All existing template usage was converted to make use of
github.com/DataDog/datadog-agent/pkg/template. The DataDog package
is a fork of the stdlib template packages with method calling
removed so that reflect.MethodByName does not prevent DCE.
There were a handful of method calls in our templates that were trivially
changed to use custom functions defined via FuncMaps or specifying the
calculated value to the template instead of calling a function in the template.
A future change will add linter rules to prevent new text/template or
html/imports from landing. They have not been included here so as
to not to break enterprise code while it is migrated.
* Update kingpin
* Convert CLI formatting to use kingpin UsageRenderers
Avoiding the legacy kingpin text/templates allows for DCE to be used
by the linker. The existing formatting has been matched with a
pure Go UsageRenderer.
The library has had a number of CVEs recently and uses shady
dependencies. https://github.com/gravitational/teleport.e/pull/8513
removed the dependency pulled in via teleport.e. This updates the
e_imports.go to reflect that change which moved buger/jsonparser to
an indirect dependency.
To remove the dependency entirely, mark3labs/mcp-go was updated to
the latest version. In that version they have replaced
github.com/invopop/jsonschema, which brough in buger/jsonparser,
with github.com/google/jsonschema-go. As a result buger/jsonparser
is no longer in our dependency tree.
* Detect EC2 join failures and surface via readyz
* Replace readyz join check with systemd log capture
* Add JoinFailureTimeout constant
The installer's readyz polling timeout is referenced by both
the autodiscover installer and the SSM waiter. A shared constant
avoids drift between the two values and keeps the user-facing
status message in sync with the actual wait duration.
* Replace two-attempt join check with poll loop
The join health check now polls the readyz endpoint in a loop
until the node reports ready or a five-minute timeout elapses.
Previously the check ran at most twice with a fixed delay of
thirty seconds, which missed nodes that needed longer to join
and could not distinguish a slow start from a permanent failure.
On timeout the error includes a best-effort systemd service
snapshot gathered via systemctl show. This replaces the earlier
systemctl is-active gate that blocked readyz from being checked
at all when the service was in a non-active or transient state.
The readyz function returns a simple (ready, error) pair instead
of the earlier four-value tuple, and per-attempt timeouts that
hit deadline-exceeded are treated as transient so that polling
continues. A clockwork.Clock field enables deterministic time
control in tests.
* Align SSM waiter timeout with poll timeout
The SSM command waiter used a hardcoded 100-second wait that was
inherited from the v1 SDK default. The installer now polls readyz
for up to five minutes, so the SSM waiter must outlast that to
avoid reporting a stale in-progress state as the final outcome.
The new timeout is the join-failure timeout plus a ten-minute pad.
* Update docs for readyz poll loop errors
Error patterns, status messages, and the example event code now
reflect the polling-based join health check. The event code moves
from TDS01E to TDS00W, and the user task description no longer
assumes an IAM join handshake rejection as the sole failure mode.
* Trim SSM stdout/stderr in audit events
SSMRun audit events can carry unbounded stdout/stderr from
command invocations, risking the 64 KB stream message limit.
Cap each field at 24 000 characters (matching the per-field
cap in the event schema) by keeping only the trailing portion
and aligning the cut to a full-line boundary so diagnostics
stay readable.
* Simplify output.
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Expand RedactFlagArgs doc comment
* Add IsConnectionError to utils package
Move the socket-level connection check from the installer package
into the shared utils package. The readyz checker needs this to
distinguish transient socket errors from application failures,
and the existing helpers in utils already cover related network
error classification.
* Remove install-script binary-exists guard
The shell installer no longer skips the download when a Teleport
binary already exists on disk. Previously the guard would bypass
reinstallation, but the installer is now expected to always run so
that package-managed upgrades and configuration changes take effect.
* Remove readiness handler tests from lib/service
These tests covered the HTTP readyz handler that is no longer
exercised through the service-level test surface. Readyz check
behaviour is now validated through the installer readyz checker
tests, making these redundant.
* Simplify join-failure error output
The error writer no longer unpacks trace message slices or strips
standalone sentinel lines before printing. Errors now flow through
as plain strings, which is sufficient because the upstream assembly
was simplified to produce one coherent error message.
* Extract readyz checker and diagnostics helpers
Split readyz check logic and systemd diagnostics out of the large
autodiscover file into dedicated files. The readyz checker becomes
a standalone struct with its own per-attempt timeout, connection
error classification, and test suite. Diagnostics helpers such as
journal capture, service state gathering, and the systemctl runner
move into a diagnostics file alongside ErrJoinFailure and related
constants.
