* Script oneoff: add optional command prefix (sudo)
We are converting the installer script used for Server Auto Discover to
use go instead of shell script.
As an example, in EC2 Auto Discover, the script runs as `ssm-user` which
has access to using `sudo`.
This script is currently using `sudo` to change system wide
configurations (adding repos, installing packages, create file locks,
....).
In order to convert this script into go code, we must also run with
elevated privileges.
This PR changes the `oneoff` script to optionally run with a prefix.
Only `sudo` can be used as a command prefix.
* use t.cleanup and fix sudo usage when testing
Some systems have a very restricted size in `/tmp`.
When doing some tests, we found out that Amazon Linux 2023 EC2 instance
only has 475MB (possibly related to using an instance with 1GB of RAM?),
and that's not enough to download and uncompress the tarball.
We tried to optimize that and only extract the `teleport/teleport`
binary, but there's not enough space for that as well.
So, instead, we are now storing the teleport binary in the user's cache
dir.
Another change is that we also remove the created folder when the script
exits.
The oneoff script downloads teleport and runs a teleport command.
In order to use the oneoff script for Server Auto Discover we must allow
it to receive a token as an argument.
You can see how the script is meant to be executed:
lib/cloud/aws/ssm_document.EC2DiscoverySSMDocument
oneoff script intends to be as simple and compatible as possible.
Using `sh` allows us to be even more compatible, not only with more
specific systems but also allows it to be used by the teleport discovery
script (which uses `/bin/sh <my-script.sh`)
Prefer the stdlib version of the experimental package.
Includes a depguard update to prevent future regressions,
as well as an e-ref update to appease depguard.
Generated with:
$ gofmt -w -r '"golang.org/x/exp/slices" -> "slices"' . && \
make fix-imports
* OneOff Script: use ent build if cluster is Enterprise
We were always using the OSS version of teleport in the one-off scripts.
This PR changes that to pick the correct version depending on the
running version in the Proxy.
* use gzip bestspeed for compressing files
When the OneOff script completes, print a success message to let the
user know that everything worked as expected and what their next action
should be.
We were escaping the command arguments with double quotes.
It works with bash4.3+.
However, AWS CloudShell has bash 4.2 which:
>
> zz. When using the pattern substitution word expansion, bash now runs the
> replacement string through quote removal, since it allows quotes in that
> string to act as escape characters. This is not backwards compatible, so
> it can be disabled by setting the bash compatibility mode to 4.2.
http://tiswww.case.edu/php/chet/bash/CHANGES
When running this script in bash 4.2, the arguments end up being `"xyz"`
instead of `xyz`.
So, errors like this happen:
```
ERROR: operation error STS: GetCallerIdentity, https response error StatusCode: 0, RequestID: , request send failed, Post "https://sts.\"us-east-1\".amazonaws.com/": dial tcp: lookup sts."us-east-1".amazonaws.com: no such host
```
Removing the quotes means it will work on older and newer bash versions:
Demo:
```
> ./bin/teleport integration configure deployservice-iam --cluster=kimlisa.cloud.gravitational.io --name=r0mant --aws-region=us-east-1 --role=r0mant-oidc --task-role=Test+1=2,3.4@5-6_7
2023/07/07 08:04:05 TaskRole: Boundary Policy "Test+1=2,3.4@5-6_7Boundary" created.
2023/07/07 08:04:05 TaskRole: Role "Test+1=2,3.4@5-6_7" created with Boundary "arn:aws:iam::278576220453:policy/Test+1=2,3.4@5-6_7Boundary".
2023/07/07 08:04:05 TaskRole: IAM Policy "Test+1=2,3.4@5-6_7" added to Role "Test+1=2,3.4@5-6_7".
2023/07/07 08:04:05 IntegrationRole: IAM Policy "DeployService" added to Role "r0mant-oidc"
```
* Teleport One Off Script
This PR creates an endpoint that returns a script.
This script does the following:
- detects the correct os/arch, downloads and extracts the teleport
binary package
- runs teleport with arguments defined in the endpoint's query param
This will allow the Discover wizard to give bash scripts in the form of
`bash -c "$(curl ..../oneoff... )"` to the user.
The user is then asked to run those commands.
One use case for those commands is the creation of specific AWS Roles
which are then used to give Teleport extra access to other AWS Services
/ Actions.
This specific command will come in a later PR.
* remove endpoint
* disable shellcheck for go templated vars
* use bintest v3
Hugo Shaka