* Pull condition operators into a one of
* Add wrapper structs to support repeated
* Adjust for new protos
* Fix tflint
* Start fixing tests
* Add more test cases
* More test cases
* Fix marshalling of resource
* Fix test in lib/services
We suggest that a UUID is used for agentless nodes metadata.name
field, but we do not enforce it. This causes several edge cases
and slightly weird UX in places that expect the name to be a UUID.
Most notably, this presents dialing problems for the web ui as
described in https://github.com/gravitational/teleport/issues/50914.
To allowing dialing to function in all cases for these servers,
routing has been updated to permit matches on metadata.name, however,
the match is given a lower score then a match on a UUID. This should
permit dialing, though, it may still result in ambiguity.
Closes#50914.
* Fix proto resource 153 marshalling
* Update tool/tctl/common/collection_test.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Update tool/tctl/common/collection_test.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Address feedback
- Change from Resource153AdapterV2 to ProtoResource153Adapter
- fix test failures and unmarshal proto resources properly
- add a failing round-trip proto 153 test case
- bonus: fix the table tesst reosurce create that did not support
running a single row
* Apply suggestions from code review
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* lint
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Persist Join Attributes in X509 Cert
* Use proto names when encoding
* Fix kube tests
* Fix other kube tests
* Fix interface nilness issue
* Add some tests to the TLSCA package and issuer
* Add more E2E style test that covers join attributes and workload id
* Explain test better
* Add JoinAttrs test for bots
* Remove methods no longer necesarry
* Fix imports
* Fix deprecation version
* Add comment explaining why we return even on failure
* Add GoDoc
* Fix logger
* Use auth server logger
* Remove unneccessary import
* Add initial expiry service
* Fix incorrect listAccessRequest options
* Fix linting
* Fix import order
* Check if context is done if sem aquisition fails in main loop
* Use gracefull exit context when starting expiry service
* Extend the protobuf
* Wire up DNS SAN field to issuance code
* Regenerate tfschema
* Add DNS SANs to the audit event
* Add test
* Rename to x509
* Add test/check that validates hostname generated
* Fix TS proto
* Update lib/auth/machineid/workloadidentityv1/decision_test.go
Co-authored-by: Tim Buckley <tim@goteleport.com>
---------
Co-authored-by: Tim Buckley <tim@goteleport.com>
* refactor: determine session type on stream based on watcher
* refactor(auth): early return when is teleport server
* refactor: move to function and add tests
* chore(lib): fix lint
* refactor(events): make private function
* Add UpsertTrustedClusterV2 rpc
This supersedes UpsertTrustedCluster rpc. V2 performs resource name
validation.
* Replace confusing UpsertValidationTrustedCluster name
* Use UpsertTrustedClusterV2 in tests
* Address feedback
- Remove unnecessary ping
- Update error messages
- Use skipNameValidation consts
- Validate cluster name before establishing trust
- Do not reveal cluster name in error message
- Use BadParameter instead of CompareFailed
* Use webclient.Find
* Fix test/lint
* Allow label updates
* Fix test
* Fix error handling
* Implement CreateTrustedClusterV2 and UpdateTrustedClusterV2
* Address feedback
* Minor fixes
* Move V2 RPCs to the trust service
* Update comment
* Drop V2 suffix
* Require matching revision
* Fix upsert/update revision
* Drop V2 from Create and Update APIs
* Lint: Fix typo
* First pass at trying to generate terraform provider
* Wire up types
* Fix generation of docs
* Add godoc comments
* Add tests
* Tflint and add example
Host resolution performed because labels, fuzzy search, or predicate
expressions were supplied to commands that establish connections to
a single host has historically been performed client side in tsh.
While that works in most cases, it can prevent correctly
resolving hosts in some situations, i.e. when there are ambiguous
hosts and tsh is unaware that the cluster routing strategy is set
to ROUTE_TO_MOST_RECENT.
To improve the experience, a new ResolveSSHTarget was added to
Auth to allow host resolution to be performed server side. The
resolution works in a similar manner to, and was inspired by
GetSSHTargets. In the event that the new RPC is not implemented,
because the client is newer than Auth, tsh has also been updated
to pull the cluster networking config and address any host
ambiguity if allowed.
As a result tsh scp and tsh proxy ssh should be much more
tolerant to, and still permit access in situations where
ambiguous hosts are present for some amount of time. Prior to
this the only way to connect in these situations was to find
the UUID of the correct target instance and try again after
seeing an ambiguous host error.
