When assigning AWS IAM permissions to Teleport, `eksctl create iamserviceaccount` command manages the ServiceAccount lifecycle.
This PR allows any user to configure an existing Kubernetes ServiceAccount used by the agent.
Part of #11866
Fixes#13129
This PR sets minReadySeconds to 15 by default. During a rollout we still have proxies that don't have tunnels to all agents, but at least agents don't end up with 0 active tunnels.
Replace role/authPref RequireSessionMFA (bool) with RequireMFAType
(string).
- Add new RequireMFAType constant values with custom boolean marshalling.
- Add RequireMFAType to role and auth preference and deprecate
RequireSessionMFA.
- Add session-mfa override login when hardware_key_touch is enforced.
- Add protobuf enum for RequireMFAType.
- Add support for proto enums in protoc-gen-crd and update Kubernetes
Operator manifests.
Provides a solution for #9298
This removes an unnecessary limitation of the Helm chart: `.Values.tls.existingCASecretName` can now be used without `.Values.tls.existingSecretName`. This allows users to trust their own CAs without building custom images.
Context:
- go's x509 library supports loading system certs based on the SSL_CERTS_FILE environment variable
- we are already using this in the chart to trust private CAs (teleport proxy needs to trust its own certs to start)
- users might want to trust custom CAs to
- speak with a S3 backend (minio)
- validate upstream app certs (unlike DB access you can't trust certs per-application)
- trust another cluster
- call an OIDC provider
- teleport-kube-agent chart already has the feature
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Stop validating schema for labels (#15204)
* operator: support receiving invalid TeleportRole CRs
This PR makes the controller-runtime manager decode TeleportRole
resource in an unstructured object. This avoid errors during decoding.
The resource is later decoded as a TeleportRole, with proper error
handling.
Fixes#12974
This commit introduces a new `authentication` value controlling:
- the authentication type (previously `authenticationType`)
- the second-factor (previously under `authenticationSecondFactor`)
- if local auth is enabled (new feature)
- the connector name (new feature)
- the locking mode (new feature)
If previous values `authenticationType` and `authenticationSecondFactor`
are specified we'll prefer them for backward compatibility.
This MR introduces Kubernetes Secret storage for Teleport Kubernetes Agent state.
When running Teleport Agent inside a Kubernetes cluster where TELEPORT_REPLICA_NAME and KUBE_NAMESPACE exist, the agent will store identities and states in a Kubernetes Secret instead of local storage.
Otherwise, if the above environment variables are not present or not in Kubernetes, the agent persists state in SQLite.
Notes:
Fresh installs will enable the Kubernetes Secret Storage by default.
If PV storage is configured, the agent will store its identity in a Secret and use the PV for non-identity objects.
If the operator is upgrading from an existing release that didn't support Secret storage, the Helm chart will convert the objects to enable Kube Secret Storage. If the current object is a Deployment, the Helm chart installs a new Statefulset side by side and will trigger a Helm hook that is responsible for deleting the Deployment once Statefulset pods are healthy. Otherwise, if upgrading from a Statefulset the agent will read the credentials stored in PV and move them into Kube Secret.
Implementation of #12958
Related to #5585
This commit adds the Teleport operator. The operator reconciles
TeleportUsers and TeleportRoles Kubernetes resources with Users and
Roles Teleport resources.
The PodSecurityPolicy specifies `MustRunAsNonRoot` but the image runs as root.
`Error: container has runAsNonRoot and image will run as root (pod: "<redacted>", container: teleport).`
We expose the securityContext to allow forcing to run as a non-root user such as 99 (nobody) and respect the psp.
