opensource/teleport
3
0
Fork 0
mirror of https://github.com/gravitational/teleport.git synced 2026-11-03 07:40:28 +08:00
Code Issues Packages Projects Releases Wiki Activity
17,712 Commits 9,614 Branches 7,118 Tags
362ce9770720effb46a06eea7528f59cdcb852ef
Commit Graph
1630 Commits
Author SHA1 Message Date
Alan Parra 8b8773e7fa Update web_session_id description in DeviceMetadata (#40637) 
* Update web_session_id description in DeviceMetadata

* Update generated protos
 2024-04-18 07:06:06 +00:00
Noah Stride 955f86ba3e Thread context.Context through auth.Register and add OTel Tracing (#40597) 
* Wire context.Context into `auth/register.go`

* Thread `context.Context` through `auth.Register` and add tracing

* Unwrap error before recording it in the span
 2024-04-17 17:19:07 +00:00
Edward DowlingMarco André Dinisrosstimothy
 		9062d62aff Add access monitoring rules cache and tctl interactions (#40218) 
* Add access monitoring rules cache and tctl interactions

* Swap access monitoring rules collections to use upsert

* Update accessmonitoringrules cache test

* Readd missing err check

* Update lib/auth/grpcserver.go

Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>

* Update lib/auth/grpcserver.go

Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>

* Update tool/tctl/common/resource_command.go

Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>

* Add tctl isForced behaviour for access monitoring rules

* Add missing methods to cache interface for access monitoring rules

* Add info messages to tctl commands for accessmonitoring rule edits

* Add missing user message for forced rule creation

* Appease linter

---------

Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
 2024-04-17 13:05:01 +00:00
Marco André Dinis 851b0d8fdf DiscoveryService: prevent EICE Node duplication (#40220) 
* DiscoveryService: exclusive worker per Discovery Group

This PR ensures only one DiscoveryService is running per DiscoveryGroup.
It does so using a SemaphoreLock.

This should prevent any duplicate API calls and also prevent duplicate
resources on Teleport side.

* improve eice server name and releaseGroupLockFn init

* review pt2

* improve error handling

* re-organize lock acquire

* improve eice node name handling

* simplify lock on discovery group

* Remove lock logic and rely on node name to prevent dups

* improve test comment

* change comment about skipping nodes
 2024-04-15 13:24:33 +00:00
Trent Clarke 2be9025558 Fix overwritten ACL member values during Sync & SCIM push (#40454) 
* Fix overwritten member values

* test fixup

* refactor for readability

* Addess review feedback

* Preserve "AddedBy"

* Make preserving metadata the default behaviour

* fix cache tests

* Replace custom validation with calls to `CheckAndSetDefaults()`

* Commentary on metadata preservation

* Test Fixup
 2024-04-15 06:48:52 +00:00
Noah Stride c8f13946a8 Fix tpm joining protobuf oneof (#40514) 
* Fix tpm joining protobuf oneof

* See if Buf will allow me to reuse the indexes outside of oneof

* Regen protos

* Tactical renaming

* Update CRDs
 2024-04-12 19:16:44 +00:00
dependabot[bot]andAlan Parra 9677ccd874 Bump the go group in /api with 3 updates (#40423) 
* Bump the go group in /api with 3 updates

Bumps the go group in /api with 3 updates: [go.opentelemetry.io/proto/otlp](https://github.com/open-telemetry/opentelemetry-proto-go), [golang.org/x/net](https://github.com/golang/net) and [google.golang.org/grpc](https://github.com/grpc/grpc-go).


Updates `go.opentelemetry.io/proto/otlp` from 1.1.0 to 1.2.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-proto-go/releases)
- [Commits](https://github.com/open-telemetry/opentelemetry-proto-go/compare/v1.1.0...v1.2.0)

Updates `golang.org/x/net` from 0.23.0 to 0.24.0
- [Commits](https://github.com/golang/net/compare/v0.23.0...v0.24.0)

Updates `google.golang.org/grpc` from 1.63.0 to 1.63.2
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](https://github.com/grpc/grpc-go/compare/v1.63.0...v1.63.2)

---
updated-dependencies:
- dependency-name: go.opentelemetry.io/proto/otlp
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: golang.org/x/net
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
...

Signed-off-by: dependabot[bot] <support@github.com>

* Tidy root module

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
 2024-04-11 13:04:36 +00:00
Tiago Silva 502879a5fe DiscoveryConfig: Update status after each run (#40267) 
* DiscoveryConfig: Update status after each run

Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>

* add unit tests

* drop method by reducing interface area

---------

Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
 2024-04-10 17:18:58 +00:00
Ryan ClarkandRafał Cieślak f13fee902b Support redirecting to TAG on first login (#40156) 
* Support redirecting to TAG on first login

* Update api/proto/teleport/userpreferences/v1/access_graph.proto

Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>

* Add support for highlighting a navigation item

* Add godoc

* Re-run make grpc

---------

Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>
 2024-04-10 13:22:20 +00:00
Bartosz Leper 06fce3f449 Keep track of whether the user has a real password set (#39576) 
* Keep track of whether the user has a real password set

* lint

* Some comments

* Fix TestCreateResources

* Fix e/ link

* Review

* Review

* Review

* Use early return on error in DeletePassword

* Fix the broken teleterm test
 2024-04-10 10:28:05 +00:00
rosstimothy 33d47c041e Correctly propagate windows desktop logins in GetUnifiedResourcePage (#40359) 
The conversion from a proto.PaginatedResource to a types.EnrichedResource
inadvertently omitted setting logins for windows desktops. A new
test, TestGetUnifiedResourcesWithLogins, was added to validate that
if logins are provided by the server that they are passed along in
the enriched resource.

Closes #40340
 2024-04-09 16:26:15 +00:00
rosstimothy ad26913c71 Load appropriate TLS config for clusters (#40293) 
Updates the proxy.Client to allow loading specific tls.Config for
individual clusters. This prevents issues when trying to access
leaf resources via the root cluster if WithAllCAs is not set.
 2024-04-09 16:02:28 +00:00
Noah Stride 0590d724c5 Add Protos for TPM Joining (#40307) 
* Add protos for TPM joining

* Add `*proto.UnimplementedJoinServiceServer` to `JoinServiceGRPCServer`

* Update CRDs
 2024-04-09 12:26:27 +00:00
Tiago Silva 71fbd21401 GoDerive: Generate Equal stubs for DiscoveryConfig object. (#40255) 
This PR generates the stubs for `DiscoveryConfig.Equal` function based
on goderive code generation.

Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
 2024-04-08 14:51:39 +00:00
Tiago Silva 86fcaecb37 DiscoveryConfig: Implement UpdateDiscoveryConfigStatus handler (#40215) 
* DiscoveryConfig: Implement `UpdateDiscoveryConfigStatus` handler

This PR implements
`/teleport.discoveryconfig.v1.DiscoveryConfigService/UpdateDiscoveryConfigStatus`
grpc method

Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>

* fix name typo

---------

Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
 2024-04-08 14:13:09 +00:00
dependabot[bot]androsstimothy f12073946a Bump the go group in /api with 13 updates (#40278) 
Bumps the go group in /api with 13 updates:

| Package | From | To |
| --- | --- | --- |
| [go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.49.0` | `0.50.0` |
| [go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.49.0` | `0.50.0` |
| [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) | `1.24.0` | `1.25.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlptrace](https://github.com/open-telemetry/opentelemetry-go) | `1.24.0` | `1.25.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc](https://github.com/open-telemetry/opentelemetry-go) | `1.24.0` | `1.25.0` |
| [go.opentelemetry.io/otel/metric](https://github.com/open-telemetry/opentelemetry-go) | `1.24.0` | `1.25.0` |
| [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) | `1.24.0` | `1.25.0` |
| [go.opentelemetry.io/otel/trace](https://github.com/open-telemetry/opentelemetry-go) | `1.24.0` | `1.25.0` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.21.0` | `0.22.0` |
| [golang.org/x/net](https://github.com/golang/net) | `0.22.0` | `0.23.0` |
| [golang.org/x/term](https://github.com/golang/term) | `0.18.0` | `0.19.0` |
| [google.golang.org/genproto/googleapis/rpc](https://github.com/googleapis/go-genproto) | `0.0.0-20240325164216-beb30f47624b` | `0.0.0-20240401170217-c3f982113cda` |
| [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.62.1` | `1.63.0` |


Updates `go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc` from 0.49.0 to 0.50.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.49.0...zpages/v0.50.0)

Updates `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` from 0.49.0 to 0.50.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.49.0...zpages/v0.50.0)

Updates `go.opentelemetry.io/otel` from 1.24.0 to 1.25.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.24.0...v1.25.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace` from 1.24.0 to 1.25.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.24.0...v1.25.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc` from 1.24.0 to 1.25.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.24.0...v1.25.0)

Updates `go.opentelemetry.io/otel/metric` from 1.24.0 to 1.25.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.24.0...v1.25.0)

Updates `go.opentelemetry.io/otel/sdk` from 1.24.0 to 1.25.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.24.0...v1.25.0)

Updates `go.opentelemetry.io/otel/trace` from 1.24.0 to 1.25.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.24.0...v1.25.0)

Updates `golang.org/x/crypto` from 0.21.0 to 0.22.0
- [Commits](https://github.com/golang/crypto/compare/v0.21.0...v0.22.0)

Updates `golang.org/x/net` from 0.22.0 to 0.23.0
- [Commits](https://github.com/golang/net/compare/v0.22.0...v0.23.0)

Updates `golang.org/x/term` from 0.18.0 to 0.19.0
- [Commits](https://github.com/golang/term/compare/v0.18.0...v0.19.0)

Updates `google.golang.org/genproto/googleapis/rpc` from 0.0.0-20240325164216-beb30f47624b to 0.0.0-20240401170217-c3f982113cda
- [Commits](https://github.com/googleapis/go-genproto/commits)

Updates `google.golang.org/grpc` from 1.62.1 to 1.63.0
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](https://github.com/grpc/grpc-go/compare/v1.62.1...v1.63.0)

---
updated-dependencies:
- dependency-name: go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: go.opentelemetry.io/otel
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: go.opentelemetry.io/otel/metric
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: go.opentelemetry.io/otel/sdk
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: go.opentelemetry.io/otel/trace
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: golang.org/x/net
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: golang.org/x/term
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: google.golang.org/genproto/googleapis/rpc
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
 2024-04-08 13:59:28 +00:00
Andrew Burke d0a68fd824 Add automatic role access requests (#39003) 
* Add automatic role requests

This change adds the optioin to automatically make a role access request
during tsh ssh instead of a resource access request.

* Speed up TestSSHAccessRequest
 2024-04-05 19:40:35 +00:00
Michael Wilson a72d02d873 Introduce role friendly name labels and frontend utilities. (#40113) 
* Introduce role friendly name labels and frontend utilities.

Role friendly name labels and frontend utilities have been introduced.

* Remove unneeded sort function.
 2024-04-05 12:40:40 +00:00
Tiago Silva 4494729e48 DiscoveryConfig: Add status field to report discovered objects and errors (#40136) 
* DiscoveryConfig: Add `status` field to report discovered objects and
errors

This PR introduces a `status` field into the `discovery_config` protobuf
spec to report status and metrics about the resources discovered for
each `discovery_config` spec.

Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>

* add last_sync_time

* fix typo

---------

Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
 2024-04-05 10:28:40 +00:00
Brian JoergerrosstimothyTim Ross
 		5c930ca9a5 Fix flaky test TestProxySSHJumpHost (#40052) 
* Use testServer.MakeTestServer to fix issue with parallel runs using the same ports.

* Add deprecation comments for test server helpers outside of tools/teleport/testenv.

* Update tool/teleport/testenv/test_server.go

Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>

* Disable SSH resumption

Enable LoadAllCAs

Update comments

* Prevent context.Canceled from being wrapped across transport stream

trail doesn't properly handle conversions to and from errors that
are context.Canceled which results in code paths trying to evaluate
errors.Is(err, context.Canceled) failing. The error recevied is
an interceptors.RemoteError, which wraps a trace.TraceErr, which
contains a status.Status with codes.Canceled. To work around this
until trail is updated the server half of the stream was updated
to return an io.EOF if if encouters a canceled error.

