* Introduce the Access List object.
The Access List object, which is the foundational object for access grants,
has been introduced. Due to the size/complexity of this object, the
implementation in api/types will come in a follow up.
* Use duration, update comments.
* Remove more requested membership bits, clarify what happens for user login state.
* Add in duration type mapping to buf-gogo.gen.yaml.
* Use an array instead of csv string.
* Migrate from legacy to regular protobuf.
* Make common resource header and metadata for use by non-legacy objects.
* Use repeated trait list instead of map for traits, remove V1 suffix since things are in a v1 package anyway.
* Move common bits into separate files.
* Use separate packages for traits, resource header, and metadata.
* Define a deployed_method field to discover deploy event
* Add deployed_method field to expected events
* Add deployed method type and define its field when emitting event from web UI
* Address CR and add another field
* Address CR
* Generalize Kubernetes Resource RBAC
This PR generalizes the work introduced by #19613 to other resources
existent in the Kubernetes API.
It allows restricting access to different Kubernetes resources using a
single `kubernetes_group`.
`kubernetes_resource.kind` supports `*` and the following resources:
* Deployments
* Statefulset
* Secrets
* Configmap
* DaemonSet
* Job
* CronJob
* Namespace
* Services
* Nodes
* ReplicaSets
* Roles
* RoleBindings
* ClusterRoles
* ClusterRoleBindings
* PersistentVolumes
* PersistentVolumeClaims
* Ingress
* Certificates
* ServiceAccounts
Part of #20811
* address zac's feedback
* Teleport Proxy Behind ALB support for IP Pinning
* move X-Forwarded-For handling to a middleware
* fix where middleware should be nil
* minor refactor based on review comments
* remove TODO and use contains
* use_x_forwarded_for -> trust_x_forwarded_for
* add NoopHTTPMiddleware
* [Assist] Include embeddings in the prompt
* Add comments
GCI
Minor fixes
* Move stuff
* Fix tests
* Fix tests
* Fixes after rebase
Apply code review suggestions.
* Address review comments
* After rebase fix
* Adds automatic approver user for use with access plugins
Adds an internal user `@teleport-access-approval-bot` with the associated
role `@teleport-access-approver`. This new role has grants the right to
approve any and all role access requests, and both the user and role
resources are automatically created on startup if not already present.
While the `@teleport-access-approval-bot` should under no circumstances
be allowed to log into the cluster or appear in UI user listings of any
kind (except as the approver in an access request), this PR does not
implement any or the requisite filtering or enforcement. This is coming
in a future PR.
* Don't crash when building OSS
* fix test fixup
* Adds labels to the Preset approval bot user
Also ads basic update functionality for preset users, and tests
for same.
* typo fix
* Commentary
* linter appeasement
* Update tests
* Update docs
* Post-merge cleanup
* Update lib/auth/init_test.go
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
* Address review feedback
* Filter out user in WebUI and plumb Teleport user through
---------
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
* InstallScripts: pin teleport version using ServerVersion
When Automatic Upgrades are enabled and the current installation is an
enterprise build, it will install teleport using:
- stable/cloud repo channel (yum, apt)
- pin the version to the one present at:
https://updates.releases.teleport.dev/v1/stable/cloud/version
* improve comments
* Add option to allow for host users not to be deleted
This adds a new role option called create_host_users_mode which allows
for it to be configured to not delete users when a session ends. The
old `create_host_user` option will be deprecated with this.
If the deprecated option is set, the new mode option will default to
dropping users as is the current behavior.
* add generated protos
* use combined output for commands, dont set CreateHostUser
* fix tests
* ci fixes
* add godocs to HostUserMode constants, fix tests
* remain -> keep
* Use an enum instead of a string
* fix merge errors
* Add tests & resolve comments
* Resolve issues
* fmt
* Changes to PagerDuty plugin to support running as a hosted plugin
The major structural change is to provide a new PagerDuty app constructor
that allows the auth server to inject a Teleport client, rather than the
plugin automaticaly creating a GRPC client on startup.
