* Move `CertificateTTL` and `RenewalInterval` into a `CertificateLifetime` struct
These values are always required together, and moving them into a struct will
make it more straightforward to override them per-service/output.
* Support custom `certificate_ttl` and `renewal_interval` on identity output
* Support custom `certificate_ttl` and `renewal_interval` on application output
* Support custom `certificate_ttl` and `renewal_interval` on application tunnel
* Support custom `certificate_ttl` and `renewal_interval` on Kubernetes output
* Support custom `certificate_ttl` and `renewal_interval` on Kubernetes V2 output
* Support custom `certificate_ttl` and `renewal_interval` on database tunnel
* Support custom `certificate_ttl` and `renewal_interval` on SSH host output
* Support custom `certificate_ttl` and `renewal_interval` on SSH multiplexer
* Support custom `certificate_ttl` and `renewal_interval` on SPIFFE SVID output
* Support custom `certificate_ttl` and `renewal_interval` on database output
* Support custom `certificate_ttl` and `renewal_interval` on workload API
* Support custom `certificate_ttl` and `renewal_interval` on workload identity output
* Add `GetCertificateLifetime` to service config interface
* Update the docs
* Add more examples to the standard config
* Rename `CertificateLifetime` to `CredentialLifetime`
So it can be used for non-certificate credentials like JWTs
* Deprecate `certificate_ttl` option and replace it with `credential_ttl`
* Return TTL warnings as errors and let the caller decide what to do with them
* Add `CredentialLifetime` to the "full" service config tests
* Support `credential_ttl` and `renewal_interval` in workload-identity-jwt service
* Silence sloglint
* Replace duplicated helper with `cmp.Or`
* Vendor gravitational/trace/trail in api
Pulling in the trail package directly in api will allow the trace
module to shed the grpc-go dependency. This needs to land prior
to https://github.com/gravitational/trace/pull/112 being included
in a new version of trace.
There should be no noticable change in the api depdency tree since
it already depends on grpc-go. Some additional items from the
trace/internal package were also vendored within trail as needed.
Additionally, some of the public api of trail that was not being
consumed has been made private.
* fix: appease linters
* Remove all direct logrus usage from teleport module
The only remaining use of logrus is from integrations, which is
unfortunately imported by teleport.e, and prevents logrus from
being moved to an indirect dependency. The logrus formatter and
initialization of the logrus logger will remain in place until
integrations is using slog. To prevent any accidental inclusions
of logrus within the teleport module the depguard rules have been
updated to prohibit importing logrus. The rules also include
prohibit a few common log packages that tools like gopls might
automatically import.
* Refactor logger initialization
Consolidates configuring of global loggers to a single function.
This is mainly to facilitate configuring the logger for
teleport scp, but will also allow us to remove the copy of logger
initialization that currently exists in integrations/lib/logger.
* fix: document ValidateFields
* fix: remove copied yaml tags
* fix: update file path comment
Converts most items to use servicecfg.Config.Logger instead of
servicecfg.Config.Log. The deprecated logrus logger unfortunately
cannot be removed yet as it's still used in e. Additionally all
logging within the config package was converted to use slog.
Plugins build without CGo, so they can't import (directly or indirectly)
any packages that require CGo.
In #47045 we added a lib/config import to pull in a constant, which
added a large dependency tree that included CGo dependencies.
Fix the builds by duplicating the constant and avoiding the import.
* key split wip
* fix piv tests
* fix terraform tests
* spelling fixes
* fix kube benchmark
* fix identity files in integrations tests
* self review
* fix typo in comment
Co-authored-by: Bernard Kim <bernard@goteleport.com>
* speed up device login tests
* use EC keys in TestProxyAppWithIdentity
* faster tsh tests
* fix race on error value
* fix lint
* write out EC SSH keys in OpenSSH format
* fix lint
* fix keyring comparisons
* PrecomputeTestKeys in lib/client
* parallelize TestNoRelogin subtests
* use ecdsa for self-signed TLS certs
* remove redundant GetTrustedCerts
* improve latency of precomputeTestKeys
Instead of waiting for all 25 test keys before returning a single one,
tests can now make use of the first precomputed test key as soon as it's
ready.
In local testing with this change, the first key is ready after ~75ms vs
>350ms on master.
* fix test and lint
---------
Co-authored-by: Bernard Kim <bernard@goteleport.com>
SIGUSR1 can now be used to trigger capturing various pprof profiles
from any integrations that opt in to providing the support. At the
moment only the event-handler implements handling the signal. It
stores all profiles under `<storage_dir>/profiles`.
* Prevent AMRs being watched if access monitoring is not enabled
* Log and ignore AMRs if cache initialisation fails
* Update integrations/access/accessrequest/app.go
Co-authored-by: Marco Dinis <marco.dinis@goteleport.com>
* Use allowPartialSuccess when watching over changing watch kinds
* Add ability to get confirmed watch kinds from watch job
* Add test coverage for newJobWithConfirmedWatchKinds
* Swap watcher accepted kinds logic to use callback instead of channel
* Update test for watcherjob
* Add check for unset init callback to watcherjob
* Remove unneeded retry utility
* Remove unused import
* Remove retry logic from watcherjob tests
* Fix linting
* Add clarifying comments and better error message
* Remove unused import
---------
Co-authored-by: Marco Dinis <marco.dinis@goteleport.com>
Teleport had 3 dependencies to parse semantic versions:
- golang.org/x/mod/semver
- github.com/coreos/go-semver/semver
- github.com/hashicorp/go-version
The last of the three was only used in `integrations/lib.AssertServerVersion`
which was a clone of `lib/utils.CheckVersion`. By converting all
code in integrations to use `lib/utils.CheckVersion` the direct
dependency on github.com/hashicorp/go-version can be dropped. The
depguard rules have also been updated to prevent it from sneaking
back into the dependency tree. A follow up change will further
consolidate semver dependencies to a single package.
