* add metadata
* newline
* cleanup status error
* refactor status error
* fix print
* order
* fix test on linux
* Truncate time to ms
* add host param to request
* jitter locally
* rename host to id
* rename func var
* Client auto updates integration for tctl/tsh
* Add version validation
Fix recursive version check for darwin platform
Fix cleanup for multi-package support
* Fix identifying tools removal from home directory
* Replace ToolsMode with ToolsAutoUpdate
* Reuse insecure flag for tests
* Fix CheckRemote with login
* Fix windows administrative access requirement
Update must be able to be canceled, re-execute with latest version or last updated
Show progress bar before request is made
* Fix update cancellation for login action
Address review comments
* Add signal handler with stack context cancellation
* Use copy instead of hard link for windows
Fix progress bar if we can't receive size of package
* Replace with list in order to support manual cancel
* Download archive package to temp directory
* Decrease timeout for client tools proxy call
* Update client autoupdate proto structure
* Replace with reserved
* Fix unit tests
* Add more info in proto
* Rename proto to be aligned RFD namings
* Replace enum type for ToolsMode to string
* Expose client tools auto update for find endpoint
* Group auto update settings in find response
Log error instead returning error
Add tests auto update settings in find endpoint
Add check for not implemented error
* Add more test cases
A new SSHDialTimeout field is added to the ClusterNetworkingConfiguration
to allow cluster admins to override the default dial timeout of 30s.
The dial timeout is made available in /webapi/ping, stored in the tsh
profile, and cached on disk like other similar cluster settings so
that tsh ssh can consume the relevant information without requiring
an additional round trip to the cluster. At the moment, there is no
support for an unlimited dial timeout, as that would cause
complexity with backwards compatibility.
* Remove integration name validation from web script
Not used by the script. It is validated by the "plugins/validate"
endpoint.
* Add required frontend constants for Entra ID
* Support Azure/Entra integrations in the list
* Add IsPolicyEnabled to web config
* Allow custom URL for ButtonLockedFeature
* Add CTA_ENTRA_ID event type
* Expose TAGInfoCache for use in e
* Add LackingIgs option
* Add Entra ID icon
* Add Entra ID plugin to storybook
* Bump e for dev build
* Return underlying error in getPrivateAPIToken
* Find default Azure subscription instead of the first one
* Require user to re-login when provisioning Azure OIDC
* Update prehog protos with Entra ID values
From https://github.com/gravitational/cloud/pull/9111
* Suppress verbose warnings / information from az
* Add an additional message after successful auth
Lets user know that `az login` has completed
and `teleport` is continuing its work.
* Move EntraId constant to the bottom
* Revert unintended changes to usageevents
CTA is 1-to-1 with prehog, but IntegrationEnrollKind is not.
* Remove integrationName validation asserts from test
This parameter is no longer accepted by the endpoint
* Revert "Bump e for dev build"
This reverts commit fc747a0c33.
* webclient.Ping: Return err on unsuccessful response
* Log mangled response, add test case
* Point towards possible causes of errors
Co-authored-by: Krzysztof Skrzętnicki <krzysztof.skrzetnicki@goteleport.com>
---------
Co-authored-by: Krzysztof Skrzętnicki <krzysztof.skrzetnicki@goteleport.com>
* Add new flags to modules
* Add deprecated comments to isTeam
* Make support flag an enum
* Add a TODO instead of deprecating flag right away
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Add gogoproto.jsontag to new fields
* remove meaning from enum zero value
* Reuse proto.SupportType instead of suping
* Replace isTeam for new flags in web app
* Update proto file: rename enum 0 value to unspecified;fix json tag casing
* Reuse proto file instead of aliasing it
* undo removing method by accident
* Add MobileDeviceManagement field to web config struct
* Improve comments
* Fix tests
* Simplify lockedFeatures object
* Include JoinActiveSessions in the web config object
* Remove more instances of isTeam
* Apply suggestions from code review - improve comments
Co-authored-by: Michelle Bergquist <11967646+michellescripts@users.noreply.github.com>
* Use consistent comments to remove isTeam
* Update godocs comments
* Revert removign `isTeam` from stories it still should
* Fix godoc typo
Co-authored-by: Michelle Bergquist <11967646+michellescripts@users.noreply.github.com>
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
Co-authored-by: Michelle Bergquist <11967646+michellescripts@users.noreply.github.com>
* Revert "Restrict IGS flag check to usage based plans only (#35431)"
This reverts commit 31e1715532.
* Update test
* Pass access request monthly limit to webconfig
* Fix typo
Prefer the stdlib version of the experimental package.
Includes a depguard update to prevent future regressions,
as well as an e-ref update to appease depguard.
Generated with:
$ gofmt -w -r '"golang.org/x/exp/slices" -> "slices"' . && \
make fix-imports
* Add team and igs flag to web config
* Use isTeam and igs flag in TeleportContext
* Update ButtonLockedFeature
* Update IntegrationTiles
* Update Sessions
* Update Support
* Fix grammar
* Add clarifying comment on isUsageBasedBilling flag
* Proxy TAG requests through Auth
* Integrate Access Graph feature and optimize services
This commit entails the integration of the Access Graph feature into the existing service configuration. This feature is manifested through an 'IsEnabled' method that checks the state of the access graph. Additionally, the auth service logic now includes a flag for enabling access graph. The services have been further optimized with adjustments geared towards improving performance and readability of the code.
* Move TAG enabled flag from proxy to user setting/auth context
* Swap a pointer to AccessGraph config with a value.
* Add 'TestNewAccessGraph' function to 'useracl_test.go' file.
The function 'TestNewAccessGraph' has been added to run tests checking the configuration of Access Graph. Furthermore, a small change is made for the 'KindAccessGraph' comment in 'constants.go' to provide more accurate information.
