* Add Azure label helper functions
* Remove misleading Azure label comments
The internal labels serve a different purpose than the visible
labels - they are not superseded by visible labels.
* Move from e/builder.go to open source
* map to Labels converter
* Introduce new update flags
* Implement update logic
* Add test
* Address review and improve update text
* Fix lint, fix audit start date, reorder member update
* tctl: add structured output to selected mutation commands
* tctl: update workload identity commands to use legacy resource wrapper for consistent output formatting
* tctl: fix workload identity revocation to use opaque proto builders
* tctl: update device enrollment token output to include asset tag name
* tctl: update workload identity revocation test to use UnmarshalOptions for unknown fields
* tctl: move structured-output tests off slow integration tests to fix flaky timeout
* Address PR feedback
* Fix lint errors
* removed presence check for IntegrationName as this can be empty when the fetcher is using ambient credentials.
* refactor command to support multiple subcommands
* lint fix
Fixes a couple of issues discovered the Identity Center resource filtering code:
1. The regex-based filters compile their regexes on every search, rather
than once up front. This is not as bad as it sounds due to Teleport's
regex cache, but it is still not ideal.
2. The filter validation and execution steps behave differently, so that
it is possible for an invalid filter to make in past validation and
only be discovered while the plugin is running.
3. The volume log spam generated by a poorly-formed filter that managed
to make it past validation would *astronomical*.
This patch addresses those issues by
1. Compiling the wire-format, protobuf filter objects from the plugin
spec into a known-good filter at construction time, and using that
as the runtime definition of the filter.
2. Compiling the filter regexes during this construction-time setup
rather than just hoping that they are cached by Teleport
2. Validating the filter stack once during this compilation phase,
rather than forcing the runtime matching code to be super very
defensive. This also removes inconsistent behaviour between the
validation at construction time vs. run time.
All of the changes here are mechanical conversions generated from
open2opaque rewrite -levels=red./.... This concludes the conversion of
teleport to consume the opaque APIs. The corresponding changes in
teleport.e must be completed prior to switching entirely to opaque codegen.
See https://protobuf.dev/reference/go/opaque-migration/ for more details.
The Lint job was also updated to prevent any Open API uses until we can
fully convert to the Opaque API.
Removes any externally visibile notions to end users that a
token name and token secret are two different entities. This
removes the need to output a token_name and token_secret value
from `tctl scoped tokens add` as well as removing the token_secret
from teleport.yaml and teleport CLIs.
Internally, the name of a scoped_token is still NOT a secret. The
secret is a separate field in the scoped_token.status. When the
token is presented to a user it is done so as `<token_name>:<base64(token_secret)`.
The leading token_name is not encoded to allow users to visually
dentify tokens they may have created with a specific name. The `~`
separator was chosen because it is neither a valid backend key, scope
separator, and does not need any special encoding if included in a URL.
The token_secret is base64 encoded so that it appears as opaque text
to users and can be included in a URL.
Additionally, the tctl scoped ref parsing has been updated such
that tctl get/edit/rm honors both `<token_name>` and `<token_name>:<base64(token_secret)>`
This does contain a few breaking changes. The token_secret has been removed
from the teleport.yaml file config and its equivalent CLI flags have been
removed. Since scopes are still under active development and this only impacts
scoped_tokens and not traditional tokens the impact of this change should be
minimal.
Mirror the web UI's filtering by accepting a repeatable flags. And
adding the `--filter` as an envelope that allows combining filters
(AND semantics). Multiple distinct flag filters are OR'ed together.
