* Add hardware key service interface; Add mock service for tests.
* Add piv implementation of hardware key service.
* Remove old yubikey parsing logic in favor of hardwarekey.PrivateKeyRef.
* Remove HardwareSigner in favor of hardwarekey.PrivateKey.
* Add test; Cleanup comment; Don't require pin/touch prompts in tests with MockHarwdareKeyService by default.
* Fix tests.
* Add TODOs.
* Use unhashed digest for WarmupHardwareKey.
* Address comments.
* Fix race condition in test service.
* Address comments.
https://github.com/gravitational/teleport/issues/53050 was a result
of some expensive initialization that ended up impacting end users.
Existing benchmark tests did not cover this because they do not
actually launch the entire teleport binary.
The cost can be observed via `inittrace`, though it is documented
that the output is not stable and may be changed at any time.
```
GODEBUG='inittrace=1' ./releases/17.4.1/teleport version 2>&1 | rg '^init' | awk '{print $5 " ms " $2}' | sort -n -r | head -10
170 ms github.com/go-mysql-org/go-mysql/server
2.6 ms github.com/microsoft/go-mssqldb/internal/cp
2.6 ms github.com/goccy/go-json/internal/decoder
2.2 ms cloud.google.com/go/compute/apiv1/computepb
2.0 ms github.com/aws/aws-sdk-go/aws/endpoints
1.8 ms k8s.io/client-go/kubernetes/scheme
1.2 ms github.com/gravitational/teleport/lib/kube/proxy
1.2 ms github.com/gogo/protobuf/types
0.78 ms k8s.io/kubectl/pkg/scheme
0.73 ms github.com/gravitational/teleport/lib/kube/proxy/testing/kube_server
```
In order to cover in a stable way, new tests were added to the tool
package of each binary. The tests does one basic thing, re-execute
the test binary and exits. The re-execution is required to account
for any initialization costs that would otherwise be missed since
they happen prior to TestMain being called.
* add metadata
* newline
* cleanup status error
* refactor status error
* fix print
* order
* fix test on linux
* Truncate time to ms
* add host param to request
* jitter locally
* rename host to id
* rename func var
All of our supported release branches are well past Go 1.18, so
we don't need to support the old build tag syntax.
Changes made by running `go fix ./...`.
* SPIFFE X.509 issuer override: CRUD
* tctl support for workload_identity_x509_issuer_override
* Define audit log events
* Emit audit log events
* Add comments to point at the e implementation
* audit events fixtures
* Use DisallowUnknown in tctl
No functional changes, just a better abstraction. LDAP can be used to
fetch metadata that is included in certificate requests, but LDAP is not
required in order to issue certificates.
* Add config for WorkloadIdenttiyAWSRAService
* Add CLI command
* Start hacking on service impl
* Write credentials in AWS credentials file format
* Fix go.mod/go.sum
* Go mod tidy
* Add ARN validation
* Add specific config for AWS session duration/renewal
* Update golden file
* Fix gomod/gosum
* Refactor CheckAndSetDefaults
* Initialize service
* Update CLI flags
* Refactor & add tests
* Use *Context slog calls
* Update service name to include full `roles-anywhere`
* Add mocked AWS rolesanywhere API based test
* Validate region
The changes here were a result of examining CPU and memory profiles
of BenchmarkListUnifiedResources. The biggest inefficiencies stemmed
from the authorizer and `(types.Server) MatchSearch`.
When the authorizer computes lock targets it will call `(types.LockTarget) Equals`,
which was relying on proto.Equals to determine if nine strings were
equivalent. The fields are now individually checked and a test
was added to ensure that if any new fields are added they must
be added to the check for the test to pass.
ListUnifiedResources attempts to be smart and evaluate whether the
user has read/list access to a particular resource kind once. However,
it was always checking if users had access to _all_ supported resources
instead of just the resources that the user was requesting. While most
of the checks are not very expensive, checking all resources is still
worse than only checking the required resources.
Lastly, the `(types.Server) MatchSearch` implementation is no longer
allocating a slice of search fields and using `types.MatchSearch`.
Instead a variant of the loop from `types.MatchSearch` is inlined.
While this was only applied to `types.Server` it should likely
be extended to other resource types in the future - or `types.MatchSearch`
should be refactored in a way that does not require callers to allocate.