The poll loop in checkJoinHealth is restructured to perform an
immediate first check before entering the timer loop, and error
assembly is inlined instead of threading through append helpers.
Tests now use a fake clock and goroutines to exercise the timer
driven polling flow deterministically.
* Move JoinFailureTimeout to installer package
Relocate JoinFailureTimeout from installstatus/exitcodes.go
into installer/autodiscover.go where the readyz polling
logic that consumes it lives. The exit-code String() method
now returns a generic timeout message; ssm_install.go
appends the concrete duration for the join-failure case.
* Reuse poll timer in readyz health check loop
The readyz poll loop allocated a new timer on every iteration and
checked readiness only after waiting. The loop now runs the first
check immediately before entering the poll cycle and reuses a single
timer via Reset, reducing per-iteration allocations. The ready state
drives the loop condition directly, moving the success return after
the loop so the function ends with the diagnostic-failure path at
the bottom.
* Replace binary mocks with function overrides
Join-health timeout tests relied on bintest process mocks for both
systemctl and journalctl, requiring filesystem setup, path wiring,
and post-run invocation assertions for every test case. Diagnostics
and journal capture now use optional function-level overrides that
are injected through the installer config, with thin wrapper methods
that fall through to the real implementation when no override is set.
Previously each test needed six to eight lines of mock orchestration
that obscured the actual test logic.
* Update lib/srv/server/installer/autodiscover_test.go
Scope context to test.
Co-authored-by: Chris Thach <chris.thach@goteleport.com>
* Update lib/srv/server/installer/autodiscover_test.go
Scope context to test.
Co-authored-by: Chris Thach <chris.thach@goteleport.com>
* Update lib/srv/server/installer/autodiscover_test.go
Scope context to test.
Co-authored-by: Chris Thach <chris.thach@goteleport.com>
* Update lib/srv/server/installer/autodiscover_test.go
nstaller/autodiscover_test.go
Co-authored-by: Chris Thach <chris.thach@goteleport.com>
* Simplify arg redaction loop to use range
Co-authored-by: Chris Thach <chris.thach@goteleport.com>
* Simplify override fields to defaults in config
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Add JoinFailureError structured error type
Replace the ErrJoinFailure sentinel with a JoinFailureError struct
that carries message, service diagnostics, journal output, and last
readyz error as separate fields. Previously callers had to parse a
concatenated string to extract individual diagnostic sections, making
downstream formatting and programmatic inspection fragile.
* Surface unexpected readyz errors to caller
Return unexpected errors from the readyz check instead of swallowing
them and returning false. The polling loop in checkJoinHealth keeps
retrying on these errors but now records the last one so it appears
in the timeout diagnostics. Previously a transient HTTP or socket
error was silently discarded, making it impossible to distinguish
"not ready yet" from "endpoint unreachable."
* Replace clock and overrides with function fields
Remove the clockwork dependency from the join-health check and use
the standard time package directly. Promote journalOverride and the
diagnosticsOverride to first-class diagnostics and journal function
fields initialized in checkAndSetDefaults. Build a JoinFailureError
on timeout instead of concatenating string parts. Tests switch from
fakeClock and BlockUntilContext to synctest.Test with time.Sleep,
removing the need for manual clock advancing.
* Use JoinFailureError in CLI error output
Switch the CLI join-failure path from errors.Is with the old sentinel
to errors.As with JoinFailureError. The writer function now accepts
the typed error and prints each diagnostic field on its own line.
Previously the error was printed as a single opaque string, making it
harder to scan in SSM console output.
* Normalize dash prefix in flag redaction
Add a lookupRedactor helper that maps both single-dash flags to their
double-dash redactor registration and vice versa, so callers need not
register both variants. Previously a -token=secret argument passed
through unredacted because only --token was registered in the redactor
map.
