* checkpoints for docker getting started guide
* adding verification commands with expected output preceeding the troubleshooting checkpoints
* adding a few more checkpoint tips
* lint error with heading
* lint error with heading
* removing duplicate suggestion and reorganizing
* pulled in master to resolve conflicts as the directory structure changed since I started drafting these updates
* edited checkpoints, formatting, and moved k8 content
* cut down the number of items in the checkpoints, rephrased some sentences, fixed link paths as they were added before the pages was moved
* created a section forcommon troubleshooting items vs so many checkpoints
* changing container to variable
* adding back the sidebar label, and added '-t' (tty) flag to docker exec command to improve text output/alignment
* post-feedback: formatting, troubleshooting content revisions
* post-feedback: formatting, and slimming down troubleshooting content
* post-feedback: formatting, and slimming down troubleshooting content
* rephrasing intro paragraph, as most prod Teleport deployments in containers are running on k8s
* followed AI suggestions and implemented suggestions on removing previous k8 content and streamlining
* cleanup, restored backup guidance
* linter flagged for list spacing - added lines
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@gmail.com>
---------
Co-authored-by: Paul Gottschling <paul.gottschling@gmail.com>
* feat: add `tctl investigate` command
Add a tctl subcommand that searches Teleport's Identity Security
activity logs. The command exposes structured filter flags mirroring
the Identity Security UI: ~19 include/exclude pairs mapping to Lucene
fields (user, resource, IP, country, etc.). Multiple values on the
same flag are OR'd; different flags are AND'd.
`--query` accepts a raw Lucene expression for cases the structured
flags can't express (wildcards, regex, OR across fields) and is
mutually exclusive with the structured filters.
Facets and events are fetched in parallel via errgroup. `total` is
derived from the `event_type` facet on the stats endpoint, so it can
drift a few percent from `len(data)` on long windows.
This PR ships JSON/YAML output only. Text rendering, the geo filter,
and the `--skill` flag land in the next PR in the stack.
* fix: address codex suggestions
* fix: update flag description
* docs: add prereqs to selinux guide
* reduced verbiage, streamlined bullets, and split the agent requirement
* minor sentence edits. also removed dupe info, we already have the first header with the rhel requirements
* Update docs/pages/zero-trust-access/management/security/selinux.mdx
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
---------
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
* Run the connection upgrade test with reversetunnelv2
* Use unwrapped connections to the auth in multiplex listener mode
* Clarify wording in debug log
* Add a test for ALPN used in direct and proxy mode
* Update godocs
* Change struct names for better clarity
* hack on migrating list RPC
* Fix tests
* Tidy up/fix tests
* Use `clientutils.CollectWithFallback`
* Use clearer c.APIClient rather than rely on embeding
* Cover ListTunnelConnections in cache test
* tweak logging
* update deprecation version
* Move fallback impls
* fix span ctx prop
* fix pagination bug when unmarshal bad
* USe t.Context()
* fix ctx propagation
* Update tunn conns to use range pattern - thanks luke
* fix unneeded dependency
* fix deprecation
* env: dev
use opaque API
* Add property-based testing for thumbnails/metadata generation
* Convert the resize test to a normal table test
* Increase the timeouts
* Reduce dimensions to avoid CI from dying
* Factor teleport-proxy-lib library chart out of teleport-cluster helm chart
* Remove 'FQDN' suffix from variable name and clean up comments
* Restored $proxy in config templates to minimize differences in review.
