* clean up pidfile and reloads
* reduce log spam during graceful shutdowns
* hold an exclusive advisory lock on the pidfile
* do systemd reloads with the pidfile rather than $MAINPID
* prioritize signals over internal restarts
* Add DatabasePermissions field to role.
* Change error wording in a minor way
* Update api/types/role.go
Co-authored-by: STeve (Xin) Huang <xin.huang@goteleport.com>
* Update api/proto/teleport/legacy/types/types.proto
Co-authored-by: STeve (Xin) Huang <xin.huang@goteleport.com>
* Update autogenerated files
* Guard against wildcards in `spec.allow.db_permissions`
---------
Co-authored-by: STeve (Xin) Huang <xin.huang@goteleport.com>
Adds the new linter and configures it to prevent direct error
comparisions and type assertions in favor of errors.Is and errors.As.
All current violations caught by the linter have been updated
accordingly.
The commit contains the following changes:
- add multi-version support by creating new kinds. This is currently done via an override to maintain compatibility. At some point, we might migrate unversioned kinds (TeleportRole) to versioned kinds (TeleportRoleV5) and remove the override
- unify all resource statuses in a single struct. This simplifies the CRD building because we are not trying to guess which package is correct anymore when parsing go's AST
- update crdgen snapshots
This PR does not update the base CRDs in the operator or the Hlem chart. This will happen in the next PR, adding go types and controller support.
Note for reviewers: the changeset might seem large, but the changes are split into commits that are much more reviewable. You only need to review the first two commits.
* Document resource version in proto files
This will be useful when generating documentation from proto for the TF
provider. With this change, we will display which version value should
be set.
This change is required so we can make version mandatory in TF.
* docs: always set version when using the TF provider
* docs: re-generate the TF reference, with the version updates
* Apply suggestions from code review
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
* re-generate grpc client
* fix typos
* re-generate CRDs
---------
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
Update master as the now-source of v16 when it gets cut:
* Update `VERSION` in `Makefile` to 16.0.0-dev
* Update `BUILDBOX_VERSION` in `build.assets/Makefile` to `teleport16`
* Update a couple of mentions of v13 in `README.md` to v16
* Run `make update-version`
* Run `make dronegen`
Some workflows are to be updated once v15.0.0 is actually released.
* Add GCP and Azure support to agent-pool-terraform
Closes#34040
The intention of this change is to keep the overall structure of the
guide and Terraform module close to the original in order to minimize
the scope of the change and reuse text and Terraform configurations
between the different cloud providers.
There isn't an elegant way to dynamically enable and disable `provider`
and `required_providers` settings based on input variables, so the
choice was between (a) writing separate modules for each cloud provider
and (b) having the user modify the module to remove unneeded cloud
provider configurations. I opted for (b) to allow the module to reuse
resources and the cloud-init script.
While adding GCP support was straightforward, Azure was less so since
the Azure VM resource requires an SSH public key. I made the SSH public
key file path an input variable while configuring the cloud-init script
disable OpensSSH and delete any authorized public keys on the instance.
This change also improves the module and guide in two ways that are
unrelated to adding Azure and GCP support:
- Adds an AWS AMI data source instead of hardcoding an AMI ID for EC2
instances. The hardcoded AMI has already become unavailable.
- Clarifies the requirement for NAT infrastructure so instances can
communicate with the Teleport Proxy Service, and explains that demo
environments can assign public IPs to each instance if NAT
infrastructure is unavailable.
* Reorganize agent-pool-terraform
Support Google Cloud and Azure without requiring the user to download
the module with `git` and remove unneeded files. Instead, define
separate upstream Terraform modules for each cloud provider, plus a
module for resources required by all three cloud providers (i.e., a
cloud-init script populated with a join token).
More specific changes:
- Reorganize the module import logic: Have the user define a main.tf to
import both the `teleport` module and a cloud-specific module. This
way, Terraform is not aware of providers for unnecessary clouds, and
users don't need to authenticate to providers they won't use.
- Add an `insecure_direct_access` input variable to enable IP addresses
for agents in demo environments without requiring the user to edit HCL
files.
