* fncache: Pass non-cancellable context to `OnExpiry` callbacks
Call `OnExpiry` when `get()` replaces an expired entry on reload.
Previously, entries that expired between cleanup intervals were
silently dropped when a new request triggered a reload, skipping
the `OnExpiry` callback entirely.
Use `context.WithoutCancel(c.cfg.Context)` at both the
`removeExpiredLocked` and `get` call sites so that `OnExpiry` work
completes even after shutdown begins. `Shutdown` cancels
`c.cfg.Context` via `c.cancel()` before processing entries, but
these two call sites passed `c.cfg.Context` directly, meaning
goroutines spawned by `OnExpiry` could run with an
already-cancelled context.
Update the `OnExpiry` doc comment to warn that the cache mutex may
be held when the callback is invoked.
* app: Add active sessions Prometheus gauge
Add a `teleport_app_active_sessions` gauge labeled by app name that
tracks HTTP app sessions on each agent. The gauge increments when a
session chunk is created and decrements after the session chunk
finishes closing, so it reflects sessions still holding resources
(audit streams, disk I/O) rather than just sessions accepting new
requests.
TCP and MCP sessions are excluded because they bypass the session
chunk cache.
* fncache: Fix `OnExpires` typo in `Shutdown` doc comment
Correct the stale field name `OnExpires` to `OnExpiry` in the
`Shutdown` method's doc comment to match the actual field name in
`FnCacheConfig`.
All existing template usage was converted to make use of
github.com/DataDog/datadog-agent/pkg/template. The DataDog package
is a fork of the stdlib template packages with method calling
removed so that reflect.MethodByName does not prevent DCE.
There were a handful of method calls in our templates that were trivially
changed to use custom functions defined via FuncMaps or specifying the
calculated value to the template instead of calling a function in the template.
A future change will add linter rules to prevent new text/template or
html/imports from landing. They have not been included here so as
to not to break enterprise code while it is migrated.
* Update kingpin
* Convert CLI formatting to use kingpin UsageRenderers
Avoiding the legacy kingpin text/templates allows for DCE to be used
by the linker. The existing formatting has been matched with a
pure Go UsageRenderer.
* Detect EC2 join failures and surface via readyz
* Replace readyz join check with systemd log capture
* Add JoinFailureTimeout constant
The installer's readyz polling timeout is referenced by both
the autodiscover installer and the SSM waiter. A shared constant
avoids drift between the two values and keeps the user-facing
status message in sync with the actual wait duration.
* Replace two-attempt join check with poll loop
The join health check now polls the readyz endpoint in a loop
until the node reports ready or a five-minute timeout elapses.
Previously the check ran at most twice with a fixed delay of
thirty seconds, which missed nodes that needed longer to join
and could not distinguish a slow start from a permanent failure.
On timeout the error includes a best-effort systemd service
snapshot gathered via systemctl show. This replaces the earlier
systemctl is-active gate that blocked readyz from being checked
at all when the service was in a non-active or transient state.
The readyz function returns a simple (ready, error) pair instead
of the earlier four-value tuple, and per-attempt timeouts that
hit deadline-exceeded are treated as transient so that polling
continues. A clockwork.Clock field enables deterministic time
control in tests.
* Align SSM waiter timeout with poll timeout
The SSM command waiter used a hardcoded 100-second wait that was
inherited from the v1 SDK default. The installer now polls readyz
for up to five minutes, so the SSM waiter must outlast that to
avoid reporting a stale in-progress state as the final outcome.
The new timeout is the join-failure timeout plus a ten-minute pad.
* Update docs for readyz poll loop errors
Error patterns, status messages, and the example event code now
reflect the polling-based join health check. The event code moves
from TDS01E to TDS00W, and the user task description no longer
assumes an IAM join handshake rejection as the sole failure mode.
* Trim SSM stdout/stderr in audit events
SSMRun audit events can carry unbounded stdout/stderr from
command invocations, risking the 64 KB stream message limit.
Cap each field at 24 000 characters (matching the per-field
cap in the event schema) by keeping only the trailing portion
and aligning the cut to a full-line boundary so diagnostics
stay readable.
