 100644 --- a/tool/tctl/common/admin_action_test.go +++ b/tool/tctl/common/admin_action_test.go @@ -1056,15 +1056,6 @@ func newAdminActionTestSuite(t *testing.T) *adminActionTestSuite { t.Helper() ctx := context.Background() - modulestest.SetTestModules(t, modulestest.Modules{ - TestBuildType: modules.BuildEnterprise, - TestFeatures: modules.Features{ - Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{ - entitlements.OIDC: {Enabled: true}, - entitlements.SAML: {Enabled: true}, - }, - }, - }) authPref, err := types.NewAuthPreference(types.AuthPreferenceSpecV2{ Type: constants.Local, @@ -1080,6 +1071,15 @@ func newAdminActionTestSuite(t *testing.T) *adminActionTestSuite { process, err := testserver.NewTeleportProcess(t.TempDir(), testserver.WithAuthPreference(authPref), testserver.WithConfig(func(cfg *servicecfg.Config) { + cfg.Modules = &modulestest.Modules{ + TestBuildType: modules.BuildEnterprise, + TestFeatures: modules.Features{ + Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{ + entitlements.OIDC: {Enabled: true}, + entitlements.SAML: {Enabled: true}, + }, + }, + } proxyPublicAddr = cfg.Proxy.WebAddr proxyPublicAddr.Addr = fmt.Sprintf("localhost:%v", proxyPublicAddr.Port(0)) cfg.Proxy.PublicAddrs = []utils.NetAddr{proxyPublicAddr} diff --git a/tool/tctl/common/edit_command_test.go b/tool/tctl/common/edit_command_test.go index 65eacc54d58..8f7fc5dc87c 100644 --- a/tool/tctl/common/edit_command_test.go +++ b/tool/tctl/common/edit_command_test.go @@ -51,6 +51,7 @@ import ( "github.com/gravitational/teleport/lib/defaults" "github.com/gravitational/teleport/lib/modules" "github.com/gravitational/teleport/lib/modules/modulestest" + "github.com/gravitational/teleport/lib/service/servicecfg" "github.com/gravitational/teleport/lib/services" "github.com/gravitational/teleport/lib/utils/log/logtest" "github.com/gravitational/teleport/tool/tctl/common/resources" @@ -58,10 +59,13 @@ import ( ) func TestEditResources(t *testing.T) { - modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise}) - + t.Parallel() log := logtest.NewLogger() - process, err := testenv.NewTeleportProcess(t.TempDir(), testenv.WithLogger(log)) + process, err := testenv.NewTeleportProcess(t.TempDir(), + testenv.WithConfig(func(cfg *servicecfg.Config) { + cfg.Modules = modulestest.EnterpriseModules() + }), + testenv.WithLogger(log)) require.NoError(t, err) t.Cleanup(func() { require.NoError(t, process.Close()) @@ -375,22 +379,24 @@ func testEditSessionRecordingConfig(t *testing.T, clt *authclient.Client) { } // TestEditEnterpriseResources asserts that tctl edit -// behaves as expected for enterprise resources. These resources cannot -// be tested in parallel because they alter the modules to enable features. -// The tests are grouped to amortize the cost of creating and auth server since +// behaves as expected for enterprise resources. The tests are +// grouped to amortize the cost of creating and auth server since // that is the most expensive part of testing editing the resource. func TestEditEnterpriseResources(t *testing.T) { - modulestest.SetTestModules(t, modulestest.Modules{ - TestBuildType: modules.BuildEnterprise, - TestFeatures: modules.Features{ - Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{ - entitlements.OIDC: {Enabled: true}, - entitlements.SAML: {Enabled: true}, - }, - }, - }) log := logtest.NewLogger() - process, err := testenv.NewTeleportProcess(t.TempDir(), testenv.WithLogger(log)) + process, err := testenv.NewTeleportProcess(t.TempDir(), + testenv.WithConfig(func(cfg *servicecfg.Config) { + cfg.Modules = &modulestest.Modules{ + TestBuildType: modules.BuildEnterprise, + TestFeatures: modules.Features{ + Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{ + entitlements.OIDC: {Enabled: true}, + entitlements.SAML: {Enabled: true}, + }, + }, + } + }), + testenv.WithLogger(log)) require.NoError(t, err) t.Cleanup(func() { require.NoError(t, process.Close()) diff --git a/tool/tctl/common/resource_command_test.go b/tool/tctl/common/resource_command_test.go index ab6fd8778c0..3c6a777ed03 100644 --- a/tool/tctl/common/resource_command_test.go +++ b/tool/tctl/common/resource_command_test.go @@ -60,6 +60,7 @@ import ( "github.com/gravitational/teleport/lib/modules" "github.com/gravitational/teleport/lib/modules/modulestest" scopedaccess "github.com/gravitational/teleport/lib/scopes/access" + "github.com/gravitational/teleport/lib/service/servicecfg" "github.com/gravitational/teleport/lib/services" "github.com/gravitational/teleport/lib/utils/log/logtest" "github.com/gravitational/teleport/tool/tctl/common/databaseobject" @@ -2436,22 +2437,22 @@ version: v1 } // TestCreateEnterpriseResources asserts that tctl create -// behaves as expected for enterprise resources. These resources cannot -// be tested in parallel because they alter the modules to enable features. -// The tests are grouped to amortize the cost of creating and auth server since +// behaves as expected for enterprise resources. The tests are +// grouped to amortize the cost of creating and auth server since // that is the most expensive part of testing editing the resource. func TestCreateEnterpriseResources(t *testing.T) { - modulestest.SetTestModules(t, modulestest.Modules{ - TestBuildType: modules.BuildEnterprise, - TestFeatures: modules.Features{ - Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{ - entitlements.OIDC: {Enabled: true}, - entitlements.SAML: {Enabled: true}, + t.Parallel() + process, err := testenv.NewTeleportProcess(t.TempDir(), testenv.WithConfig(func(cfg *servicecfg.Config) { + cfg.Modules = &modulestest.Modules{ + TestBuildType: modules.BuildEnterprise, + TestFeatures: modules.Features{ + Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{ + entitlements.OIDC: {Enabled: true}, + entitlements.SAML: {Enabled: true}, + }, }, - }, - }) - - process, err := testenv.NewTeleportProcess(t.TempDir()) + } + })) require.NoError(t, err) t.Cleanup(func() { require.NoError(t, process.Close()) diff --git a/tool/tsh/common/access_request_test.go b/tool/tsh/common/access_request_test.go index b205eccc5a5..26d9b55b8b3 100644 --- a/tool/tsh/common/access_request_test.go +++ b/tool/tsh/common/access_request_test.go @@ -29,24 +29,13 @@ import ( "github.com/stretchr/testify/require" "github.com/gravitational/teleport/api/types" - "github.com/gravitational/teleport/entitlements" "github.com/gravitational/teleport/lib/asciitable" - "github.com/gravitational/teleport/lib/modules" "github.com/gravitational/teleport/lib/modules/modulestest" "github.com/gravitational/teleport/lib/service/servicecfg" "github.com/gravitational/teleport/lib/utils" ) func TestAccessRequestSearch(t *testing.T) { - modulestest.SetTestModules(t, modulestest.Modules{ - TestBuildType: modules.BuildEnterprise, - TestFeatures: modules.Features{ - Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{ - entitlements.K8s: {Enabled: true}, - }, - }, - }, - ) ctx := context.Background() const ( rootClusterName = "root-cluster" @@ -56,6 +45,7 @@ func TestAccessRequestSearch(t *testing.T) { ) s := newTestSuite(t, withRootConfigFunc(func(cfg *servicecfg.Config) { + cfg.Modules = modulestest.EnterpriseModules() cfg.InsecureMode = true cfg.Auth.ClusterName.SetClusterName(rootClusterName) cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex) @@ -67,6 +57,7 @@ func TestAccessRequestSearch(t *testing.T) { withLeafCluster(), withLeafConfigFunc( func(cfg *servicecfg.Config) { + cfg.Modules = modulestest.EnterpriseModules() cfg.InsecureMode = true cfg.Auth.ClusterName.SetClusterName(leafClusterName) cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex) diff --git a/tool/tsh/common/db_test.go b/tool/tsh/common/db_test.go index 8bbc2e4f646..a514d6d02c2 100644 --- a/tool/tsh/common/db_test.go +++ b/tool/tsh/common/db_test.go @@ -42,12 +42,10 @@ import ( apidefaults "github.com/gravitational/teleport/api/defaults" "github.com/gravitational/teleport/api/types" "github.com/gravitational/teleport/api/utils/keys" - "github.com/gravitational/teleport/entitlements" "github.com/gravitational/teleport/lib/client" "github.com/gravitational/teleport/lib/cryptosuites" "github.com/gravitational/teleport/lib/defaults" "github.com/gravitational/teleport/lib/fixtures" - "github.com/gravitational/teleport/lib/modules" "github.com/gravitational/teleport/lib/modules/modulestest" "github.com/gravitational/teleport/lib/observability/tracing" "github.com/gravitational/teleport/lib/service" @@ -77,16 +75,6 @@ func TestTshDB(t *testing.T) { // will fail. The fake engine registered are not functional. But other // Enterprise features like Access Request can still be tested. registerFakeEnterpriseDBEngines(t) - modulestest.SetTestModules(t, - modulestest.Modules{ - TestBuildType: modules.BuildEnterprise, - TestFeatures: modules.Features{ - Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{ - entitlements.DB: {Enabled: true}, - }, - }, - }, - ) // this speeds up test suite setup substantially, which is where // tests spend the majority of their time, especially when leaf @@ -150,6 +138,7 @@ func testDatabaseLogin(t *testing.T) { alice.SetRoles([]string{"dev-access", "autouser", "access-requestor"}) s := newTestSuite(t, withRootConfigFunc(func(cfg *servicecfg.Config) { + cfg.Modules = modulestest.EnterpriseModules() cfg.InsecureMode = true cfg.Auth.BootstrapResources = append( cfg.Auth.BootstrapResources, @@ -698,6 +687,7 @@ func testListDatabase(t *testing.T) { fullName := "root-postgres-rds-us-west-1-123456789012" s := newTestSuite(t, withRootConfigFunc(func(cfg *servicecfg.Config) { + cfg.Modules = modulestest.EnterpriseModules() cfg.InsecureMode = true cfg.Auth.StorageConfig.Params["poll_stream_period"] = 50 * time.Millisecond cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex) @@ -721,6 +711,7 @@ func testListDatabase(t *testing.T) { }), withLeafCluster(), withLeafConfigFunc(func(cfg *servicecfg.Config) { + cfg.Modules = modulestest.EnterpriseModules() cfg.Auth.StorageConfig.Params["poll_stream_period"] = 50 * time.Millisecond cfg.InsecureMode = true cfg.SSH.Enabled = false @@ -1592,6 +1583,7 @@ func testDatabaseSelection(t *testing.T) { alice.SetRoles([]string{"access"}) s := newTestSuite(t, withRootConfigFunc(func(cfg *servicecfg.Config) { + cfg.Modules = modulestest.EnterpriseModules() cfg.Auth.BootstrapResources = append(cfg.Auth.BootstrapResources, alice) cfg.InsecureMode = true cfg.Auth.NetworkingConfig.SetProxyListenerMode(types.ProxyListenerMode_Multiplex) diff --git a/tool/tsh/common/kube_test.go b/tool/tsh/common/kube_test.go index e721bdf47cc..04bf3d827ff 100644 --- a/tool/tsh/common/kube_test.go +++ b/tool/tsh/common/kube_test.go @@ -46,12 +46,10 @@ import ( "github.com/gravitational/teleport/api/types" apiutils "github.com/gravitational/teleport/api/utils" "github.com/gravitational/teleport/api/utils/keypaths" - "github.com/gravitational/teleport/entitlements" "github.com/gravitational/teleport/lib/asciitable" "github.com/gravitational/teleport/lib/defaults" "github.com/gravitational/teleport/lib/kube/kubeconfig" kubeserver "github.com/gravitational/teleport/lib/kube/proxy/testing/kube_server" - "github.com/gravitational/teleport/lib/modules" "github.com/gravitational/teleport/lib/modules/modulestest" "github.com/gravitational/teleport/lib/service/servicecfg" "github.com/gravitational/teleport/lib/services" @@ -320,17 +318,6 @@ func (p *kubeTestPack) testListKube(t *testing.T) { // Tests `tsh kube login`, `tsh proxy kube`. func TestKubeSelection(t *testing.T) { - modulestest.SetTestModules(t, - modulestest.Modules{ - TestBuildType: modules.BuildEnterprise, - TestFeatures: modules.Features{ - Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{ - entitlements.K8s: {Enabled: true}, - }, - }, - }, - ) - oldResyncInterval := defaults.ResyncInterval defaults.ResyncInterval = 100 * time.Millisecond // To detect tests that run in parallel incorrectly, call t.Setenv with a @@ -366,6 +353,7 @@ func TestKubeSelection(t *testing.T) { t.Cleanup(cancel) s := newTestSuite(t, withRootConfigFunc(func(cfg *servicecfg.Config) { + cfg.Modules = modulestest.EnterpriseModules() cfg.InsecureMode = true // reconfig the user to use the new role instead of the default ones // User is the second bootstrap resource. diff --git a/tool/tsh/common/tsh_test.go b/tool/tsh/common/tsh_test.go index 86d4727150a..e7df74e5cc9 100644 --- a/tool/tsh/common/tsh_test.go +++ b/tool/tsh/common/tsh_test.go @@ -2331,7 +2331,7 @@ func TestNoRelogin(t *testing.T) { // ssh server using a resource access request when "tsh ssh" fails with // AccessDenied. func TestSSHAccessRequest(t *testing.T) { - modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise}) + t.Parallel() ctx, cancel := context.WithCancel(context.Background()) defer cancel() @@ -2380,6 +2380,9 @@ func TestSSHAccessRequest(t *testing.T) { alice.SetTraits(traits) rootAuth, rootProxy := makeTestServers(t, + withConfig(func(cfg *servicecfg.Config) { + cfg.Modules = modulestest.EnterpriseModules() + }), withBootstrap(requester, searchOnlyRequester, nodeAccessRole, emptyRole, connector, alice), // Do not use a fake clock to better imitate real-world behavior. ) @@ -2776,8 +2779,7 @@ func TestAccessRequestOnLeaf(t *testing.T) { // TestSSHAccessRequestWait tests that "tsh ssh" automatically creates an // access request when required and properly waits for it to be approved. func TestSSHAccessRequestWait(t *testing.T) { - // Access requests require enterprise. - modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise}) + t.Parallel() ctx, cancel := context.WithCancel(context.Background()) defer cancel() @@ -2815,6 +2817,9 @@ func TestSSHAccessRequestWait(t *testing.T) { // Create the cluster with our user and roles. rootAuth, rootProxy := makeTestServers(t, + withConfig(func(cfg *servicecfg.Config) { + cfg.Modules = modulestest.EnterpriseModules() + }), withBootstrap(requester, nodeAccessRole, connector, alice), ) @@ -2913,7 +2918,7 @@ func TestSSHAccessRequestWait(t *testing.T) { // TestSSHCommand tests that a user can access a single SSH node and run commands. func TestSSHCommands(t *testing.T) { - modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise}) + t.Parallel() ctx := t.Context() accessRoleName := "access" @@ -2940,6 +2945,7 @@ func TestSSHCommands(t *testing.T) { testserver.WithSSHLabel(accessRoleName, "true"), testserver.WithSSHPublicAddrs("127.0.0.1:0"), testserver.WithConfig(func(cfg *servicecfg.Config) { + cfg.Modules = modulestest.EnterpriseModules() cfg.SSH.Enabled = true cfg.SSH.PublicAddrs = []utils.NetAddr{cfg.SSH.Addr} cfg.SSH.DisableCreateHostUser = true @@ -3008,7 +3014,8 @@ func TestSSHCommands(t *testing.T) { expected: "-- this is a test message", args: []string{ fmt.Sprintf("%s@%s", user.Username, sshHostname), - "echo", + // /bin/echo avoids shell builtins (fish, zsh) that