opensource/teleport
3
0
Fork 0
mirror of https://github.com/gravitational/teleport.git synced 2026-09-21 05:55:42 +08:00
Code Issues Packages Projects Releases Wiki Activity
27,022 Commits 9,613 Branches 7,118 Tags
644cae4529f6df276ab3b911e1776d5ed4fcb785
Commit Graph
47 Commits
Author SHA1 Message Date
Chris ThachChris ThachEdoardo Spadolini
 		306b6a9db0 Set Teleport version in SSH clients (#65004) 
* Set Teleport version in SSH clients.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Add more tests. Fix lint.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Fix import. Fix lint exclude.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Fix lint - come on!

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Fix race by making a defensive copy.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Use ErrorIs.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Deep clone client conf. Early return for err. Make consistent.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Return new conf if nil. Add trace.Wrap to missing.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Add IsSSHFeatureSupported. Switch from api to api_test for test pack. Make prefix exported const.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Revert accidental commit.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Return sentinel error for older clients or non-teleport clients to improve downstream handling.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Clean up.

Co-authored-by: Chris Thach <chris.thach@protonmail.com>

* Apply suggestions from code review

Co-authored-by: Edoardo Spadolini <edoardo.spadolini@gmail.com>

* Remove defensive check.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Change from trace.BadParam to reg error.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Use strings.Cut and improve readability.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Use error struct.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Add test that errors if ssh.ClientConfig changes.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Move to subpackage.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Use static assertion instead.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Return error if config is nil.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Allow clients to override client version via config.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Fix test because I forgot to update it.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Move assert to test file.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Remove error return val.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Relax parser to allow for more.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Fix lint.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* WIP take on a tracessh wrapper. Will fail CI.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Add tests and polish new package.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Revert changes to tracessh. Add lint config.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Revert changes to use tracessh.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Delete extra s.

Co-authored-by: Chris Thach <chris.thach@protonmail.com>

* Apply suggestions from code review.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Add IsEmpty helper methods.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* First pass of refactoring.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Second pass refactor.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Third pass refactor.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Fix nil panic.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Fix missing user value.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Fix missing User value.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Remove Get from name. Polish.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Fix incorrect signers for clients. Make changes consistent.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Allow ClientConfig to be empty in proxy config.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Fix eager signers regression in generateClientConfig.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Add edge case for space after prefix.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Fix issues from code review.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Drop suffix. Update comments.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Update ClientConfig docs.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Add warning about using the Teleport version.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Teleport version is mandatory.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Revert timeout to make Claude/Codex happy.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Remove alias in places that didn't need it. Revert lib/cloud/gcp/alloydb.go.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Add wrapper for tracessh.Client.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Add tests for generate client config.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Drop config from field name to shorten.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Fix lint issues.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

---------

Signed-off-by: Chris Thach <chris.thach@goteleport.com>
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@gmail.com>
 2026-04-07 18:06:00 +00:00
rhammonds-teleport b3e014c52e TDPB Teleport Connect (#63171) 
* Teleport Connect now speaks TDPB.

* fix incorrect mousewheel encoding on web client

* Refactor tdpb protocol string to constant

* Populate FSO object in shared sirectory info response even when the file/directory does not exist

* Slightly cleaner TDP translation setup

* Refactor excessive function parameters to struct

* Fix unset 'Operation' on shared directory move response

* Fix backwards compatibility with v17 desktop service

* Guard against nil screenspec in ClientHello message
 2026-04-02 16:54:17 +00:00
rosstimothy 57505d2c70 Fix TestClient_DialHost flakiness (#61373) 
Several of the test cases failed with unexpected EOF errors because
the gRPC handler was terminating too early.

The `connection successfully established without agent forwarding`
test case used the following series of events to validate ssh frames
are forwarded correctly.

1) client sends message to server
2) server echoes the data back and immediately terminates the stream
3) client reads a message and validates the data was echoed
4) client tries to read again and gets an EOF error
5) client closes connection

The flakiness was a result of step 2. The server handler exiting
immediately after sending the echo back to the client could result
in the message never being received by the client. To make the test
more reliable the test was updated to the following.

1) client sends message to server
2) server echoes the data back
3) client reads a message and validates the data was echoed
4) client resends the message to the server
5) server receives the second message and terminates the stream
6) client tries to read again and gets an EOF error
7) client closes connection

This guarantees that the server stream handler will be alive after
the echoed data is sent and the client has had a chance to process it.

The `connection successfully established with agent forwarding` test
case was flaking for similar reasons. The gRPC handler spawned a
goroutine to consume and forward agent frames but the handler did not
wait for this goroutine to finish before returning. Depending on the
timing of the test the handler could return prior to all agent frames
being processed which terminated the gRPC stream and resulted in
unexpected EOF errors at the client.

To remedy this logic in the handler was inverted such that processing
the messasges from the gRPC stream is done in a loop in the main goroutine
of the handler. Processing of agent frames is now done in a background
goroutine spawned via an errgroup.Group. The main loop of the handler
blocks waiting for the errgroup.Group to conclude prior to exiting to
ensure all messages are exhausted before exiting.

Fixes https://github.com/gravitational/teleport/issues/32799.
 2025-11-14 18:30:20 +00:00
rosstimothy 348699d998 Improve tsh ssh error messages (#60099) 
Fixes https://github.com/gravitational/teleport/issues/60055 and
https://github.com/gravitational/teleport/issues/53267.

Errors emitted when access is denied or hosts are missing from
the inventory have been updated to be clearer to end users.

The current error when connecting to a host that does not exist

```bash
$ tsh ssh tim@fake-host
ERROR: failed connecting to host fake-host:0: failed to receive cluster details response
failed to dial target host
direct dialing to nodes not found in inventory is not supported
```

has been updated to remove ancillary details that have zero meaning to anyone
other than a Teleport developer and better clarify the host does not exist.

```
$ tsh ssh tim@fake-host 
ERROR: failed connecting to host fake-host: target host fake-host is offline or does not exist
```

The access denied error


```
$ tsh ssh tim@server01 uptime
ERROR: access denied to tim connecting to server01:0
```


has had a relatively minor and possibly unnoticed
change to omit the port from the dial target.


```
$ tsh ssh tim@server01 uptime
ERROR: access denied to tim connecting to server01
```

fix: use net.SplitHostPort instead of strings.Cut
 2025-10-14 12:59:18 +00:00
Edoardo Spadolini cd0a0b330c Add support for using the relay in tsh and Machine ID (#59095) 
* Support relay transport in the proxy client

* Support generating client options at login time

* Support storing, overriding and using the relay in tsh

* Set the default relay address based on a trait

* Display relay info from the profile in tsh status

* Add relay support to tbot ssh multiplexer

* use relay_server like proxy_server

* Make the trait name similar to other internal traits

* Simplify default status, add info in debug

* Only show relay address in status if set
 2025-09-17 10:14:04 +00:00
Luke Okraszewski b4b9e97a75 Add TELEPORT_UNSTABLE_GRPC_RECV_SIZE env var option (#57846) 
Setting this env var allows overwriting the max
size of a grpc message the client can recieve (default is 4MB).