* Simplify output.
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Expand RedactFlagArgs doc comment
* Add IsConnectionError to utils package
Move the socket-level connection check from the installer package
into the shared utils package. The readyz checker needs this to
distinguish transient socket errors from application failures,
and the existing helpers in utils already cover related network
error classification.
* Remove install-script binary-exists guard
The shell installer no longer skips the download when a Teleport
binary already exists on disk. Previously the guard would bypass
reinstallation, but the installer is now expected to always run so
that package-managed upgrades and configuration changes take effect.
* Remove readiness handler tests from lib/service
These tests covered the HTTP readyz handler that is no longer
exercised through the service-level test surface. Readyz check
behaviour is now validated through the installer readyz checker
tests, making these redundant.
* Simplify join-failure error output
The error writer no longer unpacks trace message slices or strips
standalone sentinel lines before printing. Errors now flow through
as plain strings, which is sufficient because the upstream assembly
was simplified to produce one coherent error message.
* Extract readyz checker and diagnostics helpers
Split readyz check logic and systemd diagnostics out of the large
autodiscover file into dedicated files. The readyz checker becomes
a standalone struct with its own per-attempt timeout, connection
error classification, and test suite. Diagnostics helpers such as
journal capture, service state gathering, and the systemctl runner
move into a diagnostics file alongside ErrJoinFailure and related
constants.
The poll loop in checkJoinHealth is restructured to perform an
immediate first check before entering the timer loop, and error
assembly is inlined instead of threading through append helpers.
Tests now use a fake clock and goroutines to exercise the timer
driven polling flow deterministically.
* Move JoinFailureTimeout to installer package
Relocate JoinFailureTimeout from installstatus/exitcodes.go
into installer/autodiscover.go where the readyz polling
logic that consumes it lives. The exit-code String() method
now returns a generic timeout message; ssm_install.go
appends the concrete duration for the join-failure case.
* Reuse poll timer in readyz health check loop
The readyz poll loop allocated a new timer on every iteration and
checked readiness only after waiting. The loop now runs the first
check immediately before entering the poll cycle and reuses a single
timer via Reset, reducing per-iteration allocations. The ready state
drives the loop condition directly, moving the success return after
the loop so the function ends with the diagnostic-failure path at
the bottom.
* Replace binary mocks with function overrides
Join-health timeout tests relied on bintest process mocks for both
systemctl and journalctl, requiring filesystem setup, path wiring,
and post-run invocation assertions for every test case. Diagnostics
and journal capture now use optional function-level overrides that
are injected through the installer config, with thin wrapper methods
that fall through to the real implementation when no override is set.
Previously each test needed six to eight lines of mock orchestration
that obscured the actual test logic.
* Update lib/srv/server/installer/autodiscover_test.go
Scope context to test.
Co-authored-by: Chris Thach <chris.thach@goteleport.com>
* Update lib/srv/server/installer/autodiscover_test.go
Scope context to test.
Co-authored-by: Chris Thach <chris.thach@goteleport.com>
* Update lib/srv/server/installer/autodiscover_test.go
Scope context to test.
Co-authored-by: Chris Thach <chris.thach@goteleport.com>
* Update lib/srv/server/installer/autodiscover_test.go
nstaller/autodiscover_test.go
Co-authored-by: Chris Thach <chris.thach@goteleport.com>
* Simplify arg redaction loop to use range
Co-authored-by: Chris Thach <chris.thach@goteleport.com>
* Simplify override fields to defaults in config
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Add JoinFailureError structured error type
Replace the ErrJoinFailure sentinel with a JoinFailureError struct
that carries message, service diagnostics, journal output, and last
readyz error as separate fields. Previously callers had to parse a
concatenated string to extract individual diagnostic sections, making
downstream formatting and programmatic inspection fragile.
* Surface unexpected readyz errors to caller
Return unexpected errors from the readyz check instead of swallowing
them and returning false. The polling loop in checkJoinHealth keeps
retrying on these errors but now records the last one so it appears
in the timeout diagnostics. Previously a transient HTTP or socket
error was silently discarded, making it impossible to distinguish
"not ready yet" from "endpoint unreachable."
