* Convert existing non-gogo codegen to the Hybrid API
Contributes to https://github.com/gravitational/teleport/issues/66776.
All existing protos explicitly set to API_OPEN have been change to
API_HBYRID. The new codegen was performed via make grpc. There are no
other functional changes to the code to start consuming the Hybrid API
those will come later. The intent is to get all Hybrid codegen in and
backported to ease the transition.
* Initial migration to the Opaque API
Contributes to https://github.com/gravitational/teleport/issues/66776.
All of the changes here are mechanical conversions generated from
`open2opaque rewrite -levels=green ./...`. There will be a follow up
to this in teleport.e which does the same. Once all changes have been
merged the process will be repeated with -levels=yellow followed by
-levels=red.
See https://protobuf.dev/reference/go/opaque-migration/ for more
details.
All existing template usage was converted to make use of
github.com/DataDog/datadog-agent/pkg/template. The DataDog package
is a fork of the stdlib template packages with method calling
removed so that reflect.MethodByName does not prevent DCE.
There were a handful of method calls in our templates that were trivially
changed to use custom functions defined via FuncMaps or specifying the
calculated value to the template instead of calling a function in the template.
A future change will add linter rules to prevent new text/template or
html/imports from landing. They have not been included here so as
to not to break enterprise code while it is migrated.
* feat: Extend `AWSRole` struct w/ `RequiresRequest`
- Differentiate between already-granted vs. requestable AWSRoles when
including requestable resources in `clusterUnifiedResourcesGet`
req
* feat: Implement Resource Constraints support for Proxy, Auth
* fixup: Fix tests
* test: Add tests for resourceaccessid-related helpers
* fixup: Address code review feedback
* test: Update identity/events tests for new `ResourceAccessID` fields
* fixup: Expand/improve godocs/comments for sentinel ResourceID handling
* fixup: Address code review feedback
* feat: Conv ResourceID->ResourceAccessID at cert decoding
- Convert ResourceIDs present on certs to ResourceAccessIDs at decoding
time, rather than at each callsite. Update tests/usages of tlsca/sshca
Identities to reflect this.
Plugins had their own backoff utils when they were a separate repo,
but now that they're in Teleport's repo we can reuse existing retry
utils.
Closes#47102
This update allows us to update go-chi/chi to v5.2.2 which resolves
GHSA-vrw8-fxc6-2r93.
The update also forces us to bump testify to 1.11.0 which brings
with it a change in behavior of require.Eventually. In prior versions,
the assertion function was initially only called _after_ the first tick.
In 1.11.0, the assertion function is called _immediately_ and then
on all subsequent ticks. This change in behavior has brought to light
a number of existing tests making use of require.Eventually with
buggy assertion functions. Their bugs were masked by the fact that
the intial tick was always enough time for the assertion to be
successful. The remediations in this change may not be all inclusive
as not all require.Eventually uses were audited, but all tests which
failed in one way or another are addresssed.
* Reduce the number of custom set implementations
* Move set to a dedicated package
lib/utils is a large package and we don't want to force all packages
that need a set to import everything else in there.
A small alias remains in lib/utils to avoid breakign teleport.e.
* Fix tests
Some tests were depending on sorted elements, others cared about
the difference between a nil slice and a non-nil but empty slice.
Moves all test related logger initialization and creation to the
logtest package to reduce testing symbols in production code. The
existing helpers in lib/utils have been left in place until the
enterprise references can be converted.
Updates #51023.
The new package is meant to house a test friendly implementation
of modules.Modules. Due to the pervasive and global nature of
modules, this package also contains a copy of of
modules.SetTestModules. In a perfect world this function wouldn't
be needed and modules would be injected where required, however,
that would take considerable effort. The existing test modules
are temporarily left in place until the enterprise tests can be
updated to use modulestest.
* Apply traits to logins in plugin messages
* Update docs to include include login traits information
* Add test coverage for plugin login traits application
Provides a type safe resource 153 unwrapping variant to replace
types.Resource153Unwrapper. Most uses have been switched over to
the new type, though a few still exist and may be harder, if not
possible to convert without a considerable amount of change.
Kevin