Other changes include:
- Added more PagerDuty API types
- Extra logging
- Small refactors here & there
* Update integrations/access/pagerduty/app.go
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Shorten PagerDuty typenames
* Address review feedback
- Moved API URL to plugin parameters
- Removed obsolete settings loader
* Address @marcoandredinis' review feedback
---------
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* ai: add embeddings basic support
- add Embeddings service and its local implementation
- add Embedding type and proto message
- add nodeEmbeddingCollector tracking nodes
- add NodeEmbeddingWatcher watching for events adn sending them to the
collector
- add the Embedder interface and its openai implementation
* ai: adapt embeddings to the vector index
* fixup! ai: adapt embeddings to the vector index
* fixup! fixup! ai: adapt embeddings to the vector index
* Update lib/service/service.go
Co-authored-by: Jakub Nyckowski <jakub.nyckowski@goteleport.com>
* address feedback pt.1
* address feedback pt.2: store protobuf message in backend
* address feedback pt.3: have GetEmbeddings return a stream
* Update lib/services/embeddings.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Apply suggestions from code review
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* address feedback pt.4: extract embedding logic out of Embeddings service
* fixup! address feedback pt.4: extract embedding logic out of Embeddings service
* address feedback pt.5: simpler error handling when embedding fails
* fix tests pt.1
* fix tests pt.2
* fix tests pt.3
* [Assist] Replace embedding watcher (#27953)
Change the way how the embeddings are calculated. Instead of creating a watcher in Auth, we will process all nodes every hour and process embeddings if any embeddings are missing or any node has been updated.
---------
Co-authored-by: Jakub Nyckowski <jakub.nyckowski@goteleport.com>
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Add reviewer and requester roles.
Reviewer and requester roles have been added to allow for easy defaults for
reviewing and requesting applications and user groups for the Okta service.
* Update comments, add in requester/reviewer references all over docs.
* Update constants.go
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Better names in resource-requests.mdx, no options for reviewer/requester presets.
* Add dbreviewer to cspell.json.
* Update init_test.go to handle the new number of presets.
* Remove access review/request role creation from resource-requests.mdx.
* Improve wording.
* Only add reviewer/requester/group access if in enterprise.
* Docs updates.
* Remove errant scoped block.
* Tune access controls getting started.
* Prevent customer roles from being overwritten by new defaults.
* Apply suggestions from code review
Co-authored-by: Nic Klaassen <nic@goteleport.com>
* Doc updates, function name updates, bootstrap label behavior changes.
* Adjust TeleportManagedLabel comment to sound less dire.
* Remove unnecessary references to reviewer/requester in the docs.
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Docs tweaks, removal of unnecessary login setting.
* Use internal resource type as discussed offline.
* Update api/types/constants.go
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
Co-authored-by: Nic Klaassen <nic@goteleport.com>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* AWS OIDC Integration: Deploy DB Service in a single click
This PR adds a new AWS OIDC Integration action: deploy database service
This uses Amazon ECS to deploy a Database and a Discovery Service in a
single click.
Please read `lib/integrations/awsoidc.DeployDBService` for more
information.
* set discovery group to uuid
* add agent matcher labels
* add tags to indicate ownership
* create deployment mode
* allow for dot named clusters
* rename service and taskdefinition to include deployment mode
* add ECS service dashboard url to the response
* change ownership tags
* remove delete service api call
* fix json indent in comment and iam token name
* Add mapping between user groups and applications.
Within Okta, user groups can assign permission to many applications and
applications can belong to many user groups. This commit establishes that
mapping so that the Okta service can perform more user friendly access
requests by adding all applications from a user group to the access request
and additionally allowing application access requests to request associated
user groups as well.
* Adjust NewUserGroup to take a spec.
* feat: adds motd to the ui
* address review suggestions:
- update MOTD to Motd
- moved motd state to useLogin
- added behaviour tests
* add motd test to apiserver_test.go webconfig. update snapshot test to address motd warning
* git mv to update MOTD to Motd
* multiple fix:
- add unmount test
- remove motd title
- group states together in useLogin
- update arrow func to classic js func
* remove unused waitForElementToBeRemoved
* Fix an issue ALPN handshake test does not respect "HTTPS_PROXY"
* address review comment
* remove simplehttsproxy
* Add context to IsALPNConnUpgradeRequired in ten thousand places
* add goc and dial with context
* fix: set jamf plugin default checks to include PluginStaticCredentialsRef
* add labels check. move apiendpoint check to default checks
* check if setting is not nil
* At the notion of friendly names to access request details.
Access request details can now return friendly names. This will help display
access request resources in a way that allows easier reviewing of Okta apps
and user groups, where the names are not human readable.
* Use friendly name for nodes, tune variable names.
* Add in DetailsID helper function for use by the enterprise UI.
* Request apps instead of app servers, remove DetailsID as its no longer needed.
