* Update protobuf
* Implement and test ValidateTokenWithJWKS
* Update join logic to use new method for static jwks
* Update Terraform Provider
* Update operator docs/files
* Update goldenfile
* plugins: remove outdated `sigs.k8s.io/kustomize/api` replace
This PR removes the outdated go.mod replace directive for
`sigs.k8s.io/kustomize/api` and adds the
`kustomize_disable_go_plugin_support` build tag to skip the support for
dynamic plugins.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* handle review comments
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Vendor gravitational/trace/trail in api
Pulling in the trail package directly in api will allow the trace
module to shed the grpc-go dependency. This needs to land prior
to https://github.com/gravitational/trace/pull/112 being included
in a new version of trace.
There should be no noticable change in the api depdency tree since
it already depends on grpc-go. Some additional items from the
trace/internal package were also vendored within trail as needed.
Additionally, some of the public api of trail that was not being
consumed has been made private.
* fix: appease linters
Converts most items to use servicecfg.Config.Logger instead of
servicecfg.Config.Log. The deprecated logrus logger unfortunately
cannot be removed yet as it's still used in e. Additionally all
logging within the config package was converted to use slog.
The dots cause issues with our hosting infrastructure, which returns
404s when users make requests for Kubernetes operator reference pages
with no trailing slash.
This change returns a filename from the format function in the CRD/CRD
docs generator so we can return different file names for CRDs and their
docs. It also renames CRD docs pages to include hyphens instead of dots
and underscores, and adds redirects.
* Add WorkloadIdentityLabels field to role
* Wire up access checker
* Add validation for new field
* Update CRDs
* Add to terraform provider
* Mispel some words to keep the republic happy
* Add WorkloadIdentityLabelsExpression
* Update Terraform provider
* Add to operator CRD
* PLS RUN CLA CHECK
* git_server resource and role.allow.github_permissions
* implicit RO on KindGitServer
* review comments
* fix ut
* make -C integrations/operator crd
* fix ut again
* make crds-up-to-date and make -C integrations/terraform docs
This changes the proto type (+validation) only to declutter the original PR https://github.com/gravitational/teleport/pull/49124
The real changes are in
- api/proto/teleport/legacy/types/types.proto
- api/types/access_request.go
- lib/auth/auth_with_roles.go
- lib/auth/auth_with_roles_test.go
The rest is all generated.
* Add `bitbucket` join method for Bitbucket Pipelines joining
This adds a new `bitbucket` join method that Machine ID bots can use
to authenticate to Teleport from Bitbucket Pipelines CI runs.
* Add unit tests for bitbucket joining
This also fully adds `deployment_environment_uuid` which was found to
be missing.
* Fix imports
* Update tf docs
* Docs update
* Update generated TF resources
* Attempt to work around docs linter
* Add provision token tests
* Remove pipeline_uuid and step_uuid from protos
Also, fix deploment_environment_uuid field name.
* Remove references to removed fields in tests
* Switch to go-oidc/v3 and remove now-redundant nbf check
* Fix go.mod imports for the TF provider
* Fix event-handler go.mod
* Address review feedback; add 15s timeout to fetch provider metadata
* Update lib/bitbucket/token_validator.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Fix build after constant rename
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Improve 'Please run error'
* add missing file
* fix script
* Apply suggestions from code review
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* address alan's feedback
* Update Makefile
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Update build.assets/please-run.sh
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
- Add Hierarchy utils for nested AccessList validation and handling
- Update AccessList Protos with new fields
- Update AccessList and AccessListMember types and converters with new
fields
* Add Kubernetes access section to the role editor
* Review
* Update the k8s operator docs
This also removes the mention of valid values of the Kind field, as I don't
want the external documentation to point to Teleport source files.
* Update operator CRDs and Terraform resources
* Add missing SAML MFA settings.
* Validate saml mfa settings and set fields from entity_descriptor.
* Reuse entity descriptor from base connector when applicable.
* Upate terraform schema and docs and crds.
* adding new Attribute param to custom type generator funcs and adjusting
configs to support using protoc-gen-terraform v3.0.0
* generating newly available docs for the terraform provider
* fixing new lint errors
* Allow operator secret lookup
* Document which fields can lookup secrets
* operator: support secret lookup
* fixup! operator: support secret lookup
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* lint
* add link to operator docs
* address feedback
* Revert "add link to operator docs"
This reverts commit cd812eb453.
