All of our supported release branches are well past Go 1.18, so
we don't need to support the old build tag syntax.
Changes made by running `go fix ./...`.
Adds an additional type constraint go FnCacheGet and FnCacheGetWithTTL
to enforce that all keys are comparable. This should allow the
removal of various compile time hashability checks that are in
place for existing keys of custom types.
* Convert autoupdate version handling to coreos/go-semver
* get the right version in installer endpoint + get rid of x/mod/semver
* depguard x/mod/semver
* Add nolint rules for existing x/mod/semver usages
* Add depguard explanation
* lib/utils/typical: support `==` and `!=` operators for integers
In #52460, we're adopting the Teleport predicate language for Workload Identity
rules. We currently allow you to match on the equality/inequality of the attested
process' PID, GID, and UID, but this wasn't supported in the predicate language.
We now check the operand types at compile-time and choose the correct
booleanOperator. If both operands are dynamically typed (e.g. `ifelse`) we do
not allow you to use the `==` or `!=` operators.
* Fix compile/parse time nomenclature
* Rename type parameters for clarity
We added this function to mitigate slow user.Current() calls in
Windows Active Directory environments. Go 1.24 ships with an optimized
verison of user.Current, rendering this utility unnecessary.
Closes#41922
* Refactor client version compat for reuse in lib/teleterm
* Remove ClustersService.getAuthSettigns, add test helper
* FormLogin: Nest AuthSettings under distinct prop
* Return client version status with auth settings
* Add UI for compatibility warning
* Do not use wildcards for TOO_OLD to mirror tsh
Also, handle TOO_OLD first to mirror lib/client/api.go.
* Adjust buttons to mirror the look of primaryAction/secondaryAction of Alert
* Do not show pre-release "-aa" suffix
* Fix title case in button
* Add skipVersionCheck to docs
---------
Co-authored-by: Grzegorz Zdunek <grzegorz.zdunek@goteleport.com>
- Adds (SortCache) Clear to allow resetting an existing cache
- Converts (SortCache) Ascend and (SortCache) Descend to return
an iter.Seq[T] instead of taking an iteration function
- Removes (SortCache) AscendPaginated and (SortCache) DescendPaginated
Leveraging iterates aligns the API with the direction that Go is
heading in regards to iteration. Removing of the paginated functions
does put the onus on callers to paginate, however, in the only
cases these were used there are now fewer allocations. AscendPaginated
was unused and DescendPaginated was only used in two places - both
of which would benefit from migrating away from using streams in
favor of iter.Seq.
The new Clear API makes it easier for callers to reset an existing
cache. Without this change the only way to reset a cache would be
to replace the entire cache with a new one. This places the burden
on callers to apply locking and handle concurrent read/write/deletes
and swapping out the cache entirely. That all is eliminated by
Clear handling the internal locking to reset the cache state.
In order to provide better validation when installing the IC integration via `tctl`,
this patch moves some IC-specific validation tools from `teleport.e` to
into the OSS repository.
* Add the dynamodbutils and stsutils packages
* Use stsutils.NewFromConfig()
* Use stsutils.NewV1()
* Use dynamodbutils.IsFIPSEnabled()
* Add forbidigo rules
* Appease linter
The main changes here are:
- Using an LRU cache to store compiled regular expressions.
- Removing stack traces captured by trace.NotFound/trace.Wrap
when there are no matches.
This was heavily inspired by
https://github.com/gravitational/teleport/pull/23534 which made
similar changes to improve the performance of utils.MatchString.
The main beneficiaries of this change are services.MapRoles and
services.TraitsToRoles which rely heavily on
utils.ReplaceRegexp, utils.RegexpWithConfig, or ReplaceRegexpWith.
BenchmarkReplaceRegexp was added to validate the improvements in
this change and prevent regressions in the future. Results from
before and after this change:
benchstat old.txt new.txt
goos: darwin
goarch: arm64
pkg: github.com/gravitational/teleport/lib/utils
cpu: Apple M2 Pro
│ old.txt │ new.txt │
│ sec/op │ sec/op vs base │
ReplaceRegexp/same_expression-12 29.527µ ± 12% 6.837µ ± 1% -76.84% (p=0.000 n=10)
ReplaceRegexp/unique_expressions-12 22.94µ ± 1% 25.10µ ± 1% +9.41% (p=0.002 n=10)
ReplaceRegexp/no_matches-12 24.692µ ± 3% 2.861µ ± 1% -88.41% (p=0.000 n=10)
geomean 25.57µ 7.889µ -69.15%
│ old.txt │ new.txt │
│ B/op │ B/op vs base │
ReplaceRegexp/same_expression-12 22071.5 ± 1% 164.0 ± 0% -99.26% (p=0.000 n=10)
ReplaceRegexp/unique_expressions-12 12.90Ki ± 1% 12.87Ki ± 0% ~ (p=0.165 n=10)
ReplaceRegexp/no_matches-12 14257.00 ± 1% 15.00 ± 0% -99.89% (p=0.000 n=10)
geomean 15.70Ki 318.8 -98.02%
│ old.txt │ new.txt │
│ allocs/op │ allocs/op vs base │
ReplaceRegexp/same_expression-12 58.000 ± 0% 6.000 ± 0% -89.66% (p=0.000 n=10)
ReplaceRegexp/unique_expressions-12 55.00 ± 0% 55.00 ± 0% ~ (p=1.000 n=10) ¹
ReplaceRegexp/no_matches-12 58.00 ± 0% 0.00 ± 0% -100.00% (p=0.000 n=10)
geomean 56.98 ? ² ³
¹ all samples are equal
² summaries must be >0 to compute geomean
³ ratios must be >0 to compute geomean
This eliminates the SigningService in favor of a free function
SignRequest, which eliminates AWS credential loading and simplifies the
AWS utils package.