Towards: https://github.com/gravitational/teleport.e/issues/6759
changelog: Add TELEPORT_UNSTABLE_GRPC_RECV_SIZE env var which can be set to overwrite client side max grpc message size.
 2025-08-19 10:11:54 +00:00
dependabot[bot]Marco DinisTim Ross
 		d1284f01f4 Bump the go group with 72 updates (#55340) 
* Bump the go group with 72 updates

Bumps the go group with 72 updates:

| Package | From | To |
| --- | --- | --- |
| [cloud.google.com/go/cloudsqlconn](https://github.com/googlecloudplatform/cloud-sql-go-connector) | `1.17.0` | `1.17.1` |
| [cloud.google.com/go/compute](https://github.com/googleapis/google-cloud-go) | `1.37.0` | `1.38.0` |
| [cloud.google.com/go/compute/metadata](https://github.com/googleapis/google-cloud-go) | `0.6.0` | `0.7.0` |
| [cloud.google.com/go/container](https://github.com/googleapis/google-cloud-go) | `1.42.4` | `1.43.0` |
| [cloud.google.com/go/kms](https://github.com/googleapis/google-cloud-go) | `1.21.2` | `1.22.0` |
| [cloud.google.com/go/spanner](https://github.com/googleapis/google-cloud-go) | `1.80.0` | `1.82.0` |
| [cloud.google.com/go/storage](https://github.com/googleapis/google-cloud-go) | `1.52.0` | `1.53.0` |
| [github.com/Azure/azure-sdk-for-go/sdk/azidentity](https://github.com/Azure/azure-sdk-for-go) | `1.9.0` | `1.10.0` |
| [github.com/ClickHouse/ch-go](https://github.com/ClickHouse/ch-go) | `0.65.1` | `0.66.0` |
| [github.com/ClickHouse/clickhouse-go/v2](https://github.com/ClickHouse/clickhouse-go) | `2.34.0` | `2.35.0` |
| [github.com/aws/aws-sdk-go-v2/feature/s3/manager](https://github.com/aws/aws-sdk-go-v2) | `1.17.74` | `1.17.77` |
| [github.com/aws/aws-sdk-go-v2/service/applicationautoscaling](https://github.com/aws/aws-sdk-go-v2) | `1.36.0` | `1.36.1` |
| [github.com/aws/aws-sdk-go-v2/service/athena](https://github.com/aws/aws-sdk-go-v2) | `1.50.4` | `1.50.5` |
| [github.com/aws/aws-sdk-go-v2/service/ec2](https://github.com/aws/aws-sdk-go-v2) | `1.213.0` | `1.224.0` |
| [github.com/aws/aws-sdk-go-v2/service/ecs](https://github.com/aws/aws-sdk-go-v2) | `1.56.2` | `1.57.1` |
| [github.com/aws/aws-sdk-go-v2/service/glue](https://github.com/aws/aws-sdk-go-v2) | `1.109.2` | `1.113.0` |
| [github.com/aws/aws-sdk-go-v2/service/iam](https://github.com/aws/aws-sdk-go-v2) | `1.41.1` | `1.42.0` |
| [github.com/aws/aws-sdk-go-v2/service/identitystore](https://github.com/aws/aws-sdk-go-v2) | `1.28.2` | `1.28.3` |
| [github.com/aws/aws-sdk-go-v2/service/rds](https://github.com/aws/aws-sdk-go-v2) | `1.95.0` | `1.96.0` |
| [github.com/aws/aws-sdk-go-v2/service/redshiftserverless](https://github.com/aws/aws-sdk-go-v2) | `1.27.1` | `1.27.2` |
| [github.com/aws/aws-sdk-go-v2/service/s3](https://github.com/aws/aws-sdk-go-v2) | `1.79.3` | `1.80.0` |
| [github.com/aws/aws-sdk-go-v2/service/ssoadmin](https://github.com/aws/aws-sdk-go-v2) | `1.30.2` | `1.31.0` |
| [github.com/docker/docker](https://github.com/docker/docker) | `28.1.1+incompatible` | `28.2.2+incompatible` |
| [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) | `4.0.5` | `4.1.0` |
| [github.com/go-logr/logr](https://github.com/go-logr/logr) | `1.4.2` | `1.4.3` |
| [github.com/go-webauthn/webauthn](https://github.com/go-webauthn/webauthn) | `0.11.2` | `0.13.0` |
| [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) | `0.20.3` | `0.20.5` |
| [github.com/google/go-tpm](https://github.com/google/go-tpm) | `0.9.4` | `0.9.5` |
| [github.com/googleapis/gax-go/v2](https://github.com/googleapis/gax-go) | `2.14.1` | `2.14.2` |
| [github.com/grpc-ecosystem/go-grpc-middleware/v2](https://github.com/grpc-ecosystem/go-grpc-middleware) | `2.3.1` | `2.3.2` |
| [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) | `5.7.4` | `5.7.5` |
| [github.com/mark3labs/mcp-go](https://github.com/mark3labs/mcp-go) | `0.30.1` | `0.31.0` |
| [github.com/oracle/oci-go-sdk/v65](https://github.com/oracle/oci-go-sdk) | `65.89.3` | `65.92.0` |
| [github.com/pquerna/otp](https://github.com/pquerna/otp) | `1.4.0` | `1.5.0` |
| [github.com/prometheus/common](https://github.com/prometheus/common) | `0.63.0` | `0.64.0` |
| [github.com/quic-go/quic-go](https://github.com/quic-go/quic-go) | `0.51.0` | `0.52.0` |
| [github.com/shirou/gopsutil/v4](https://github.com/shirou/gopsutil) | `4.25.4` | `4.25.5` |
| [github.com/sigstore/protobuf-specs](https://github.com/sigstore/protobuf-specs) | `0.4.1` | `0.4.2` |
| [github.com/snowflakedb/gosnowflake](https://github.com/snowflakedb/gosnowflake) | `1.14.0` | `1.14.1` |
| [github.com/tidwall/pretty](https://github.com/tidwall/pretty) | `1.2.0` | `1.2.1` |
| [gitlab.com/gitlab-org/api/client-go](https://gitlab.com/gitlab-org/api/client-go) | `0.127.0` | `0.129.0` |
| [go.etcd.io/etcd/api/v3](https://github.com/etcd-io/etcd) | `3.5.21` | `3.6.0` |
| [go.etcd.io/etcd/client/v3](https://github.com/etcd-io/etcd) | `3.5.21` | `3.6.0` |
| [go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.60.0` | `0.61.0` |
| [go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.60.0` | `0.61.0` |
| [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) | `1.35.0` | `1.36.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlptrace](https://github.com/open-telemetry/opentelemetry-go) | `1.35.0` | `1.36.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc](https://github.com/open-telemetry/opentelemetry-go) | `1.35.0` | `1.36.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp](https://github.com/open-telemetry/opentelemetry-go) | `1.35.0` | `1.36.0` |
| [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) | `1.35.0` | `1.36.0` |
| [go.opentelemetry.io/otel/trace](https://github.com/open-telemetry/opentelemetry-go) | `1.35.0` | `1.36.0` |
| [go.opentelemetry.io/proto/otlp](https://github.com/open-telemetry/opentelemetry-proto-go) | `1.6.0` | `1.7.0` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.37.0` | `0.38.0` |
| [golang.org/x/net](https://github.com/golang/net) | `0.39.0` | `0.40.0` |
| [golang.org/x/oauth2](https://github.com/golang/oauth2) | `0.29.0` | `0.30.0` |
| [golang.org/x/sync](https://github.com/golang/sync) | `0.13.0` | `0.14.0` |
| [golang.org/x/sys](https://github.com/golang/sys) | `0.32.0` | `0.33.0` |
| [golang.org/x/term](https://github.com/golang/term) | `0.31.0` | `0.32.0` |
| [golang.org/x/text](https://github.com/golang/text) | `0.24.0` | `0.25.0` |
| [google.golang.org/api](https://github.com/googleapis/google-api-go-client) | `0.230.0` | `0.233.0` |
| [google.golang.org/genproto/googleapis/rpc](https://github.com/googleapis/go-genproto) | `0.0.0-20250428153025-10db94c68c34` | `0.0.0-20250528174236-200df99c418a` |
| [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.72.1` | `1.72.2` |
| [helm.sh/helm/v3](https://github.com/helm/helm) | `3.17.3` | `3.18.1` |
| [k8s.io/api](https://github.com/kubernetes/api) | `0.33.0` | `0.33.1` |
| [k8s.io/apiextensions-apiserver](https://github.com/kubernetes/apiextensions-apiserver) | `0.33.0` | `0.33.1` |
| [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) | `0.33.0` | `0.33.1` |
| [k8s.io/apiserver](https://github.com/kubernetes/apiserver) | `0.33.0` | `0.33.1` |
| [k8s.io/cli-runtime](https://github.com/kubernetes/cli-runtime) | `0.33.0` | `0.33.1` |
| [k8s.io/client-go](https://github.com/kubernetes/client-go) | `0.33.0` | `0.33.1` |
| [k8s.io/component-base](https://github.com/kubernetes/component-base) | `0.33.0` | `0.33.1` |
| [k8s.io/kubectl](https://github.com/kubernetes/kubectl) | `0.33.0` | `0.33.1` |
| [sigs.k8s.io/controller-runtime](https://github.com/kubernetes-sigs/controller-runtime) | `0.20.4` | `0.21.0` |


