* Add spans to TeleportClient/ProxyClient/NodeSession
* Improve dialer tracing
* Alter default http client span name to include path
* propagate tracing options in NewClientConn
* Make tctl write out kube tls server name if tls routing is enabled
Fixes#14489
* Extract kube TLS name generation function to shareable location
We want tctl to be able to use this function as well, so we're locating it
in a place where both tctl and tsh can use it.
Also changing input parameter to k8s host, since it doesn't really care
about port number.
Kubernetes v1.24 enabled, by default, the LegacyServiceAccountTokenNoAutoGeneration feature.
This feature prevents Secrets containing service account tokens from being automatically created for every ServiceAccount.
Instead, when enabled, it requires a manual action for creating the Secret bound to the SA.
Fixes#15611
Fixes#4218
This commit:
- Bumps the grafana version
- Fixes the packer script failing when `DEBUG` is unset
- Makes nginx propagate the Host header required since
https://grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes/
- Makes nginx proxy websocket calls properly (since grafana 8)
- Retab nginx conf files that were a mix of tabs and spaces
- Makes Terraform compute s3 files md5 to detect and apply changes
* Stop validating schema for labels (#15204)
* operator: support receiving invalid TeleportRole CRs
This PR makes the controller-runtime manager decode TeleportRole
resource in an unstructured object. This avoid errors during decoding.
The resource is later decoded as a TeleportRole, with proper error
handling.
Fixes#12974
This commit introduces a new `authentication` value controlling:
- the authentication type (previously `authenticationType`)
- the second-factor (previously under `authenticationSecondFactor`)
- if local auth is enabled (new feature)
- the connector name (new feature)
- the locking mode (new feature)
If previous values `authenticationType` and `authenticationSecondFactor`
are specified we'll prefer them for backward compatibility.
* Move Machine ID support matrix into the introduction page
* Link to Machine Id specific guides in support matrix
* Add Machine Id guides to introduction page
* Move machine id guides to includes
* Fix links to guides
* Remove already-answered question from FAQ
This PR adds the concept of ConnectionTester
ConnectionTester will generate ConnectionDiagnostics by connecting to
the actual resource using a user and some Resource Specific parameters
(principal for SSH access, Database User and Name for Database access,
and so on) and storing the result of multiple checkpoints.
Each resource will have a ConnectionTester (we'll start by SSH access
and then Databases).
It also improves Connection Diagnostics by adding
- update operation (similar to the create one)
- a list of traces, which contain the result of checkpoints in multiple
steps of the connection flow
As an example, for SSH, we'll have at least the following checks:
- Node is reachable
- User has the right permissions
- Node has the expected Principal
The trigger to test a connection will be an endpoint, because our
primary goal is to let the user test the access right after adding the
resource.
This PR does not implement the actual SSHConnectionTester but creates
most of the boilerplate to do so.
The next PR will focus in adding the actual traces.
This change makes the error message for when EC2 tags aren't available in instance metadata only emit once, to reduce log spam.
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Add an installer script resource type and HTTP endpoint
* Add default installer scripts
* Resolve comments
- run `shfmt` over the installer script
- add MustNewInstaller
- move default installer logic to GetInstaller
- only include PublicProxyAddr in server.Config
* Resolve comments
- move from auth_with_roles -> auth/grpcserver
- document `MustNewInstallerV1`
This fixes a corner case where a docs review who submits a PR that
touches code or examples is treated as an external author instead
of an internal employee.
Fixes#14577
Update the guide and make it easier to use:
- Give this guide the structure of the Slack guide, adding stepped
headings and a section on configuring Access Requests, to make this
guide easier to follow step by step.
- Add the initial Access Request RBAC setup as a partial
- Indicate that this has been tested with Mattermost v7.0.1
- Add clarity tweaks throughout
- Update the instructions for editing the plugin configuration. The
configuration fields have changed since guide was written.
An earlier commit erroneously removed the /user-manual redirect, causing
404s for several pages on the goteleport site that still point to this
outdated URL. This change reinstates the redirect.
* Add Machine ID Kubernetes guide and partial Apps guide
* Small wording tweaks to the k8s guide
* Rename menu titles to match convention
* Fix inaccurate CA cert recommendation on the API access guide
* Tidy up the Kubernetes guide
* Finish up first pass on Apps guide
* Remove empty admonition
* Address review feedback
* Fix doctest lints
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Address a batch of review comments
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Address further review comments
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
The code attempts to wait on an existing download if one is already
in progress rather than starting a concurrent download of the same
session. If this code path runs, we incorrectly defer a call to a
nil function, triggering a panic.
This bug was introduced in #7360.
rosstimothy