* Improve trace msg
Co-authored-by: Gavin Frazar <gavin.frazar@goteleport.com>
* Minor refactor
Co-authored-by: Gavin Frazar <gavin.frazar@goteleport.com>
* Minor refactor
Co-authored-by: Gavin Frazar <gavin.frazar@goteleport.com>
* Minor refactor
Co-authored-by: Gavin Frazar <gavin.frazar@goteleport.com>
* Minor refactor
Co-authored-by: Gavin Frazar <gavin.frazar@goteleport.com>
* Minor refactor
Co-authored-by: Gavin Frazar <gavin.frazar@goteleport.com>
* Minor log improvement
Co-authored-by: Gavin Frazar <gavin.frazar@goteleport.com>
* Remove redundant check
Co-authored-by: Gavin Frazar <gavin.frazar@goteleport.com>
* Quote command+args
Co-authored-by: Gavin Frazar <gavin.frazar@goteleport.com>
* Remove token-redaction utility and its usage
Log node-configure arguments directly instead of redacting the join
token. The token is a short-lived secret issued by the auth server
for EC2 auto-discovery; it expires before log entries are typically
reviewed, so the redaction layer added complexity without meaningful
security benefit. Previously every call to the node-configure step
copied the argument slice through a redactor map and a flag-parsing
loop.
Replace hardcoded five-second sleeps in health-check tests with the
installer's readyzPollInterval field so the tests stay correct when
the interval changes. Remove a stray closing brace left over from a
prior edit.
* Improve diagnostics error messages and comments
Add a comment explaining the systemctl-show output format that the
property parser expects. Quote "systemctl show" in the log message
for the invocation-ID retrieval failure so it renders as a distinct
command name rather than bare words. Switch the infrastructure error
path to use the %q format verb with the full command object so the
message includes the complete binary path instead of manually joining
the argument list.
* Use server clock for EC2 installation SyncTime
Set SyncTime to the discovery server's clock instead of the SSM run
event timestamp. Previously the field carried the event time, which
reflects when SSM dispatched the command rather than when the server
recorded the installation result, causing user-task entries to show
stale timestamps that did not advance on re-evaluation.
* Expand trimToRecentTail godoc comment
* Bound diagnostics collection after join timeout
Diagnostics and journal capture now run under a dedicated five-second
timeout derived from the parent context. Previously they inherited the
caller's context with no independent deadline, so a hung systemctl or
journalctl call could block indefinitely after the readyz poll already
determined the node failed to join.
Journal capture errors are downgraded from a hard return to a warning
log entry. A transient journalctl failure was masking the underlying
join-failure error, causing the caller to receive a journal-capture
error instead of the structured JoinFailureError that carries the
diagnostics payload.
* Document waitTimeoutPad tradeoff and TODO
* Replace systemctl subprocess with D-Bus API
Diagnostics collection now queries systemd properties through the
native D-Bus connection rather than shelling out to systemctl show
and parsing stdout. The D-Bus interface needs fully-qualified unit
names, so the unit-name builder appends a ".service" suffix to each
returned value. This eliminates the systemctl binary-path dependency
during diagnostics and avoids subprocess-parsing fragility around
exit-code versus infrastructure error disambiguation.
* Fix go mod
* Bump how many journal lines we output
* Extract systemd client into lib/systemd package
The systemd D-Bus property lookups, invocation ID retrieval, and the
journalctl capture now live in a reusable lib/systemd package that
exposes a Client with ReadServiceState, InvocationID, and CaptureJournal
methods. Previously these helpers lived as unexported methods on the
AutoDiscoverNodeInstaller type, so any other call site that needed a
systemd state snapshot had to either duplicate the logic or import the
installer package just to reach them. Moving them to a dedicated package
keeps the shared integration layer free of installer-specific policy
and makes the code reusable by unrelated callers.
The installer diagnostics file retains only installer-facing types and
the enableAndRestartTeleportService logic. JoinFailureError doc comments
no longer hardcode the 5m0s timeout in the example, since the timeout
is now configurable and changes across releases. Two clarifying comments
on runSystemctlCommand document why context errors are preferred over
exec errors, and why ExitError branches include the exit code and the
captured stdout and stderr streams in the wrapped error message.
The installer-side test file drops the helpers' tests because they now
live alongside the package they cover in lib/systemd. The remaining
TestJoinFailureErrorString case derives its expected message from
JoinFailureTimeout rather than hardcoding a duration literal.
* Bound join-health polling and diagnostics collection
The join-health check now drives polling with retryutils.NewRetryV2
against a dedicated pollCtx bounded by readyzPollTimeout, and the
diagnostics collection step races the diagnostics and journal goroutines
against diagCtx using channels and a select loop. Previously the poll
loop used a hand-rolled timer with a remaining-duration calculation, and
the diagnostics step waited on a sync.WaitGroup, so a stuck diagnostics
or journal implementation blocked the join failure report indefinitely
even after the parent context was canceled. With the new structure,
context cancellation and the diagnostic timeout both unblock the join
failure path, and the journal output field now carries an explanatory
message when collection times out or is canceled instead of being
silently empty.