---------

Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Co-authored-by: Tim Ross <tim.ross@goteleport.com>
 2024-04-04 21:20:30 +00:00
Krzysztof SkrzętnickiandAnton Miniailo 24021556c4 Implement persistence for database_object resource (#39756) 
* Implement persistence for database_object resource

* Split monolithic service test

* Add `t.Parallel()` to the tests

* lint fix

* Update copyright year

Co-authored-by: Anton Miniailo <anton@goteleport.com>

* `make grpc`

---------

Co-authored-by: Anton Miniailo <anton@goteleport.com>
 2024-04-03 08:28:11 +00:00
Brian Joerger baf030253f Move types.NewWebSessionRequest to lib/auth/sessions.go. (#39742) 
Move related methods to lib/auth/sessions.go.
 2024-04-02 18:41:24 +00:00
Alan Parra f33c3f6eb5 Add device trust "token move check" protos (#40097) 
* Add DeviceConfirmationToken and ConfirmDeviceWebAuthentication

* Add DeviceConfirmationToken to TerminalService

* Rename cluster_uri to root_cluster_uri

* Update generated protos
 2024-04-02 17:49:07 +00:00
Tiago Silvaandrosstimothy 8681546401 Add conditional update methods for AccessList and AccessListMembers (#40036) 
* Add conditional update methods for `AccessList` and `AccessListMembers`

This PR adds two new methods for conditinally update an AccessList and
AccessListMember resources to avoid overriding changed resources.

This is a preparation for a ineligible status reconciler.

Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>

* Update lib/services/simple/access_list.go

Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>

* handle review comments and drop copy methods

* simplify code

---------

Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
 2024-04-02 16:52:55 +00:00
Edward Dowlingandrosstimothy 2a08180e99 Add access monitoring rules services and backend (#39143) 
* Add access monitoring rules backend

* Add missing service implementations for access monitoring rules

* Add missing struct tags to access monitoring rules

* Simplify toProto and fromProto for access monitoring rules

* Remove simple/access_monitoring_rules

* Use backend service adapter for access monitoring rules service

* Remove unused logger from access monitoring rules service

* Use cache for ListAccessMonitoringRules

* Add tests for access monitoring rules local backend

* Add tests for access monitoring rules service

* Fix import order

* Update lib/services/local/access_monitoring_rules.go

Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>

* Update lib/services/local/access_monitoring_rules.go

Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>

* Add checks to validate AccessMonitoringRules

* Update lib/services/access_monitoring_rules.go

Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>

* Update lib/services/access_monitoring_rules.go

Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>

* Remove unused deleteAll method from access monitoing rules service

* Update accessMonitoringRules cache interface to be more restrictive

* Update access monitoring rules tests to not deprecated methods

* Appease linter

* Fix import order in access monitoring rules test

* Fix import order in access monitoring rules test

* Remove remaining no generated access monitoring rules definitions

* Remove remaining uses of access monitoring rules conv

* Remove unused imports

* Remove use of removed convert package in tests

* Remove access monitoring rules interface assertion

* Remove unused import

* Fix access monitoring rule service test

* Appease linter

* Appease linter

* Appease linter

---------

Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
 2024-04-02 15:51:17 +00:00
Noah StrideandEdoardo Spadolini 8209d4daea Migrate RemoteClusters CRUD to gRPC (#38671) 
* Add protos for PresenceService and RemoteCluster CRUD

* Add service skeleton for presence service

* Add bodies for all methods

* Hook up to new backend methods

* Add presence service to auth grpc server

* Add fallback functions to call old http endpoints

* Fix tests for DeleteAllRemoteClusters

* Remove bad rebase file

* Update proto to remove Create

* Remove unused create grpc handler

* Add Patch support to Update gRPC

* Fix method missing from interface

* Add test for GetRemoteCluster

* Add test for ListRemoteClusters

* Add test for DeleteRemoteCluster

* Add tests for TestUpdateRemoteCluster

* Appease linter

* Fix GetRemoteCluster test

* Update lib/auth/httpfallback.go

Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>

* Update api/client/client.go

Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>

* Update lib/auth/httpfallback.go

Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>

* Fix reference to trace.Component

---------

Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
 2024-04-02 11:24:33 +00:00
Forrest 06ac626868 user filtering (#39844) 2024-04-01 21:19:55 +00:00
Alan Parra 07b029e6d4 Keep device extensions in renewed sessions (#39982) 
* Add the HasDeviceExtensions field to WebSessionSpecV2

* Update generated protos

* Add GetHasDeviceExtensions to the WebSession interface

* Write HasDeviceExtensions on augmented sessions

* Make NewWebSessions private

* Keep device extensions in renewed sessions

* Add a DeviceWebToken TODO to ChangeUserAuthentication

* Explicitly state we don't revalidate the certs on renewal
 2024-04-01 19:24:07 +00:00
Michael Wilson 49c540caf1 Introduce plugins cleanup command line function. (#40035) 
* Introduce plugins cleanup command line function.

tctl can now explicitly issue a plugins cleanup command, which will allow
admins to remove any extra artifacts that a plugin may have left behind
after being deleted.

* Add in a dry run command, list resources.

* GCI.

* Code cleanup, use ResourceID instead of string.

* Only allow okta cleanup, default to dry-run on.
 2024-04-01 18:00:08 +00:00
Yassine Bounekhla b4531476a7 add notifications to the cache (#39715) 2024-03-30 01:13:15 +00:00
Brian Joerger 4690eeab10 Keep App Session secrets secret (#39853) 
* Don't reveal app session secrets to users.

* Fix panic in WebSessionV2.WithoutSecrets.

* Use client's key for azure jwt tokens

Proxy verifies and signs jwt tokens

Ensure backwards compatibility

* Remove unused GetAppSession methods.

* Move azure jwt token resigning logic into the session transport's
rewriteRequest method with an improved Azure app check

Fix GetAppSession backward compatibility check

* Add test.

* Address lint comments.

* Address parseBearerToken comment.

