Adds an additional type constraint go FnCacheGet and FnCacheGetWithTTL
to enforce that all keys are comparable. This should allow the
removal of various compile time hashability checks that are in
place for existing keys of custom types.
* Support automatic_approval in AMR spec
* Support filter by automatic_approval_name
* Update AMR validation
* Update terraform schema
* Fix import
* Add additional test case
* Improve amr spec godocs
* make -C integrations/terraform docs
Eliminates the namespace CRUD API as part of
https://github.com/gravitational/teleport/issues/49509.
The most notable change introduce here is with flushCache in the
auth helpers. It was ironically using namespaces because they
were deprecated, however, it has since been updated to use a role
instead. The helpers.go file was also updated not to rely on testify
in attempt to prevent it from being included in production builds.
Updates https://github.com/gravitational/teleport/issues/6394.
* GitHub proxy part 6: proxing Git using SSH transport
* better command parsing and update suite
* refactor
* revert unnecearrty files
* address review comments
* ut fix
* revert localsite_test.go
* change special suffix to teleport-github-org for routing
* fix routing ut
* minor typo edit
* fix ut after sshca change
* add UT to sshutils
* minor review comments
* fix api ut because of special suffix change
* GitServerReadOnlyClient
* downgrade error to warning
* run go mod tidy. not sure why it's needed
* rename mock.go to mock_test.go
* Use math/rand/v2's thread-local RNG for jitters
* Replace NewJitter() with DefaultJitter
* Replace NewFullJitter() with FullJitter
* Replace NewHalfJitter() with HalfJitter
* Replace NewSeventhJitter() with SeventhJitter
* Inline jitters in lib/utils/diagnostics/latency
* Replace var jitters in lib/utils with proxy functions
* Replace utils.HalfJitter with retryutils.HalfJitter
* Replace utils.FullJitter with retryutils.FullJitter
* Replace utils.SeventhJitter with retryutils.SeventhJitter
* Replace sharded jitters with thread-local ones
* Remove NewSeventhJitter reference in integrations
- Recursively check for accesslist membership
- Allow adding/removing/listing included access lists in acl commands
- Add a recursive test
- Use dynamic access lists structure from RFD
- Resolve proto changes
- Exclude 'list' members from Access List memberCount
- Calc Access List member count with members of type 'list' excluded,
return seperately to front end
- Update examples/integrations
- Update crd docs
- Update tf docs
- Perform calculation of inherited roles/traits to AccessList service in
order to utilize cache and minimize number of requests.
- Grant Okta integration RO for Access Lists
- Update AccessListMember-* events
- Include count for inherited grants
- Include MembershipKind of affected member(s)
- Emit inherited grants / members' MembershipKind for AccessListMember-*
events
- Update notified owners for Access Requests
- Ensure dynamic owners are notified for Access Requests
- Ensure dynamic owners are notified via Slack integration
- Optionally pass an AbortSignal to `fetchAccessLists` in Web UI
- Replace usages of `services.IsAccessListOwner/IsAccessListMember` with
equivelant funcs from `Hierarchy`
- Remove final references to AccessListMembershipChecker
- Don't allow ACL deletion when member/owner in other lists
- Guard Access List deletion behind membership/ownership checks for List
- Expose Hierarchy func to recursively get all members
- Tidy UserLoginStateGenerator logic involving ACL Membership/Ownership
Co-authored-by: Maxim Dietz <maxim.dietz@goteleport.com>
* proto
* Fix update for DynamicWindowsDesktops
* fix test server
* fix test
* fix test
* fix test
* Update api/proto/teleport/dynamicwindows/v1/dynamicwindows_service.proto
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* update proto
* fix tests
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Adds caching support for Identity Center resources
Adds support for caching (and watching) some IdentityCenter resource types.
Specifically:
- identitycenterv1.Account
- identitycenterv1.AccountAsssignment
- identitycenterv1.PrincipalAssignment
Also breaks the cache's `genericcollection` out into its own file as an attempt
to reduce clutter in the main collections source file.
* Update identitycenter_events.go
* Update identitycenter_events.go
* Speed up tests
* Update client autoupdate proto structure
* Replace with reserved
* Fix unit tests
* Add more info in proto
* Rename proto to be aligned RFD namings
* Replace enum type for ToolsMode to string
* SCIM state record storage service
* Address review feedback
* Add page size option to listings
* reduce boilerplate
* It's not a misspelling, it's a perfectly valid regional variant.
