All of the changes here are mechanical conversions generated from
open2opaque rewrite -levels=red./.... This concludes the conversion of
teleport to consume the opaque APIs. The corresponding changes in
teleport.e must be completed prior to switching entirely to opaque codegen.
See https://protobuf.dev/reference/go/opaque-migration/ for more details.
The Lint job was also updated to prevent any Open API uses until we can
fully convert to the Opaque API.
* Convert existing non-gogo codegen to the Hybrid API
Contributes to https://github.com/gravitational/teleport/issues/66776.
All existing protos explicitly set to API_OPEN have been change to
API_HBYRID. The new codegen was performed via make grpc. There are no
other functional changes to the code to start consuming the Hybrid API
those will come later. The intent is to get all Hybrid codegen in and
backported to ease the transition.
* Initial migration to the Opaque API
Contributes to https://github.com/gravitational/teleport/issues/66776.
All of the changes here are mechanical conversions generated from
`open2opaque rewrite -levels=green ./...`. There will be a follow up
to this in teleport.e which does the same. Once all changes have been
merged the process will be repeated with -levels=yellow followed by
-levels=red.
See https://protobuf.dev/reference/go/opaque-migration/ for more
details.
* app: Consolidate app name and public_addr validation
Consolidate app `name` and `public_addr` validation to fix six issues
where Teleport rejects valid app names, accepts invalid ones, or
crashes on startup. Preserve backwards compatibility for dynamic and
heartbeat paths: clusters with mixed-case records already in the
backend keep working.
Strict write validation (admin writes + static config):
- App name, static: `IsDNS1123Label` - no dots, max 63 chars.
- App name, dynamic: `IsDNS1123Subdomain` - dots OK for AWS-OIDC,
max 253 chars.
- `public_addr`: `IsDNS1123Subdomain` - dots OK (it is a hostname),
max 253 chars.
All three k8s validators also enforce lowercase. RFC 1123 itself
does not -- lowercase is a Teleport convention for interop with
Kubernetes object names.
`ValidateApp` is the single write-time validator, called from
`CreateApp`, `UpdateApp`, `UpsertApplicationServer`, the inventory
control stream, and app service startup. Heartbeats run
`NormalizeAppServerForHeartbeat` first, which lowercases both
`name` and `public_addr` and strips URL schemes and ports, so
heartbeats from older agents end up stored lowercase.
Link: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/
* app: Apply review feedback
Address review nits from the PR:
- Use t.Context() in new tests; add t.Cleanup for client Close.
- Drop double Close() in inventory controller tests.
- Use proto getters in identitycenter to avoid panic on nil Spec.
- Replace multi-hyphen regex with strings.ReplaceAll loop.
- Collapse mockRolesAnywhereClient.profiles into pages.
- Retitle and flesh out the CHANGELOG entry.
- Revert accidental enterprise submodule bump.
* app: Apply review feedback
Use proto getters for the remaining `acct.Spec.*` accesses in
`IdentityCenterAccountToAppServer` so the function stays nil-safe end to
end. Fix grammar in the app name doc bullet ("as is a duplicate name" ->
"as are duplicate names").
* app: Preserve Identity Center launch URL
Identity Center accounts surface in the unified-resource cache as
synthetic AppServers and never traverse `ValidateApp` /
`ValidateAppServer`, so the DNS-1123 normalization the previous
commits introduced in `IdentityCenterAccountToAppServer` had no write
path to satisfy. Keep the raw StartUrl in both `URI` and
`PublicAddr`: the web Launch button builds the SSO launch href as
`${publicAddr}&role_name=...`, so stripping scheme, path, port, or
case breaks every Identity Center app launch.
Drop the matching lowercase on `metadata.Name` for the same reason,
and restore the delete handler in `processEventsAndUpdateCurrent` to
its pre-PR shape (rebuild a `KindAppServer` header from the IC
account event, no lowercase).
Rewrite `TestIdentityCenterAccountToAppServer` to assert StartUrl
passes through verbatim; remove the `ValidateApp` round-trip
assertion, which was checking a path the synthetic AppServer never
takes in real callers.
* app: Apply review feedback
* app: Apply review feedback
Tighten the "Stricter application validation" CHANGELOG entry to
focus on the three backwards-incompatible cases: static-config
DNS label, unrecoverable public_addr, and duplicate names within
one agent's teleport.yaml. Expand the write-path list to include
the Terraform provider, Kubernetes operator, and direct API
calls. Note that multi-agent same-name heartbeats remain
supported for load balancing.
* app: Allow underscores in dynamic app names
Swap IsDNS1123Subdomain for IsDNS1123SubdomainWithUnderscore in
ValidateApp, the required_apps loop, and ValidateAppServer. The
strict variant rejected snake_case names that Teleport Cloud and
self-hosted clusters both accept today, breaking the Terraform
provider tests as the canary.
Static yaml (lib/service/servicecfg/app.go) remains strict, since
the rule there is a deliberate breaking change. public_addr also
stays strict, since it is the actual hostname used for routing.
Document the new rule and the strict-TLS-client caveat in the
"Application name" section of connecting-apps.mdx.
* enforce region validation on all AWS config loading
Replace direct uses of `github.com/aws/aws-sdk-go-v2/config.LoadDefaultConfig`
with the internal `lib/cloud/aws/config.LoadDefaultConfig` wrapper, which
validates any explicitly requested AWS region before use. Enforces this via a
new forbidigo linter rule.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Apply suggestions from code review
Co-authored-by: Nic Klaassen <nic@nicklaassen.ca>
* fix unit tests
* include underscores and uppercase letters
* add ConfigureRegion
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: Nic Klaassen <nic@nicklaassen.ca>
* Update URI creation for Roles Anywhere integration in govcloud
Noticed that RA defaults to a commercial URI which will not successfully
launch a console in govcloud. This change updates the URI creation logic
to use the correct URI when the parsed ARNs indicate a govcloud partition.