JoinFailureTimeout is reduced from five to three minutes to surface
join failures sooner in SSM invocation results, where the full five
minute wait previously delayed operator feedback without improving the
odds of recovery. LastError is no longer populated when the error from
readyzChecker originates from the poll context already expiring, so the
join failure message reflects the actual join outcome rather than a
context cancellation observed only after the poll deadline.
The installer now delegates diagnostics collection and journal capture
to a teleportsystemd.Client constructed from the installer config,
rather than calling unexported systemd helpers on the installer itself.
The local dbusConn interface and its sole usage are removed in favor of
teleportsystemd.NewConnFunc, which is now the test seam for injecting
fake D-Bus connections into the diagnostics client.
The autodiscover tests cover the new behaviors: a stuck diagnostics or
journal implementation does not block join failure reporting when the
parent context is canceled, a poll timeout does not populate LastError,
and a diagnostics timeout produces a human-readable journal substitute.
Existing tests switch from context.Background() to t.Context() so they
inherit the per-test deadline configured by the testing package.
The EC2 troubleshooting docs and ssm_install_test fixtures stop using
a hardcoded five-minute duration and instead derive it from exported
installer.JoinFailureTimeout, so they track future timeout changes
without manual edits across docs, tests, and error message snippets.
* Use t.Context in readyz checker tests
* Reduce join-failure timeout default from 3m to 2m
---------
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
Co-authored-by: Chris Thach <chris.thach@goteleport.com>
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: Gavin Frazar <gavin.frazar@goteleport.com>
* Update docker dependency to moby v1.29
* go mod tidy all
* Update go.mod
* Fix up linting issues
* Fix cosign test broken due to ssrf protections in patched go-containerregistry
* Add session recordings to e2e runner
* teleport -> testenv
* Make session recordings start at midnight
* Add missing license
* Use the timezone of the machine
* go mod tidy
* Wait for audit log to exist before writing to it
* Seed recordings on the fly instead of using code generation
* enforce region validation on all AWS config loading
Replace direct uses of `github.com/aws/aws-sdk-go-v2/config.LoadDefaultConfig`
with the internal `lib/cloud/aws/config.LoadDefaultConfig` wrapper, which
validates any explicitly requested AWS region before use. Enforces this via a
new forbidigo linter rule.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Apply suggestions from code review
Co-authored-by: Nic Klaassen <nic@nicklaassen.ca>
* fix unit tests
* include underscores and uppercase letters
* add ConfigureRegion
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: Nic Klaassen <nic@nicklaassen.ca>
* Auto detect fixture usage in tests
* Changes to runner for enabling e e2e tests
* Only detect fixtures in test/UI/debug modes
* Make scanning more resilient - require test.use, allow for multiple lines
* Fix e2e/runner CI generate check
* Make scanning context aware to match with running individual tests
* Log enabled fixtures on one line
* Rename gen-fixtures, move go gen to main.go
* Return an error if no tests are matched
* gen-ts-fixtures: Use text/template instead of manually writing to buf
* Ignore generated fixtures.ts instead of formatting it
* Fix pnpm lockfile patching for when e/e2e is missing
* Simplify test running mode detection for scanning fixtures
* go generate
* Remove codegen from test run logic
* Handle run.sh receiving e/e2e directly
* Allow for fixtures to be enabled manually through flags
* Fix logging of enabled fixtures to include the ones set by flags
* Handle inline comments
* Update cmd in generated file
* Only pnpm install if teleport/connect needs building
* Error if UI mode is invoked with connect tests
* Handle errors better when checking if a binary exists
* Add info to the README about manually enabling fixtures
* Debug -> Warn
* Add test files to --ui
* Handle comments in strings properly
* Remove connect TSH from pnpm install logic
* Ignore flags in run.sh
* Handle double quotes just in case
* Add line number back
* Handle commented out imports
* Always include host.docker.internal in the certs
* Only scan fixtures in test mode/when test files are specified
* Make e2e/run.sh work with absolute paths to e/ tests
* Scan fixtures when running tests but not in UI mode
---------
Co-authored-by: Maja Cieślak <maja.cieslak@goteleport.com>
* Add focus trap to Modal
* Enable focus trap in DocumentsReopen
* Select focusable elements that are visible and not disabled
* Add fallbacks when nothing in modal is focused yet
* Remove deprecated MutableRefObject
* Clean up test components
* Reuse the same focusable logic in both handlers
* Reset lastTabKeyDirection in disableFocusTrap
* Handle trapFocus prop change while modal is open
* Guard against stale detached lastModalFocus in focus trap
* Suppress no-node-access lint in offsetParent mock
* `open={true}` -> `open`
* Replace offsetParent check with getComputedStyle for display:none filtering
offsetParent returns null for position:fixed elements regardless of visibility,
which would incorrectly exclude them from the focusable elements list.