* Replace clock and overrides with function fields
Remove the clockwork dependency from the join-health check and use
the standard time package directly. Promote journalOverride and the
diagnosticsOverride to first-class diagnostics and journal function
fields initialized in checkAndSetDefaults. Build a JoinFailureError
on timeout instead of concatenating string parts. Tests switch from
fakeClock and BlockUntilContext to synctest.Test with time.Sleep,
removing the need for manual clock advancing.
* Use JoinFailureError in CLI error output
Switch the CLI join-failure path from errors.Is with the old sentinel
to errors.As with JoinFailureError. The writer function now accepts
the typed error and prints each diagnostic field on its own line.
Previously the error was printed as a single opaque string, making it
harder to scan in SSM console output.
* Normalize dash prefix in flag redaction
Add a lookupRedactor helper that maps both single-dash flags to their
double-dash redactor registration and vice versa, so callers need not
register both variants. Previously a -token=secret argument passed
through unredacted because only --token was registered in the redactor
map.
* Improve trace msg
Co-authored-by: Gavin Frazar <gavin.frazar@goteleport.com>
* Minor refactor
Co-authored-by: Gavin Frazar <gavin.frazar@goteleport.com>
* Minor refactor
Co-authored-by: Gavin Frazar <gavin.frazar@goteleport.com>
* Minor refactor
Co-authored-by: Gavin Frazar <gavin.frazar@goteleport.com>
* Minor refactor
Co-authored-by: Gavin Frazar <gavin.frazar@goteleport.com>
* Minor refactor
Co-authored-by: Gavin Frazar <gavin.frazar@goteleport.com>
* Minor log improvement
Co-authored-by: Gavin Frazar <gavin.frazar@goteleport.com>
* Remove redundant check
Co-authored-by: Gavin Frazar <gavin.frazar@goteleport.com>
* Quote command+args
Co-authored-by: Gavin Frazar <gavin.frazar@goteleport.com>
* Remove token-redaction utility and its usage
Log node-configure arguments directly instead of redacting the join
token. The token is a short-lived secret issued by the auth server
for EC2 auto-discovery; it expires before log entries are typically
reviewed, so the redaction layer added complexity without meaningful
security benefit. Previously every call to the node-configure step
copied the argument slice through a redactor map and a flag-parsing
loop.
Replace hardcoded five-second sleeps in health-check tests with the
installer's readyzPollInterval field so the tests stay correct when
the interval changes. Remove a stray closing brace left over from a
prior edit.
* Improve diagnostics error messages and comments
Add a comment explaining the systemctl-show output format that the
property parser expects. Quote "systemctl show" in the log message
for the invocation-ID retrieval failure so it renders as a distinct
command name rather than bare words. Switch the infrastructure error
path to use the %q format verb with the full command object so the
message includes the complete binary path instead of manually joining
the argument list.
* Use server clock for EC2 installation SyncTime
Set SyncTime to the discovery server's clock instead of the SSM run
event timestamp. Previously the field carried the event time, which
reflects when SSM dispatched the command rather than when the server
recorded the installation result, causing user-task entries to show
stale timestamps that did not advance on re-evaluation.
* Expand trimToRecentTail godoc comment
* Bound diagnostics collection after join timeout
Diagnostics and journal capture now run under a dedicated five-second
timeout derived from the parent context. Previously they inherited the
caller's context with no independent deadline, so a hung systemctl or
journalctl call could block indefinitely after the readyz poll already
determined the node failed to join.
Journal capture errors are downgraded from a hard return to a warning
log entry. A transient journalctl failure was masking the underlying
join-failure error, causing the caller to receive a journal-capture
error instead of the structured JoinFailureError that carries the
diagnostics payload.
* Document waitTimeoutPad tradeoff and TODO
* Replace systemctl subprocess with D-Bus API
Diagnostics collection now queries systemd properties through the
native D-Bus connection rather than shelling out to systemctl show
and parsing stdout. The D-Bus interface needs fully-qualified unit
names, so the unit-name builder appends a ".service" suffix to each
returned value. This eliminates the systemctl binary-path dependency
during diagnostics and avoids subprocess-parsing fragility around
exit-code versus infrastructure error disambiguation.