* apply suggestion about indentation.
 2024-03-29 23:31:31 +00:00
Sakshyam Shah bdba1a65c2 remove saml_idp_service_provider_labels and saml_idp_service_provider_labels_expression (#40047) 
* reserve 40, 41 tag numbers for RoleConditions

* remove GetSAMLIdPServiceProviderLabels and SetSAMLIdPServiceProviderLabels

* remove SAMLIdPServiceProviderLabels from label matchers and rolev6 test

* run make -C integrations/operator manifests
 2024-03-29 20:22:48 +00:00
Michael Wilson a153965066 Introduce plugin cleanup endpoints. (#39957) 
Plugin cleanup endpoints have been introduced. One that indicates whether a
plugin needs cleanup, the other that actually performs cleanup. This is
primarily to address issues with the Okta integration and leftover
assignments.
 2024-03-29 14:49:43 +00:00
Lisa Kim e5165df49b Return eligible status with UpsertAccessListWithMembers (#40003) 2024-03-29 08:23:49 +00:00
Brian Joerger bbf447fe0d Move NewWebSessionRequest to lib/auth; add TODO. (#39741) 2024-03-28 23:59:45 +00:00
Alan Parra 9a8b3cb1ed Remove the webauthn.User proto (#39950) 
* Move webauthn.User to lib/services/local

* Remove the webauthn.User proto

* Update generated protos
 2024-03-28 16:49:38 +00:00
Trent Clarke 244b946f83 Fix issues with User Sync audit events (#39830) 
- UserSync Events have fields whose values are routinely 0, which the
   JSON marshaler was omitting. This patch removes the `omitempty`
   directive so these values are preserved in the serialized event.
 - Typo in the UserSync event failure code
 2024-03-28 04:54:33 +00:00
Alan Parra e757b0b3c5 Add a page_size toggle to JamfInventoryEntry (#39799) 
* Add a page_size toggle to JamfInventoryEntry

* Update generated protos

* Add page_size to Jamf fileconf
 2024-03-27 20:57:04 +00:00
Michael aeed30d33c Use new access request filters in webUI (#39625) 2024-03-27 18:21:55 +00:00
Edward DowlingRoman TkachenkoHugo Hervieux
 		0b01cf5c1f Fix opsgenie plugin to use correct annotation to determine whether or not to create alerts (#38435) 
* Fix bug in opsgenie plugin mixing up notify-services and schedules

* Update docs for opsgenie plugin to use correct schedules

* Remove accidental change to opsgenie client

* Update opsgenie client tests

* Update opsgneie plugin behaviour for determining recipients

* Update docs with correct screenshot of role creation

* Stop Opsgenie plugin sending alerts when /schedules label is set

* Change rawRecipients initialisation in opsgenie bot

* Remove opsgenie add role example image from docs

* Update integrations/access/accessrequest/app.go

Co-authored-by: Roman Tkachenko <roman@goteleport.com>

* Update docs/pages/access-controls/access-request-plugins/opsgenie.mdx

Co-authored-by: Roman Tkachenko <roman@goteleport.com>

* Make variable Opsgenie plugin var names more consistent

* Update changelog with opsgenie breaking changes

* Rename ReqAnnotationSchedulesLabel for consistency

* Fix opsgenie getOnCall

* Add opsgenie approval tests + add approval user configuration

* Appease linter

* Add back in opsgenie client fix

* Appease linter

* Add in clarifying comment for alert request retry behaviour

* Add missing opsgenie endpoint mocks

---------

Co-authored-by: Roman Tkachenko <roman@goteleport.com>
Co-authored-by: Hugo Hervieux <hugo.hervieux@goteleport.com>
 2024-03-27 13:44:25 +00:00
Yassine Bounekhla 4b4fa81d01 implement notification sortcaches (#39616) 2024-03-27 13:40:05 +00:00
Michael Wilson 7cf309867f Add derived equals for other types within Teleport. (#39081) 
Derived equals have been added for other types within Teleport with two
notable exceptions:

- AccessLists, as there is a bug with goderive when determining equivalence
  for the ResourceHeader.
- Users, as goderive's equal plugin does not support interface{} types, which
  is used in the underlying UserV2 type generated by protoc.
 2024-03-26 20:32:44 +00:00
Marco André Dinis 455632e28a EC2 Auto-Discovery: EICE support (#35504) 
* AutoDiscover: add support for EICE nodes

* ignore openssh nodes when updating labels from serverinfo

* downcase imports

* improve comment on why we need account/instance and subkind

* add applyovertime method

* skip nodes that wont expire in the near future

* create helper functions
 2024-03-26 16:16:20 +00:00
Forrest 9f63987cc6 add filter to ListRoles (#39546) 
* impl role filtering

* auth version check
 2024-03-26 15:42:03 +00:00
Michael Wilson 2a2ac936a3 Add a generation field to plugins. (#39635) 
* Add a generation field to plugins.

A new field has been added to the plugin object that will help uniquely
identify the plugin and its current revision, which will be used to properly
namespace Okta sourced access lists and resources.

* Undo the reformatting of types.proto.
 2024-03-26 14:03:59 +00:00
Mike Jensen 742d1b6467 Update direct go dependencies that were not excluded by Dependabot (#39796) 
This attempts to be a manual broad update to fix our automatic update PRs.
 2024-03-25 21:33:09 +00:00
rosstimothyandForrest efc8c498c8 Improve performance of resource filtering (#39724) 
* update benchmark tests