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
In the reference page for one Kubernetes operator resource, some
Markdown links are malformed.
The issue is that some fields of custom resource definitions used by the
operator consist of arrays of anonymous objects with fields that are
also objects. When creating docs based on these fields, the operator
resource docs generator creates a malformed link reference.
This change modifies the generator to replace any spaces with hyphens
before outputting link references, causing the resulting internal links
to work correctly.
This change also does some light refactoring to remove an unnecessary
`switch` statement.
This adds support for hostname/issuer overrides, needed to support
on-prem Terraform Enterprise installs. When the new `hostname` field
is unset, behavior is changed, but when set, the JWT is validated
against it instead of `app.terraform.io`.
Additionally, this renames `join_terraform.go` to
`join_terraformcloud.go`, since that was missed during the rename
in #45574.
Integration tests only run on `api/types` changes so they don't end up validating if the crds are out of sync with protos.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Machine ID: Terraform Cloud joining
This adds a new `terraform` join method, which uses Terraform Cloud's
Workload Identity OIDC provider to provide delegated joining support
for Machine ID bots. As the Terraform provider now embeds tbot, this
means - with some light modifications - that the Terraform provider
can now join using this join method, and without any secrets.
* Address some review feedback, add first batch of tests
This addresses a few feedback items, defaulting the audience to the
Teleport cluster name and requiring allow rules specify an
organization + at least one other parameter.
Also, adds a first batch of tests.
* Update autogenerated CRD docs
* Add tests for RegisterUsingToken and provisioning token init
* Fix imports
* Fix CRD docs
* Update tfschema
* Update tf docs
* Update docstring to make it clear that `Audience` is optional
* Update manifests
* Update CRD docs
* Code review feedback; docstring fixes
* Rename lib/terraform to lib/terraformcloud
* Rename terraform -> terraform_cloud
Renames the new join method to terraform_cloud to make it clear that
it won't work for TF running elsewhere (where other join methods
should be used)
* Fix tests and docs lints
* Update api/proto/teleport/legacy/types/types.proto
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Update proto artifacts
---------
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Auto-generate operator CRD docs
We already pull JSON schema data from Teleport protobuf message
definitions in order to generate CRD manifests. Extract a shared library
from code within the existing protoc plugin for generating CRDs. This
way, we can use the library to generate docs for our CRDs with a
separate plugin, and don't need to complicate the interface for using
the existing plugin.
- Organize `integrations/crdgen` into `lib` and `cmd` directories,
turning `lib` into a package.
- Edit the `generateSchema` signature to include a function that formats
a CRD into a document, injecting separate functions for formatting the
CRD as YAML and as a docs page.
- Add Makefile targets for building the docs plugin and generating CRD
docs.
To display the resulting reference pages in the docs, this change
configures `docs/config.json` to generate the Reference section of the
sidebar from the docs directory. This requires moving the Helm reference
includes directory into `docs/pages/includes`.
* Respond to hugoShaka feedback
- Do not display the `status` field.
- Indicate that enum fields can take an integer or a string. This is
consistent with our comment conventions, which describe both the
integer and the string values for each enum option.
* Sort CRD reference page sections
Also handle duplicate page sections by including the names of parent
properties within section headings.
* Fix crdgen Makefile targets
- bring test data and hack out of `lib/`
- fix broken debug builds
- add crd-docs checks to the `crds-up-to-date` target
- trigger proto lint on CRD and CRD doc changes
- removed stale gitkeep in `docs/pages/includes/crd-docs/.gitkeep`
- split crdgen formatting logic in another file for readability
- update license header years on new files
* fixup! Fix crdgen Makefile targets
* lint files due to false positive 'generated' comment
* fixup! lint files due to false positive 'generated' comment
* Incorporate rosstimothy feedback
Remove an unnecessary package.
Also regenerate the CRD docs.
* fix debug builds and gitignore
* fixup! fix debug builds and gitignore
* Respond to rosstimothy feedback
Fix integrations/operator/crdgen/Makefile
* Fix spelling
* Fix flaky propertyTable test
Compare the unsorted slice elements, since sorting takes place on the
containing VersionSection.
---------
Co-authored-by: hugoShaka <hugo.hervieux@goteleport.com>
Gavin Frazar