When assigning AWS IAM permissions to Teleport, `eksctl create iamserviceaccount` command manages the ServiceAccount lifecycle.
This PR allows any user to configure an existing Kubernetes ServiceAccount used by the agent.
Part of #11866
Fixes#13129
This PR sets minReadySeconds to 15 by default. During a rollout we still have proxies that don't have tunnels to all agents, but at least agents don't end up with 0 active tunnels.
Replace role/authPref RequireSessionMFA (bool) with RequireMFAType
(string).
- Add new RequireMFAType constant values with custom boolean marshalling.
- Add RequireMFAType to role and auth preference and deprecate
RequireSessionMFA.
- Add session-mfa override login when hardware_key_touch is enforced.
- Add protobuf enum for RequireMFAType.
- Add support for proto enums in protoc-gen-crd and update Kubernetes
Operator manifests.
Provides a solution for #9298
This removes an unnecessary limitation of the Helm chart: `.Values.tls.existingCASecretName` can now be used without `.Values.tls.existingSecretName`. This allows users to trust their own CAs without building custom images.
Context:
- go's x509 library supports loading system certs based on the SSL_CERTS_FILE environment variable
- we are already using this in the chart to trust private CAs (teleport proxy needs to trust its own certs to start)
- users might want to trust custom CAs to
- speak with a S3 backend (minio)
- validate upstream app certs (unlike DB access you can't trust certs per-application)
- trust another cluster
- call an OIDC provider
- teleport-kube-agent chart already has the feature
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Fixes#14576
- Add updated instructions, as the behavior and configuration settings
for the PagerDuty plugin have changed since we first added this guide.
- Ensure the guide can be followed as a set of step-by-step
instructions. For example, this change tells the user to create two
PagerDuty services and refers to these services throughout the page.
- Also edits example configs for the PagerDuty and Mattermost plugins.
* Add documentation for Jira Helm chart
It includes an updated guide and the reference of the new Helm chart.
* Fixed some minor mistakes in the guides
* Reorganized Helm related examples
* Fixed a few minor mistakes
* Alphabetized jira.* settings
* Renamed Cloud to Executable in Testing
* Extended YAML config example with explanation
* Edit Jira Access Request plugin Helm chart docs
- Edit the configuration instructions so we don't instruct Helm users to
use the `configure` subcommand. Also use the `Tabs` component's
dropdown functionality so we can include both self-hosted and Teleport
Cloud instructions for Helm and VM users.
- Minor style tweaks.
* Add Helm Chart example to Installation section
* Removed confusing (and broken) link
git push
* Fixed wrong default value
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Kubernetes v1.24 enabled, by default, the LegacyServiceAccountTokenNoAutoGeneration feature.
This feature prevents Secrets containing service account tokens from being automatically created for every ServiceAccount.
Instead, when enabled, it requires a manual action for creating the Secret bound to the SA.
Fixes#15611
Fixes#4218
This commit:
- Bumps the grafana version
- Fixes the packer script failing when `DEBUG` is unset
- Makes nginx propagate the Host header required since
https://grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes/
- Makes nginx proxy websocket calls properly (since grafana 8)
- Retab nginx conf files that were a mix of tabs and spaces
- Makes Terraform compute s3 files md5 to detect and apply changes
* Stop validating schema for labels (#15204)
* operator: support receiving invalid TeleportRole CRs
This PR makes the controller-runtime manager decode TeleportRole
resource in an unstructured object. This avoid errors during decoding.
The resource is later decoded as a TeleportRole, with proper error
handling.
Fixes#12974
This commit introduces a new `authentication` value controlling:
- the authentication type (previously `authenticationType`)
- the second-factor (previously under `authenticationSecondFactor`)
- if local auth is enabled (new feature)
- the connector name (new feature)
- the locking mode (new feature)
If previous values `authenticationType` and `authenticationSecondFactor`
are specified we'll prefer them for backward compatibility.
This MR introduces Kubernetes Secret storage for Teleport Kubernetes Agent state.
When running Teleport Agent inside a Kubernetes cluster where TELEPORT_REPLICA_NAME and KUBE_NAMESPACE exist, the agent will store identities and states in a Kubernetes Secret instead of local storage.
Otherwise, if the above environment variables are not present or not in Kubernetes, the agent persists state in SQLite.
Notes:
Fresh installs will enable the Kubernetes Secret Storage by default.
If PV storage is configured, the agent will store its identity in a Secret and use the PV for non-identity objects.
If the operator is upgrading from an existing release that didn't support Secret storage, the Helm chart will convert the objects to enable Kube Secret Storage. If the current object is a Deployment, the Helm chart installs a new Statefulset side by side and will trigger a Helm hook that is responsible for deleting the Deployment once Statefulset pods are healthy. Otherwise, if upgrading from a Statefulset the agent will read the credentials stored in PV and move them into Kube Secret.
Implementation of #12958
Related to #5585
This commit adds the Teleport operator. The operator reconciles
TeleportUsers and TeleportRoles Kubernetes resources with Users and
Roles Teleport resources.
Steven Martin