Updates `cloud.google.com/go/cloudsqlconn` from 1.17.0 to 1.17.1
- [Release notes](https://github.com/googlecloudplatform/cloud-sql-go-connector/releases)
- [Changelog](https://github.com/GoogleCloudPlatform/cloud-sql-go-connector/blob/main/CHANGELOG.md)
- [Commits](https://github.com/googlecloudplatform/cloud-sql-go-connector/compare/v1.17.0...v1.17.1)

Updates `cloud.google.com/go/compute` from 1.37.0 to 1.38.0
- [Release notes](https://github.com/googleapis/google-cloud-go/releases)
- [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/documentai/CHANGES.md)
- [Commits](https://github.com/googleapis/google-cloud-go/compare/pubsub/v1.37.0...pubsub/v1.38.0)

Updates `cloud.google.com/go/compute/metadata` from 0.6.0 to 0.7.0
- [Release notes](https://github.com/googleapis/google-cloud-go/releases)
- [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/CHANGES.md)
- [Commits](https://github.com/googleapis/google-cloud-go/compare/v0.6.0...v0.7.0)

Updates `cloud.google.com/go/container` from 1.42.4 to 1.43.0
- [Release notes](https://github.com/googleapis/google-cloud-go/releases)
- [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/CHANGES.md)
- [Commits](https://github.com/googleapis/google-cloud-go/compare/container/v1.42.4...pubsub/v1.43.0)

Updates `cloud.google.com/go/kms` from 1.21.2 to 1.22.0
- [Release notes](https://github.com/googleapis/google-cloud-go/releases)
- [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/documentai/CHANGES.md)
- [Commits](https://github.com/googleapis/google-cloud-go/compare/kms/v1.21.2...kms/v1.22.0)

Updates `cloud.google.com/go/spanner` from 1.80.0 to 1.82.0
- [Release notes](https://github.com/googleapis/google-cloud-go/releases)
- [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/CHANGES.md)
- [Commits](https://github.com/googleapis/google-cloud-go/compare/spanner/v1.80.0...spanner/v1.82.0)

Updates `cloud.google.com/go/storage` from 1.52.0 to 1.53.0
- [Release notes](https://github.com/googleapis/google-cloud-go/releases)
- [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/CHANGES.md)
- [Commits](https://github.com/googleapis/google-cloud-go/compare/spanner/v1.52.0...spanner/v1.53.0)

Updates `github.com/Azure/azure-sdk-for-go/sdk/azidentity` from 1.9.0 to 1.10.0
- [Release notes](https://github.com/Azure/azure-sdk-for-go/releases)
- [Changelog](https://github.com/Azure/azure-sdk-for-go/blob/main/documentation/go-mgmt-sdk-release-guideline.md)
- [Commits](https://github.com/Azure/azure-sdk-for-go/compare/sdk/azcore/v1.9.0...sdk/azcore/v1.10.0)

Updates `github.com/ClickHouse/ch-go` from 0.65.1 to 0.66.0
- [Release notes](https://github.com/ClickHouse/ch-go/releases)
- [Commits](https://github.com/ClickHouse/ch-go/compare/v0.65.1...v0.66.0)

Updates `github.com/ClickHouse/clickhouse-go/v2` from 2.34.0 to 2.35.0
- [Release notes](https://github.com/ClickHouse/clickhouse-go/releases)
- [Changelog](https://github.com/ClickHouse/clickhouse-go/blob/main/CHANGELOG.md)
- [Commits](https://github.com/ClickHouse/clickhouse-go/compare/v2.34.0...v2.35.0)

Updates `github.com/aws/aws-sdk-go-v2/feature/s3/manager` from 1.17.74 to 1.17.77
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/feature/s3/manager/v1.17.74...feature/s3/manager/v1.17.77)

Updates `github.com/aws/aws-sdk-go-v2/service/applicationautoscaling` from 1.36.0 to 1.36.1
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/v1.36.0...v1.36.1)

Updates `github.com/aws/aws-sdk-go-v2/service/athena` from 1.50.4 to 1.50.5
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/service/ssm/v1.50.4...service/ssm/v1.50.5)

Updates `github.com/aws/aws-sdk-go-v2/service/ec2` from 1.213.0 to 1.224.0
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/service/ec2/v1.213.0...service/ec2/v1.224.0)

Updates `github.com/aws/aws-sdk-go-v2/service/ecs` from 1.56.2 to 1.57.1
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/service/ecs/v1.56.2...service/s3/v1.57.1)

Updates `github.com/aws/aws-sdk-go-v2/service/glue` from 1.109.2 to 1.113.0
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/service/glue/v1.109.2...service/ec2/v1.113.0)

Updates `github.com/aws/aws-sdk-go-v2/service/iam` from 1.41.1 to 1.42.0
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/service/ivs/v1.41.1...service/s3/v1.42.0)

Updates `github.com/aws/aws-sdk-go-v2/service/identitystore` from 1.28.2 to 1.28.3
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/config/v1.28.2...config/v1.28.3)

Updates `github.com/aws/aws-sdk-go-v2/service/rds` from 1.95.0 to 1.96.0
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/service/ec2/v1.96.0/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/service/ec2/v1.95.0...service/ec2/v1.96.0)

Updates `github.com/aws/aws-sdk-go-v2/service/redshiftserverless` from 1.27.1 to 1.27.2
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/v1.27.1...v1.27.2)

Updates `github.com/aws/aws-sdk-go-v2/service/s3` from 1.79.3 to 1.80.0
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/service/s3/v1.79.3...service/s3/v1.80.0)

Updates `github.com/aws/aws-sdk-go-v2/service/ssoadmin` from 1.30.2 to 1.31.0
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/v1.30.2...v1.31.0)

Updates `github.com/docker/docker` from 28.1.1+incompatible to 28.2.2+incompatible
- [Release notes](https://github.com/docker/docker/releases)
- [Commits](https://github.com/docker/docker/compare/v28.1.1...v28.2.2)

Updates `github.com/go-jose/go-jose/v4` from 4.0.5 to 4.1.0
- [Release notes](https://github.com/go-jose/go-jose/releases)
- [Changelog](https://github.com/go-jose/go-jose/blob/main/CHANGELOG.md)
- [Commits](https://github.com/go-jose/go-jose/compare/v4.0.5...v4.1.0)