* Fix go mod
* Bump how many journal lines we output
* Extract systemd client into lib/systemd package
The systemd D-Bus property lookups, invocation ID retrieval, and the
journalctl capture now live in a reusable lib/systemd package that
exposes a Client with ReadServiceState, InvocationID, and CaptureJournal
methods. Previously these helpers lived as unexported methods on the
AutoDiscoverNodeInstaller type, so any other call site that needed a
systemd state snapshot had to either duplicate the logic or import the
installer package just to reach them. Moving them to a dedicated package
keeps the shared integration layer free of installer-specific policy
and makes the code reusable by unrelated callers.
The installer diagnostics file retains only installer-facing types and
the enableAndRestartTeleportService logic. JoinFailureError doc comments
no longer hardcode the 5m0s timeout in the example, since the timeout
is now configurable and changes across releases. Two clarifying comments
on runSystemctlCommand document why context errors are preferred over
exec errors, and why ExitError branches include the exit code and the
captured stdout and stderr streams in the wrapped error message.
The installer-side test file drops the helpers' tests because they now
live alongside the package they cover in lib/systemd. The remaining
TestJoinFailureErrorString case derives its expected message from
JoinFailureTimeout rather than hardcoding a duration literal.
* Bound join-health polling and diagnostics collection
The join-health check now drives polling with retryutils.NewRetryV2
against a dedicated pollCtx bounded by readyzPollTimeout, and the
diagnostics collection step races the diagnostics and journal goroutines
against diagCtx using channels and a select loop. Previously the poll
loop used a hand-rolled timer with a remaining-duration calculation, and
the diagnostics step waited on a sync.WaitGroup, so a stuck diagnostics
or journal implementation blocked the join failure report indefinitely
even after the parent context was canceled. With the new structure,
context cancellation and the diagnostic timeout both unblock the join
failure path, and the journal output field now carries an explanatory
message when collection times out or is canceled instead of being
silently empty.
JoinFailureTimeout is reduced from five to three minutes to surface
join failures sooner in SSM invocation results, where the full five
minute wait previously delayed operator feedback without improving the
odds of recovery. LastError is no longer populated when the error from
readyzChecker originates from the poll context already expiring, so the
join failure message reflects the actual join outcome rather than a
context cancellation observed only after the poll deadline.
The installer now delegates diagnostics collection and journal capture
to a teleportsystemd.Client constructed from the installer config,
rather than calling unexported systemd helpers on the installer itself.
The local dbusConn interface and its sole usage are removed in favor of
teleportsystemd.NewConnFunc, which is now the test seam for injecting
fake D-Bus connections into the diagnostics client.
The autodiscover tests cover the new behaviors: a stuck diagnostics or
journal implementation does not block join failure reporting when the
parent context is canceled, a poll timeout does not populate LastError,
and a diagnostics timeout produces a human-readable journal substitute.
Existing tests switch from context.Background() to t.Context() so they
inherit the per-test deadline configured by the testing package.
The EC2 troubleshooting docs and ssm_install_test fixtures stop using
a hardcoded five-minute duration and instead derive it from exported
installer.JoinFailureTimeout, so they track future timeout changes
without manual edits across docs, tests, and error message snippets.
* Use t.Context in readyz checker tests
* Reduce join-failure timeout default from 3m to 2m
---------
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
Co-authored-by: Chris Thach <chris.thach@goteleport.com>
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: Gavin Frazar <gavin.frazar@goteleport.com>
Adds a new variable `user.metadata.name` that can be used in role templates:
```yaml
allow:
node_labels:
owner: '{{user.metadata.name}}'
```
Or in expressions:
```yaml
allow:
node_labels_expression: |
labels["owner"] == user.metadata.name
```
So that you can create roles that allow access to user-owned resources such as
"Connect My Computer" nodes, or the upcoming Beams feature.