- Add an `agent_roles` input variable so the user can modify the agent
roles included in both the Teleport configuration files and join
tokens generated by the module.
* Add role grants for access list owners.
Access list owners can now have their own individual role grants.
* Update operator CRDs.
* Update access list reference with owner grants.
* gRPC update.
* Fix tests.
AWS starter and HA autoscale cluster examples are outdated now that legacy AMIs
have been deprecated. Update them to use hardened AMIs and bump AWS terraform
provider to v5.x.
Graviton is the preferred (and cheaper) platform on EC2, so our documentation
/example code should use such instance types. This also means using ARM64
builds as well.
Remove the `monitor` role and associated infrastructure (as the new hardened
AMIs lack telegraf, influxdb, etc.).
s/letsencrypt/Let's Encrypt/
Ref #34282.
Ref #36110.
Closes#2734.
Closes#4756.
Closes#4572.
Prefer the stdlib version of the experimental package.
Includes a depguard update to prevent future regressions,
as well as an e-ref update to appease depguard.
Generated with:
$ gofmt -w -r '"golang.org/x/exp/slices" -> "slices"' . && \
make fix-imports
Closes#14580Closes#17528
Get the Jira guide to follow the structure of other Access Request
plugin guides, including instructions for Teleport Cloud and Machine ID
users.
Also make some small adjustments for clarity and readability:
- Flesh out the intro to include sarchitectural information.
- Make the prerequisites list more comprehensive.
- Fix the list of columns required in the project board, which is out of
date.
- Mention the `/status` endpoint of the webhook.
* Add support for `include_enterprise_slug` in `github` joining
* Correct assertiosn in github validator token test
* Remove `want` in TestIDTokenValidator_Validate
* Fix missing `should` in docs
Co-authored-by: Krzysztof Skrzętnicki <krzysztof.skrzetnicki@goteleport.com>
* Fix spelling of customize in docs
* Update operator CRDs
* Regen protos
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Try both under same header
* Try H4
* Remove spurious period
* Use bold rather than heading
---------
Co-authored-by: Krzysztof Skrzętnicki <krzysztof.skrzetnicki@goteleport.com>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Support paid editions in agent-pool-terraform
Closes#33652
Currently, the `agent-pool-terraform` module only supports installing
Teleport Community Edition on agent nodes, which is not compatible with
commercial editions of Teleport.
This change edits the `agent-pool-terraform` module to support
commercial Teleport editions by:
- Adding a variation of the user data script that installs Teleport
Enterprise
- Branching on the user data script to load based on an input variable
* Linter fixes
* Improve the agent-pool-terraform module
Responds to feedback by **r0mant**.
Add an input variable for the user's Teleport edition and use that input
variable to supply the second parameter of the one-line install script,
which specifies the Teleport edition. This way, we do not need to branch
the user data script within the module.
This change also includes the following edits, which were required to
test the guide:
- Put the version number in quotes within `main.auto.tfvars`.
- Add the `terraform init` command.
- Add an AMI data source instead of hardcoding an AMI ID. This prevents
the AMI ID from going out of date.
For neatness, this also adds a separate `.tf` file for the token,
preventing the file from appearing too long when we include it in the
guide.
* Respond to hugoShaka feedback
- Disable non-SSH services by default on the agent token and in the
configuration file written by the init script. Use comments to
instruct the reader to enable other services.
- Add instructions in the how-to guide to enable services you want to
run on agent nodes.
Also removes a statement about the init script that is no longer
accurate.
* Respond to webvictim feedback
Fix spelling
* Add external upgrader version to proto message
* Inlcude upgrader version in metrics and inventory
* Include TELEPORT_EXT_UPGRADER_VERSION in deployment
* whitespace
* Include upgrader version in inventory ls
* Small docs change
* Use teleport-upgrade version if available
* Normalize version
* Address feedback
* Revert e
* Update lib/automaticupgrades/config.go
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
---------
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
* tooling: introduce helm reference generator
This commit introduces a Helm reference generator. It reads the
description of the values from the chart's values.yaml and generates a
markdown file that can be included in our user documentation.
The check will be enabled in later commits as we start generating doc
reference with this tool.
* license
Edoardo Spadolini