Updates `github.com/go-logr/logr` from 1.4.2 to 1.4.3
- [Release notes](https://github.com/go-logr/logr/releases)
- [Changelog](https://github.com/go-logr/logr/blob/master/CHANGELOG.md)
- [Commits](https://github.com/go-logr/logr/compare/v1.4.2...v1.4.3)

Updates `github.com/go-webauthn/webauthn` from 0.11.2 to 0.13.0
- [Release notes](https://github.com/go-webauthn/webauthn/releases)
- [Commits](https://github.com/go-webauthn/webauthn/compare/v0.11.2...v0.13.0)

Updates `github.com/google/go-containerregistry` from 0.20.3 to 0.20.5
- [Release notes](https://github.com/google/go-containerregistry/releases)
- [Changelog](https://github.com/google/go-containerregistry/blob/main/.goreleaser.yml)
- [Commits](https://github.com/google/go-containerregistry/compare/v0.20.3...v0.20.5)

Updates `github.com/google/go-tpm` from 0.9.4 to 0.9.5
- [Release notes](https://github.com/google/go-tpm/releases)
- [Commits](https://github.com/google/go-tpm/compare/v0.9.4...v0.9.5)

Updates `github.com/googleapis/gax-go/v2` from 2.14.1 to 2.14.2
- [Release notes](https://github.com/googleapis/gax-go/releases)
- [Commits](https://github.com/googleapis/gax-go/compare/v2.14.1...v2.14.2)

Updates `github.com/grpc-ecosystem/go-grpc-middleware/v2` from 2.3.1 to 2.3.2
- [Release notes](https://github.com/grpc-ecosystem/go-grpc-middleware/releases)
- [Commits](https://github.com/grpc-ecosystem/go-grpc-middleware/compare/v2.3.1...v2.3.2)

Updates `github.com/jackc/pgx/v5` from 5.7.4 to 5.7.5
- [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md)
- [Commits](https://github.com/jackc/pgx/compare/v5.7.4...v5.7.5)

Updates `github.com/mark3labs/mcp-go` from 0.30.1 to 0.31.0
- [Release notes](https://github.com/mark3labs/mcp-go/releases)
- [Commits](https://github.com/mark3labs/mcp-go/compare/v0.30.1...v0.31.0)

Updates `github.com/oracle/oci-go-sdk/v65` from 65.89.3 to 65.92.0
- [Release notes](https://github.com/oracle/oci-go-sdk/releases)
- [Changelog](https://github.com/oracle/oci-go-sdk/blob/master/CHANGELOG.md)
- [Commits](https://github.com/oracle/oci-go-sdk/compare/v65.89.3...v65.92.0)

Updates `github.com/pquerna/otp` from 1.4.0 to 1.5.0
- [Release notes](https://github.com/pquerna/otp/releases)
- [Commits](https://github.com/pquerna/otp/compare/v1.4.0...v1.5.0)

Updates `github.com/prometheus/common` from 0.63.0 to 0.64.0
- [Release notes](https://github.com/prometheus/common/releases)
- [Changelog](https://github.com/prometheus/common/blob/main/RELEASE.md)
- [Commits](https://github.com/prometheus/common/compare/v0.63.0...v0.64.0)

Updates `github.com/quic-go/quic-go` from 0.51.0 to 0.52.0
- [Release notes](https://github.com/quic-go/quic-go/releases)
- [Commits](https://github.com/quic-go/quic-go/compare/v0.51.0...v0.52.0)

Updates `github.com/shirou/gopsutil/v4` from 4.25.4 to 4.25.5
- [Release notes](https://github.com/shirou/gopsutil/releases)
- [Commits](https://github.com/shirou/gopsutil/compare/v4.25.4...v4.25.5)

Updates `github.com/sigstore/protobuf-specs` from 0.4.1 to 0.4.2
- [Release notes](https://github.com/sigstore/protobuf-specs/releases)
- [Changelog](https://github.com/sigstore/protobuf-specs/blob/main/CHANGELOG.md)
- [Commits](https://github.com/sigstore/protobuf-specs/compare/v0.4.1...v0.4.2)

Updates `github.com/snowflakedb/gosnowflake` from 1.14.0 to 1.14.1
- [Release notes](https://github.com/snowflakedb/gosnowflake/releases)
- [Changelog](https://github.com/snowflakedb/gosnowflake/blob/master/release.go)
- [Commits](https://github.com/snowflakedb/gosnowflake/compare/v1.14.0...v1.14.1)

Updates `github.com/tidwall/pretty` from 1.2.0 to 1.2.1
- [Commits](https://github.com/tidwall/pretty/compare/v1.2.0...v1.2.1)

Updates `gitlab.com/gitlab-org/api/client-go` from 0.127.0 to 0.129.0
- [Release notes](https://gitlab.com/gitlab-org/api/client-go/tags)
- [Changelog](https://gitlab.com/gitlab-org/api/client-go/blob/main/.release.config.mjs)
- [Commits](https://gitlab.com/gitlab-org/api/client-go/compare/v0.127.0...v0.129.0)

Updates `go.etcd.io/etcd/api/v3` from 3.5.21 to 3.6.0
- [Release notes](https://github.com/etcd-io/etcd/releases)
- [Commits](https://github.com/etcd-io/etcd/compare/v3.5.21...v3.6.0)

Updates `go.etcd.io/etcd/client/v3` from 3.5.21 to 3.6.0
- [Release notes](https://github.com/etcd-io/etcd/releases)
- [Commits](https://github.com/etcd-io/etcd/compare/v3.5.21...v3.6.0)

Updates `go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc` from 0.60.0 to 0.61.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.60.0...zpages/v0.61.0)

Updates `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` from 0.60.0 to 0.61.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.60.0...zpages/v0.61.0)

Updates `go.opentelemetry.io/otel` from 1.35.0 to 1.36.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.35.0...v1.36.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace` from 1.35.0 to 1.36.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.35.0...v1.36.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc` from 1.35.0 to 1.36.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.35.0...v1.36.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp` from 1.35.0 to 1.36.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.35.0...v1.36.0)

Updates `go.opentelemetry.io/otel/sdk` from 1.35.0 to 1.36.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.35.0...v1.36.0)

Updates `go.opentelemetry.io/otel/trace` from 1.35.0 to 1.36.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.35.0...v1.36.0)

Updates `go.opentelemetry.io/proto/otlp` from 1.6.0 to 1.7.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-proto-go/releases)
- [Commits](https://github.com/open-telemetry/opentelemetry-proto-go/compare/v1.6.0...v1.7.0)

Updates `golang.org/x/crypto` from 0.37.0 to 0.38.0
- [Commits](https://github.com/golang/crypto/compare/v0.37.0...v0.38.0)

Updates `golang.org/x/net` from 0.39.0 to 0.40.0
- [Commits](https://github.com/golang/net/compare/v0.39.0...v0.40.0)

Updates `golang.org/x/oauth2` from 0.29.0 to 0.30.0
- [Commits](https://github.com/golang/oauth2/compare/v0.29.0...v0.30.0)

Updates `golang.org/x/sync` from 0.13.0 to 0.14.0
- [Commits](https://github.com/golang/sync/compare/v0.13.0...v0.14.0)

Updates `golang.org/x/sys` from 0.32.0 to 0.33.0
- [Commits](https://github.com/golang/sys/compare/v0.32.0...v0.33.0)

Updates `golang.org/x/term` from 0.31.0 to 0.32.0
- [Commits](https://github.com/golang/term/compare/v0.31.0...v0.32.0)

Updates `golang.org/x/text` from 0.24.0 to 0.25.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](https://github.com/golang/text/compare/v0.24.0...v0.25.0)

