* Mentioned in the documentation that we ignore "kube-system" and "kube-public" namespaces for kube app discovery.
* Use admonition
Co-authored-by: Hugo Shaka <hugo.hervieux@goteleport.com>
* Rerender kube agent docs
---------
Co-authored-by: Hugo Shaka <hugo.hervieux@goteleport.com>
* reserve 40, 41 tag numbers for RoleConditions
* remove GetSAMLIdPServiceProviderLabels and SetSAMLIdPServiceProviderLabels
* remove SAMLIdPServiceProviderLabels from label matchers and rolev6 test
* run make -C integrations/operator manifests
* document creating SSH servers via IAC
* add links and index page
* Apply suggestions from code review
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* address feedback + fix Var XML tags
* test tctl flow and fill tctl command outputs
* fix kubernetes and terraform documentation
* make docs linter happy
---------
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* update ami list in aws ha terraform makefile
* include fips instrs
Co-authored-by: Reed Loden <reed@goteleport.com>
---------
Co-authored-by: Reed Loden <reed@goteleport.com>
It was discovered that some customers' EKS clusters did not have their IMDSv2 hop limits
set correctly, causing requests for key functionality to attempt IMDSv1 fallback and failing.
For now, re-enable IMDSv1 fallback by way of removing the explicit disabling of
`EC2MetadataEnableFallback` until better documentation, error handling, and other work
can be done to inform customers that they need to correctly set their IMDSv2 hop limits.
* SAMLIdPServiceProviderLabels and SAMLIdPServiceProviderLabelsExpression proto def
* GetSAMLIdPServiceProviderLabels and SetSAMLIdPServiceProviderLabels funcs
* add KindSAMLIdPServiceProvider to labellabel and Set/GetLabelMatchers
* add to SAMLIdPServiceProviderLabels CheckAndSetDefaults, tests
* remove default SAMLIdPServiceProviderLabels wildcard value. Merge checkAndSetDefault test
* run make -C integrations/operator manifests
* rerun make -C integrations/operator manifests
* update e-ref to current master
* Update google.golang.org/protobuf to v1.33.0
This updates all instances of google.golang.org/protobuf to address CVE-2024-24786.
* Make grpc after update
* Add a Discovery Service section
Closes#38741
Add a dedicated sidebar section for the Teleport Discovery Service.
Since the Discovery Service is a separate agent service from the SSH
Service, Kubernetes Service, etc., it makes sense to add a dedicated
section for this service. In the future, we can include configuration
guides, architecture guides, etc. in this section.
To create the new section, this change moves existing auto-discovery
guides from other sections of the docs.
* Respond to hugoShaka feedback
- Move the Kubernetes application discovery docs
- Edit the "Kubernetes Access" intro to include a link to Kubernetes
auto-discovery
Updates the api module used in examples to a more recent commit
to pull in a newer version of otel to resolve build problems.
```
cannot use &TracerProvider{} (value of type *TracerProvider) as "go.opentelemetry.io/otel/trace".TracerProvider value in variable declaration: *TracerProvider does not implement "go.opentelemetry.io/otel/trace".TracerProvider (missing method tracerProvider)
cannot use t (variable of type *tracer) as "go.opentelemetry.io/otel/trace".Tracer value in return statement: *tracer does not implement "go.opentelemetry.io/otel/trace".Tracer (missing method tracer)
```
* integrations/operator: Add openSSH and openSSHEICE servers
* lint
* Update integrations/operator/controllers/resources/openssheiceserverv2_controller.go
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
* rename Openssh to OpenSSH and fix comments
* hide cmdlabels
---------
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
See #36816
The docs are inconsistent in using "automatic updates" vs. "automatic
upgrades". Prefer the former to be consistent with the
`teleport-ent-updater` script.
- Replace "automatic upgrade" with "automatic update" in docs pages.
- Replace "automatic upgrade" uses in the `teleport-kube-agent` chart
and regenerate the docs.
- Catch uses of "automatic upgrade" in the `consistent-terms` Vale rule
* Workload ID RBAC changes
* Update api/proto/teleport/legacy/types/types.proto
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
* Validate IPSANs CIDRs are good
* Improve regex matching for SPIFFE conditions
* Remove unused globMatch function
* Prefer using utils.MatchString
* make grpc
* Update the charts
---------
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
* clean up pidfile and reloads
* reduce log spam during graceful shutdowns
* hold an exclusive advisory lock on the pidfile
* do systemd reloads with the pidfile rather than $MAINPID
* prioritize signals over internal restarts
* Add DatabasePermissions field to role.
* Change error wording in a minor way
* Update api/types/role.go
Co-authored-by: STeve (Xin) Huang <xin.huang@goteleport.com>
* Update api/proto/teleport/legacy/types/types.proto
Co-authored-by: STeve (Xin) Huang <xin.huang@goteleport.com>
* Update autogenerated files
* Guard against wildcards in `spec.allow.db_permissions`
---------
Co-authored-by: STeve (Xin) Huang <xin.huang@goteleport.com>
Adds the new linter and configures it to prevent direct error
comparisions and type assertions in favor of errors.Is and errors.As.
All current violations caught by the linter have been updated
accordingly.
