* Restore field order in UpdateIntegrationRequest proto
Restore field order after https://github.com/gravitational/teleport/pull/51637. It turned out those
fields got to v17.
* Add temporary protobuf liter exception
Converts web file transfers to use the same in process dialing that
web sessions use. This eliminates extra latency by avoiding an SSH
dial from the proxy to the proxy as a result of no longer using
client.TeleportClient to establish the connection to the target host.
Closes https://github.com/gravitational/teleport/issues/24419.
* Stable user UID addition to the host user creation guide
* tctl stable-unix-users-ls docs
* CAP resource reference
* auth service reference
* Uncomment defaulted field in fileconf
* Clarify conditions for stable uids
Listing ECS Services requires an AWS Region.
Instead of guessing the AWS Regions, this PR allows the API Client to
send a list of AWS Regions which are used call the ECS APIs
Updates the servicenow and opsgenie plugins to create an http
client manually like all other access plugins. In addition to
unifying client creation, this allows us to remove the dependency
on the legacy aws sdk.
This eliminates all remaining references to AWS SDK v1 in the
lib/srv/db/... and lib/srv/discovery/... packages.
Most of the changes are simply to remove dead code.
This eliminates the SigningService in favor of a free function
SignRequest, which eliminates AWS credential loading and simplifies the
AWS utils package.
In the process of doing this refactor, the AWS app handler has been
changed to use AWS SDK v2 to load its credentials as well.
* [vnet] refactor osconfig
This PR refactors VNet's OS configuration code.
There is now a `osConfigurator` struct that runs the OS configuration
loop and calls out to a `targetOSConfigProvider` which determines the
current target OS configuration.
This `targetOSConfigProvider` can be implemented for the MacOS daemon
process by moving some of the existing code around.
In a following PR I will implement it for Windows which will call out to
the user process to get the current target OS configuration.
This PR doesn't really change any of the logic that runs on MacOS, it
just refactors things so that we can swap in a different implementation
for Windows.
FYI, after I get the Windows code fully working, I plan to migrate the
MacOS code to follow the new way Windows handles things, where the admin
process handles all networking and calls out to the user process for
everything that uses a Teleport client.
This will unify multiple codepaths and eliminate the
profileOSConfigProvider added here.
* fix lint on linux
* use ip-aware function to compute TUN address
SSO flows are initiated via unauthenticated APIs, so it's not uncommon
to see spam from security tools or malicious bots probing. If we can
tell that these are not legitimate SSO attempts then we avoid emitting
falures that clutter the audit log.
Only DynamoDB and AWS MongoDB Atlas depended on GetAWSSession, and the
migration for these packages was trivial.
Since this was the last AWS method in lib/cloud/clients, the vast majority
of the changes are to remove dead code.
DiscoveryService can process DiscoveryConfig matchers and will update
its Status field depending on the number of found resources.
Currently, it was updating them in real-time-ish: every time it found a
new resource, it would update the counter in memory and propagate that
change into the cluster shared storage.
However, this resulted in counters flutuating a lot and causing
confusion from the user's point of view (being at 0 every couple of
minutes).
Instead, this PR, ensures we update the values only once per iteration
cycle (happens at discovery_service.poll_interval - defaults to 5
miunutes).
This means we lose real-time observation of the counters, but we gain
stability on the values which should help UX.
The new tab consumes `audit_failed_emit_events`,
`teleport_audit_stored_trimmed_events`, and
`teleport_audit_emitted_event_sizes` to help troubleshoot issues
related to audit log backends. The metrics are displayed in graphs
which illustrate the change in metrics over the sampling period.
* Add mapping of profile color to theme color
* Prepare UserIcon to display colors, make it slightly larger
* Rewrite single identity item to show icon and user/cluster in separate lines
* Render single cluster items in a list
* Add color picker
* Render active cluster separately, above inactive clusters
* Put the new identity components together
* Refactor `Identity` story, render the container component instead of "presentational" one
* Refresh startup page
* Minor style fixes
* Add comment about `dataVisualisationColors`
* Bring back the original styling of `StaticListItem`
* Make the pencil icon hoverable and clickable
* Increase min-width from 200 px to 300 px, simplify active cluster layout
* Show logout button when any part of `ListItem` is hovered
* Remove text from logout button, improve titles
* Pass correct index number to `AddClusterItem`
* Update comment for `focusGrabber`
* Use `useStoreSelector` correctly
* Improve accessibility of color picker
* Replace Pam icon with plus symbol
* Remove unnecessary optional chaining
* Align profile status error with user icon
* Add story for cluster connect panel
* Make user icon letter follow active theme
This was suggested by Kenny, and I think it looks good.
* Change gap from 11 px to 10 px
* Rename profile color -> workspace color
* Adjust workspace tests to accept persisted workspace type
* Store profile color in workspace
* Replace manual workspace creation in stories/tests with `addRootClusterWithDoc`
* Fix checking if all colors are taken
* Add DELETE IN comment
* `ProfileColor` -> `WorkspaceColor`
* Lint
* Prettier
* Add TODO about creating workspaces in `setActiveWorkspace`
PR #46899 introduced a subtle change in Kubernetes service behavior, where the direct transport—kube agent to Kubernetes API—is now cached for five hours.
This disrupts auto-discovery because tokens are only valid for 15 minutes, while the HTTP transport that applies them remains valid for five hours. As a result, the Kubernetes service continues using the same expired token for 4 hours and 45 minutes.
This PR resolves the issue by preventing token caching altogether.
Fixes#51639
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
PR #51448 replaced the `x/exp/maps` with stdlib `maps` but there is a
subtle change, the `x/exp/maps` automatically collects the map values
when `maps.Values` and the stdlib package returns an iterator.
Since we were collecting the values under a lock, the iterator approach
doesn't held the lock during actual map range causing a datarace with
other code.
This PR fixes that by collecting the iterator values while holding the
lock.
Fixes#51572
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Add BotInstanceActivitySupport to usage reporting
* Wire BotInstanceActivityReport into submitter
* Share userActivityLock
* Add test for bot instance
* TestBotInstanceActivityReportSplitting
* Use 15minute interval rather than hourly
* Switch to compound key for botInstanceActivity map
* ADjust lolck name
In https://github.com/gravitational/teleport/pull/24254 expansion
of tilde prefixes(i.e. `tsh scp CHANGELOG.md root@host:~foo/`) was
explicitly denied. However, because the error returned to the user
is a trace.BadParameter error the reauthentication logic kicks in
and attempts to resolve the issue with fresh credentials. This
error is now caught and wrapped in a NonRetryableError to prevent
the authentication logic from providing a weird UX.
Updates https://github.com/gravitational/teleport/issues/22886.
* Tests event with non-UUID session ID
* Randomly derive UUIDs from non-conformant session IDs
* nit: Use "" instead of ``
* Link godoc references to Log.deriveSessionID
* Mention UUIDv5 for derived IDs
* Do not log the session ID
* Rename test helper, move truncateEvents out of it
* wiring the API client through
* tctl stable-unix-users ls
* stable UID fallback for Teleport SSHD
* stable_unix_user.create event
* fix-license
* Require and test audit log message
* Add stable_unix_user_config to fileconf
* Avoid saying "fallback UID" in logs
* Avoid saying "fallback UID" in error messages
* Avoid racing writes in the mock emitter
* pnpm lint-fix
* fix lib/auth tests that broken during rebase
Yassine Bounekhla