Adds an additional type constraint go FnCacheGet and FnCacheGetWithTTL
to enforce that all keys are comparable. This should allow the
removal of various compile time hashability checks that are in
place for existing keys of custom types.
* SPIFFE X.509 issuer override: CRUD
* tctl support for workload_identity_x509_issuer_override
* Define audit log events
* Emit audit log events
* Add comments to point at the e implementation
* audit events fixtures
* Use DisallowUnknown in tctl
* Support additional claims in JWT-SVIDs
* Exclude the `extra_claims` field in Terraform
* Add a maximum nesting depth
* Add comment to clarify behavior of `PrivateClaims`
* Combine declaration with nil check
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
---------
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
When we originally broke some of the desktop access code out into
a shared windows package to help with MS SQL access we pulled too
much code. This commit just moves code that is only needed in one
package to the package where it is used, and un-exports it.
No functional changes.
Now that all backends implement backend.BackendWithItems the
temporary interface is removed and the Items method is included in
backend.Backend. All wrapper implementations, and backend mocks were
updated accordingly.
The backend reporter used to tally prometheus metrics was updated
with new metrics to track streaming requests since reusing the
batch read requests wouldn't make sense for iteration. This means
that once upstream consumers of the backend start switching from
GetRange to Items the batch read metrics will not be the complete
source of truth. The streaming metrics also lack some of the same
observability since chunk sizes and latency of reads cannot be
known at the reporter level. The only way to provide the same
batch metrics that we have today would require each backend
implementation to be responsible for updating the metrics when
performing their internal reads to supply the Items iterator.
No functional changes, just a better abstraction. LDAP can be used to
fetch metadata that is included in certificate requests, but LDAP is not
required in order to issue certificates.
* Update protobuf
* Implement and test ValidateTokenWithJWKS
* Update join logic to use new method for static jwks
* Update Terraform Provider
* Update operator docs/files
* Update goldenfile
This builds on top of #52199 by updating the firestore backend to
implement backend.BackendWithItems. Only GetRange, and not DeletRange,
was refactored to use Items to retrieve a range.
The iteration logic is slightly more complex here to ensure that
documents in the collection are produced in the correct order no
matter how the key was stored in the collection. Over the years the
key has been stored in three different formats, and no single query
will pull the items from all keys. There was a background migration
task introduced in v17 to convert all keys to a single format. The
iteration logic can be simplified once said migration is removed
and all keys can be assumed to be of a single type.
* Add config for WorkloadIdenttiyAWSRAService
* Add CLI command
* Start hacking on service impl
* Write credentials in AWS credentials file format
* Fix go.mod/go.sum
* Go mod tidy
* Add ARN validation
* Add specific config for AWS session duration/renewal
* Update golden file
* Fix gomod/gosum
* Refactor CheckAndSetDefaults
* Initialize service
* Update CLI flags
* Refactor & add tests
* Use *Context slog calls
* Update service name to include full `roles-anywhere`
* Add mocked AWS rolesanywhere API based test
* Validate region
* Capture the binary path and SHA256 checksum in the Unix workload attestor
* Increase binary size limit to 1GiB
* Make maximum binary size configurable
* Remove error-prone mount namespace check
* Document that `binary_hash` is hex-encoded
* Handle wrapped errors properly
The changes here were a result of examining CPU and memory profiles
of BenchmarkListUnifiedResources. The biggest inefficiencies stemmed
from the authorizer and `(types.Server) MatchSearch`.
When the authorizer computes lock targets it will call `(types.LockTarget) Equals`,
which was relying on proto.Equals to determine if nine strings were
equivalent. The fields are now individually checked and a test
was added to ensure that if any new fields are added they must
be added to the check for the test to pass.
ListUnifiedResources attempts to be smart and evaluate whether the
user has read/list access to a particular resource kind once. However,
it was always checking if users had access to _all_ supported resources
instead of just the resources that the user was requesting. While most
of the checks are not very expensive, checking all resources is still
worse than only checking the required resources.
Lastly, the `(types.Server) MatchSearch` implementation is no longer
allocating a slice of search fields and using `types.MatchSearch`.
Instead a variant of the loop from `types.MatchSearch` is inlined.