* Avoid creating a logrus logger if RBAC logging is not enabled

```bash

$ benchstat 03d741b33f153ff98d516b54a3e163bd443fdf63.txt new.txt
goos: darwin
goarch: arm64
pkg: github.com/gravitational/teleport/lib/auth
                                        │ 03d741b33f153ff98d516b54a3e163bd443fdf63.txt │              new.txt               │
                                        │                    sec/op                    │   sec/op     vs base               │
ListUnifiedResources/labels-12                                            281.6m ± 10%   279.1m ± 6%       ~ (p=0.631 n=10)
ListUnifiedResources/predicate_path-12                                    503.1m ±  2%   509.2m ± 1%       ~ (p=0.165 n=10)
ListUnifiedResources/predicate_index-12                                   504.9m ±  4%   494.5m ± 4%       ~ (p=0.190 n=10)
ListUnifiedResources/search_lower-12                                      335.7m ±  1%   320.4m ± 7%  -4.57% (p=0.002 n=10)
ListUnifiedResources/search_upper-12                                      340.2m ± 13%   330.9m ± 4%       ~ (p=0.105 n=10)
geomean                                                                   382.3m         375.3m       -1.83%

                                        │ 03d741b33f153ff98d516b54a3e163bd443fdf63.txt │               new.txt                │
                                        │                     B/op                     │     B/op      vs base                │
ListUnifiedResources/labels-12                                           158.75Mi ± 0%   85.50Mi ± 0%  -46.14% (p=0.000 n=10)
ListUnifiedResources/predicate_path-12                                    396.9Mi ± 0%   323.7Mi ± 0%  -18.45% (p=0.000 n=10)
ListUnifiedResources/predicate_index-12                                   396.9Mi ± 0%   323.6Mi ± 0%  -18.46% (p=0.000 n=10)
ListUnifiedResources/search_lower-12                                     158.62Mi ± 0%   85.33Mi ± 0%  -46.21% (p=0.000 n=10)
ListUnifiedResources/search_upper-12                                     159.58Mi ± 0%   86.31Mi ± 0%  -45.91% (p=0.000 n=10)
geomean                                                                   229.2Mi        145.8Mi       -36.38%

                                        │ 03d741b33f153ff98d516b54a3e163bd443fdf63.txt │               new.txt               │
                                        │                  allocs/op                   │  allocs/op   vs base                │
ListUnifiedResources/labels-12                                             2.412M ± 0%   1.662M ± 0%  -31.10% (p=0.000 n=10)
ListUnifiedResources/predicate_path-12                                     7.363M ± 0%   6.613M ± 0%  -10.19% (p=0.000 n=10)
ListUnifiedResources/predicate_index-12                                    7.212M ± 0%   6.462M ± 0%  -10.40% (p=0.000 n=10)
ListUnifiedResources/search_lower-12                                       3.162M ± 0%   2.412M ± 0%  -23.73% (p=0.000 n=10)
ListUnifiedResources/search_upper-12                                       3.312M ± 0%   2.562M ± 0%  -22.65% (p=0.000 n=10)
geomean                                                                    4.222M        3.376M       -20.03%
```

* Simplify and reduce memory usage of MatchResourceByFilters

```bash

$ benchstat 215637fd4bca413a43d3ae3db25e1aa382c4b032.txt new.txt
goos: darwin
goarch: arm64
pkg: github.com/gravitational/teleport/lib/auth
                                        │ 215637fd4bca413a43d3ae3db25e1aa382c4b032.txt │               new.txt                │
                                        │                    sec/op                    │    sec/op     vs base                │
ListUnifiedResources/labels-12                                             279.1m ± 6%   210.3m ±  2%  -24.66% (p=0.000 n=10)
ListUnifiedResources/predicate_path-12                                     509.2m ± 1%   448.5m ± 12%  -11.91% (p=0.009 n=10)
ListUnifiedResources/predicate_index-12                                    494.5m ± 4%   478.1m ±  2%        ~ (p=0.089 n=10)
ListUnifiedResources/search_lower-12                                       320.4m ± 7%   271.6m ±  4%  -15.24% (p=0.000 n=10)
ListUnifiedResources/search_upper-12                                       330.9m ± 4%   272.8m ±  4%  -17.57% (p=0.000 n=10)
geomean                                                                    375.3m        319.7m        -14.83%

                                        │ 215637fd4bca413a43d3ae3db25e1aa382c4b032.txt │               new.txt                │
                                        │                     B/op                     │     B/op      vs base                │
ListUnifiedResources/labels-12                                            85.50Mi ± 0%   74.03Mi ± 0%  -13.42% (p=0.000 n=10)
ListUnifiedResources/predicate_path-12                                    323.7Mi ± 0%   312.2Mi ± 0%   -3.56% (p=0.000 n=10)
ListUnifiedResources/predicate_index-12                                   323.6Mi ± 0%   312.2Mi ± 0%   -3.53% (p=0.000 n=10)
ListUnifiedResources/search_lower-12                                      85.33Mi ± 0%   73.88Mi ± 0%  -13.41% (p=0.000 n=10)
ListUnifiedResources/search_upper-12                                      86.31Mi ± 0%   74.85Mi ± 0%  -13.27% (p=0.000 n=10)
geomean                                                                   145.8Mi        131.9Mi        -9.57%

                                        │ 215637fd4bca413a43d3ae3db25e1aa382c4b032.txt │               new.txt               │
                                        │                  allocs/op                   │  allocs/op   vs base                │
ListUnifiedResources/labels-12                                             1.662M ± 0%   1.212M ± 0%  -27.09% (p=0.000 n=10)
ListUnifiedResources/predicate_path-12                                     6.613M ± 0%   6.162M ± 0%   -6.81% (p=0.000 n=10)
ListUnifiedResources/predicate_index-12                                    6.462M ± 0%   6.012M ± 0%   -6.96% (p=0.000 n=10)
ListUnifiedResources/search_lower-12                                       2.412M ± 0%   1.962M ± 0%  -18.66% (p=0.000 n=10)
ListUnifiedResources/search_upper-12                                       2.562M ± 0%   2.112M ± 0%  -17.57% (p=0.000 n=10)
geomean                                                                    3.376M        2.844M       -15.77%
```

