* Revert "Add unstable envvar to disable server keepalives (#43342)"
This reverts commit 1e2d7724e7.
* Allow changing a VariableDuration by more than one
* Get rid of control log pings
* Dedicated lightweight jittered ticker for the inventory
* Split off per-protocol tickers
* Tests for jittered ticker
* Use a start barrier in TestVariableDurationIncDec
* Explain value to be passed to Advance
* Add explanations in jitteredticker tests
* Rename jitteredticker to delay
* Add metric to expose cluster role count
A new `teleport_roles_total` is added to count the number of roles
in the cluster. The metric is intentionally updated infrequently
to avoid putting any additional strain on the backend. Additionally,
the reads performed when calculating the metric are rate limited
to prevent any bursts in reads when the metric timer does fire.
The auth periodic tickers have also been consolidated into a single
multi-interval instead of a ticker per operation. To prevent the
sub-intervals from impacting each other all operations are moved
to their own goroutine once their ticker fires.
* Convert multi to use a clock
* fix: specify a smallish page size
* Introduce scaffolding for access list Slack notification.
The initial scaffolding for notification of the need for reviews for access
lists has been introduced. This is not expected to do anything just yet, but
will do so in a follow on PR.
This has additionally separated the plugin data from the dynamic access core,
as it no longer is tightly coupled to access requests. No effort was made to
refactor the existing plugin data backend logic.
* Ensure that the context is cancelled on process termination.
* Remove debug hour addition.
* Correct notification date calcs, add test for notifications.
* Expire the access list after two weeks, use a single map instead of multiple plugin data keys.
* Run GCI.
* Tune tests, retry period is now a duration.
* Get rid of gocron, use intervals, test using intervals.
* GCI.
* Renames, test tweaks.
* Refactor access plugins.
* GCI.
* Adjust tests, remove generics, plugin data uses JSON marshal instead of custom marshaling.
* Move recipient back to common.
* Missed a few recipients imports.
* Tweaks to logic, auto registration of apps, commenting and cleanup.
This reverts commit 4f3aa9a3f2.
We're unable to build for 32-bit Linux due to
https://github.com/golang/go/issues/55152,
which looks like it will be fixed with Go 1.19.2 next week.
We'll re-evaluate with the next Go release and reintroduce this change
as soon as we can.
* Add Yubikey PrivateKey implementation for use by Teleport clients.
- Add yubikey login logic, reusing previously stored private keys.
- Fix identity file decoding with PIV keys, which sign ecdsa certificates.
- Add libpcsclite-dev pre-req for building on linux.
- Remove unnecessary keys.Signer interface and move its functionality to keys.PrivateKey.
- Move retry and jitter utils to new api/utils/retryutils package.
* Prevent relative expiry from emitting more events than can be processed
This alters relative expiry in four ways:
1) Relative expiry is no longer exclusively run by the auth cache
2) Relative expiry no longer emits delete events
3) There is now a limit to the number of nodes removed per interval
4) Relative expiry now runs more frequently
We can remove the need to emit any fake delete events during relative
expiry by not running it exclusively in the auth cache. All caches
will now run relative expiry themselves, even the components that
don't watch for nodes - this is effectively a noop for them. To
prevent the individual caches from getting too far out of sync, the
expiry interval is set to a much smaller value and we limit the
number of nodes being deleted per interval.
Edoardo Spadolini