* Write CLI --help text to stdout instead of stderr
* Display only one level of subcommands in help text
* Prevent a hidden command from increasing indentation level
* Add entry to changelog explaining updates to --help output
* enforce region validation on all AWS config loading
Replace direct uses of `github.com/aws/aws-sdk-go-v2/config.LoadDefaultConfig`
with the internal `lib/cloud/aws/config.LoadDefaultConfig` wrapper, which
validates any explicitly requested AWS region before use. Enforces this via a
new forbidigo linter rule.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Apply suggestions from code review
Co-authored-by: Nic Klaassen <nic@nicklaassen.ca>
* fix unit tests
* include underscores and uppercase letters
* add ConfigureRegion
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: Nic Klaassen <nic@nicklaassen.ca>
* MWI: Adapt bound keypair verification logic to account for standard hosts
This adds support for verifying host UUIDs (rather than bot instance
UUIDs) to the bound keypair join method.
Note that as hosts only have a trustworthy UUID when joining via the
new join service, bound keypair joining for agents via the legacy join
service is not allowed and will result in an error.
* Test coverage and small fixes for legacy joining
Agents cannot join via the legacy join service, however the bound
keypair implementation depends on having a trustworthy HostID that
is unset for bots. The impl passed it through before since it wasn't
used, so we now clear it.
* Add unit test coverage for node joining
Also includes missing bound keypair case in HostID generation,
fixes a leaky error string in HandleBoundKeypair, and adds additional
checks for identity misuse with presenting HostIDs to a token with
a bot ID and vice versa.
* Address review feedback
- Use `t.Context()` in tests
- Remove unnecessary params for mutator functions that were always
an empty string.
* events: refactor download methods to return io.ReadCloser
Replace the writer-based download interface (Download, DownloadSummary,
DownloadMetadata, DownloadThumbnail) with a reader-based one that returns
io.ReadCloser, giving callers control over streaming.
Add a downloadretrier package implementing an io.ReadCloser that
transparently retries failed downloads up to 3 times, resuming from the
last successfully read byte offset. This replaces the S3-only retry logic
and extends resilient downloads to all storage backends (S3, GCS, Azure,
and local filesystem).
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* avoid breaking e
* handle review feedback
* disable retry for pending summaries in gcs and abs
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Depguard rules for the session submodule
* Move lib/auditd to session/auditd
* Move lib/loginuid to session/loginuid
* Reduce dependencies of lib/utils/envutils
* Move lib/utils/envutils to session/envutils
* Split the SSH utilities of sshutils/x11 into sshutils/x11forward
* Move lib/sshutils/x11 to session/networking/x11
* Move lib/sshutils/networking to session/networking
* Move lib/shell to session/shell
* Move lib/utils/uds to session/uds
* Move lib/utils/host to session/host
* Move lib/pam to session/pam
* Avoid lib/utils/log in session/pam
* Move lib/service/servicecfg.PAMConfig to session/pam/pamcfg.PAMConfig
* Move lib/srv/uacc to session/uacc
* Avoid importing lib/utils in session/uacc
* Move lib/selinux to session/selinux
* Avoid lib/utils and lib/utils/log in session/selinux
* make go-mod-tidy-all
* Update oss-fuzz path for session/networking/x11
Compile allowed/denied name and namespace patterns once per request
into a fast matcher instead of calling matchKubernetesResource per item.
The per-item cost is not regex compilation (already cached) but cache
lookups, iteration over all rules, per-field matching, and branching
logic. For 5k pods x 3 rules x 3 fields = ~45k cache lookups per
request.
The fast matcher resolves kind, verb, and apiGroup at compile time
(constant per request) and only checks name and namespace per item.
Falls back to the existing defaultMatcher for namespace-kind requests
which have special cross-field matching logic.
* limiter: Add failing test for custom rate bucket clobbering
Add an assertion to TestCustomRate that proves the bug: when a
default-rate RegisterRequest call interleaves with custom-rate calls
for the same client IP, the custom-rate bucket is clobbered because
both share a single TokenBucketSet keyed by IP alone.
The test fails on master at limiter_test.go:145. The next commit
fixes the bug.