Updates `google.golang.org/api` from 0.230.0 to 0.233.0
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](https://github.com/googleapis/google-api-go-client/compare/v0.230.0...v0.233.0)

Updates `google.golang.org/genproto/googleapis/rpc` from 0.0.0-20250428153025-10db94c68c34 to 0.0.0-20250528174236-200df99c418a
- [Commits](https://github.com/googleapis/go-genproto/commits)

Updates `google.golang.org/grpc` from 1.72.1 to 1.72.2
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](https://github.com/grpc/grpc-go/compare/v1.72.1...v1.72.2)

Updates `helm.sh/helm/v3` from 3.17.3 to 3.18.1
- [Release notes](https://github.com/helm/helm/releases)
- [Commits](https://github.com/helm/helm/compare/v3.17.3...v3.18.1)

Updates `k8s.io/api` from 0.33.0 to 0.33.1
- [Commits](https://github.com/kubernetes/api/compare/v0.33.0...v0.33.1)

Updates `k8s.io/apiextensions-apiserver` from 0.33.0 to 0.33.1
- [Release notes](https://github.com/kubernetes/apiextensions-apiserver/releases)
- [Commits](https://github.com/kubernetes/apiextensions-apiserver/compare/v0.33.0...v0.33.1)

Updates `k8s.io/apimachinery` from 0.33.0 to 0.33.1
- [Commits](https://github.com/kubernetes/apimachinery/compare/v0.33.0...v0.33.1)

Updates `k8s.io/apiserver` from 0.33.0 to 0.33.1
- [Commits](https://github.com/kubernetes/apiserver/compare/v0.33.0...v0.33.1)

Updates `k8s.io/cli-runtime` from 0.33.0 to 0.33.1
- [Commits](https://github.com/kubernetes/cli-runtime/compare/v0.33.0...v0.33.1)

Updates `k8s.io/client-go` from 0.33.0 to 0.33.1
- [Changelog](https://github.com/kubernetes/client-go/blob/master/CHANGELOG.md)
- [Commits](https://github.com/kubernetes/client-go/compare/v0.33.0...v0.33.1)

Updates `k8s.io/component-base` from 0.33.0 to 0.33.1
- [Commits](https://github.com/kubernetes/component-base/compare/v0.33.0...v0.33.1)

Updates `k8s.io/kubectl` from 0.33.0 to 0.33.1
- [Commits](https://github.com/kubernetes/kubectl/compare/v0.33.0...v0.33.1)

Updates `sigs.k8s.io/controller-runtime` from 0.20.4 to 0.21.0
- [Release notes](https://github.com/kubernetes-sigs/controller-runtime/releases)
- [Changelog](https://github.com/kubernetes-sigs/controller-runtime/blob/main/RELEASE.md)
- [Commits](https://github.com/kubernetes-sigs/controller-runtime/compare/v0.20.4...v0.21.0)

---
updated-dependencies:
- dependency-name: cloud.google.com/go/cloudsqlconn
  dependency-version: 1.17.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: cloud.google.com/go/compute
  dependency-version: 1.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: cloud.google.com/go/compute/metadata
  dependency-version: 0.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: cloud.google.com/go/container
  dependency-version: 1.43.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: cloud.google.com/go/kms
  dependency-version: 1.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: cloud.google.com/go/spanner
  dependency-version: 1.82.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: cloud.google.com/go/storage
  dependency-version: 1.53.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/Azure/azure-sdk-for-go/sdk/azidentity
  dependency-version: 1.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/ClickHouse/ch-go
  dependency-version: 0.66.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/ClickHouse/clickhouse-go/v2
  dependency-version: 2.35.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/aws/aws-sdk-go-v2/feature/s3/manager
  dependency-version: 1.17.77
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/aws/aws-sdk-go-v2/service/applicationautoscaling
  dependency-version: 1.36.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/aws/aws-sdk-go-v2/service/athena
  dependency-version: 1.50.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/aws/aws-sdk-go-v2/service/ec2
  dependency-version: 1.224.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/aws/aws-sdk-go-v2/service/ecs
  dependency-version: 1.57.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/aws/aws-sdk-go-v2/service/glue
  dependency-version: 1.113.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/aws/aws-sdk-go-v2/service/iam
  dependency-version: 1.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/aws/aws-sdk-go-v2/service/identitystore
  dependency-version: 1.28.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/aws/aws-sdk-go-v2/service/rds
  dependency-version: 1.96.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/aws/aws-sdk-go-v2/service/redshiftserverless
  dependency-version: 1.27.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/aws/aws-sdk-go-v2/service/s3
  dependency-version: 1.80.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/aws/aws-sdk-go-v2/service/ssoadmin
  dependency-version: 1.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/docker/docker
  dependency-version: 28.2.2+incompatible
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/go-jose/go-jose/v4
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/go-logr/logr
  dependency-version: 1.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/go-webauthn/webauthn
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/google/go-containerregistry
  dependency-version: 0.20.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/google/go-tpm
  dependency-version: 0.9.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/googleapis/gax-go/v2
  dependency-version: 2.14.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/grpc-ecosystem/go-grpc-middleware/v2
  dependency-version: 2.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/jackc/pgx/v5
  dependency-version: 5.7.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/mark3labs/mcp-go
  dependency-version: 0.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/oracle/oci-go-sdk/v65
  dependency-version: 65.92.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/pquerna/otp
  dependency-version: 1.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/prometheus/common
  dependency-version: 0.64.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/quic-go/quic-go
  dependency-version: 0.52.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/shirou/gopsutil/v4
  dependency-version: 4.25.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/sigstore/protobuf-specs
  dependency-version: 0.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/snowflakedb/gosnowflake
  dependency-version: 1.14.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/tidwall/pretty
  dependency-version: 1.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: gitlab.com/gitlab-org/api/client-go
  dependency-version: 0.129.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: go.etcd.io/etcd/api/v3
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: go.etcd.io/etcd/client/v3
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc
  dependency-version: 0.61.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  dependency-version: 0.61.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: go.opentelemetry.io/otel
  dependency-version: 1.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace
  dependency-version: 1.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
  dependency-version: 1.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
  dependency-version: 1.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: go.opentelemetry.io/otel/sdk
  dependency-version: 1.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: go.opentelemetry.io/otel/trace
  dependency-version: 1.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: go.opentelemetry.io/proto/otlp
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: golang.org/x/crypto
  dependency-version: 0.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: golang.org/x/net
  dependency-version: 0.40.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: golang.org/x/oauth2
  dependency-version: 0.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: golang.org/x/sync
  dependency-version: 0.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: golang.org/x/sys
  dependency-version: 0.33.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: golang.org/x/term
  dependency-version: 0.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: golang.org/x/text
  dependency-version: 0.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: google.golang.org/api
  dependency-version: 0.233.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: google.golang.org/genproto/googleapis/rpc
  dependency-version: 0.0.0-20250528174236-200df99c418a
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: google.golang.org/grpc
  dependency-version: 1.72.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: helm.sh/helm/v3
  dependency-version: 3.18.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: k8s.io/api
  dependency-version: 0.33.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: k8s.io/apiextensions-apiserver
  dependency-version: 0.33.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: k8s.io/apimachinery
  dependency-version: 0.33.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: k8s.io/apiserver
  dependency-version: 0.33.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: k8s.io/cli-runtime
  dependency-version: 0.33.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: k8s.io/client-go
  dependency-version: 0.33.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: k8s.io/component-base
  dependency-version: 0.33.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: k8s.io/kubectl
  dependency-version: 0.33.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: sigs.k8s.io/controller-runtime
  dependency-version: 0.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
...