Co-authored-by: daquinoaldo <aldd@bendingspoons.com>
* feat(helm): add priorityClassName and extraLabels to kube-agent
Signed-off-by: Roman Tkachenko <roman@goteleport.com>
Co-authored-by: daquinoaldo <aldd@bendingspoons.com>
* examples/chart/teleport-cluster/templates/deployment.yaml: set strategy to 'Recreate' if chartMode is 'standalone' (fixes#11484)
Signed-off-by: Johannes Kastl <kastl@b1-systems.de>
* examples/chart/teleport-cluster/tests/deployment_test.yaml: add test for strategy in standalone mode
Signed-off-by: Johannes Kastl <kastl@b1-systems.de>
* update examples/chart/teleport-cluster/tests/__snapshot__/deployment_test.yaml.snap after running local tests
Co-authored-by: Johannes Kastl <kastl@b1-systems.de>
* Allow for probe timeouts to be configurable
When setting up a new Teleport enterprise cluster on GCP,
I noticed that I needed to set the probe timeouts to get the
cluster to be healthy. This seems to be a known issue (https://github.com/kubernetes/kubernetes/issues/89898).
As a "stopgap", I've updated the helm chart to allow for end users
to be able to configure these timeouts.
* Update configuration option name and add documentation
* Update docs/pages/kubernetes-access/helm/reference.mdx
Co-authored-by: Gus Luxton <gus@goteleport.com>
* Add tests for probeTimeoutSeconds
* Add probeTimeoutSeconds to required values
* Add probeTimeoutSeconds to teleport-kube-agent
* Add tests for probeTimeoutSeconds to teleport-kube-agent
* Add probeTimeoutSeconds to teleport-kube-agent reference
Co-authored-by: Hunter Madison <hunter.madison@instana.com>
Co-authored-by: Hunter Madison <hmadison@users.noreply.github.com>
* helm: Update NOTES.txt for AWS ACM
* Add support for separate Postgres/MongoDB listeners in teleport-cluster chart
* Special case backend listener protocol based on presence of ACM annotation
* Add tests for separate listeners
* Add tests for ACM annotation setting backend protocol
* Don't add AWS annotations when not in AWS mode
* Adds for separatePostgresListener/separateMongoListener
Also adds missing example for setitng proxyListenerMode
* Add continuous backups permission to DynamoDB policy
Fixes#11411
https://github.com/gravitational/teleport/pull/10817 states in the docs that the default for `authenticationSecondFactor.secondfactor` is `otp`, but it didn't actually update the values.yaml file to make this change the default. This PR addresses that mistake and brings the chart in-line with the docs.
* POC for Helm unit tests
This uses https://github.com/vbehar/helm3-unittest to define
expectations of our helm templates
* Test that enterprise is configured correctly
* Added tests for teleport-cluster
* Added tests for teleport-kube-agent
* Removed tests for teleport chart
* Add tests for teleport-cluster Deployment
* Run shorter tests first
* Fix Docker plugin installation and add update-helm-snapshots target
* Add README
* Fix lint syntax error and add some missing linters
* Add missing ImagePullPolicy to Deployment and StatefulSet
* Add Deployment tests for teleport-kube-agent
* Fix replicaCount logic
* Add clarification to values
* Add StatefulSet suite for teleport-kube-agent
* Update snapshots after merge with master
* Helm tests are quicker than bash tests
* Add tests for extraEnv
* Random space
* Tidy up formatting of multiple tests
* [debug] List helm plugins and directories
* Special case Helm linting when running in CI
* Make trailing line breaks consistent
* Special case Helm linting when running in CI
* Add contribution guidelines for Helm charts
* Add contribution guidelines to READMEs
* Deprecate old charts
* Typo
* Spacing
* Clarification
* Update examples/chart/CONTRIBUTING.md
* Don't erroneously set extraEnv for initContainers
* Rename update-helm-snapshots -> test-helm-update-snapshots for clarity
Co-authored-by: Gus Luxton <gus@goteleport.com>
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* helm: Adds extraArgs and extraEnv to teleport-kube-agent
These were present in teleport-cluster but not teleport-kube-agent. This PR fixes that.
* Line breaks
* Also add to StatefulSet
Tiago Silva