* Implement Access Graph feature across various files
The Access Graph feature has been incorporated in 'module.go', 'authservice.proto', 'auth.go', and 'plugin.go' files. A method 'EnableAccessGraph' is also introduced in 'module.go' to allow the usage of this feature. Descriptions of Access Graph have been adjusted across files to explicitly state the feature's enablement.
* Fix tests
* Remove unused access graph feature code
This commit removes all references and uses of the access graph feature from the codebase. It also updates corresponding tests to reflect this removal. It also adds EnableAccessGraph() method to testing module to fix test compilation.
* TAG initial implementation
This change introduces the initial Teleport integration with TAG. The implementation introduces:
* new `access_graph` section in `teleport.yaml` file that holds the access graph configuration
* new `access_graph` RBAC kind, that controls who has access to TAG feature
* the new access graph RBAC kind is added to the ACL REST endpoint, so WebUI know if TAG is enabled and the user has access to it.
* Remove `UseAuth` and improve comments in `AccessGraph`
This commit removes the `UseAuth` field from the `AccessGraph` configuration. At the same time, the comments for each field in `AccessGraph` have been made more consistent and descriptive, providing clear declaration of each field's purpose. The comments in `WatchEvents` in `grpcserver.go` have also been updated for clarity.
Improves reliability of the test by eliminating the reliance of
connection states being received in the expected order. Instead all
states are sorted and compared with the expected states.
Fixes#30535
* feat: adds motd to the ui
* address review suggestions:
- update MOTD to Motd
- moved motd state to useLogin
- added behaviour tests
* add motd test to apiserver_test.go webconfig. update snapshot test to address motd warning
* git mv to update MOTD to Motd
* multiple fix:
- add unmount test
- remove motd title
- group states together in useLogin
- update arrow func to classic js func
* remove unused waitForElementToBeRemoved
* Add IsUsageBased to features and send to web UI
* Update flag name
* Improve comment
* Add comments and improve field name
* Remove duplicated property
* Use `cloud/stable` when Automatic Upgrades is on.
Teleport provides scripts to install teleport agents/services.
Those scripts use YUM/DEB repositories when possible.
Each repo has multiple channels:
- stable/v11
- stable/v12
- cloud/stable
We want to ensure that if the cluster is running in the cloud and
automatic upgrades is on (auth service was started with
TELEPORT_AUTOMATIC_UPGRADES=yes teleport ...), then the installation
script must offer the `cloud/stable` channel.
This PR changes the following scripts:
- Discover Install Node
- Discover Install Database Service
- Install App script
- EC2 default-installer and EC2 default-agentless-installer
* add helm chart knobs to enable auto updater
* use let instead of const and remove default export
* add HA to helm chart
* always return .automatic_upgrades in web ping response
* rename cloud/stable to stable/cloud
* fix ts test
A new `api/client/proxy/Client` has been added to interact with
the SSH and gRPC servers that the Proxy serves on its SSH port.
The client will first try connecting to the gRPC server and if
that fails it will fall back to the SSH server.
Much of the SSH functionality mimics the existing behavior of the
`ProxyClient` in `lib/client`. This is the first part of phasing
out that client in favor of the new client. There will be a follow
up PR that migrates `lib/client` to make use of the new client instead.
Part of #19812
Sets `http.Server.IdleTimeout` and `http.Client.IdleConnTimeout`
on clients and servers which didn't have them set. A default of
360s was chosen to be on par with the default of an NLB without
being identical.
This was added as another safety measure to prevent leaking any
idle connections indefinitely as seen in #22757.
`apidefaults.DefaultDialTimeout` was also renamed to
`apidefaults.DefaultIOTimeout` to better reflect its usage.
The `http.Client.Transport` created in `newWebClient` wraps a
chain of `http.RoundTripper` over an underlying `http.Transport`.
Since we cannot guarantee that each `http.RoundTipper` has a
`CloseIdleConnections` method the usage of
`defer clt.CloseIdleConnections()` does not guarantee that the http
connections created during Find/Ping/etc are closed.
To prevent leaking connections implementations of `http.RoundTripper`
have added a `CloseIdleConnections` method added that forwards the
request on to the wrapped interface. The `otelhttp.Transport` does
not implement this method either so care has been taken to wrap it
in a `http.RoundTripper` which will call the root transport in
`enforceCloseIdleConnections`. An upstream issue has been filed
with otelhttp: https://github.com/open-telemetry/opentelemetry-go-contrib/issues/3543
to get the method added to their `Transport` implementation.
This wasn't noticed prior to upgrading to go1.20 becuase prior to
[this](https://github.com/golang/go/commit/4e7e7ae1406c70d9cc0809ec11105a55a60a0b70)
commit the `ReadHeaderTimeout` set on the Proxy web api http.Server
would cause the connection to appear idle and get terminated by the
server.
`TestWebClientClosesIdleConnections` was added to capture the leak
in connections as reported in #22757 and prevent any regressions.
* Add UiConfig option to proxy service config
* Add uiConfig to GRV_CONFIG window object and use in terminal constructor
* Update configuration reference docs
* Remove extra structs and change property to scrollbackLines
* Update web/packages/teleport/src/config.ts
Co-authored-by: Jeff Pihach <hatched@users.noreply.github.com>
* Use a common struct and apply in applyProxyConfig
* Remove webclient dependency for fileconf
* Add missing doc comments
* Set individual properties of cfg.Proxy.UI
* Remove unneeded comment
* Add nolint rule
* Fix nolint
* Add test for UIConfig
* Cleanup tests
* Fix TestUIConfig context
* Allow dynamic config for web ui (#22097)
* Update protofiles
---------
Co-authored-by: Jeff Pihach <hatched@users.noreply.github.com>
Stephen Levine