All of our supported release branches are well past Go 1.18, so
we don't need to support the old build tag syntax.
Changes made by running `go fix ./...`.
Changes:
When Okta read-only is enabled (bidirectional sync is disabled):
- don't display Okta-originated resources in "All Resources" view
- don't display Okta-originated resources in "New Request" view
- error if Okta-originated resource access is requested
Note: this is still possible to request a role which allow access to an Okta-originated resource,
but the team made a decision to allow this case.
There are no semantic changes whatsoever.
While I was working on support Okta read-only in Access Requests I needed to understand the way we
handle unified resources listing. While figuring this out I refactored the code so it is now easier
to comprehend to me. Hopefully it's also easier to comprehend to others.
This is a part of my branch with changes for Okta read-only support in Access Requests.
Provides a type safe resource 153 unwrapping variant to replace
types.Resource153Unwrapper. Most uses have been switched over to
the new type, though a few still exist and may be harder, if not
possible to convert without a considerable amount of change.
* SPIFFE X.509 issuer override: CRUD
* tctl support for workload_identity_x509_issuer_override
* Define audit log events
* Emit audit log events
* Add comments to point at the e implementation
* audit events fixtures
* Use DisallowUnknown in tctl
* Support additional claims in JWT-SVIDs
* Exclude the `extra_claims` field in Terraform
* Add a maximum nesting depth
* Add comment to clarify behavior of `PrivateClaims`
* Combine declaration with nil check
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
---------
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
When we originally broke some of the desktop access code out into
a shared windows package to help with MS SQL access we pulled too
much code. This commit just moves code that is only needed in one
package to the package where it is used, and un-exports it.
No functional changes.
No functional changes, just a better abstraction. LDAP can be used to
fetch metadata that is included in certificate requests, but LDAP is not
required in order to issue certificates.
* Update protobuf
* Implement and test ValidateTokenWithJWKS
* Update join logic to use new method for static jwks
* Update Terraform Provider
* Update operator docs/files
* Update goldenfile
The changes here were a result of examining CPU and memory profiles
of BenchmarkListUnifiedResources. The biggest inefficiencies stemmed
from the authorizer and `(types.Server) MatchSearch`.
When the authorizer computes lock targets it will call `(types.LockTarget) Equals`,
which was relying on proto.Equals to determine if nine strings were
equivalent. The fields are now individually checked and a test
was added to ensure that if any new fields are added they must
be added to the check for the test to pass.
ListUnifiedResources attempts to be smart and evaluate whether the
user has read/list access to a particular resource kind once. However,
it was always checking if users had access to _all_ supported resources
instead of just the resources that the user was requesting. While most
of the checks are not very expensive, checking all resources is still
worse than only checking the required resources.
Lastly, the `(types.Server) MatchSearch` implementation is no longer
allocating a slice of search fields and using `types.MatchSearch`.
Instead a variant of the loop from `types.MatchSearch` is inlined.
While this was only applied to `types.Server` it should likely
be extended to other resource types in the future - or `types.MatchSearch`
should be refactored in a way that does not require callers to allocate.