* limiter: Use dedicated RateLimiter for account recovery
Replace the shared-bucket custom rate approach with a separate
RateLimiter instance for account recovery RPCs. This follows the
same pattern as gravitational/teleport#64559 and avoids the
shared-bucket clobber problem entirely: each concern gets its own
RateLimiter with its own FnCache, so default-rate requests cannot
reset stricter per-endpoint buckets.
The `getCustomRate` middleware passed per-endpoint rate sets through
a shared FnCache keyed only by client IP. When a default-rate
request hit the same IP, `TokenBucketSet.Update` overwrote the
cached bucket with the default rate parameters, resetting the
stricter custom-rate state.
Add a private `accountRecoveryLimiter` to the auth Middleware and
wire it into `rateLimitUnaryInterceptor`, which applies the default
limiter to all endpoints and the recovery limiter on top. Remove
`getCustomRate`, `CustomRateFunc`, `UnaryServerInterceptorWithCustomRate`,
and the `customRate` parameter from `RateLimiter.RegisterRequest` and
`RegisterRequestFromAddr`. Export `ClientIPFromContext` from the limiter
package for use by the middleware.
Keep a deprecated `Limiter.RegisterRequestWithCustomRate` shim for
backwards compatibility with enterprise callers (they all pass nil).
* limiter: Remove stale accountRecoveryEndpoints comment
Remove orphaned comment from the deleted `accountRecoveryEndpoints`
variable. The comment was left behind when the variable was replaced
by inline switch cases in `rateLimitUnaryInterceptor`.
* limiter: Guard nil accountRecoveryLimiter in interceptor
The accountRecoveryLimiter is nil when Middleware is constructed
without calling newAccountRecoveryLimiter, which happens in
initSecureGRPCServer for Kube-only traffic. The nil dereference is
not reachable on current code paths because recovery RPCs are never
routed to that server, but add a nil guard to make the interceptor
safe independently of how the server is wired.
* limiter: Remove RegisterRequestWithCustomRate
Remove the backwards-compatibility shim now that all enterprise
callers have been removed via gravitational/teleport.e#8359.
* limiter: Extract ClientIPFromAddr to lib/utils
Move the addr-to-IP parsing into `utils.ClientIPFromAddr` (next to
`ClientIPFromConn`) so `lib/auth` does not depend on `lib/limiter` for
IP extraction. Add an unexported `clientIPFromContext` in `lib/auth`
for the gRPC peer lookup.
Reduce the public API surface of `lib/limiter` that deals with gRPC
concepts, keeping it closer to its intended role as a general-purpose
rate limiter keyed by string tokens.
* Initialize usage reporting via plugin registry after auth server setup
Usage reporting was previously initialized in enterprise process
constructors (cloud.NewTeleport, pro.NewTeleport), which ran after the
OSS auth server completed initialization. This caused enterprise auth
extensions to miss the UsageReporter service because they were initialized
after the OSS auth server was created but before the usage reporting was set up.
To fix the ordering, add a callback mechanism to plugin.Registry:
- SetUsageReportingInitFunc registers a callback to be called once the
auth server is ready.
- InitUsageReporting triggers that callback from initAuthService, after
setLocalAuth makes the server available to callers.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* update comment
* handle review feedback
* remove dynamic function load
* fix another addition
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Make it clear in generated CLI reference docs that they were generated
so authors do not attempt to edit them directly. Edit the template for
generated CLI docs to add a message.
Regenerate CLI references to include the message. This also updates the
references.
Note that the CLI reference doc generation is not yet fully idempotent,
so we cannot enforce generation.
To pass linting, edit the `teleport` CLI to use "Amazon Bedrock" (the
correct product name) in an error message instead of "AWS Bedrock".
* MWI: Add certificate expiry check leeway for app tunnel service
This adds some leeway to the application-tunnel service's certificate
expiration check.
For context, the app tunnel service does not follow Machine ID's
usual certificate renewal cycle and instead opts to renew
certificates just-in-time before completing a request if the
certificate has expired per the local clock.
Unfortunately, the local clock is not always accurate, and if the
certificate or underlying app session has already expired from the
server's perspective, client requests can still fail until the local
clock catches up and the certificate is refreshed.