* Optimize memory usage of CombineLabels

```bash

$ benchstat 6ef17028eb6f3d83cee141c4ecd9d30bfbf54460.txt new.txt
goos: darwin
goarch: arm64
pkg: github.com/gravitational/teleport/lib/auth
                                        │ 6ef17028eb6f3d83cee141c4ecd9d30bfbf54460.txt │               new.txt               │
                                        │                    sec/op                    │   sec/op     vs base                │
ListUnifiedResourcesFilter/labels-12                                            210.3m ±  2%   186.1m ± 3%  -11.48% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_path-12                                    448.5m ± 12%   418.5m ± 3%   -6.68% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_index-12                                   478.1m ±  2%   422.8m ± 4%  -11.56% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_lower-12                                      271.6m ±  4%   295.1m ± 7%   +8.65% (p=0.001 n=10)
ListUnifiedResourcesFilter/search_upper-12                                      272.8m ±  4%   270.4m ± 4%        ~ (p=0.481 n=10)
geomean                                                                   319.7m         304.7m        -4.68%

                                        │ 6ef17028eb6f3d83cee141c4ecd9d30bfbf54460.txt │               new.txt                │
                                        │                     B/op                     │     B/op      vs base                │
ListUnifiedResourcesFilter/labels-12                                            74.03Mi ± 0%   25.95Mi ± 0%  -64.95% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_path-12                                    312.2Mi ± 0%   264.1Mi ± 0%  -15.40% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_index-12                                   312.2Mi ± 0%   264.1Mi ± 0%  -15.40% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_lower-12                                      73.88Mi ± 0%   73.94Mi ± 0%   +0.07% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_upper-12                                      74.85Mi ± 0%   74.84Mi ± 0%   -0.02% (p=0.015 n=10)
geomean                                                                   131.9Mi        100.0Mi       -24.15%

                                        │ 6ef17028eb6f3d83cee141c4ecd9d30bfbf54460.txt │               new.txt               │
                                        │                  allocs/op                   │  allocs/op   vs base                │
ListUnifiedResourcesFilter/labels-12                                            1211.8k ± 0%   911.7k ± 0%  -24.76% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_path-12                                     6.162M ± 0%   5.862M ± 0%   -4.87% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_index-12                                    6.012M ± 0%   5.712M ± 0%   -4.99% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_lower-12                                       1.962M ± 0%   1.962M ± 0%   +0.00% (p=0.010 n=10)
ListUnifiedResourcesFilter/search_upper-12                                       2.112M ± 0%   2.112M ± 0%        ~ (p=0.423 n=10)
geomean                                                                    2.844M        2.633M        -7.42%
```

* Avoid combining labels in parser

```bash

$ benchstat 8ddd25edecca2cb8cb16dc76e921b984defdefff.txt new.txt
goos: darwin
goarch: arm64
pkg: github.com/gravitational/teleport/lib/auth
                                        │ 8ddd25edecca2cb8cb16dc76e921b984defdefff.txt │               new.txt               │
                                        │                    sec/op                    │   sec/op     vs base                │
ListUnifiedResourcesFilter/labels-12                                             186.1m ± 3%   161.1m ± 4%  -13.45% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_path-12                                     418.5m ± 3%   383.6m ± 1%   -8.34% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_index-12                                    422.8m ± 4%   396.6m ± 1%   -6.21% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_lower-12                                       295.1m ± 7%   258.6m ± 2%  -12.35% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_upper-12                                       270.4m ± 4%   266.1m ± 8%        ~ (p=0.796 n=10)
geomean                                                                    304.7m        278.9m        -8.48%

                                        │ 8ddd25edecca2cb8cb16dc76e921b984defdefff.txt │               new.txt               │
                                        │                     B/op                     │     B/op      vs base               │
ListUnifiedResourcesFilter/labels-12                                            25.95Mi ± 0%   25.93Mi ± 0%  -0.06% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_path-12                                    264.1Mi ± 0%   264.1Mi ± 0%       ~ (p=0.393 n=10)
ListUnifiedResourcesFilter/predicate_index-12                                   264.1Mi ± 0%   264.1Mi ± 0%       ~ (p=0.971 n=10)
ListUnifiedResourcesFilter/search_lower-12                                      73.94Mi ± 0%   73.94Mi ± 0%       ~ (p=0.684 n=10)
ListUnifiedResourcesFilter/search_upper-12                                      74.84Mi ± 0%   74.84Mi ± 0%       ~ (p=0.971 n=10)
geomean                                                                   100.0Mi        100.0Mi       -0.01%

                                        │ 8ddd25edecca2cb8cb16dc76e921b984defdefff.txt │              new.txt               │
                                        │                  allocs/op                   │  allocs/op   vs base               │
ListUnifiedResourcesFilter/labels-12                                             911.7k ± 0%   911.7k ± 0%  -0.01% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_path-12                                     5.862M ± 0%   5.862M ± 0%       ~ (p=0.959 n=10)
ListUnifiedResourcesFilter/predicate_index-12                                    5.712M ± 0%   5.712M ± 0%  -0.00% (p=0.037 n=10)
ListUnifiedResourcesFilter/search_lower-12                                       1.962M ± 0%   1.962M ± 0%       ~ (p=0.085 n=10)
ListUnifiedResourcesFilter/search_upper-12                                       2.112M ± 0%   2.112M ± 0%       ~ (p=0.402 n=10)
geomean                                                                    2.633M        2.633M       -0.00%
```