* Handle lastModalFocus becoming unfocusable (e.g. dynamically disabled)
* Respect defaultPrevented on Tab and detect ancestor display:none in focus trap
* Use `Array.prototype.at`
* Add e2e test for switching to dark mode
* Fix license
* Also check theme while logged out
* Ensure dark theme is saved to the backend
* Move the test to unauthenticated project
This lets it use a dedicated user and minimize impact on other tests
running in parallel.
* Delete the user after the test is done
* Undo commenting out clearing cookies
* Guarantee deletion of the test user
* lint
* Run E2E tests in CI
* Rename results JSON so upload-artifacts finds it
* Skip failing auth connector test
* Remove e2e's pnpm workspace, add it to root
* Use cache v5
* Change paths-filter checkout to only on merge group
* Add timeout to e2e tests job
* Only run build/test if there are changes
* Cache the pnpm store instead of node_modules
* Add rust-toolchain.toml to changed files detection
* Add rust-toolchain.toml and Makefile to Rust cache hash
* Add build.assets/Makefile to Rust cache too
* Expand the path filters to capture more changes
* Improve the build error reporting, upload failure logs as artifacts
* Add `contents:read` permission for checkout in merge_group/push triggers
* Cancel previous jobs on new push in a PR
* Move type checking to earlier to fail faster
* Use the correct glob syntax
* Remove redundant env var
* Validate playwright version before trying to get the container
* Use fetch-depth: 1 for faster checkouts
* Use bash for pipefail
* Add versions.mk to changes detection and Rust cache key
* Use bash for version checking
* Ensure build is successful before running tests
* Exit with code 1 if any build failed
* Remove redundant corepack enable
* Use exit $failed for consistency
* Exit as early as possible if e2e type-checking errors
* Remove pnpm store cache as pnpm install is fast enough
* Change playwright back to ^, remove validation, get version from installed
* Run playwright version getter in e2e dir
* Add nested Cargo.toml to paths filter
* Add --init to playwright container
* Add --ipc=host to playwright docker container
* stateRestoration.spec.ts: Limit number of `login` calls
This is to avoid running into auth rate limits when running the full
Connect test suite.
* Cleanup temp dir if `fs.cp` fails
* Remove typescript/node types from e2e package.json
* Move GitHub report to a separate step
* Add more pnpm stuff to paths filter
* Skip for dependabot PRs
* Add persist-credentials: false to checkout
* Move e2e binary building to a bash script
* Define the test results JSON path only once
* Move PR comment management to gh CLI calls instead of runner
* Add build-e2e-binaries.sh to paths filter
* Handle the possibility of a missing PR comment file
* Move PR comment posting to a separate job
* Always run the update-pr-comment job
* Print logs instead of uploading them
* Add the repo name to the concurrency group
* Up test timeout limit to 20s
* Add a SHA flag to the e2e report command
* Fix the GitHub comment not deleting on success
---------
Co-authored-by: Rafał Cieślak <maja.cieslak@goteleport.com>
* Refactor launchApp to avoid `app.app` callsites
* Add tests for state restoration
* Add test for first launch
* Preserve app_state.json for the missing-tsh restart case
* Choose window bounds relative to the current display
* Account for work area, read bounds after setting them
* Assert absence of the restore modal after re-login
* Assert that telemetry dialog is dismissed
* setActiveWorkspace: Test if rootClusterUri and documents-reopen are set in same tick
* Disable jest/no-conditional-expect
* Assert the reopen dialog closes after restoring tabs
* Verify that documents-reopen was called
* Verify setBounds works
* Create source of truth for dir selection for `make build/teleport`
* Install JS deps before building Teleport & Connect
* Add fall back to repoRoot when teleportBuildDir is empty
* Add another fallback when teleportBuildDir is empty
* Use a single worker for Connect tests
* Set roles and data-doc-kind on tabs to streamline e2e tests
* Use custom shell for local terminal in Connect e2e tests
* Enable screen reader mode in Connect
* Add shell test
* Verify `TELEPORT_TOOLS_VERSION` and `TELEPORT_HOME` too
* Remove custom 10s timeout
The default timeout of 5s should be enough even in CI.