```bash
$ benchstat old.txt new.txt
goos: darwin
goarch: arm64
pkg: github.com/gravitational/teleport/lib/auth
cpu: Apple M2 Pro
│ old.txt │ new.txt │
│ sec/op │ sec/op vs base │
ListUnifiedResourcesFilter/labels-12 195.0m ± 6% 173.3m ± 2% -11.12% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_path-12 230.6m ± 3% 210.8m ± 4% -8.57% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_index-12 229.8m ± 5% 209.0m ± 7% -9.08% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_lower-12 600.6m ± 3% 364.3m ± 1% -39.35% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_upper-12 687.0m ± 2% 423.4m ± 1% -38.37% (p=0.000 n=10)
geomean 335.7m 259.5m -22.69%
│ old.txt │ new.txt │
│ B/op │ B/op vs base │
ListUnifiedResourcesFilter/labels-12 868.8Ki ± 0% 414.1Ki ± 0% -52.34% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_path-12 7.731Mi ± 0% 7.287Mi ± 0% -5.74% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_index-12 7.731Mi ± 0% 7.288Mi ± 0% -5.74% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_lower-12 22106.9Ki ± 0% 486.8Ki ± 0% -97.80% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_upper-12 22107.0Ki ± 0% 486.3Ki ± 0% -97.80% (p=0.000 n=10)
geomean 7.494Mi 1.371Mi -81.70%
│ old.txt │ new.txt │
│ allocs/op │ allocs/op vs base │
ListUnifiedResourcesFilter/labels-12 11.401k ± 0% 4.865k ± 0% -57.32% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_path-12 161.5k ± 0% 155.0k ± 0% -4.04% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_index-12 161.5k ± 0% 155.0k ± 0% -4.04% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_lower-12 162.212k ± 0% 5.277k ± 0% -96.75% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_upper-12 162.224k ± 0% 5.275k ± 0% -96.75% (p=0.000 n=10)
geomean 95.22k 20.07k -78.93%
```
* Adds AWS Role ARN to IC Integration settings
The Identity Center integration needs to be able to assume an AWS role
when using the ambient system credentials. This patch updates the IC
integration protobuf definition to include the role ARN, by refactoring
the settings block to replace the CredentialSource enumeration with a
`Credentials` type containing a `oneof` union of System and OIDC credential blocks.
The CredentalSource value is preserved for backwards compatibility with previous
Teleport releases.
This patch includes
- the updated protobuf message and generated types
- update tests, etc
- updated `tctl` to handle new plugin settings structure
Chagnges required to actually use this information are coming in a later PR.
* Apply suggestions from code review
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Rename role ARN
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
We added this function to mitigate slow user.Current() calls in
Windows Active Directory environments. Go 1.24 ships with an optimized
verison of user.Current, rendering this utility unnecessary.
Closes#41922
* Adds edit support for IC plugin to `tctl edit`
This patch expands the plugin resource unmarshaler in `tctl` to handle the
heterogenous filters used by the Identity Center plugin settings. It also adds
support for the IC status block.
These changes allow a user to edit the plugin resource via `tctl edit` after
installation.
* Why not use protojson? Well...
* Update collection.go
* Add json.(un)MarshalJSON implementations father than structure unpacking
* Dead code removal
* Apply suggestions from code review
Co-authored-by: Marek Smoliński <marek@goteleport.com>
* Apply review feedback
---------
Co-authored-by: Marek Smoliński <marek@goteleport.com>
* RouteConflictDiag: Refetch routes if no VNet routes found
* Run diagnostics periodically in Connect
* Handle manual diag re-run being superseded by periodic diag run
* Dismiss alerts until re-running diags manually
* Filter out command output from Connect logs
#52109 added a dependency on the unified resource cache to user
cert generation to reduce resource consumption. A number of tests
that exercise generating Kubernetes user certs were either not
waiting for the Kubernetes resources to exist prior to authentication
and getting lucky, or checking that the resources were in the auth
cache, but not the unified resource cache.
This attempts to cover any tests which generate Kubernetes user
certificates to verify that the unified resource cache contains
the expected cluster before proceeding.
Fixes#52157.
Fixes#52441.