* Reduce memory usage of MatchSearch

```bash

$ benchstat f8aa6f9a7a26d34796a0ecb9d3eadf245c3b478d.txt new.txt
goos: darwin
goarch: arm64
pkg: github.com/gravitational/teleport/lib/auth
                                        │ f8aa6f9a7a26d34796a0ecb9d3eadf245c3b478d.txt │              new.txt               │
                                        │                    sec/op                    │   sec/op     vs base               │
ListUnifiedResourcesFilter/labels-12                                             161.1m ± 4%   168.7m ± 5%  +4.73% (p=0.043 n=10)
ListUnifiedResourcesFilter/predicate_path-12                                     383.6m ± 1%   389.4m ± 1%  +1.50% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_index-12                                    396.6m ± 1%   397.7m ± 3%       ~ (p=0.190 n=10)
ListUnifiedResourcesFilter/search_lower-12                                       258.6m ± 2%   266.6m ± 3%  +3.07% (p=0.007 n=10)
ListUnifiedResourcesFilter/search_upper-12                                       266.1m ± 8%   259.2m ± 2%       ~ (p=0.052 n=10)
geomean                                                                    278.9m        282.7m       +1.36%

                                        │ f8aa6f9a7a26d34796a0ecb9d3eadf245c3b478d.txt │               new.txt                │
                                        │                     B/op                     │     B/op      vs base                │
ListUnifiedResourcesFilter/labels-12                                            25.93Mi ± 0%   25.94Mi ± 0%        ~ (p=0.089 n=10)
ListUnifiedResourcesFilter/predicate_path-12                                    264.1Mi ± 0%   264.1Mi ± 0%        ~ (p=0.853 n=10)
ListUnifiedResourcesFilter/predicate_index-12                                   264.1Mi ± 0%   264.1Mi ± 0%        ~ (p=0.927 n=10)
ListUnifiedResourcesFilter/search_lower-12                                      73.94Mi ± 0%   55.63Mi ± 0%  -24.77% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_upper-12                                      74.84Mi ± 0%   56.53Mi ± 0%  -24.46% (p=0.000 n=10)
geomean                                                                   100.0Mi        89.33Mi       -10.68%

                                        │ f8aa6f9a7a26d34796a0ecb9d3eadf245c3b478d.txt │               new.txt               │
                                        │                  allocs/op                   │  allocs/op   vs base                │
ListUnifiedResourcesFilter/labels-12                                             911.7k ± 0%   911.7k ± 0%        ~ (p=0.469 n=10)
ListUnifiedResourcesFilter/predicate_path-12                                     5.862M ± 0%   5.862M ± 0%   -0.00% (p=0.019 n=10)
ListUnifiedResourcesFilter/predicate_index-12                                    5.712M ± 0%   5.712M ± 0%        ~ (p=0.305 n=10)
ListUnifiedResourcesFilter/search_lower-12                                       1.962M ± 0%   1.662M ± 0%  -15.29% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_upper-12                                       2.112M ± 0%   1.812M ± 0%  -14.20% (p=0.000 n=10)
geomean                                                                    2.633M        2.470M        -6.18%
```

* Switch to using containsFold instead of ToLower and Contains

```bash

$ benchstat b4f5af277a8da79470673a9d4da95e1ae747deea.txt new.txt
goos: darwin
goarch: arm64
pkg: github.com/gravitational/teleport/lib/auth
                                        │ b4f5af277a8da79470673a9d4da95e1ae747deea.txt │               new.txt               │
                                        │                    sec/op                    │   sec/op     vs base                │
ListUnifiedResourcesFilter/labels-12                                             168.7m ± 5%   160.5m ± 2%   -4.84% (p=0.002 n=10)
ListUnifiedResourcesFilter/predicate_path-12                                     389.4m ± 1%   387.2m ± 2%        ~ (p=0.393 n=10)
ListUnifiedResourcesFilter/predicate_index-12                                    397.7m ± 3%   396.4m ± 1%        ~ (p=0.247 n=10)
ListUnifiedResourcesFilter/search_lower-12                                       266.6m ± 3%   214.8m ± 1%  -19.43% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_upper-12                                       259.2m ± 2%   231.0m ± 1%  -10.89% (p=0.000 n=10)
geomean                                                                    282.7m        261.5m        -7.50%

                                        │ b4f5af277a8da79470673a9d4da95e1ae747deea.txt │               new.txt               │
                                        │                     B/op                     │     B/op      vs base               │
ListUnifiedResourcesFilter/labels-12                                            25.94Mi ± 0%   25.93Mi ± 0%  -0.04% (p=0.004 n=10)
ListUnifiedResourcesFilter/predicate_path-12                                    264.1Mi ± 0%   264.1Mi ± 0%       ~ (p=0.481 n=10)
ListUnifiedResourcesFilter/predicate_index-12                                   264.1Mi ± 0%   264.1Mi ± 0%       ~ (p=0.684 n=10)
ListUnifiedResourcesFilter/search_lower-12                                      55.63Mi ± 0%   53.42Mi ± 0%  -3.97% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_upper-12                                      56.53Mi ± 0%   53.42Mi ± 0%  -5.50% (p=0.000 n=10)
geomean                                                                   89.33Mi        87.61Mi       -1.93%

                                        │ b4f5af277a8da79470673a9d4da95e1ae747deea.txt │               new.txt               │
                                        │                  allocs/op                   │  allocs/op   vs base                │
ListUnifiedResourcesFilter/labels-12                                             911.7k ± 0%   911.6k ± 0%   -0.00% (p=0.011 n=10)
ListUnifiedResourcesFilter/predicate_path-12                                     5.862M ± 0%   5.862M ± 0%        ~ (p=0.812 n=10)
ListUnifiedResourcesFilter/predicate_index-12                                    5.712M ± 0%   5.712M ± 0%        ~ (p=0.812 n=10)
ListUnifiedResourcesFilter/search_lower-12                                       1.662M ± 0%   1.212M ± 0%  -27.09% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_upper-12                                       1.812M ± 0%   1.212M ± 0%  -33.12% (p=0.000 n=10)
geomean                                                                    2.470M        2.139M       -13.38%
```

* Perform RBAC only on matches

```bash

$ benchstat 874a1dd0b8090dd0ae6f22754f0f989a57f08293.txt new.txt
goos: darwin
goarch: arm64
pkg: github.com/gravitational/teleport/lib/auth
                                        │ 874a1dd0b8090dd0ae6f22754f0f989a57f08293.txt │               new.txt               │
                                        │                    sec/op                    │   sec/op     vs base                │
ListUnifiedResourcesFilter/labels-12                                            160.52m ± 2%   79.33m ± 3%  -50.58% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_path-12                                     387.2m ± 2%   317.1m ± 8%  -18.10% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_index-12                                    396.4m ± 1%   337.6m ± 2%  -14.84% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_lower-12                                       214.8m ± 1%   154.4m ± 3%  -28.11% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_upper-12                                       231.0m ± 1%   171.9m ± 3%  -25.57% (p=0.000 n=10)
geomean                                                                    261.5m        186.5m       -28.69%

                                        │ 874a1dd0b8090dd0ae6f22754f0f989a57f08293.txt │               new.txt                │
                                        │                     B/op                     │     B/op      vs base                │
ListUnifiedResourcesFilter/labels-12                                          26551.2Ki ± 0%   732.7Ki ± 1%  -97.24% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_path-12                                    264.1Mi ± 0%   238.9Mi ± 0%   -9.54% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_index-12                                   264.1Mi ± 0%   238.9Mi ± 0%   -9.54% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_lower-12                                      53.42Mi ± 0%   28.22Mi ± 0%  -47.17% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_upper-12                                      53.42Mi ± 0%   28.23Mi ± 0%  -47.16% (p=0.000 n=10)
geomean                                                                   87.61Mi        31.80Mi       -63.70%

                                        │ 874a1dd0b8090dd0ae6f22754f0f989a57f08293.txt │               new.txt               │
                                        │                  allocs/op                   │  allocs/op   vs base                │
ListUnifiedResourcesFilter/labels-12                                            911.65k ± 0%   11.45k ± 0%  -98.74% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_path-12                                     5.862M ± 0%   4.962M ± 0%  -15.36% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_index-12                                    5.712M ± 0%   4.812M ± 0%  -15.76% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_lower-12                                      1211.8k ± 0%   311.7k ± 0%  -74.28% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_upper-12                                      1211.8k ± 0%   311.7k ± 0%  -74.28% (p=0.000 n=10)
geomean                                                                    2.139M        484.0k       -77.38%
```