To mitigate this, this change adds a `leeway` parameter to the
service, configurable via YAML, with a default value of 1m. This is
added to the current time when certificate validity is checked. This
means that, in the worst case, certificates will be refreshed to early
rather than too late.
See also: #64284
* Remove duration pointer and ignore leeway if greater than cert TTL
* Make tbot's leeway parameter global
This makes the leeway parameter global, and additionally uses it in
the main renewal loop (for the expired bot internal identity
detection) and in the database tunnel service.
Also adds some test coverage for app tunnel cert renewals.
* Tweak doc comment for clarity
* Remove unused code
* Ignore excessive leeway values in identity service
* Honor effective lifetime in leeway check
* Fix leeway var reference
* Update golden tests
* Codex reviewer appeasement
Factor in actual cert TTL in the leeway cap.
* Fix failing test
* Fix imports
This commit does the following:
- Move existing smoke benchmark workflows to seperate workflow.
- Add differential benchmark workflows
- Split benchmarks into heavy and micro categories
- Add make target arguments for benchmark time and count
- Move smoketests to run only on PRs
- Differential benchmarks run on merge queue
Benchmarks above 1ms/op are considered heavy and should make
use of iteration based benchtime to prevent the CI job from taking
too much time. Benchmarks are skipped based on env vars, this is an
alternative to splitting benchmark targets into seperate files with
build tags.
The smoke tests should be much faster and as such are set to run
on PRs to ensure the targets are not broken in the change.
The current parameters for differential benchmarks attempt to balance
CI runner time and confidence for benchstat.
Differential benchmarks determine the base commit to run the tests against,
this happens within the same job to remove the runner to runner variance.
* [mcp] Enforce case-sensitive JSON parsing for MCP messages
Implement custom UnmarshalJSON methods on mcputils JSON-RPC types to
enforce case-sensitive field matching. This makes case sensitivity
foolproof - json.Unmarshal automatically uses case-sensitive parsing
via the json.Unmarshaler interface.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
* Add TODO to migrate to encoding/json/v2
---------
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
* Generate a tctl reference page
Add a `cli-docs-tctl` Make target and generate the page.
To allow the page to render, make the `tctl edit` help text more
consistent with that of other commands by using a single line for the
resource type/name argument.
This change adds 47 `tctl` commands not present in the current
reference.
Also change the default value of the `tctl recordings download`
`output-dir` flag to the system-independent "." value. Otherwise,
generating this page prints a system-specific file path.
Also make minor modifications to flag, argument, and command
descriptions to be consistent with messaging conventions in the docs.
* CLI ref generator: add arg/flag default overrides
In the CLI reference doc generator, make it possible to override default
argument and flag values. This is necessary when these values are
dynamic and system dependent, e.g., a user's home directory.
Add the `flag_default_overrides` and `arg_default_overrides` fields to
the generator config file. Use these fields to create template functions
that replace default values in a `*kingpin.FlagModel` or
`*kingpin.ArgModel`.
* Add flag default overrides for tctl reference
Configure flags with dynamic values to have hardcoded values in the
reference docs page so there is no need to edit the dynamic argument
logic in the tctl source.
* feat: Extend `AWSRole` struct w/ `RequiresRequest`
- Differentiate between already-granted vs. requestable AWSRoles when
including requestable resources in `clusterUnifiedResourcesGet`
req
* feat: Implement Resource Constraints support for Proxy, Auth
* fixup: Fix tests
* test: Add tests for resourceaccessid-related helpers
* fixup: Address code review feedback
* test: Update identity/events tests for new `ResourceAccessID` fields
* fixup: Expand/improve godocs/comments for sentinel ResourceID handling
* fixup: Address code review feedback
* feat: Conv ResourceID->ResourceAccessID at cert decoding
- Convert ResourceIDs present on certs to ResourceAccessIDs at decoding
time, rather than at each callsite. Update tests/usages of tlsca/sshca
Identities to reflect this.
* saving progress
* Proxy working with legacy web client
* a bit of cleanup and refactoring. Removed unecessary 'WriteTo' implementations on TDP/TDPB messages.