* Add initial implementation of CRL signing
* Clarify
* Add basic support for streaming signed CRL to `tctl`
* Add log messages
* Start adding CRL support to tbot
* Wire in CRL support to workload-identity-x509
* Wire up crlCache to dependent services
* Fix missing cluster name injectiont
* Run the background goroutine
* FIx notification mechanism
* Add CRL assertions to TestBotWorkloadIdentityX509
* Add appropriate backoff to RevocationService
* Start work on TestRevocationService_CRL
* Change comparison in test
* Finish TestRevocationService_CRL
* Add CRL assertion to TestBotWorkloadIdentityAPI
* Fix linter complaint
* Update lib/tbot/service_workload_identity_api_test.go
Co-authored-by: Dan Upton <daniel.upton@goteleport.com>
* Update lib/tbot/service_workload_identity_api_test.go
Co-authored-by: Dan Upton <daniel.upton@goteleport.com>
* Rename KeyStorer
* Trigger CRL signing every ten minutes
* ADd SVIDCRLPemPath to Describe
---------
Co-authored-by: Dan Upton <daniel.upton@goteleport.com>
* lib/teleterm/vnet: Collect CIDR ranges while listing DNS zones
This will be used for the diagnostic report.
* Include IPv6Prefix in NetworkStackInfo
* Refactor RouteConflict into a protobuf struct
* Add protos for diagnostic report
* Add Diagnostician for generating diag report
* Add netstat command for route conflict check
* Send diag report from tshd to Electron app
* Remove unnecessary Diagnostician struct
* Return nil instead of an empty slice
* s/is supposed to return/returns/
* Capture stderr of failed command attempt
* Check if command stdout and stderr are valid UTF-8 text
On Windows tctl will attempt to load a teleport config file from
the default path of C:\etc\teleport.yaml. However, on Windows,
C:\etc\ does not exist by default, and may be created by any user.
This could potentially allow an unprivileged user to trick tctl
into loading a malicious teleport.yaml file and perform some kind
of MITM attack. In practice, this attack would have to be quite
sophisticated since tctl does check the data directory defined in
the config file and requires a host_uuid and a valid admin identity
before proceeding with using the local credentials.
If this behavior is to be restored in the future, the default
config path on Windows should be changed to something that respects
Windows path conventions.
* Move `CertificateTTL` and `RenewalInterval` into a `CertificateLifetime` struct
These values are always required together, and moving them into a struct will
make it more straightforward to override them per-service/output.
* Support custom `certificate_ttl` and `renewal_interval` on identity output
* Support custom `certificate_ttl` and `renewal_interval` on application output
* Support custom `certificate_ttl` and `renewal_interval` on application tunnel
* Support custom `certificate_ttl` and `renewal_interval` on Kubernetes output
* Support custom `certificate_ttl` and `renewal_interval` on Kubernetes V2 output
* Support custom `certificate_ttl` and `renewal_interval` on database tunnel
* Support custom `certificate_ttl` and `renewal_interval` on SSH host output
* Support custom `certificate_ttl` and `renewal_interval` on SSH multiplexer
* Support custom `certificate_ttl` and `renewal_interval` on SPIFFE SVID output
* Support custom `certificate_ttl` and `renewal_interval` on database output
* Support custom `certificate_ttl` and `renewal_interval` on workload API
* Support custom `certificate_ttl` and `renewal_interval` on workload identity output
* Add `GetCertificateLifetime` to service config interface
* Update the docs
* Add more examples to the standard config
* Rename `CertificateLifetime` to `CredentialLifetime`
So it can be used for non-certificate credentials like JWTs
* Deprecate `certificate_ttl` option and replace it with `credential_ttl`
* Return TTL warnings as errors and let the caller decide what to do with them
* Add `CredentialLifetime` to the "full" service config tests
* Support `credential_ttl` and `renewal_interval` in workload-identity-jwt service
* Silence sloglint
* Replace duplicated helper with `cmp.Or`
Closes https://github.com/gravitational/teleport/issues/52073.
The requested Kubernetes cluster is now cross referenced with the
KubeServers in the unified resource cache. This results in a
reduction in CPU, memory, and cert generation latency. This also
cleans up some of the helper functions in lib/kube/utils that
were no longer needed, and suboptimal.
The client side changes here shouldn't have any impact, as the
server is performing the same check, and returning the equivalent
error the client side code used to. This will also cut the time
of `tctl auth sign` in half as both the client and server were
performing the same expensive CheckKubeCluster operation.
Brian Joerger