* Reduce allocations in (ServerV2) MatchSearch

```bash

$benchstat 4782fe42f72a5ed7628bdb4a94f16d5cb06b35bb.txt  new.txt
goos: darwin
goarch: arm64
pkg: github.com/gravitational/teleport/lib/auth
                                        │ 4782fe42f72a5ed7628bdb4a94f16d5cb06b35bb.txt │              new.txt               │
                                        │                    sec/op                    │   sec/op     vs base               │
ListUnifiedResourcesFilter/labels-12                                             79.33m ± 3%   77.79m ± 4%  -1.94% (p=0.019 n=10)
ListUnifiedResourcesFilter/predicate_path-12                                     317.1m ± 8%   307.0m ± 2%  -3.18% (p=0.023 n=10)
ListUnifiedResourcesFilter/predicate_index-12                                    337.6m ± 2%   310.2m ± 1%  -8.12% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_lower-12                                       154.4m ± 3%   139.5m ± 2%  -9.65% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_upper-12                                       171.9m ± 3%   154.9m ± 4%  -9.94% (p=0.000 n=10)
geomean                                                                    186.5m        174.1m       -6.63%

                                        │ 4782fe42f72a5ed7628bdb4a94f16d5cb06b35bb.txt │               new.txt                │
                                        │                     B/op                     │     B/op      vs base                │
ListUnifiedResourcesFilter/labels-12                                            732.7Ki ± 1%   731.0Ki ± 0%        ~ (p=0.481 n=10)
ListUnifiedResourcesFilter/predicate_path-12                                    238.9Mi ± 0%   238.9Mi ± 0%        ~ (p=0.123 n=10)
ListUnifiedResourcesFilter/predicate_index-12                                   238.9Mi ± 0%   238.9Mi ± 0%   -0.01% (p=0.001 n=10)
ListUnifiedResourcesFilter/search_lower-12                                      28.22Mi ± 0%   16.76Mi ± 0%  -40.60% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_upper-12                                      28.23Mi ± 0%   16.77Mi ± 0%  -40.58% (p=0.000 n=10)
geomean                                                                   31.80Mi        25.81Mi       -18.84%

                                        │ 4782fe42f72a5ed7628bdb4a94f16d5cb06b35bb.txt │               new.txt               │
                                        │                  allocs/op                   │  allocs/op   vs base                │
ListUnifiedResourcesFilter/labels-12                                             11.45k ± 0%   11.44k ± 0%        ~ (p=0.077 n=10)
ListUnifiedResourcesFilter/predicate_path-12                                     4.962M ± 0%   4.962M ± 0%        ~ (p=0.060 n=10)
ListUnifiedResourcesFilter/predicate_index-12                                    4.812M ± 0%   4.812M ± 0%   -0.00% (p=0.015 n=10)
ListUnifiedResourcesFilter/search_lower-12                                       311.7k ± 0%   161.6k ± 0%  -48.15% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_upper-12                                       311.7k ± 0%   161.6k ± 0%  -48.14% (p=0.000 n=10)
geomean                                                                    484.0k        372.1k       -23.11%
```

* Remove allocations from MatchLabels

* fix: TestServerLabels

* Add comment to containsFold

Co-authored-by: Forrest <30576607+fspmarshall@users.noreply.github.com>

* fix: log and skip match failures

* fix: only create closure if required

* fix: func (a *AppServerOrSAMLIdPServiceProviderV1) GetLabel

* fix: validate provided predicate expressions

---------

Co-authored-by: Forrest <30576607+fspmarshall@users.noreply.github.com>
 2024-03-25 17:38:49 +00:00
rosstimothy 10da1b3b9e Display available allowed logins for leaf resources in root web ui (#39579) 
The Proxy web api now requests that Auth include allowed logins
per resource instead of guessing logins per resource based on the
information it has cached. However, due to the way SSH sessions
are authorized, the logins are not provide to users verbatim.

Any sessions created via the root web ui to a leaf resource will use
the SSH certificate created for that user in the root cluster. New
certificates are not minted per leaf cluster. This is important
because the nodes only allow os logins for a session if they are
present in the valid prinicpals of the SSH certificate. So even
though we are now capabale of displaying all allowed logins for
leaf SSH servers in the root web ui, the user is only able to use
a subset of them. To avoid any odd UX, the Proxy will filter out
any allowed logins which do not exist in the principals of the
root SSH certificate.

The above only holds for SSH, windows desktops are not as strict
and any allowed login from a leaf cluster is now visible in the
root web ui.

Fixes https://github.com/gravitational/teleport/issues/5041
 2024-03-25 16:34:51 +00:00
Krzysztof Skrzętnicki febeb8b323 Fix incorrect expiry when using resource153ToLegacyAdapter (#39761) 2024-03-25 14:17:04 +00:00
Tiago Silva 86ec74b795 Introduce patch_type to KubernetesWaitingContainer (#39738) 
This PR adds the `patch_type` to `KubernetesWaitingContainer` objects.
This patch type is used to decode the contents correctly depending on
different patch strategies allowed by Kubernetes clients.

Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
 2024-03-22 19:35:46 +00:00