While this was only applied to `types.Server` it should likely
be extended to other resource types in the future - or `types.MatchSearch`
should be refactored in a way that does not require callers to allocate.
```bash
$ benchstat old.txt new.txt
goos: darwin
goarch: arm64
pkg: github.com/gravitational/teleport/lib/auth
cpu: Apple M2 Pro
│ old.txt │ new.txt │
│ sec/op │ sec/op vs base │
ListUnifiedResourcesFilter/labels-12 195.0m ± 6% 173.3m ± 2% -11.12% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_path-12 230.6m ± 3% 210.8m ± 4% -8.57% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_index-12 229.8m ± 5% 209.0m ± 7% -9.08% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_lower-12 600.6m ± 3% 364.3m ± 1% -39.35% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_upper-12 687.0m ± 2% 423.4m ± 1% -38.37% (p=0.000 n=10)
geomean 335.7m 259.5m -22.69%
│ old.txt │ new.txt │
│ B/op │ B/op vs base │
ListUnifiedResourcesFilter/labels-12 868.8Ki ± 0% 414.1Ki ± 0% -52.34% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_path-12 7.731Mi ± 0% 7.287Mi ± 0% -5.74% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_index-12 7.731Mi ± 0% 7.288Mi ± 0% -5.74% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_lower-12 22106.9Ki ± 0% 486.8Ki ± 0% -97.80% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_upper-12 22107.0Ki ± 0% 486.3Ki ± 0% -97.80% (p=0.000 n=10)
geomean 7.494Mi 1.371Mi -81.70%
│ old.txt │ new.txt │
│ allocs/op │ allocs/op vs base │
ListUnifiedResourcesFilter/labels-12 11.401k ± 0% 4.865k ± 0% -57.32% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_path-12 161.5k ± 0% 155.0k ± 0% -4.04% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_index-12 161.5k ± 0% 155.0k ± 0% -4.04% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_lower-12 162.212k ± 0% 5.277k ± 0% -96.75% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_upper-12 162.224k ± 0% 5.275k ± 0% -96.75% (p=0.000 n=10)
geomean 95.22k 20.07k -78.93%
```
The internal pagination allows the read lock to be held for
shorter intervals, and most crucially, cannot be held open while
consuming the iterator. This eliminate issues that may arise by
executing slow operations during iteration which may starve writes.
* Update references to renamed features
Renames:
- Teleport Policy to Teleport Identity Security
- Teleport Identity to Teleport Identity Governance
* Capitalize the constants
* satisfy Go lint
* Rename FeatureNames to FeatureName
* prototype
* add server name and fix ut
* reduce scope
* fix ut and check client ip
* minor refactor
* remove extra check
* fix GetClusterName after merge
* fix lint
* feat: MenuLoginWithActionMenu component
* update MenuLogin to accomodate changes for MenuLoginWithActionMenu
* handle samlAppLaunchUrls in makeapp.ts
* update saml app login button
* update app.go to return SAMLAppLaunchURLs
* resource action button:
- added test and story
- handles both action and non-action buttons
* launchExternalUrl props for MenuLogin to open url with <a> tag
* handle memu login onClick to apply onClose callback
* use same comment over be and fe, app_test.go
* add isExternalUrl to LoginItem type instead of MenuLoginProps
* use text-align:left, update story
* proper js comment tag
* extend MenuInputType with NONE value
* update resourceActionButton story
* address review comments
* remove unused waitfor
This adds a new field, UseAnyProxyPublicAddr, that will be used to
tell the web api/ui to rebuild the request app's FQDN based on the proxy
public addr that the request came from (upcoming PR to consume this)
* Convert autoupdate version handling to coreos/go-semver
* get the right version in installer endpoint + get rid of x/mod/semver
* depguard x/mod/semver
* Add nolint rules for existing x/mod/semver usages
* Add depguard explanation
This commit adds two new singular resources to the Terraform provider:
teleport_version and telpeort-config.
Both got added using the resource 153 pattern (new protoc-X.yaml file)
and it went pretty seamless.
The only specific is that I had to add a provider feature to
automatically set singular resource names as we don't run
CheckAndSetDefaults() locally anymore. This got merged in a separate PR.
rosstimothy