* add dns diagnostic check proto
* add DNSServerSuffix and DNSServerPort constants
* handle dns diagnostic probe queries
* add dns diagnostic check
* enable dns diagnostic check in Connect
* run dns diagnostic check in tsh vnet
* render dns diagnostic check in Connect
* fix some nits
* move ssh diag check after dns check
* handle dns diagnostic probe A queries
* add dns diagnostic check proto for A queries
* refactor dns diagnostic check to also check A records
* refactor Connect to also render dns diagnostic A records
* drop trailing dot from dns diag probe
* add tests for dns diag text rendering
* do not fail dns diag if any nameserver is reachable
* Adjust spacing between DNS diag success/warning rows
* fix some nits
* improve rendering of dns reachability errors
---------
Co-authored-by: Maja Cieślak <maja.cieslak@goteleport.com>
* Add Classifier backend storage, cache, gRPC service, and tctl support
* Fix formatting in lib/services/summarizer_test.go
* Replace Cache.AllClassifiers with RangeClassifiers using genericLister
* Validate that the filter is a boolean expression
* Code review fixes: sync test, range fallback
* feat: text output, geo, and `--skill` support
Layer three orthogonal additions on top of the core command:
- Text rendering: period header, matches summary, wrapped facet
panel, events table. `--all-facets` opts out of the top-5
truncation.
- Geo filter (`--latitude`/`--longitude`/`--radius`, all three
required together). Geo applies to events only; the stats endpoint
has no geo params, so facet counts and `total` cover the
window+query without geo. Text output prints a Note when geo is
active.
- `--skill` prints an embedded Markdown skill for LLM agents and
skips the backend entirely.
* fix: update skill to follow RFD 0037e
* fix: small fixes reported in PR review
* fix: small suggestion about code comment
* feat: iteration based on notion/customer request
* feat: add sanitization to text rendering
* fix: small fix to the access request review
* fix: typos and PR suggestions
* fix: help message indentation
* feat: add `tctl investigate` command
Add a tctl subcommand that searches Teleport's Identity Security
activity logs. The command exposes structured filter flags mirroring
the Identity Security UI: ~19 include/exclude pairs mapping to Lucene
fields (user, resource, IP, country, etc.). Multiple values on the
same flag are OR'd; different flags are AND'd.
`--query` accepts a raw Lucene expression for cases the structured
flags can't express (wildcards, regex, OR across fields) and is
mutually exclusive with the structured filters.
Facets and events are fetched in parallel via errgroup. `total` is
derived from the `event_type` facet on the stats endpoint, so it can
drift a few percent from `len(data)` on long windows.
This PR ships JSON/YAML output only. Text rendering, the geo filter,
and the `--skill` flag land in the next PR in the stack.
* fix: address codex suggestions
* fix: update flag description
* Run the connection upgrade test with reversetunnelv2
* Use unwrapped connections to the auth in multiplex listener mode
* Clarify wording in debug log
* Add a test for ALPN used in direct and proxy mode
* Update godocs
* Change struct names for better clarity
* hack on migrating list RPC
* Fix tests
* Tidy up/fix tests
* Use `clientutils.CollectWithFallback`
* Use clearer c.APIClient rather than rely on embeding
* Cover ListTunnelConnections in cache test
* tweak logging
* update deprecation version
* Move fallback impls
* fix span ctx prop
* fix pagination bug when unmarshal bad
* USe t.Context()
* fix ctx propagation
* Update tunn conns to use range pattern - thanks luke
* fix unneeded dependency
* fix deprecation
* env: dev
use opaque API
* add session filter, access predicate, impersonate checks; fail fast on invalid expressions at create/update
* add list indexes to role validation error messages
* reject wildcards in search_as_roles and preview_as_roles
* validate join_sessions and require_session_join fields
* include index and tool value in mcp.tools validation error
* update commentary
* aggregate errors in ValidateRole
* aggregate errors in ValidateAccessPredicates
* validate linux_desktop_logins templates
* Convert existing non-gogo codegen to the Hybrid API
Contributes to https://github.com/gravitational/teleport/issues/66776.
All existing protos explicitly set to API_OPEN have been change to
API_HBYRID. The new codegen was performed via make grpc. There are no
other functional changes to the code to start consuming the Hybrid API
those will come later. The intent is to get all Hybrid codegen in and
backported to ease the transition.
* Initial migration to the Opaque API
Contributes to https://github.com/gravitational/teleport/issues/66776.
