* Add hardware key service interface; Add mock service for tests.
* Add piv implementation of hardware key service.
* Remove old yubikey parsing logic in favor of hardwarekey.PrivateKeyRef.
* Remove HardwareSigner in favor of hardwarekey.PrivateKey.
* Add test; Cleanup comment; Don't require pin/touch prompts in tests with MockHarwdareKeyService by default.
* Fix tests.
* Add TODOs.
* Use unhashed digest for WarmupHardwareKey.
* Address comments.
* Fix race condition in test service.
* Address comments.
https://github.com/gravitational/teleport/issues/53050 was a result
of some expensive initialization that ended up impacting end users.
Existing benchmark tests did not cover this because they do not
actually launch the entire teleport binary.
The cost can be observed via `inittrace`, though it is documented
that the output is not stable and may be changed at any time.
```
GODEBUG='inittrace=1' ./releases/17.4.1/teleport version 2>&1 | rg '^init' | awk '{print $5 " ms " $2}' | sort -n -r | head -10
170 ms github.com/go-mysql-org/go-mysql/server
2.6 ms github.com/microsoft/go-mssqldb/internal/cp
2.6 ms github.com/goccy/go-json/internal/decoder
2.2 ms cloud.google.com/go/compute/apiv1/computepb
2.0 ms github.com/aws/aws-sdk-go/aws/endpoints
1.8 ms k8s.io/client-go/kubernetes/scheme
1.2 ms github.com/gravitational/teleport/lib/kube/proxy
1.2 ms github.com/gogo/protobuf/types
0.78 ms k8s.io/kubectl/pkg/scheme
0.73 ms github.com/gravitational/teleport/lib/kube/proxy/testing/kube_server
```
In order to cover in a stable way, new tests were added to the tool
package of each binary. The tests does one basic thing, re-execute
the test binary and exits. The re-execution is required to account
for any initialization costs that would otherwise be missed since
they happen prior to TestMain being called.
* Generate CRDs
* Update snapshots
* Add apis impl for WorkloadIdentity
* Add WorkloadIdentityReconciler
* Add test for WorkloadIdentityReconciler
* Update RBAC
* Update to include version in kind
* Fix license header
* Fix handling of well-known Struct type
* Ignore revsiion
This PR expands `NetIQResourceAssignmentRef` message to include the
`entitlements` to carry information about how a particular role/resource
is mapped into other IdPs.
Each entitlement contains information about name and specially the
`value` field where the information is carried.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Moves and duplicates Kubernetes test helpers to keep testing code
out of production binaries. Two of the most extensive init operations
in v17 stem from `lib/kube/testing/kube_server`.
```
$ GODEBUG='inittrace=1' ./releases/17.4.1/teleport version 2>&1 | rg '^init' | awk '{print $5 " ms " $2}' | sort -nr | head -5
0.93 ms github.com/gravitational/teleport/lib/kube/proxy
0.69 ms github.com/gravitational/teleport/lib/kube/proxy/testing/kube_server
0.24 ms github.com/gravitational/teleport/gen/go/eventschema
0.20 ms github.com/gravitational/teleport/lib/config
0.18 ms github.com/gravitational/teleport/api/types/externalauditstorage
$ GODEBUG='inittrace=1' ./releases/17.4.1/teleport version 2>&1 | rg '^init' | awk '{print $8 " bytes " $2}' | sort -nr | head -5
623960 bytes github.com/gravitational/teleport/lib/kube/proxy
555896 bytes github.com/gravitational/teleport/lib/kube/proxy/testing/kube_server
404008 bytes github.com/gravitational/teleport/gen/go/eventschema
402208 bytes github.com/gravitational/teleport/api/types/externalauditstorage
348112 bytes github.com/gravitational/teleport/api/utils/aws
```
To remove this package from the teleport dependency tree, testing
utilities were moved into _test.go files, and some test harness
code was duplicated between lib/kube/grpc and lib/kube/proxy.
Resulting in a difference of
```
$ GODEBUG='inittrace=1' ./build/teleport version 2>&1 | rg '^init' | awk '{print $5 " ms " $2}' | sort -nr | head -5
0.94 ms github.com/gravitational/teleport/lib/kube/proxy
0.25 ms github.com/gravitational/teleport/lib/config
0.21 ms github.com/gravitational/teleport/api/types/externalauditstorage
0.20 ms github.com/gravitational/teleport/api/utils/aws
0.15 ms github.com/gravitational/teleport/api/types/events
$ GODEBUG='inittrace=1' ./build/teleport version 2>&1 | rg '^init' | awk '{print $8 " bytes " $2}' | sort -nr | head -5
558944 bytes github.com/gravitational/teleport/lib/kube/proxy
402208 bytes github.com/gravitational/teleport/api/types/externalauditstorage
357184 bytes github.com/gravitational/teleport/api/gen/proto/go/teleport/integration/v1
348112 bytes github.com/gravitational/teleport/api/utils/aws
344896 bytes github.com/gravitational/teleport/api/types/events
```
These tests have been flaky because clockwork's BlockUntil functionality
isn't capable of blocking until the code is waiting on a timer.
The synctest package introduced in Go 1.24 doesn't suffer from this
limitation and allows us to reliably wait for the code to be blocked
on the timer's channel.
This package is experimental only available to the compiler when
the GOEXPERIMENT=synctest environment variable is set. For this reason,
the tests are hidden behind a build flag to prevent `go test` invocations
from failing for devs who haven't set the env var. The makefile does
set the variable, so `make test-go` _will_ execute the test (both
locally and in CI).
Closes#43559Closes#40842
* Update some methods in the user page to use TanStack query
* Update Storybook to allow non-localhost domains
* Update to match new hook name, fix issue when creating users
* Pass MFA response through to create user call
* Set queries and mutations to always use the network
* Update fedramp.mdx with v17 migration instructions
based on multiple customer issues, adding instructions about a required CA rotation as of v17 with our new sig algo changes
* Update fedramp.mdx
spelling fix
* Update docs/pages/admin-guides/access-controls/compliance-frameworks/fedramp.mdx
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Update fedramp.mdx
update flow based on feedback
* Update fedramp.mdx
move link and add missing word
* Update docs/pages/admin-guides/access-controls/compliance-frameworks/fedramp.mdx
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Update fedramp.mdx
remove compliant from description
* Update docs/pages/admin-guides/access-controls/compliance-frameworks/fedramp.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* add metadata
* newline
* cleanup status error
* refactor status error
* fix print
* order
* fix test on linux
* Truncate time to ms
* add host param to request
* jitter locally
* rename host to id
* rename func var
* docs: update warning on data dir on daemon guide
* docs: update wording on data dir default in daemon guide
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Use checkboxes for resource permissions (verbs)
As a prerequisite, the set of valid verbs is dynamically computed based
on the resource kinds picked for a given admin rule.
This change also narrows down the scope of compatible roles to those
that don't specify verbs that are irrelevant for a given set of resource
kinds.
Also turns action types supported by `useStandardModel()` into enums.
This makes it easier to navigate and refactor the code.
* review
* review
* Document the Systemd workload attestor
* Document the `binary_path` and `binary_hash` attribute
* Replace period with colon
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
* Add "dbus" to the linter's known words
* Better grammar
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Remove extraneous newlines in list
---------
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Brian Joerger