```bash
$ benchstat old.txt new.txt
goos: darwin
goarch: arm64
pkg: github.com/gravitational/teleport/lib/auth
cpu: Apple M2 Pro
│ old.txt │ new.txt │
│ sec/op │ sec/op vs base │
ListUnifiedResourcesFilter/labels-12 195.0m ± 6% 173.3m ± 2% -11.12% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_path-12 230.6m ± 3% 210.8m ± 4% -8.57% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_index-12 229.8m ± 5% 209.0m ± 7% -9.08% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_lower-12 600.6m ± 3% 364.3m ± 1% -39.35% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_upper-12 687.0m ± 2% 423.4m ± 1% -38.37% (p=0.000 n=10)
geomean 335.7m 259.5m -22.69%
│ old.txt │ new.txt │
│ B/op │ B/op vs base │
ListUnifiedResourcesFilter/labels-12 868.8Ki ± 0% 414.1Ki ± 0% -52.34% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_path-12 7.731Mi ± 0% 7.287Mi ± 0% -5.74% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_index-12 7.731Mi ± 0% 7.288Mi ± 0% -5.74% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_lower-12 22106.9Ki ± 0% 486.8Ki ± 0% -97.80% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_upper-12 22107.0Ki ± 0% 486.3Ki ± 0% -97.80% (p=0.000 n=10)
geomean 7.494Mi 1.371Mi -81.70%
│ old.txt │ new.txt │
│ allocs/op │ allocs/op vs base │
ListUnifiedResourcesFilter/labels-12 11.401k ± 0% 4.865k ± 0% -57.32% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_path-12 161.5k ± 0% 155.0k ± 0% -4.04% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_index-12 161.5k ± 0% 155.0k ± 0% -4.04% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_lower-12 162.212k ± 0% 5.277k ± 0% -96.75% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_upper-12 162.224k ± 0% 5.275k ± 0% -96.75% (p=0.000 n=10)
geomean 95.22k 20.07k -78.93%
```
* Convert autoupdate version handling to coreos/go-semver
* get the right version in installer endpoint + get rid of x/mod/semver
* depguard x/mod/semver
* Add nolint rules for existing x/mod/semver usages
* Add depguard explanation
* Hack on including attrs in svid issuance
* Add attrs to JWT SVID issuance
* Fix comparison in tests
* Improve comment on attributes field of event proto
The PKCS#11 that we use defaults to allowing 1024 concurrent
sessions. If an HSM is configured with a lower limit it results in
broken UX since the PKCS#11 library does not reuse open and available
sessions until it has opened the maximum number of sessions that it
can. While the library behavior is out of our control, we now allow
users the ability to specify what their desired max and propagate it
on to the PKCS#11 library so that it will not open more sessions
than the HSM will allow.
The auth config reference was updated to include `ca_key_params`.
While these config options were somewhat discoverable via individual
HSM guides, they were not mentioned in the auth reference.
* Support automatic_approval in AMR spec
* Support filter by automatic_approval_name
* Update AMR validation
* Update terraform schema
* Fix import
* Add additional test case
* Improve amr spec godocs
* make -C integrations/terraform docs
* Add new `expression` package in workload identity service
* Add traits to the `Attrs` proto message
* Add support for user traits to the `expression` package
* Use `expression` package to template Workload Identities
* Add support for expressions to Workload Identity rules
* Update terraform docs
* Error instead of returning zero value for unset fields
* Fix linting failures
* Codify edge cases
#52109 added a dependency on the unified resource cache to user
cert generation to reduce resource consumption. A number of tests
that exercise generating Kubernetes user certs were either not
waiting for the Kubernetes resources to exist prior to authentication
and getting lucky, or checking that the resources were in the auth
cache, but not the unified resource cache.
This attempts to cover any tests which generate Kubernetes user
certificates to verify that the unified resource cache contains
the expected cluster before proceeding.
Fixes#52157.
Fixes#52441.
* Add initial implementation of CRL signing
* Clarify
* Add basic support for streaming signed CRL to `tctl`
* Add log messages
* Start adding CRL support to tbot
* Wire in CRL support to workload-identity-x509
* Wire up crlCache to dependent services
* Fix missing cluster name injectiont
* Run the background goroutine
* FIx notification mechanism
* Add CRL assertions to TestBotWorkloadIdentityX509
* Add appropriate backoff to RevocationService
* Start work on TestRevocationService_CRL
* Change comparison in test
* Finish TestRevocationService_CRL
* Add CRL assertion to TestBotWorkloadIdentityAPI
* Fix linter complaint
* Update lib/tbot/service_workload_identity_api_test.go
Co-authored-by: Dan Upton <daniel.upton@goteleport.com>
* Update lib/tbot/service_workload_identity_api_test.go
Co-authored-by: Dan Upton <daniel.upton@goteleport.com>
* Rename KeyStorer
* Trigger CRL signing every ten minutes
* ADd SVIDCRLPemPath to Describe
---------
Co-authored-by: Dan Upton <daniel.upton@goteleport.com>
Gavin Frazar