All of the changes here are mechanical conversions generated from
`open2opaque rewrite -levels=green ./...`. There will be a follow up
to this in teleport.e which does the same. Once all changes have been
merged the process will be repeated with -levels=yellow followed by
-levels=red.
See https://protobuf.dev/reference/go/opaque-migration/ for more
details.
* [2] Migration to the Opaque API
Contributes to #66776.
All of the changes here are mechanical conversions generated from
open2opaque rewrite -levels=yellow./.... There will be a follow up
to this in teleport.e which does the same. Once all changes have been
merged the process will be repeated with -levels=red.
See https://protobuf.dev/reference/go/opaque-migration/ for more details.
"Load more" in the recordings search TUI (and --resume-token) failed with
"start_time is required" after the latest access graph update.
Follow-up pages were sent with only the batch_token, relying on the
proto comment that claimed all other filter fields are ignored
once batch_token is set. That contract is wrong: the server validates
and applies start_time/end_time and every other filter on each request,
and the access graph re-checks that the checkpoint falls
within the requested time range.
The batch token is intentionally only a cursor and does not carry the full
search state - encoding every filter into the token would let it grow to
very large sizes. So the original request must be replayed with the
batch_token set on each page. Build the request once and have the fetcher
clone it and attach the token for the initial page, resume, and load-more,
fixing both the TUI and --resume-token.
Also surface the fetch error back to the user: a failed "load more" now
opens a popup with a red header and the server message rendered as code,
instead of silently swallowing the error behind a "(retry)" label.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Convert existing non-gogo codegen to the Hybrid API
Contributes to https://github.com/gravitational/teleport/issues/66776.
All existing protos explicitly set to API_OPEN have been change to
API_HBYRID. The new codegen was performed via make grpc. There are no
other functional changes to the code to start consuming the Hybrid API
those will come later. The intent is to get all Hybrid codegen in and
backported to ease the transition.
* Initial migration to the Opaque API
Contributes to https://github.com/gravitational/teleport/issues/66776.
All of the changes here are mechanical conversions generated from
`open2opaque rewrite -levels=green ./...`. There will be a follow up
to this in teleport.e which does the same. Once all changes have been
merged the process will be repeated with -levels=yellow followed by
-levels=red.
See https://protobuf.dev/reference/go/opaque-migration/ for more
details.
Rename --from/--to to --from-utc/--to-utc on `recordings search` to
match the `recordings ls` flag naming convention. The old names are
kept as hidden aliases for backward compatibility.
For JSON and YAML output formats, automatically paginate through result
batches until up to 500 sessions are collected rather than stopping
after the first batch. When results are truncated, a --resume-token
hint is printed to stderr so the caller can continue from where the
previous run left off.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Move tctl acl command into its own directory
Create a accesslist preset file to be referenced later
in future acl commands
* Remakes the original acl_command.go file
This is so that during merging, the enterprise build doesn't break
This file will be removed once all merging is complete.
* Add FormatUserDisplay helper for CLI user identity output
* refactor: reuse terminal control sequence handling
* update FormatUserDisplay output format for clarity
* fix tests
* test: update TestFormatUserDisplay_CanonicalForms to include empty input case
Relocates client.ParseLabelSpec to lib/utils/parse. This results in
a net 5MB reduction in the weight of lib/config. This may not
have a correlation in binary size since lib/client is heavily consumed
by other packages.
```bash
$ goda cut './lib/config:all' | rg '^github.com/gravitational/teleport/lib/client\b|^ID'
github.com/gravitational/teleport/lib/client InDegree=1 Cut.PackageCount=75 Cut.AllFiles.Size=5.3MB Cut.Go.Lines=129512
```
Replace the functions in the scopes package to infer if scoped features
are enabled with a concrete struct that is injected to consumers. This
permits tests to toggle scopes features without having to specify environment
variables.
Adds the first user-facing Access Graph tctl command, listing security
detections with filters and a time window.
Talks to Access Graph through the web proxy and relies on the backend's typed
501/credential errors (see access-graph#1998) instead of a pre-emptive
features.json probe, so the CLI stays stateless.
Yassine Bounekhla