Signed-off-by: dependabot[bot] <support@github.com>

* upgrade submodule deps

* rollback github.com/go-webauthn/webauthn

* replace otelgrpc interceptors with stats handlers

* update KEXAlgos

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Marco Dinis <marco.dinis@goteleport.com>
Co-authored-by: Tim Ross <tim.ross@goteleport.com>
 2025-06-11 18:59:19 +00:00
Przemko Robakowski 28f78c3d09 Simplify code around latency detection for desktop (#54795) 
* Simplify code around latency detection for desktop

* cleanup

* Use tdp.Conn for client and server

* Add check for context cancellation

* Cleanup

* remove context check

* remove context check

* remove unused field

* use sync.OnceFunc, error on unexpected ping

* err message
 2025-05-19 10:34:03 +00:00
Grzegorz Zdunek 6ab3d71d86 Add ProxyWindowsDesktopSession API (#54280) 
* Extract reusable function for establishing connections to Windows Desktop Service

* Add `ProxyWindowsDesktopSession` proto

* Implement `ProxyWindowsDesktopSession`

* Enable fetching desktops and desktop services in remote proxy cache

* Implement dialing windows desktop

* Implement client

* Use `utils.ShuffleVisit`

* Improve stream cancellation handling

* Leave a TODO about ListWindowsDesktops

* Do not return empty data slice

* Provide non-nil src and dest addresses to `streamutils.NewConn()`

* Do not emit an empty message to indicate a successful connection

* Fix test

* Simplify code

* Require that the first message is only a dial request and the subsequent ones are only data

* Add explicit `stop()` check

* Hold cluster name and desktop name in a struct for the map key

* Do not return early on non-connection problem errors

* Handle io.EOF error specifically in BidiStreamingClient.Send instead of in `tlsConn.HandshakeContext`

* Post merge fixes
 2025-05-09 06:27:52 +00:00
rosstimothy ef859498bc Vendor gravitational/trace/trail in api (#51032) 
* Vendor gravitational/trace/trail in api

Pulling in the trail package directly in api will allow the trace
module to shed the grpc-go dependency. This needs to land prior
to https://github.com/gravitational/trace/pull/112 being included
in a new version of trace.

There should be no noticable change in the api depdency tree since
it already depends on grpc-go. Some additional items from the
trace/internal package were also vendored within trail as needed.
Additionally, some of the public api of trail that was not being
consumed has been made private.

* fix: appease linters
 2025-01-14 21:04:01 +00:00
Nic Klaassen 0a0d4137db eliminate rsa.GenerateKey and lib/auth/native (#47768) 2024-10-21 20:55:22 +00:00
Grzegorz Zdunekandjoerger bd6fdbf2c1 Cache PIV connections to share across the program execution (#47091) 
* Cache yubikey objects.

* Cache PIV connections to share across the program execution.

* Do not release the connection until `sign` returns

* Do not ignore errors

* Perform a "warm up" call to YubiKey

* Fix tests

* Use a specific interface to check if the key can be "warmed up"

* Allow abandoning `signer.Sign` call when context is canceled

* Make sure that the cached key is valid for the given private key policy

The reason for adding this check was failing `invalid key policies` test.

* Make `hardwareKeyWarmer` private

* Force callers to release connection

* Improve comments

* Fix lint

* Improve `connect` comment

* Fix race condition

* Simplify `release` logic

* Trigger license/cla

---------

Co-authored-by: joerger <bjoerger@goteleport.com>
 2024-10-16 08:02:17 +00:00
Alan Parra be520a30e9 chore: Bump google.golang.org/grpc/cmd/protoc-gen-go-grpc to v1.5.0 (#44739) 
* chore: Bump google.golang.org/grpc/cmd/protoc-gen-go-grpc to v1.5.0

* Update generated protos

* Fix various Unimplemented{Service}Server pointer embeds
 2024-07-29 15:05:34 +00:00
Hugo Shaka 26f9b77948 Support detecting a credential expiry (#43886) 
* Support detecting a credential expiry

* Fix Expiry() and add tests

* protect identityFile cred with a lock

* add godoc

* Fix tests
 2024-07-11 02:57:14 +00:00
Noah StrideEdoardo SpadolinirosstimothyTim Buckley
 		a298b3cf5e Introduce long-lived SSH proxy for Machine ID (#42592) 
* Skeleton out SSHProxyService

* Skeleton out actual service implementation

* Simple unit tests for yaml/validation

* Add main config file unit test

* Crudely copy in the connection handle code

* Copy in basic setup code

* Add rudimentary "dial cycler"

* Tidy up handling of listener closure

* Add basic prometheus metrics

* Add ssh proxy command connect

* Fix crashes

* Make session resumption enabled by default

* Use `utils.ProxyConn`

* last few changes before i convert to socks5

* Rename socket

* Add support for loading proxy templates

* Tidy up logging

* rename to multiplexer

* Fix up a few bits

* Generate artifacts on initial start

* Support specifying command and subcommand

* Add identity generation and renewal to ssh multiplexer

* Tidy up code post-identity generation

* Tidy up logging for connection multiplexing/proxying

* Americanize spellings

* Info( -> InfoContext(

* stash

* Replace low-level cycler with higher-level but broken cycler

* Remove reference to grpcClientConnInterfaceCloser

* minor tweaks and fixes to the cycler

* Fix lone tab in the ssh_config template

* Better metrics

* Fix ineff assign

* Simplify config for custom muxcommand

* Start wrtiign test

* Fix broken fdpass

* Potentially flaky but working test

* Switch to NULL delimited

* Tidy up tests

* Remove commented out code

* Drain buffer after the conn resumption has been enabled

* Change socket name to `v1.sock`

* Switch away from JSON

* Switch to ProxyCommand style config for overrides

* Switch to `filepath`

* Update lib/tbot/service_ssh_multiplexer.go

Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>

* Update lib/tbot/ssh/ssh.go

Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>

* Update lib/tbot/service_ssh_multiplexer.go

Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>

* Absolute paths

* Remove unused dep

* Update lib/tbot/service_ssh_multiplexer.go

Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>

* Update lib/tbot/ssh/ssh.go

Co-authored-by: Tim Buckley <tim@goteleport.com>

* Drain buffer as part of proxying goroutine

* Fix missing godoc

* Missing godoc

* Add test for connection cycler

* Update lib/tbot/service_ssh_multiplexer.go

Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>

* Simpler buffer draining

* Fix race in test

* More generous time outs

---------

Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Co-authored-by: Tim Buckley <tim@goteleport.com>
 2024-06-11 11:45:58 +00:00
rosstimothyandEdoardo Spadolini 7a7f982ed9 Add tbot ssh-proxy-command (#41346) 
The new subcommand is meant to be a replacement for tbot proxy ssh
which does the ssh proxying entirely within tbot to reduce resource
consumption. The old mechanism spawned a tsh process to perform the
proxying which leads to increased CPU and memory consumption - which
can be quite problematic when used as an OpenSSH ProxyCommand for
an ansible playbook.

The new command also deviates in behavior from tsh proxy ssh in that,
for the moment, it requires users to explicitly dictate whether
tls routing, alpn connection upgrades instead of guessing by making a
call to webapi/ping. This again turns out to be quite resource
intensive when tbot is used as an OpenSSH ProxyCommand for an ansible
playbook.

In the future tbot can look this information up out of band and store
it in the proper location so that tbot ssh-proxy-command can consume
it directly without users needing to provide it. The behavior as is
provides a path toward the future while also allowing users to gain
the performance improvements now.

Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
 2024-05-10 21:05:47 +00:00
rosstimothy 29430d699f Migrate Connect to use client.ClusterClient instead of client.ProxyClient (#40562) 
Updates #38239.
 2024-04-23 13:39:06 +00:00
Edoardo Spadolini e96f103954 Fix some gRPC-tunneled connections (#40632) 
* Fix some gRPC-tunneled connections

* Fix tests checking the return value of dial()
 2024-04-18 16:11:00 +00:00
rosstimothy ad26913c71 Load appropriate TLS config for clusters (#40293) 
Updates the proxy.Client to allow loading specific tls.Config for
individual clusters. This prevents issues when trying to access
leaf resources via the root cluster if WithAllCAs is not set.
 2024-04-09 16:02:28 +00:00
rosstimothy ad2d83c42c Attempt to make TestClient_DialHost more reliable (#38856) 
Takes inspiration from https://github.com/gravitational/teleport.e/pull/1944
which addressed similar EOF error showing up when driving streams
in tests.

From https://pkg.go.dev/google.golang.org/grpc#ClientStream.SendMsg:

> // SendMsg is generally called by generated code. On error, SendMsg aborts
> // the stream. If the error was generated by the client, the status is
> // returned directly; otherwise, io.EOF is returned and the status of
> // the stream may be discovered using RecvMsg.
 2024-03-01 18:46:21 +00:00
STeve (Xin) Huang e192ad386e Propagate user-agent from GRPC for cert.create events (#37726) 
* Add user-agent to cert.create event

* fix tctl and minor stuff

* fix integration test
 2024-02-08 20:39:43 +00:00
Edoardo Spadolini b5512bf418 Unblock Read and Write when closing a grpc transport Conn (#37343) 2024-01-26 17:22:29 +00:00
Zac Bergquist 44a6bb1933 Use pkg slices from the standard library (#35905) 
Prefer the stdlib version of the experimental package.
Includes a depguard update to prevent future regressions,
as well as an e-ref update to appease depguard.

Generated with:

    $ gofmt -w -r '"golang.org/x/exp/slices" -> "slices"' . && \
        make fix-imports
 2023-12-19 23:06:53 +00:00
rosstimothy 9be0b678c3 Add latency diagnostic to tsh (#35679) 
The new `tsh latency` command allows visualizing latency to
resources in real time. Currently, supported is limited to SSH
instances, but may be extended to anything that implements a
`latency.Pinger` to support other protocols in the future.
 2023-12-19 20:55:17 +00:00
Noah Stride 634de05c42 Remove Dialer(client.Config) from Credential interface (#34833) 
* Remove `Dialer(client.Config)` from Credential interface

* Re-add support for address-less configuration

* Only use profile address if none are explicitly provided

* Try all methods with credential provided address

* Fall back to address from credential

* Remove log message

* Adjust log message

* Spell explicitly correctly

* Formalize CredentialsWithDefaultAddrs interface

* GetDefaultAddrs -> DefaultAddrs
 2023-11-29 08:43:07 +00:00
dependabot[bot]andTim Ross 286ae03314 Bump the go group in /api with 6 updates (#34488) 
* Bump the go group in /api with 6 updates

Bumps the go group in /api with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.45.0` | `0.46.0` |
| [go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.45.0` | `0.46.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlptrace](https://github.com/open-telemetry/opentelemetry-go) | `1.19.0` | `1.20.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc](https://github.com/open-telemetry/opentelemetry-go) | `1.19.0` | `1.20.0` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.14.0` | `0.15.0` |
| [golang.org/x/net](https://github.com/golang/net) | `0.17.0` | `0.18.0` |


Updates `go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc` from 0.45.0 to 0.46.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.45.0...zpages/v0.46.0)

Updates `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` from 0.45.0 to 0.46.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.45.0...zpages/v0.46.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace` from 1.19.0 to 1.20.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.19.0...v1.20.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc` from 1.19.0 to 1.20.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.19.0...v1.20.0)

Updates `golang.org/x/crypto` from 0.14.0 to 0.15.0
- [Commits](https://github.com/golang/crypto/compare/v0.14.0...v0.15.0)

Updates `golang.org/x/net` from 0.17.0 to 0.18.0
- [Commits](https://github.com/golang/net/compare/v0.17.0...v0.18.0)

---
updated-dependencies:
- dependency-name: go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: golang.org/x/net
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
...

Signed-off-by: dependabot[bot] <support@github.com>

* Ignore otelgrpc deprecation notices

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Tim Ross <tim.ross@goteleport.com>
 2023-11-13 20:15:09 +00:00
rosstimothy d5a796c056 Enable testify lint (#34222) 
Updates our golangci-lint configuration to enable testifylint and
fixes all issues found.

Bump e ref to include gravitational/teleport.e#2567
 2023-11-06 20:38:38 +00:00
Anton Miniailo 0111c24b1e Add PROXY header getter to the grpc proxy client (#31992) 2023-09-18 21:36:06 +00:00
Brian Joerger cf6473feb9 Add gRPC error interceptors to API client (#30578) 
* Move gRPC error intercetpors to api/utils/grpc/interceptors.

* Use error interceptors in api client and mock server.

* Apply suggestions from CR.

* Unwrap FromGRPC errors in middleware.

* Use gRPC auth service in tests instead of external example service.

* It's gRPC!!!

* Fix unit test.

* Add error interceptor to proxy client.

* Fix merge conflict.
 2023-08-24 23:27:06 +00:00
rosstimothy ff6a81a8bd Removes support for legacy ssh connections to the Proxy (#30043) 
In preparation for v14 we can remove support for SSH connections
to the Proxy from the `api/proxy.Client` since all supported instances
should all be serving the TransportService.
 2023-08-09 02:10:44 +00:00
rosstimothy 8f23cd40ad Use web address when appropriate for a jump host (#25237) 
* Use web address when appropriate for a jump hosts

Determines whether the jump host provided via `tsh ssh -J` is belongs
to the Proxy SSH or Web server to ensure when using jump hosts that
connections are established directly on the target cluster.

Closes #25178

* Modify tsh tests to capture issues with jump hosts

Alters the root and leaf cluster and node names used by tsh tests
so that the root cluster is named `root` instead of `localhost` and
sets a unique `NodeName` for each cluster instead of reusing
`localnode` for both. This was masking problems in jump hosts tests
by connecting to the node in the root cluster instead of the leaf
cluster.

Some additional changes to tsh tests were made as a result of
changing the cluster and node names.

* fix proxy client tests

* update TestList to login once

* ignore TestList in flaky test detector
 2023-05-02 18:03:35 +00:00
rosstimothy b6b57bcfe8 Unify errors returned from ProxyClient when targets are ambiguous (#25004) 
Ensures that SSH and gRPC connections via `tsh` return the same
error when dialing a host fails.

Closes #24943
 2023-04-21 20:36:47 +00:00
STeve (Xin) Huang b1941aaa85 TLS routing behind LB support for Auth, SSH, Reverse tunnel (#23866) 
* ALPN connect test improvements

* fix typos

* remove extra period

* simplify error check

* moving things over

* tsh dials

* reverse tunnel

* fix auth connect

* move ping

* add ssh support

* add HTTP client support

* Move ALPN dialer, ALPN conn upgrade, Ping conn to api

* beatify

* add test

* beautify round 2

* fix timeout

* Implement alpn-ping upgrade for reversetunnel and ssh

* clean up

* fix proxy test

* minor refactor

* remove WebProxyAddr

* require IsALPNConnUpgradeRequiredFunc

* add tlsRoutingWithConnUpgradeConnect

* fix lint

* simplify

* remove debug log and change unknown upgrade type to 404

* Force new proxy client to use web proxy when TLS routing is enabled
 2023-04-14 19:22:23 +00:00
rosstimothy a5898a2a99 Convert tsh ssh to use the proxy transport service instead of ssh (#23228) 
* Convert tsh ssh to use the proxy transport service instead of ssh

In an effort to reduce latency establishing sessions `tsh ssh` is
migrating away from connecting to the Proxy via SSH in favor of
using gRPC. The SSH handshakes with the Proxy increase latency in
situations where the distance between geolocations of the client
and Proxy are large. TLS handshakes used by the gRPC service have
proven to reduce latency by ~20% in the same scenario.