This commit does two changes:
- the controller now sets the rollout start time when resetting the
rollout
- the controller will not start a group if the rollout changed during
the maintenance window (checks if the rollout start time is in the
window)
This commit removes the restrictions of the autoupdate_agent_rollout and autoupdate_config schedules but adds groups validation.
It also adds some optional server-side validation that should not be enforced at the resource level.
* Add the decisionv1.Service boilerplate
* Wire decisionv1.Service to auth.GRPCServer
* Wire decisionpb.DecisionServiceClient to client.Client
* Add basic service testing
* Add protos for issuance service and attrs
* "expiry" -> "expires_at" rename
* Pull jwt/x509 svid out into own messages
* Add WorkloadIdentity/WorkloadIdentityRevision fields to SPIFFESVIDIssued
* Update package name
* Add debugging steps for DiscoverEC2 User Task issues
This PR adds a new field when getting an User Task.
Description contains a markdown document that should be displayed to the
user which helps them fix the issue with the task.
* move descriptions from api to lib
* Adds IC Account Assignments to preset `access` role
Adds the global-allow wildcards to the preset access role, allowing the `access`
role to participate in Resource Access Requests involving Identty Center
resources.
* Adds IC Account Assignments to preset `access` role
Adds the global-allow wildcards to the preset access role, allowing the `access`
role to participate in Resource Access Requests involving Identty Center
resources.
* Add default roles if not present
* Add reviewer role
* Update lib/services/presets.go
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* apply feedback
---------
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Change autoupdate proto messages
This commits does 3 changes:
- reflect the maintenance duration on the rollout in a new spec field
- add a rollout start time field in its status
- change wait_days into wait_hours
* int64 -> in32 for consistency with other fields
* UserTasks for Discover EKS: create tasks when auto enrolling fails
This PRs changes the DiscoveryService to ensure it creates UserTasks
when EKS Clusters fail to auto-enroll.
* simplify types
* Automatially add IC Account to Account Assignments Access Requests
The UI needs access to the account associated with an Account Assignment
in order to display the enclosing Account, otherwise the user will not
be able to see their assogned permission sets.
This patch automatically adds the enclosing account for any account
assignments in a resource access request and allows the user to see
ther human-friendly names in the access request listing.
* Apply suggestions from code review
Co-authored-by: Sakshyam Shah <sshah@goteleport.com>
Co-authored-by: Marek Smoliński <marek@goteleport.com>
* Code review sugestions
---------
Co-authored-by: Sakshyam Shah <sshah@goteleport.com>
Co-authored-by: Marek Smoliński <marek@goteleport.com>
* Filter IC Permission Sets based on access
If a user is granted access to an IC Permission Set via an access request,
the UI treats the referenced account as if all Permission Sets are granted.
This hides the requestable Permission Sets from the user, making it
impossible for a user to requests more Permission Sets on that account.
This patch filters the Permission Sets delivered to the UI based on whether
the user already has access the Permission Sets and marks any requestable
Permission Sets on the account.
This provides the UI with enough information to decide how to display the
Permission Set list in order to get around the issue.
* Update lib/auth/auth_with_roles.go
Co-authored-by: Marek Smoliński <marek@goteleport.com>
* Update auth_with_roles.go
---------
Co-authored-by: Marek Smoliński <marek@goteleport.com>
* Add WorkloadIdentityLabels field to role
* Wire up access checker
* Add validation for new field
* Update CRDs
* Add to terraform provider
* Mispel some words to keep the republic happy
* Add WorkloadIdentityLabelsExpression
* Update Terraform provider
* Add to operator CRD
* PLS RUN CLA CHECK
* Add custom type for list of port ranges
* Verify local port before initializing local proxy
* Call AppResolver.OnInvalidLocalPort before refusing conn
* Fix how lib/vnet.TCPAppResolver sets leafClusterName
* Refactor CannotProxyVnetConnection
This allows more reasons to be specified.
* Improve how TshdNotificationsService gets cluster names
* Let notifications override auto-removability
* Send RPC to Electron app on invalid port
* Remove impl of sort.Interface from PortRanges
* Make GetTCPPorts return PortRanges
* Test clusterName only against RootClusterName
* Don't say "local port" in UI
* Show valid ports in Connect
* Show valid ports in tsh
* Fix fake app provider in tests
Marco Dinis