https://playwright.dev/docs/test-configuration#expect-options
* Add command to download playwright report/results from GHA
* Add annotations and a comment on failures
* Merge tests, update formatting
* Be smarter about printing errors
* Use head SHA, paginate list artifacts
* Stream the artifacts instead
* Filter by bot comments only
* Clean up artifact after run
* Only build teleport/tctl, skip if passed as flags, support e/
* Add support for running in different browsers
* Use a local build of teleport for the SSH node fixture
* Add a custom print summary to log results after execution finished
* Add typescript for type checking in CI
* Update mockWebAuthn to be browser agnostic
* Move the tctl invocation from Go to the test
* Save logs
* Allow for a custom docker host to be passed in
* Update playwright
* Run separate Teleport instances for each browser
* Give Connect its own Teleport instance
* Add custom dot reporter
* Add @gravitational/e2e/helpers path
* Use START_URL instead of INVITE_URL in connect login
* Always use custom dot reporter
* Always use blob reporter locally
* Only run connect if only connect tests are specified
* Do not run chromium if only running connect
* Silence the output from playwright report merging
* Ensure chromium Teleport instance doesn't start when running --browse-connect
* Log test files not projects if test files are specified
* Move `tests` to `tests/web`
* Enable building Connect
* Prepare Playwright test setup
* Add `browse` mode
* Replace `foo-` with `connect-e2e-test-`
* Merge if statements together
* `--browse-web` -> `--browse`
* Build Connect if requested path is `tests`
* Make imports more readable
* Attach logs to failed tests
* Link to docs about `use`
* Include "." in slashPath comparison
* Properly clean up app when `launchApp` throws before returning async disposer
* Add a helper for getting env vars we expect to be defined
* Enable strict mode in TypeScript, add tsx for running browser
* Add custom script for running browse/codegen modes with webauthn setup
* Normalize test file paths to the e2e directory
* Wire up the --teleport-log-level flag
* Add @avatus, @ravicious, @ryanclark as codeowners of e2e deps
* Keep e2e tsconfig.json isolated, will run type-check in CI
* Reset changes to root tsconfig.json
* Wrap `import.meta.url` in `fileURLToPath`
* Add a runner utility for E2E tests
* credentials -> usercredentials
* Use NotifyContext instead
* Add a comment about the port allocation
* Use `getByTestId`
* Update e2e/tests/auth.setup.ts
Co-authored-by: Nick Marais <nicholas.marais@goteleport.com>
---------
Co-authored-by: Nick Marais <nicholas.marais@goteleport.com>
Part 1 or removing InsecureDevMode - enterprise still relies on it
so a few TODOs were left around for clean up later. This global is
mostly leveraged in tests to permit trust when self-signed certificates
are used. These tests are often spinning up multiple teleport instances
and most of the time exercise trusted clusters which makes them slow.
Due to the global nature of InsecureDevMode these tests cannot be
run in parallel.
* Fix data race in e2e AWS tests
* replace pgx.Conn with pgxpool.Pool, which is safe for concurrent usage
* remove redundant mutex
* Format retry wait duration as a readable string
* Update healthcheck logger component
To disambiguate from normal user connections, the health checker will
use a new logger component: "db:health".
* Skip granting teleport-auto-user to Redshift admin
This is not necessary for Redshift and the syntax is not correct either,
because Redshift grants must use "GRANT ROLE" instead of "GRANT".
This removes a superfluous log message about bad grant syntax.
* Run proxy and local proxy tests sequentially
This potentially fixes test flakiness.
The Redshift deactivation and deletion SQL scripts both check
stv_sessions for active user connections, which can cause failures when
a parallel test is still running.
* Log on test cleanup failure
Our weekly destroy&reconstruct AWS infrastructure script is broken and
we are unable to run AWS E2E tests for the time being.
This PR temporarily skips running AWS E2E tests in our CI.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Moves all test related logger initialization and creation to the
logtest package to reduce testing symbols in production code. The
existing helpers in lib/utils have been left in place until the
enterprise references can be converted.
Updates #51023.
dependabot[bot]