* Use established constants for all use cases
* Add more comprehensive tests to profile syncer tests
---------
Co-authored-by: Benjamin McKenna <bemckenn@cisco.com>
The AWS IAM Roles Anywhere integration syncs Profiles as Teleport AWS
Apps.
In order to use the API, Teleport uses a specific Profile which is
configured as the Profile Syncer's Profile.
This Profile is only meant to be used by Teleport for syncing profiles,
and should not be available as an end-user Profile/Teleport AWS App.
During the Sync set up, we show the user all the available profiles.
This listing operation, wrongly, returns the Profile used for the
Profile Syncer.
We are showing a Profile that will not be available later on.
This PR changes the listing to only show the profiles that will be
synced, removing the Profile used in the Profile Syncer.
* chore: Bump Go to 1.25.1
Update all Go modules to use Go 1.25.1.
* Use stable synctest API introduced in Go 1.25
All existing tests that used synctest have had their build
constraints removed and have been updated to use synctest.Test
instead of synctest.Run. There are still tests in teleport.e that
needs to be updated before we can remove GOEXPERIMENT=synctest
and retire the synctest build tag.
* Remove coverage from go test invocations
This is a temporary workaround to https://github.com/golang/go/issues/75031.
When the buildboxes have Go 1.25 installed globally this should no
longer be an issue and coverage can be restored.
* Lazily unmount cgroups
Adds the MNT_DETACH flag to the cgroups unmount call to workaround
issues stemming from a behavior chagne in Go 1.25 to support
automatically setting GOMAXPROCS. In doing so the Go runtime
interacts with cgroups to determine what limits should be applied
which interferes with our ability to clean up.
Fixes https://github.com/gravitational/teleport/issues/58879.
* Fix syntest bug with waitgroups
```
=== Failed
=== FAIL: lib/srv/discovery TestDiscoveryServerEKS (unknown)
fatal error: sync: WaitGroup.Add called from multiple synctest bubbles
```
The failure stems from a bug in Go 1.25 and is a result of loading
aws configs which internally use a sync.WaitGroup. This can be worked
around in the short term by mocking out the aws.Config since the test
is configured to use a mock eks client anyway. Other tests may still
run into this issue until Go 1.25.2 - though our relatively small number
of synctest usage at this point may limit our exposure to said bug.
* AWS Roles Anywhere: Test connection ignores the Profile sync
When the user is setting up the AWS IAM Roles Anywhere integration,
they will test the connection.
This test connection (aka ping) will let the user know if the
credentials are working and how many profiles they have that they can
use.
Before this PR, we were also counting the Profile that is used to sync
profiles.
Even though, this is a valid Profile, it will not be added as an AWS
App, it is only used to sync profiles.
After this PR, we are no longer including it.
The UI, when there's no profiles, will also let the user know about this
and ask them to create profiles.
* review pt1
* AWS IAM Roles Anywhere: implement filters for Profile sync and lister
* move client out of request
* improve godoc for the ListRolesAnywhereProfiles api
Moves all test related logger initialization and creation to the
logtest package to reduce testing symbols in production code. The
existing helpers in lib/utils have been left in place until the
enterprise references can be converted.
Updates #51023.
The package required testing packages for two reasons
1) To expose helpers which populated servicecfg.KeystoreConfig
based on environment variables set by the host running the tests.
2) To expose a helper for creating a manager that used software
keys for tests
The first case has been eliminated by copying the helpers to all
the other packages that called it. The helpers are all self contained
and don't rely on any keystore package specific logic. The duplication
was chosen instead of dependency for simplicity.
keystore.NewSoftwareKeystoreForTests existed only to optionally
allow overriding how RSA keys were generated. The same means has
been moved into the keystore.Options allowing all tests to call
keystore.NewManager directly.
Updates #51023.
* AWS Roles Anywhere: implement client / `tsh` access
* be explicit about valid scenarios when not generating the credentials
* only default the CreateSession API method once
* move some code to its own file
* New teleport configure command: AWS Roles Anywhere set up
This PR adds a new teleport configuration command which performs the AWS
IAM Roles Anywhere Integration set up.
It does the following:
- creates a new Roles Anywhere Trust Anchor using the certificate received
- creates a new IAM Role which allows the required APIs for sync, and is
usable by the Roles Anywhere service, filtered by the created Trust
Anchor
- creates a new Roles Anywhere Profile which can use the IAM Role above
This is part of the new AWS IAM Roles Anywhere integration required set
up.
* clarify placeholder usage + tests
* fix godoc
* AWS Web/Console Access using IAM Roles Anywhere Integration
This PR adds support for AWS Web/Console Access using the IAM Roles
Anywhere Integration.
When trying to access an AWS App which has an associated:
- integration of AWS RA kind
- Roles Anywhere metadata: profile ARN
- IAM Role
There is a new flow which generates credentials using the:
- trust anchor present in the integration metadata
- profile arn present in the AppServer metadata
- target IAM Role
- and a X.509 certificate generated from the AWS Roles Anywhere CA
Those credentials are then used to generate the signing URL using the
federation service.
* move assume role details to helper func
* remove dead code, fix comment and error message
This PR adds a wrapper to the IAM Roles Anywhere CreatesSessionAPI.
AWS does not provide this API in their SDK.
Instead, they provide an AWS guide (see code) where they explain how to
call it.
rosstimothy