* Restored unnecessary changes to ingress template
* Fix unnecessary change in predeploy job
* used deep copy for .Values
* Explain renter-time _validation in comment
* Set domain for proxy config test
* Fixed snapshot and test differences
* Cleaned up comments
* Replace mistakenly removed asserts
* Added forceHAReplicas tests
* Fixed edge case of replicas=0, preserving previous behavior
* Eliminated intermediate version/majorVersion templates and used util lib templates directly
* Update examples/chart/lib/teleport-proxy-lib/templates/_ingress.tpl
Co-authored-by: Hugo Shaka <hugo.hervieux@goteleport.com>
* Removed unneeded alias for teleport-proxy-lib
* Corrected teleport-cluster schema bugs and removed teleport-proxy-lib validation not also done by schema
---------
Co-authored-by: Hugo Shaka <hugo.hervieux@goteleport.com>
* docs: distinguish host user creation from host sudoers in SSH guides
* clarified conflicting language, added missing comma to yaml as it was causing syntax errors when testing, and clarified examples
* post-feedback: clarifications and corrections
* added note about insecure-drop users
Rename encodeSessionRecordingThumbnail and its result type
sessionRecordingThumbnailResponse to the exported
EncodeSessionRecordingThumbnail and SessionRecordingThumbnailResponse so
the enterprise session search web handler can reuse the proto-to-JSON
thumbnail conversion instead of duplicating it.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Composite the cursor in Rust during ResizeCrop
* Apply code review feedback
* Update test
* Move CursorBitmap to an enum, remove Cow, avoid cloning the bitmap
* Remove dereference
* Invalidate E2E Rust cache on decoder changes
VERSION can be empty if there is an error running get-version.
Quote the arg so that empty VERSION is detected and returns
an error when running make docs.
* MWI: Ignore `user_login_state` for bots
This change is part of a fix for gravitational/teleport#63920, where
the Okta usermonitor will inadvertently create unneccessary ULS
entries for bots when they are deleted. Normally, these ULS entries
are sane, but if the bot is deleted and recreated too quickly, there's
a race.
Here's the sequence of events:
1. The user creates a bot (`tctl bots add` or similar)
2. The usermonitor watcher catches the OpPut and creates a sane ULS
entry
3. The user deletes the bot (`tctl bots rm ...`)
4. The usermonitor watcher catches the OpDelete and replaces the sane
ULS with an empty variant, with no roles or labels.
5. The user recreates the bot (`tctl bots add ...`)
6. One of two events happens first:
1. The usermonitor watcher catches the OpPut and replaces the bad
ULS with a sane variant.
2. The bot joins and receives certificates
If 6.1 occurs before 6.2, the bot joins normally and receives valid
certificates. If 6.2 occurs before 6.2, the bot is issued certs with
roles derived from the bad ULS (i.e. empty list) and fails to start
due to the invalid cert bundle.
In my testing, the race window is ~1 second. I see a ~10% failure rate
if the bot is joined within 0.5 seconds of being recreated, and a 50%
failure rate if the bot is joined immediately (well, as immediately as
tbot can start after `tctl bot add ...` returns). Bot joins generally
succeed if there's >= 1 second between recreate and join.
The associated teleport.e makes the usermonitor ignore bots so new
invalid ULS entries won't be created. However, this isn't sufficient
to fix the bug for existing clusters. This PR adds 2 additional fixes:
- `GetUserOrLoginState()` always returns the user variant for bots,
ignoring any potential ULS.
- Deleting a bot now deletes any ULS entry for the bot
See also: https://github.com/gravitational/teleport.e/pull/8773
* Fix failing test
* First Draft of teleport-session-review skill
Framework based on ACL skill
* Adds Examples and Playbook for how to use Session Search
* Add a preflight check
* Feedback from Docs
* Extra Testing on a Teleport Cloud Tenant
* Docs to Skill
* Remove local dev for now
* update locate commands to include $TSH
* Update docs/pages/identity-security/session-summaries/session-search.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Remove Filter caveats
These have been fixed
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Document user display names and how Teleport derives them
* remove redundant notes on display name behavior in user types documentation
* drop unnecessary word
* refine user display name mapping for Okta, Microsoft Entra ID, SAML/OIDC, and SCIM integrations
* refactor: streamline display name documentation across identity provider integrations
* update user display name documentation
* improve clarity and consistency in user display name documentation
* Add public docs for the CA override feature
* Use `code` blocks instead of `shell`
* Number steps as n/d. Move alternatives to H3.
* Move intro paragraphs to "How it works"
* Remove "Supported CAs" section, move its contents to other sections
* Mention specific commands in the info box
* Emphasize future growth
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Add proxy verb to kubernetes_resources
* Preserve upstream kube Status code in forwarder
* Readable comment
* Strip [scheme:]name[:port] on kube proxy paths
* Use SplitSchemeNamePort from k8s apimachinery