In the process of doing this refactor, the AWS app handler has been
changed to use AWS SDK v2 to load its credentials as well.
* refactor(opensearch): use aws config provider for signing service
* test(opensearch): cleanup unused code
* fix: accept a base role on the signing service
* feat(aws): provide a way to use different external id for role
* add external ID
---------
Co-authored-by: STeve Huang <xin.huang@goteleport.com>
* Introduce the clocki package
* Do root module fixes so e/ can be built
* Use clocki in lib/backend tests
* Genericfy test.Constructor and related methods
* Protobuf and configuration for Access Graph Azure Discovery
* Adding the Azure sync module functions along with new cloud client functionality
* Moving reconciliation to the upstream azure sync PR
* Moving reconciliation test to the upstream azure sync PR
* Fixing rebase after protobuf gen
* Updating to use existing msgraph client
* PR feedback
* Using variadic options
* Removing memberOf expansion
* Expanding memberships by calling memberOf on each user
* PR feedback
* Rebase go.sum stuff
* Go mod tidy
* Fixing go.mod
* Update lib/msgraph/paginated.go
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* PR feedback
* e ref update
* Adding the Azure sync module functions along with new cloud client functionality
* Protobuf and configuration for Access Graph Azure Discovery
* Adding Azure sync functionality which can be called by the Azure fetcher
* Protobuf update
* Update sync process to use msgraph client
* Conformant package name
* Invoking membership expansion
* Setting principals before expansion
* Removing msgraphclient
* Update e ref
* Linting
* PR feedback
* Adding test names to reconciliation tests
* Adding channel buffer
* Going back to just reading from channel
* Linting
* PR feedback
* PR feedback
* PR feedback
* Apply suggestions from code review
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* PR feedback
* Fixing flaky test
* Lint
* Fix imports
---------
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Fix AWS SigV4 parsing
Parsing the AWS SigV4 Authorization header no longer requires spaces
between the components - only the comma delimiter is required.
* add test case for empty signed header list
This is the _last_ step required to migrate from logrus to slog.
All components in the repository have been migrated to use slog
allowing the logrus formatter to be deleted.
The slog handler tests that validate the output have been updated
to assert the format directly instead of comparing it to the output
from the logrus formatter.
* Remove all direct logrus usage from teleport module
The only remaining use of logrus is from integrations, which is
unfortunately imported by teleport.e, and prevents logrus from
being moved to an indirect dependency. The logrus formatter and
initialization of the logrus logger will remain in place until
integrations is using slog. To prevent any accidental inclusions
of logrus within the teleport module the depguard rules have been
updated to prohibit importing logrus. The rules also include
prohibit a few common log packages that tools like gopls might
automatically import.
* Refactor logger initialization
Consolidates configuring of global loggers to a single function.
This is mainly to facilitate configuring the logger for
teleport scp, but will also allow us to remove the copy of logger
initialization that currently exists in integrations/lib/logger.
* fix: document ValidateFields
* fix: remove copied yaml tags
* fix: update file path comment
The refactoring done in #50451 caused the trace.Error debug report
to be quoted in log output. This updates the quoting bypass used
for log level to also consider trace.Errors in order to restore
the previous output.
* DiscoveryConfigStatus: update even when no resource is found
During Auto Discover, when using a DiscoveryConfig, if no resources are
found, the DiscoveryConfigStatus is not updated accordingly.
This PR ensures that, even when no resources are found, the status will
report so.
* use comparable instead of any for generic method
* remove useless un-named function on PreFetchHooks
* prevent call to ssm:SendCommand with 0 instances
* rename var from ok to found
This only converts the places in the utils package that were
logging with logrus, but it does not fully remove the logrus
package as a dependency. The package is home to the logrus text
formatter which needs to exist until slog is the only logging
mechanism in use.
* DiscoveryConfig Status: update even when no resources are found
The DiscoveryService was not updating the DiscoveryConfigStatus when its
matchers didn't discovered any resource.
This would lead the user to think that there the DiscoveryConfig was not
being processed, when in fact it was.
* rename to FilterMapUnique
* rename to DiscoveryConfigName and GetDiscoveryConfigName
* fix var name
This starts the transition of our SSH servers to use slog. The
regular.Server has been converted to use slog, though there
are still various logs emitted via the srv.ServerContext from the
server which use logrus.
Zac Bergquist