* Push friendly name into app and usergroup UI objects.
* Fix apps test.
* Linting.
* [Connect] Add FriendlyName to AccessRequest (#27694)
---------
Co-authored-by: Michael <michael.myers@goteleport.com>
This PR introduces a new role version - `v7` - to support other
Kubernetes resources such as `Deployments`, `Statefulsets`... while
keeping compatibility with previous role versions.
This PR adds the following validations:
- `v6`, `v5`, `v4`: `kubernetes_resources` can only include `kind: pod`
resources
- `v7`: `kubernetes_resources` can include wildcards or other
resourceces (to be introduced by #26244.
It also adds a role version downgrade (v13 clients connecting to v14
auth server) where we downgrade the role's version and remove unsuported
kubernetes_resources from the resource list.
Part of #20811
* Add types for storing Platform Attestation
* Add to/from resource conversion
* Use bytes for nonce field
* Tidy up usage of pointers
* Ensure tests cover multiple entries
* Adjust comments as per PR review
* Don't loop over authMethods in (*agentDialer)DialContext
* Make HostKeyCallbackConfig.OnCheckCert fallible
* Add a way to check if a proxy is claimed
* Abort reverse tunnel conns early if the proxy is already claimed
* Document the pre-closed global request channel
* Fix moderated session presence checking
Addresses all of the issues that were preventing presence checking during
moderated sessions from working as described in
[#18092](https://github.com/gravitational/teleport/issues/18092#issuecomment-1540900859).
Closes#18092
* make presence test clearer
* fix presence checking on the web ui
* Refactor web socket message handling
A single message processing loop handles retrieving the envelope
and passing it off to individual message handlers. This allows all
messages to be processed outside of `Read` which was dependent on
the terminal being active to process any messages.
The webauthn challenge response was also moved from a raw message
to a webauthn message. By sending it as a raw message it made
presence checking fail because the response has a `t` in it which
caused the session to be killed during moderated sessions.
* enforce mfa ceremony when joining and cluster wide mfa is enabled
* fix conflicts with master
* moderated tests
* Add moderated session tests for the UI
* Add moderated session integration test
* fix lints
* clean up presence test
* refactor envelope handling
* fix build
* fix: revert test debug timeout
* fix: use local context in tests
* simplify closing streams
* generalize waitForOutput to work with an io.Reader
* fix error handling in stream close
* unexport PresenceOptions
* Improve waitForOutput to match against output in successive reads
This commit adds the new function `labels_matching` to the label
expression syntax. It accepts a Teleport-style glob or regular
expression, and returns the aggregate of all values for keys matching
that expression.
Since it is now more likely for users to want to compare two slices,
I've also added the `contains_any` and `contains_all` functions to
complement the existing `contains` function.
This commit also adds the `email.local` function that is already
available in role templates and should be useful.
Some examples are included in the new test cases.
- downgrade roles with label expressions for older clients
- add teleport.internal/downgraded label to downgraded roles
- block UpsertRole if inventory contains servers without label expression support
* feat: partial label expression support
This commit implements support for label expressions (RFD 116) with the
exception that user traits can not yet be used in the expressions.
The user traits will be made available to the expressions in a following
PR.
* explicitly compare role condition with Allow
* add comment on label matcher templating
* reuse labelMatchersUnset loop
* improve debug messages
* Move Cloud Matchers to proto
As described in RFD0125, we are going to create a new resource:
DiscoveryConfig
This new resource will contain the Cloud Matchers as spec fields:
- AWSMatcher
- AzureMatcher
- GCPMatcher
To define grpc methods that use this new resource, we must create all
the matchers types as part of the proto definition.
This PR moves those definitions into types.pb.go and removes them from
`lib/services.{AWS,Azure,GCP}Matcher`.
This should have no side effect in business logic given that we re-use
the same field names everywhere.
* remove most of gogo tags
* Revert "remove most of gogo tags"
This reverts commit 5ecf8d0cec.
* fix typos
* feat: device resource in tctl get all
* check for device resource but ignore in favour of enterprise resource migration
* add firstStart indicator in auth service config. Tests
* remove device bootstrap from this PR
* multiple updates:
- remove resource marshaler, this will be added to e repo instead
- remove device resource checks in oss (not needed as resource marshaler now added to e). tests removed
* move device marshalers to service package
* run fix-imports, fix test
* remove device case from itemsFromResource
Marco André Dinis