* Generate CRDs
* Update snapshots
* Add apis impl for WorkloadIdentity
* Add WorkloadIdentityReconciler
* Add test for WorkloadIdentityReconciler
* Update RBAC
* Update to include version in kind
* Fix license header
* Fix handling of well-known Struct type
* Ignore revsiion
* Update protobuf
* Implement and test ValidateTokenWithJWKS
* Update join logic to use new method for static jwks
* Update Terraform Provider
* Update operator docs/files
* Update goldenfile
Use Docusaurus syntax for admonitions so the docs engine does not need
to replace these. This is one step toward removing the
`remark-update-tags` plugin. See: gravitational/docs-website#94
Relevant commands are included below to make reproducing this work
easier.
1. Replace all `Notice` tags with `Admonition` tags.
2. Add `type="info"` if an Admonition is missing a type.
To find instances:
```
find docs/pages -name "*.mdx" -exec awk '
BEGIN{a=0}
a==0 && /<Admonition/{ a = 1 }
a==1 && /type/{t = 1}
a==1 && />/{ a = 0; if(t == 0) print FILENAME ":" FNR }' {} \;
```
3. Replace `type="notice"` with `type="note"`.
To find instances:
```
find docs/pages -name "*.mdx" -exec awk '
BEGIN{a=0}
a==0 && /<Admonition/{ a = 1 }
a==1 && /type="notice"/{t = 1}
a==1 && />/{ a = 0; if(t == 1) print FILENAME ":" FNR }' {} \;
```
Fixes#51181.
K8S `Role` & `RoleBinding` are created by default. Their creation does not depends on the `ServiceAccount` creation anymore.
Co-authored-by: maximumG <maxime.gerges@backmarket.com>
* kube-agent-update: Use the RFD-184 webapi proxy update protocol by default when possible
* Update integrations/kube-agent-updater/cmd/teleport-kube-agent-updater/main.go
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* log update group
---------
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Remove v13 mentions in the docs
Our policy is to remove mentions of the version prior to the most recent
deprecated version.
This change includes mentions of v13 in Helm chart values file comments.
* Clarify distroless images in Helm values
Responds to hugoShaka feedback.
* Add WorkloadIdentityLabels field to role
* Wire up access checker
* Add validation for new field
* Update CRDs
* Add to terraform provider
* Mispel some words to keep the republic happy
* Add WorkloadIdentityLabelsExpression
* Update Terraform provider
* Add to operator CRD
* PLS RUN CLA CHECK
One edge case is the `structure.architecture-h2` warning in
`docs/pages/includes/database-access/rds-proxy.mdx`. This is technically
correct, since the "How it works" section is before the "Prerequisites"
section. We can determine whether this is a bug to fix in a separate
change.
* feat(charts): Give the possibility to add labels on more resources
Currently it's possible to add labels on Jobs but not on Pods created by the Job. Let's allow it.
Same problem on operator subchart for deployments and pod created by the deployment.
* Fix doc indentation
* fix typo
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: emmanuel.lagree <emmanuel.lagree@mirakl.com>
Co-authored-by: Emmanuel Lagrée <36861662+elagree@users.noreply.github.com>
* git_server resource and role.allow.github_permissions
* implicit RO on KindGitServer
* review comments
* fix ut
* make -C integrations/operator crd
* fix ut again
* make crds-up-to-date and make -C integrations/terraform docs
This changes the proto type (+validation) only to declutter the original PR https://github.com/gravitational/teleport/pull/49124
The real changes are in
- api/proto/teleport/legacy/types/types.proto
- api/types/access_request.go
- lib/auth/auth_with_roles.go
- lib/auth/auth_with_roles_test.go
The rest is all generated.
* Add `bitbucket` join method for Bitbucket Pipelines joining
This adds a new `bitbucket` join method that Machine ID bots can use
to authenticate to Teleport from Bitbucket Pipelines CI runs.
* Add unit tests for bitbucket joining
This also fully adds `deployment_environment_uuid` which was found to
be missing.
* Fix imports
* Update tf docs
* Docs update
* Update generated TF resources
* Attempt to work around docs linter
* Add provision token tests
* Remove pipeline_uuid and step_uuid from protos
Also, fix deploment_environment_uuid field name.
* Remove references to removed fields in tests
* Switch to go-oidc/v3 and remove now-redundant nbf check
* Fix go.mod imports for the TF provider
* Fix event-handler go.mod
* Address review feedback; add 15s timeout to fetch provider metadata
* Update lib/bitbucket/token_validator.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Fix build after constant rename
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Closes#43181
Address inconsistent information between the Event Handler README and
step-by-step guides by using the information in the step-by-step guides,
which is more in line with our current recommendations.
- Add Hierarchy utils for nested AccessList validation and handling
- Update AccessList Protos with new fields
- Update AccessList and AccessListMember types and converters with new
fields
* Add Kubernetes access section to the role editor
* Review
* Update the k8s operator docs
This also removes the mention of valid values of the Kind field, as I don't
want the external documentation to point to Teleport source files.
* Update operator CRDs and Terraform resources
Noah Stride