* Address review feedback
This PR adds a new method that allows users to list UserTasks by
Integration.
Given this is our main use case when showing the UserTasks in the UI
(we'll be always showing UserTasks for a given integration), we created
a dedicated method in the gRPC.
We'll probably add more filters but they will always include the
integration (at least for the uses cases we have currently).
* User Tasks: add `discover-ec2` task type
This PR adds more business logic into the User Tasks, in particular into
the `discover-ec2` task type.
One of the key features of the DiscoverEC2 User Tasks is that we must
have a single task per:
- integration
- region
- account id
- issue type
This allows user to have a detailed view of the issues their are facing
but still grouping EC2 instances.
To do this, we had to move the region and account id up one level.
Previously they were at the instance level, and it would require
iterating over them to actually create the group (uniq key) we want.
This also adds well known errors as issue types to ensure we validate
them.
A later PR will come where we actually start creating/updating
DiscoverEC2 User Tasks from the DiscoveryService.
* use strings.Compare
* improve docs and fix typos
This PR adds the implementation for the User Tasks:
- services (backend+cache)
- clients (API + tctl)
- light validation to set up the path for later PRs
* Add AutoUpdate Client/Cache implementation
* CR changes
* Add permission for proxy to access resources
* Rename all occurrences auto update to camelcase
* Remove auto update client wrapper
* Drop AutoUpdateServiceClient helper
Rename comments for consistency
Refactoring in preparation for creating a concrete backend.Key
type instead of using []byte for keys. The backend.Key function
still exists and was not deprecated because it is still consumed
in e. It will be removed when the e ref is updated after e uses
backend.NewKey.
* Start adding `lib/services` content for SPIFFEFederation type
* Add SPIFFEFederation resource to cache
* Wire SPIFFEFederation into cache
* Fix NewTestAuthServer
* Start writing tests
* Add more test cases to validation
* Add tests to cache for SPIFFEFederation
* More test coverage
* Add test for DeleteSPIFFEFederations
* Finish off tests for SPIFFEFederation resource
* go mod tidy
* Go mod tidy
* Appease linter
* Avoid forcing kind/version in MarshalSPIFFEFederation
* more linter appeasal
This groups the trusted cluster and cert authority storage into
the same service. While on its own this doesn't change much, it
unlocks the ability to fix racy behavior described in
https://github.com/gravitational/teleport/issues/36400.
* Add initial condition parser for access monitoring rules
* Update integrations/access/accessrequest/app.go
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Check previously unchecked error and minor refactor of AMR
* Simplify check for applicable access monitoring rules
* Refactor access monitoring rules plugin integration
* Fix formating and move lock aquisition
* Add methods for listing access monitoring rules with a filter
* Add contains_any predicate expression func
* Add in is_empty func to predicate expression
* Lock AMR cache in plugins while getting initial rules
* Add in check for access monitoring rule version
* Update integrations/access/accessrequest/app.go
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Update integrations/access/accessrequest/app.go
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Move lock so it doesnt persist over api calls
* Remove unused constant and add more context to logs
* Appease linter
* Update access monitoring rules tests to pass rule validation
* Add in missing access monitoring rules list with filter code
* Appease linter
* Add back validation code for AMRs
* Fix test plugin role and rename listaccessmonitoringrulewithfilter
* Fix local test for AMR crud operations
* Fix end range for listing rules
* Fix unwrapping of resource153 event for monitoring rules
* Refactor AMR cache init into helper function in plugin app
* Add seperate response type for listAccessMonitoringRulesWithfilter
* Add context to log for plugins failing to fetch recipients
* Grab access monitoring rules cache under lock all at once
* Add clarification for which fields are optional in listAMRfilter req
* Update integrations/access/accessrequest/app.go
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Update integrations/access/accessrequest/app.go
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Add forEach to common recipient set
* Move type check to after AMR event op switch
* Move turn some default parser spec methods to funcs
* Make some predicate func usable as methods as well
* Add len func to common recipient sets
* Add integration test for access monitoring rule and slack plugin
* Fix error types and messages when handling AMRs
* Use generic list resource with filter for AMR
* Add test for generic listResourceWithFilter
* Update listResourceWithFilter to use revision instead of id
* Update generic tests to use revision instead of id
* Fix linting
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
rosstimothy