strip a leading -- as end-of-options. + "/bin/echo", "--", "this is a test message", }, @@ -3040,7 +3047,8 @@ func TestSSHCommands(t *testing.T) { expected: "-- this is a test message", args: []string{ fmt.Sprintf("%s@%s", user.Username, sshHostname), - "echo", "-- this is a test message", + // /bin/echo avoids shell builtins (fish, zsh) that strip a leading -- as end-of-options. + "/bin/echo", "-- this is a test message", }, shouldErr: false, }, @@ -3418,8 +3426,6 @@ func TestSSHHeadlessCLIFlags(t *testing.T) { } func TestSSHHeadless(t *testing.T) { - modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise}) - ctx, cancel := context.WithCancel(context.Background()) t.Cleanup(cancel) @@ -3458,6 +3464,7 @@ func TestSSHHeadless(t *testing.T) { sshHostname := "test-ssh-host" server, err := testserver.NewTeleportProcess(t.TempDir(), testserver.WithConfig(func(cfg *servicecfg.Config) { + cfg.Modules = modulestest.EnterpriseModules() cfg.Hostname = sshHostname cfg.Auth.Enabled = true cfg.Proxy.Enabled = true @@ -3553,7 +3560,6 @@ func TestSSHHeadless(t *testing.T) { } func TestHeadlessDoesNotAddKeysToAgent(t *testing.T) { - modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise}) agentKeyring, _ := createAgent(t) ctx, cancel := context.WithCancel(context.Background()) @@ -3582,6 +3588,7 @@ func TestHeadlessDoesNotAddKeysToAgent(t *testing.T) { server, err := testserver.NewTeleportProcess(t.TempDir(), testserver.WithConfig(func(cfg *servicecfg.Config) { + cfg.Modules = modulestest.EnterpriseModules() cfg.Hostname = sshHostname cfg.Auth.Enabled = true cfg.Proxy.Enabled = true @@ -7247,7 +7254,7 @@ func TestRolesToString(t *testing.T) { // TestResolve tests that host resolution works for various inputs and // that proxy templates are respected. func TestResolve(t *testing.T) { - modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise}) + t.Parallel() ctx := t.Context() accessRoleName := "access" @@ -7273,6 +7280,7 @@ func TestResolve(t *testing.T) { testserver.WithClusterName("root"), testserver.WithSSHPublicAddrs("127.0.0.1:0"), testserver.WithConfig(func(cfg *servicecfg.Config) { + cfg.Modules = modulestest.EnterpriseModules() cfg.SSH.Enabled = true cfg.SSH.PublicAddrs = []utils.NetAddr{cfg.SSH.Addr} cfg.SSH.DisableCreateHostUser = true @@ -7291,6 +7299,7 @@ func TestResolve(t *testing.T) { node, err := testserver.NewTeleportProcess(t.TempDir(), testserver.WithConfig(func(cfg *servicecfg.Config) { + cfg.Modules = modulestest.EnterpriseModules() cfg.SetAuthServerAddresses(rootServer.Config.AuthServerAddresses()) cfg.Hostname = "second-node" cfg.Auth.Enabled = false @@ -7546,7 +7555,6 @@ func TestVersionCompatibilityFlags(t *testing.T) { // TestSCP validates that tsh scp correctly copy file content while also // ensuring that proxy templates are respected. func TestSCP(t *testing.T) { - modulestest.SetTestModules(t, modulestest.Modules{TestBuildType: modules.BuildEnterprise}) ctx := t.Context() accessRoleName := "access" @@ -7572,6 +7580,7 @@ func TestSCP(t *testing.T) { testserver.WithClusterName("root"), testserver.WithSSHPublicAddrs("127.0.0.1:0"), testserver.WithConfig(func(cfg *servicecfg.Config) { + cfg.Modules = modulestest.EnterpriseModules() cfg.SSH.Enabled = true cfg.SSH.PublicAddrs = []utils.NetAddr{cfg.SSH.Addr} cfg.SSH.DisableCreateHostUser = true @@ -7592,6 +7601,7 @@ func TestSCP(t *testing.T) { const secondServerHostname = "second-node" server, err := testserver.NewTeleportProcess(t.TempDir(), testserver.WithConfig(func(cfg *servicecfg.Config) { + cfg.Modules = modulestest.EnterpriseModules() cfg.SetAuthServerAddresses(rootServer.Config.AuthServerAddresses()) cfg.Hostname = secondServerHostname cfg.Auth.Enabled = false