* key split wip
* fix piv tests
* fix terraform tests
* spelling fixes
* fix kube benchmark
* fix identity files in integrations tests
* self review
* fix typo in comment
Co-authored-by: Bernard Kim <bernard@goteleport.com>
* speed up device login tests
* use EC keys in TestProxyAppWithIdentity
* faster tsh tests
* fix race on error value
* fix lint
* write out EC SSH keys in OpenSSH format
* fix lint
* fix keyring comparisons
* PrecomputeTestKeys in lib/client
* parallelize TestNoRelogin subtests
* use ecdsa for self-signed TLS certs
* remove redundant GetTrustedCerts
* improve latency of precomputeTestKeys
Instead of waiting for all 25 test keys before returning a single one,
tests can now make use of the first precomputed test key as soon as it's
ready.
In local testing with this change, the first key is ready after ~75ms vs
>350ms on master.
* fix test and lint
---------
Co-authored-by: Bernard Kim <bernard@goteleport.com>
* Add initial condition parser for access monitoring rules
* Update integrations/access/accessrequest/app.go
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Check previously unchecked error and minor refactor of AMR
* Simplify check for applicable access monitoring rules
* Refactor access monitoring rules plugin integration
* Fix formating and move lock aquisition
* Add methods for listing access monitoring rules with a filter
* Add contains_any predicate expression func
* Add in is_empty func to predicate expression
* Lock AMR cache in plugins while getting initial rules
* Add in check for access monitoring rule version
* Update integrations/access/accessrequest/app.go
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Update integrations/access/accessrequest/app.go
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Move lock so it doesnt persist over api calls
* Remove unused constant and add more context to logs
* Appease linter
* Update access monitoring rules tests to pass rule validation
* Add in missing access monitoring rules list with filter code
* Appease linter
* Add back validation code for AMRs
* Fix test plugin role and rename listaccessmonitoringrulewithfilter
* Fix local test for AMR crud operations
* Fix end range for listing rules
* Fix unwrapping of resource153 event for monitoring rules
* Refactor AMR cache init into helper function in plugin app
* Add seperate response type for listAccessMonitoringRulesWithfilter
* Add context to log for plugins failing to fetch recipients
* Grab access monitoring rules cache under lock all at once
* Add clarification for which fields are optional in listAMRfilter req
* Update integrations/access/accessrequest/app.go
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Update integrations/access/accessrequest/app.go
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Add forEach to common recipient set
* Move type check to after AMR event op switch
* Move turn some default parser spec methods to funcs
* Make some predicate func usable as methods as well
* Add len func to common recipient sets
* Add integration test for access monitoring rule and slack plugin
* Fix error types and messages when handling AMRs
* Use generic list resource with filter for AMR
* Add test for generic listResourceWithFilter
* Update listResourceWithFilter to use revision instead of id
* Update generic tests to use revision instead of id
* Fix linting
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Vendor event-forwarder plugin
* fix tests + add Makefile + CI
* lint
* Fix broken test
* use a separate go.mod
* ignore event-handler in flaky tests + update go.mod
* go mod tidy
Similar to https://github.com/gravitational/teleport/pull/39315,
this updates the integrations test suite to use a regular
expression that will match output to know when the ssh_service is
ready now that Teleport is using slog instead of logrus.
The change to migrate the TeleportProcess to use slog in
https://github.com/gravitational/teleport/pull/38551 was preventing
the regular expressions used by the operator tests to determine
when auth and proxy were ready. This lead to the tests hanging indefinitely
until the go test framework timed out. To remediate, the regular
expressions have been updated to match the output when using slog.
For example, the test was expecting the output in the format of:
```
Auth service 15.0.0:v15.0.0-0-ge126e8cd is starting on 192.168.50.108:3025. pid:61933.1 service/service.go:2072
```
#38551 moved the listen address to a field instead of being formatted
in the message:
```
Auth service is starting. pid:54159.1 version:16.0.0-dev git_ref:api/v13.4.16-31-g2b9ae35e31 listen_address:127.0.0.1:63152 service/service.go:2107
```
Adds the new linter and configures it to prevent direct error
comparisions and type assertions in favor of errors.Is and errors.As.
All current violations caught by the linter have been updated
accordingly.
* Remove use of require assertions inside Eventually calls
require.Eventually runs the predicate function in a background
goroutine. It is invalid to use require to make assertions
inside the eventually, because require will fail the test if the
assertion fails, and tests can only be failed from the test's
main goroutine.
* Use EventuallyWithT
The t.Log() function calls have been removed from most tests. This is to keep our test logs cleaner and more focused on error messages. Logging every detail in tests makes it harder to spot actual errors and relevant information.
* Compile binaries for access plugin tests
* Fix PD test asserts for newer Teleport versions
* Unpin role from V6 in access plugin tests
* Remove license from OSS plugins tests
We now run tests against OSS Teleport in the OSS repo,
and against Enterprise Teleport in the E repo.
So the assumption that CI always needs an enterprise license
is incorrect.
* Only compile the required binaries
This PR introduces a new role version - `v7` - to support other
Kubernetes resources such as `Deployments`, `Statefulsets`... while
keeping compatibility with previous role versions.
This PR adds the following validations:
- `v6`, `v5`, `v4`: `kubernetes_resources` can only include `kind: pod`
resources
- `v7`: `kubernetes_resources` can include wildcards or other
resourceces (to be introduced by #26244.
It also adds a role version downgrade (v13 clients connecting to v14
auth server) where we downgrade the role's version and remove unsuported
kubernetes_resources from the resource list.
Part of #20811
* Vendors the `pagerduty` plugin source into `teleport`
This commit vendors the PagerDuty Access Plugiun code into the `teleport`
repo (from `teleport-plugins`), with only the minimal set of changes
required to get it to compile and tests to pass.
Changes include:
- updating the package name (`main` -> `pagerduty`)
- removing `main.go`
- removing installation scripts
- minor testing tweaks to aid local debugging
* Revert test change
* `go mod tidy`
* fmt
* linter appeasement
This commit updates all `err == io.EOF` comparisons to use
`errors.Is(err, io.EOF)`. This is necessary when the error may have been
wrapped and fixes at least one current breakage (in `tsh request ls`).
`golang.org/x/tools/refactor/eg` was very handy for this, I used the
following template:
```go
package teleport
import (
"errors"
"io"
)
func before(err error) bool { return err == io.EOF }
func after(err error) bool { return errors.Is(err, io.EOF) }
```
When gravitational/teleport-plugins imports this test suite
in CI, the repo root gravitational/teleport/... is not writable.
This uses GitHub's `RUNNER_TEMP` instead, if it is set.
* Vendor slack plugin and supporting libraries
* Fix up plugin integration tests (wip)
* Run GCI on vendored code
* Use newtype instead of type alias
golangci-lint currently panics on this,
"skip-files" et al don't help, as it is a linter panic, not an error
See https://github.com/dominikh/go-tools/commit/d717045480130461e1e777ead7f2981621f0d9f0
* Remove long-runing plugins tests from difftest
* Move access plugin tests to unit-tests-integrations