A new `lib/client.ClusterClient` has been introduced that should
be used instead of `lib/client.ProxyClient` to connect to a Teleport
cluster. Most of the functionality within the `ClusterClient` was
a direct copy from the `ProxyClient`.

The `lib/client.TeleportClient` now has a `ConnectToCluster` method
which will connect to both the Proxy and Auth service via the
`api/client.ProxyClient` which first attempts to use gRPC and reverts
back to SSH to preserve backwards compatability. The `ClusterClient`
should be passed around and reused instead of following the
established pattern of `tc.ConnectToProxy` followed by a
`proxy.ConnectToCluster` to get an `auth.ClientI`.

Additionally some of the `agentless` package was refactored to reduce
dependencies and allow it to work with connections to the Proxy that
originated via gRPC instead of SSH.

Changes to the integration tests are mostly to accomodate IP Pinning
and ensure that it works for both connections established via SSH
and gPRC.

This is the final PR needed to complete #19812.

* fix typos and unify span attributes

* pass node name to ConnectToNode

* simplify jump host resetting
 2023-04-04 21:31:39 +00:00
rosstimothy d3276b2caa Make proxy.Client infer the cluster name from Proxy (#23644) 
Instead of relying on users to provide the cluster name, the client
now determines the cluster name by inspecting the certificate
presented by the Proxy during the TLS or SSH handshake. This is
required when connecting to a Proxy via a jump host since the
name of the cluster may not match the currently logged in cluster.

This is achieved by leveraging a custom `credentials.TransportCredentials`
when connecting via gRPC and a custom `ssh.HostKeyCallback` when
connecting SSH.
 2023-04-03 12:34:43 +00:00
rosstimothy 1427e194af Refactor stream.Source implementations (#23351) 
The interface smuggling within `stream.ReadWriter.Close` now checks
for `io.Closer` instead of `grpc.ClientStream` to allow clients
that need to perform additoinal closing logic besides sending a
`CloseSend` message to do so. All existing client implementations
of `stream.Source` now implement `io.Closer` so they are still
cleaned up properly.

The multiplexed ssh streams are now tied together to prevent attempts
to send a message at the same time. In addition, the client ssh
streams have been updated to only send a single `CloseSend` on which
ever protocol is terminated first.
 2023-03-22 14:33:16 +00:00
rosstimothy da61e75b36 Reuse a single grpc server in transport client tests (#23148) 2023-03-16 19:44:07 +00:00
rosstimothy 1c3188a38a Add a dedicated client to communicate with the Proxy SSH server (#22629) 
A new `api/client/proxy/Client` has been added to interact with
the SSH and gRPC servers that the Proxy serves on its SSH port.
The client will first try connecting to the gRPC server and if
that fails it will fall back to the SSH server.

Much of the SSH functionality mimics the existing behavior of the
`ProxyClient` in `lib/client`. This is the first part of phasing
out that client in favor of the new client. There will be a follow
up PR that migrates `lib/client` to make use of the new client instead.

Part of #19812
 2023-03-15 13:41:56 +00:00
rosstimothy fa3bb9ac59 Ensure that the webclient closes connections (#22832) 
The `http.Client.Transport` created in `newWebClient` wraps a
chain of `http.RoundTripper` over an underlying `http.Transport`.
Since we cannot guarantee that each `http.RoundTipper` has a
`CloseIdleConnections` method the usage of
`defer clt.CloseIdleConnections()` does not guarantee that the http
connections created during Find/Ping/etc are closed.

To prevent leaking connections implementations of `http.RoundTripper`
have added a `CloseIdleConnections` method added that forwards the
request on to the wrapped interface. The `otelhttp.Transport` does
not implement this method either so care has been taken to wrap it
in a `http.RoundTripper` which will call the root transport in
`enforceCloseIdleConnections`. An upstream issue has been filed
with otelhttp: https://github.com/open-telemetry/opentelemetry-go-contrib/issues/3543
to get the method added to their `Transport` implementation.

This wasn't noticed prior to upgrading to go1.20 becuase prior to
[this](https://github.com/golang/go/commit/4e7e7ae1406c70d9cc0809ec11105a55a60a0b70)
commit the `ReadHeaderTimeout` set on the Proxy web api http.Server
would cause the connection to appear idle and get terminated by the
server.

`TestWebClientClosesIdleConnections` was added to capture the leak
in connections as reported in #22757 and prevent any regressions.
 2023-03-10 15:21:16 +00:00
rosstimothy a4da87b1e5 Run TestService_ProxySSH_Errors serially (#22612) 2023-03-07 16:13:53 +00:00
rosstimothy 48fe7172c0 Rename ProxyService to TransportService (#22405) 
Changes the name to better align with the naming used by the rest
of the feature and to prevent ambiguity as the term proxy is quite
overloaded. This has not landed in a release yet so there are no
backward compatability concerns as nothing serves or consumes this
api yet.
 2023-02-28 18:40:06 +00:00
rosstimothy 9440763235 Implement transport client (#21947) 
Provides a client that can be used to connect to and interact with
the transport service in `lib/srv/transport`. The client abstracts
the fact that a gRPC stream is being used for the `net.Conn` created
by `DialCluster` and `DialHost`.

This also moves `lib/utils/grpc/stream` to `api/utils/grpc/stream`
so that the client and server can make use of the same stream
abstractions.

Part of #19812
 2023-02-21 14:38:57 +00:00
Vitor Enes d72ac18247 Set extra proxy headers in all tsh HTTP requests (#19766) 
Before this commit, the `tsh` HTTP requests that had the extra headers
were those that did not use `roundtrip`.
This commit leverages `http.RoundTripper.RoundTrip` to ensure that all
requests have the the extra headers.
 2023-01-11 10:29:05 +00:00
Jakub NyckowskiandAlan Parra 9c80f3802e Enable nolintlint linter (#19406) 
* Enable nolintlint linter

* Fix nolint comments in the api package

* Fix RDP client comment

* Address review comment

Co-authored-by: Alan Parra <alan.parra@goteleport.com>

* Allow unused for nolintlint linter

* Remove redundant casting

* Add comment on why allowed unused is enabled

Co-authored-by: Alan Parra <alan.parra@goteleport.com>

Co-authored-by: Alan Parra <alan.parra@goteleport.com>
 2022-12-16 21:13:58 +00:00
NajiObeid 2aad238a12 Naji/12220 socks proxy client (#17976) 
* add support for clients connecting through a socks proxy

* deps

* fixes nodes joining through socks proxyw

* linting

* linting x2

* linting x3

* address pr comments

* linting

* misspell

* pr comments

* pr comments

* linting and pr comments
 2022-11-04 17:40:26 +00:00
Gavin Frazar 1858aafa15 Fix http proxy basic auth (#13140) 
* Fix http proxy basic auth

* Update docs about HTTP CONNECT env var formats
 2022-06-23 00:27:29 +00:00
Andrew Burke e3a8fb7a0f NO_PROXY port support + special case for proxying via localhost (#11403) 
This change updates NO_PROXY handling to allow blocking specific host:port combinations, rather than just the host. It also adds a special case for downgrading requests to plain HTTP when --insecure is true and the request goes through a plain HTTP proxy at localhost (i.e. HTTP_PROXY=http://localhost).
 2022-04-04 14:23:50 -07:00