* Add initial condition parser for access monitoring rules
* Update integrations/access/accessrequest/app.go
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Check previously unchecked error and minor refactor of AMR
* Simplify check for applicable access monitoring rules
* Refactor access monitoring rules plugin integration
* Fix formating and move lock aquisition
* Add methods for listing access monitoring rules with a filter
* Add contains_any predicate expression func
* Add in is_empty func to predicate expression
* Lock AMR cache in plugins while getting initial rules
* Add in check for access monitoring rule version
* Update integrations/access/accessrequest/app.go
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Update integrations/access/accessrequest/app.go
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Move lock so it doesnt persist over api calls
* Remove unused constant and add more context to logs
* Appease linter
* Update access monitoring rules tests to pass rule validation
* Add in missing access monitoring rules list with filter code
* Appease linter
* Add back validation code for AMRs
* Fix test plugin role and rename listaccessmonitoringrulewithfilter
* Fix local test for AMR crud operations
* Fix end range for listing rules
* Fix unwrapping of resource153 event for monitoring rules
* Refactor AMR cache init into helper function in plugin app
* Add seperate response type for listAccessMonitoringRulesWithfilter
* Add context to log for plugins failing to fetch recipients
* Grab access monitoring rules cache under lock all at once
* Add clarification for which fields are optional in listAMRfilter req
* Update integrations/access/accessrequest/app.go
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Update integrations/access/accessrequest/app.go
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Add forEach to common recipient set
* Move type check to after AMR event op switch
* Move turn some default parser spec methods to funcs
* Make some predicate func usable as methods as well
* Add len func to common recipient sets
* Add integration test for access monitoring rule and slack plugin
* Fix error types and messages when handling AMRs
* Use generic list resource with filter for AMR
* Add test for generic listResourceWithFilter
* Update listResourceWithFilter to use revision instead of id
* Update generic tests to use revision instead of id
* Fix linting
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Vendor event-forwarder plugin
* fix tests + add Makefile + CI
* lint
* Fix broken test
* use a separate go.mod
* ignore event-handler in flaky tests + update go.mod
* go mod tidy
Similar to https://github.com/gravitational/teleport/pull/39315,
this updates the integrations test suite to use a regular
expression that will match output to know when the ssh_service is
ready now that Teleport is using slog instead of logrus.
* Bump github.com/gravitational/trace from 1.3.1 to 1.4.0
## Changelog
- Bump google.golang.org/grpc from 1.43.0 to 1.53.0 by @dependabot in #94
- Bump golang.org/x/net from 0.8.0 to 0.17.0 by @dependabot in #100
- Bump google.golang.org/grpc from 1.53.0 to 1.56.3 by @dependabot in #101
- Bump golang.org/x/crypto from 0.14.0 to 0.17.0 by @dependabot in #105
## Breaking Changes
- Remove logrus dependency by @rosstimothy in #107
- Remove references to UDP logrus hook from README by @rosstimothy in #108
Full Changelog: https://github.com/gravitational/trace/compare/v1.3.1...v1.4.0
* remove final references to removed trace functionality
* fix: formatter error handling
The change to migrate the TeleportProcess to use slog in
https://github.com/gravitational/teleport/pull/38551 was preventing
the regular expressions used by the operator tests to determine
when auth and proxy were ready. This lead to the tests hanging indefinitely
until the go test framework timed out. To remediate, the regular
expressions have been updated to match the output when using slog.
For example, the test was expecting the output in the format of:
```
Auth service 15.0.0:v15.0.0-0-ge126e8cd is starting on 192.168.50.108:3025. pid:61933.1 service/service.go:2072
```
#38551 moved the listen address to a field instead of being formatted
in the message:
```
Auth service is starting. pid:54159.1 version:16.0.0-dev git_ref:api/v13.4.16-31-g2b9ae35e31 listen_address:127.0.0.1:63152 service/service.go:2107
```
Adds the new linter and configures it to prevent direct error
comparisions and type assertions in favor of errors.Is and errors.As.
All current violations caught by the linter have been updated
accordingly.
* Remove `Dialer(client.Config)` from Credential interface
* Re-add support for address-less configuration
* Only use profile address if none are explicitly provided
* Try all methods with credential provided address
* Fall back to address from credential
* Remove log message
* Adjust log message
* Spell explicitly correctly
* Formalize CredentialsWithDefaultAddrs interface
* GetDefaultAddrs -> DefaultAddrs
* Introduce scaffolding for access list Slack notification.
The initial scaffolding for notification of the need for reviews for access
lists has been introduced. This is not expected to do anything just yet, but
will do so in a follow on PR.
This has additionally separated the plugin data from the dynamic access core,
as it no longer is tightly coupled to access requests. No effort was made to
refactor the existing plugin data backend logic.
* Ensure that the context is cancelled on process termination.
* Remove debug hour addition.
* Correct notification date calcs, add test for notifications.
* Expire the access list after two weeks, use a single map instead of multiple plugin data keys.
* Run GCI.
* Tune tests, retry period is now a duration.
* Get rid of gocron, use intervals, test using intervals.
* GCI.
* Renames, test tweaks.
* Refactor access plugins.
* GCI.
* Adjust tests, remove generics, plugin data uses JSON marshal instead of custom marshaling.
* Move recipient back to common.
* Missed a few recipients imports.
* Tweaks to logic, auto registration of apps, commenting and cleanup.
