* Generate CRDs
* Update snapshots
* Add apis impl for WorkloadIdentity
* Add WorkloadIdentityReconciler
* Add test for WorkloadIdentityReconciler
* Update RBAC
* Update to include version in kind
* Fix license header
* Fix handling of well-known Struct type
* Ignore revsiion
* Vendor gravitational/trace/trail in api
Pulling in the trail package directly in api will allow the trace
module to shed the grpc-go dependency. This needs to land prior
to https://github.com/gravitational/trace/pull/112 being included
in a new version of trace.
There should be no noticable change in the api depdency tree since
it already depends on grpc-go. Some additional items from the
trace/internal package were also vendored within trail as needed.
Additionally, some of the public api of trail that was not being
consumed has been made private.
* fix: appease linters
Converts most items to use servicecfg.Config.Logger instead of
servicecfg.Config.Log. The deprecated logrus logger unfortunately
cannot be removed yet as it's still used in e. Additionally all
logging within the config package was converted to use slog.
* Removes the entire notion of a DynamicAccessList from Teleport
Insurmountable security issues were found with the notion of dynamic
AccessList ownership and membership, so the entire concept is being
removed.
This PR removes all internal usage of the Dynamic access list
concept. The corresponding protobuf updates are coming in a later
PR.
Changelog: Removed Dynamic AccessList
* Fix API tests
* More API test fixes
* Fix integrations tests
* Refactor operator resource reconciler to support resource153 + add label propagation
I initially just wanted to add label propagation (which is required for
OpenSSH and OpenSSHEICE servers).
However I ran into an issue: not all Teleport resources implement the
`ResourceWithLabels` interface. Basically we have 4 cases:
- resources implementing `ResourceWithLabels` (e.g. User, Role, ...)
- resources implementing `ResourceWithOrigin` but not
`ResourceWithLabels` (e.g. GitHub connector, ProvisionToken, ...)
- resources that have been tweaked to implement only the operator
`TeleportResource` interface (`LoginRule`)
- resources implementing `Resource153`
To support all those resoucres, we can either:
- edit each resource so they expose the same methods (e.g.
ProvisionToken exposes `GetLabels` instead of `GetStaticLabels`)
- wrap each ressource in a wrapper that implements the operator
TeleportResource interface
- add multiple reconcilers, one for each resource kind
I don't think it's sane for the operator to force changes on Teleport
resources. Especially as those are known to be non consistent. I also
don't want the operator to maintain a copy of each resource, this is not
viable on the long term.
For those reasons I chose the 3rd approach and built 3 reconcilers. Then
I deducplicated the code to end up with a generic reconciler that can be
tuned by passing an adapter. The adapter is an empty struct that has all
the methods to extract the information the operator requires from the
resource.
The resulting PR is large and heavily uses generics but the amount of
logical changes is quite low (the only diff is that we now copy labels).
I can walk you through the PR if needed.
With this PR, the operator supports properly any resource implementing
`types.Resource153`, this will be useful to add `TeleportBotV1` support.
* Update integrations/operator/controllers/reconcilers/base.go
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
* use structured logging
---------
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
* integrations/operator: Add openSSH and openSSHEICE servers
* lint
* Update integrations/operator/controllers/resources/openssheiceserverv2_controller.go
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
* rename Openssh to OpenSSH and fix comments
* hide cmdlabels
---------
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
This commit prepares everything for us to switch to a single reconciler for all resources. Part of https://github.com/gravitational/teleport/issues/21416
This commit does the following changes:
- setup controllers for the unstructured objects instead of the structured ones (like `Role` was doing). This is due to the bad behaviour of `utils.Strings` of serializing as a single string if the list contains a single element.
- use a single scheme for everything instead of multiple ones. We suffered from drifts between main and tests in the past.
- fetch the GVK for the unstructure objects from the scheme. This operation can fail and now a bunch of builder/init functions can return errors
- Introduce a new `Reconciler` interface to hide the controller internals
- unify how controllers are started in main and tests. This is not directly related to the PR goal (preparing the ground for a unified controller) but I was drawn into this when I made the constructors return errors.
This commit creates a standard set of compare options for all tests that
handles the common use cases:
- ignore ID, labels and other dynamic metadata
- apply sane time comparison by default
- equates nil maps and empty maps (caused by proto serialization)
This solves a couple of comparison issues I faced in another PR.
* use eventuallyWithT
* integrations/operator: remove require checks from Eventually funcs
* fixup! integrations/operator: remove require checks from Eventually funcs
* k8s operator supports Okta import rules.
The k8s operator now supports Okta import rules, which will allow users to
use native k8s CRDs to provision Okta import rules in k8s environments.
* Fix helm test.
* Remove unneeded proto files.
* Use additionalProperties in the okta import rules CRD instead of properties.
* integrations/operator: Use a dedicated scheme in tests
Relying on a global scheme can cause race-conditions when registering
schema in multiple tests. This commit does two things in an attempt to
fix https://github.com/gravitational/teleport/issues/26753:
- use a separate Scheme for tests to avoid being affected by what others
might be doing with the scheme
- initiate the Scheme only once during import
* unexport scheme
Noah Stride