* docs: explain awsic plugin install flag
* expand the use system credential sentence
* Update docs/pages/admin-guides/management/guides/aws-iam-identity-center/migrating-identity-center-from-okta-to-teleport.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Add cdocumentation for `workload-identity-aws-ra` service
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Adjust name to be full roles anywhere
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update protobuf
* Implement and test ValidateTokenWithJWKS
* Update join logic to use new method for static jwks
* Update Terraform Provider
* Update operator docs/files
* Update goldenfile
Include inlining the partial:
docs/pages/includes/machine-id/recover-circle-ci-claims.mdx
This is because it's only used by two pages and, as a partial, violates
the rule in which each Var with a given name must be used multiple
times on a single page. Since this Vale rule uses the `raw` scope, it is
not possible to ignore it with an MDX comment.
DocCardList is a Docusaurus-native component that achieves the same
goal as our custom `remark-toc` plugin, but with Docusaurus APIs instead
of file system lookups. Replace `(!toc!)` mentions so we can remove
`remark-toc`.
This adds a new field, UseAnyProxyPublicAddr, that will be used to
tell the web api/ui to rebuild the request app's FQDN based on the proxy
public addr that the request came from (upcoming PR to consume this)
This commit adds two new singular resources to the Terraform provider:
teleport_version and telpeort-config.
Both got added using the resource 153 pattern (new protoc-X.yaml file)
and it went pretty seamless.
The only specific is that I had to add a provider feature to
automatically set singular resource names as we don't run
CheckAndSetDefaults() locally anymore. This got merged in a separate PR.
See gravitational/docs-website#91
Docusaurus uses semantic HTML tags instead of a custom Details
component. Replace instances of our Details component with the
`<details>` and `<summary>` tags so we do not need to perform a
conversion when building the docs website.
See gravitational/docs-website#95
The docs engine currently unwraps them, meaning that they are no-op
components. Remove these so we can delete the Figure-unwrapping code.
* Document the Podman and Docker workload attestors
* Use more direct language and fix typo
* Add "rootlessly" and "rootfully" to recognized words
* Use proper `code` blocks and improved grammar
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Use real tbot image name
* Linter doesn't like angle brackets
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Machine ID: Document `kubernetes/v2` service
This adds initial documentation for the new `kubernetes/v2` service.
This only includes reference documentation for now, since this
service was added partway through v17; the existing Kubernetes guide
will be updated in a separate PR for v18 and won't be backported to
v17.
Partially fixes#52412
* Review feedback, and add an FAQ entry about the new service
* Add more detailed version note
* Fix broken link
We are deprecating the Notice component since it is not supported
natively in Docusaurus and the Docusaurus-native Admonition component
serves the same purpose.
Use Docusaurus syntax for admonitions so the docs engine does not need
to replace these. This is one step toward removing the
`remark-update-tags` plugin. See: gravitational/docs-website#94
Relevant commands are included below to make reproducing this work
easier.
1. Replace all `Notice` tags with `Admonition` tags.
2. Add `type="info"` if an Admonition is missing a type.
To find instances:
```
find docs/pages -name "*.mdx" -exec awk '
BEGIN{a=0}
a==0 && /<Admonition/{ a = 1 }
a==1 && /type/{t = 1}
a==1 && />/{ a = 0; if(t == 0) print FILENAME ":" FNR }' {} \;
```
3. Replace `type="notice"` with `type="note"`.
To find instances:
```
find docs/pages -name "*.mdx" -exec awk '
BEGIN{a=0}
a==0 && /<Admonition/{ a = 1 }
a==1 && /type="notice"/{t = 1}
a==1 && />/{ a = 0; if(t == 1) print FILENAME ":" FNR }' {} \;
```
* Support automatic_approval in AMR spec
* Support filter by automatic_approval_name
* Update AMR validation
* Update terraform schema
* Fix import
* Add additional test case
* Improve amr spec godocs
* make -C integrations/terraform docs
- Fix "Auth Service" variations.
- Fix some AWS product naming violations.
- Ignore some false positives.
- Fix capitalization warnings.
- Address warnings re: outdated product names.
Some of the warning categories above include auto-generated pages. This
change does not touch the generators in order to simplify things.
* Add new `expression` package in workload identity service
* Add traits to the `Attrs` proto message
* Add support for user traits to the `expression` package
* Use `expression` package to template Workload Identities
* Add support for expressions to Workload Identity rules
* Update terraform docs
* Error instead of returning zero value for unset fields
* Fix linting failures
* Codify edge cases
* Move `CertificateTTL` and `RenewalInterval` into a `CertificateLifetime` struct
These values are always required together, and moving them into a struct will
make it more straightforward to override them per-service/output.
* Support custom `certificate_ttl` and `renewal_interval` on identity output
* Support custom `certificate_ttl` and `renewal_interval` on application output
* Support custom `certificate_ttl` and `renewal_interval` on application tunnel
* Support custom `certificate_ttl` and `renewal_interval` on Kubernetes output
* Support custom `certificate_ttl` and `renewal_interval` on Kubernetes V2 output
* Support custom `certificate_ttl` and `renewal_interval` on database tunnel
* Support custom `certificate_ttl` and `renewal_interval` on SSH host output
* Support custom `certificate_ttl` and `renewal_interval` on SSH multiplexer
* Support custom `certificate_ttl` and `renewal_interval` on SPIFFE SVID output
* Support custom `certificate_ttl` and `renewal_interval` on database output
* Support custom `certificate_ttl` and `renewal_interval` on workload API
* Support custom `certificate_ttl` and `renewal_interval` on workload identity output
* Add `GetCertificateLifetime` to service config interface
* Update the docs
* Add more examples to the standard config
* Rename `CertificateLifetime` to `CredentialLifetime`
So it can be used for non-certificate credentials like JWTs
* Deprecate `certificate_ttl` option and replace it with `credential_ttl`
* Return TTL warnings as errors and let the caller decide what to do with them
* Add `CredentialLifetime` to the "full" service config tests
* Support `credential_ttl` and `renewal_interval` in workload-identity-jwt service
* Silence sloglint
* Replace duplicated helper with `cmp.Or`
Dan Upton