* Refactoring and code cleanup around tdpb message handling and translation
* Get translation set up
* A bit more cleanup
* Update TDP MFA util to utilize new MFA service protos
* Remove MFA messages from translation interceptors. They're not needed since MFA is handled before we start proxying the connection.
* Add 'PingerFunc' adapter to latency monitor
* More cleanup and refactoring around TDP setup and translation.
* Added tests for desktop proxy with each permutation of client/server dialects.
* Remove redundant and/or dead code.
* More refactoring
* Advertise TDPB as a subprotocol when handling websocket upgrade requests
* Fixes from integration testing
* Update usage of LatencyStats after renaming some fields
* Add a few more TDPB unit tests
* Remove comment
* Add a couple tests for 'handshakeData'
* Light cleanup
* * Remove unnecessary warning logs from MFA flow
* Add test case for TDPB MFA flow
* Remove obsolete 'tdpMFACodec'
* Update Go TDPB implementation after protobuf 'oneof' refactor.
* more cleanup
* Proxy alpn and username fixes
* The great refactor
* refactor aftermath
* Add explicit strict/permissive TDPB Decode implementations and fix test case that validates permissive decoding
* Missed recording_export during refactor
* not yet
* Fix a few refactor typos
* Cleanup TDP/TDPB proxy handler by refactoring disparate TDP/TDPB client handling.
* last bit of cleanup
* Clean up tdp/tdpb translation
* Remove commented out code
* Attempt to reduce some noise by refactoring package aliases.
* update comment
* fix lint errors
* more lint fixes
* last lint fixes
* Fix race in test setup
* Add license headers to new files
* Apply suggestions from code review
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Rename wsAdapter and re-implement it's 'ReadMessage' method with a re-usable buffer
* Move TDP/TDPB MFA ceremony implementations to tdp/tdpb/legacy packages.
* Improved godocs in tdpb package
* Address the lighter PR feedback.
* Drop tdp/legacy import aliasing
* fix unnecessary conversion
* Fix license
* Apply suggestions from code review
Co-authored-by: Przemko Robakowski <przemko.robakowski@goteleport.com>
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Fix ping/pong matching
* * Rename 'isMFAResponse' to 'asMFAResponse'
* Fix surrounding comments
* fix comment
* Do not send empty error messages to client
* Fix some TDPB/TDP translation layer oversights
* Fix incorrect protobuf representation of MouseWheel's 'delta'. Should be int32, not uint32.
* Fix quoting in error string
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
Co-authored-by: Przemko Robakowski <przemko.robakowski@goteleport.com>
Add a `cli-docs-teleport` Make target and generate the `teleport` CLI
reference page.
Edit the `teleport` app description to work with both in-app help text
and the generated docs.
Add a `cli-docs-tbot` Make target and generate the page.
This change adds 19 `tbot` commands not present in the current
reference.
Also make minor changes to the app description so it can apply to both
in-app help text and generated docs.
Generated CLI reference docs take their introductory paragraphs from the
app-wide descriptions defined using the `kingpin` library. However, this
approach can make for awkward text, as the in-app descriptions are not
intended for docs pages.
This change modifies the logic for loading config files for generating
CLI reference docs in order to define custom introductions. It enforces
a nonempty introduction field in the config.
There is currently one CLI reference page we generate from the source,
the one for tsh. Edit the tsh reference generator config to include an
introduction.
Tangential changes:
- Pass a loaded config in `updateAppUsageTemplate` so we can define
introductions in tests.
- Print error messages to stdout and exit with an error instead of
panicking. This is because kingpin prints CLI help text to stderr,
which gets redirected to the generated docs page.
Our `/.well-known/openid-configuration` endpoint currently advertises that we
support the `pair-wise` subject type. This is a typo of `pairwise` which causes
stricter parsers such as the Nimbus Java SDK to reject our configuration.
As we do not actually supoprt `pair-wise` yet, we should not advertise support
for it.
changelog: Removed erroneous `pair-wise` subject type from Teleport's OpenID configuration
Closes#47358
Run the docs generator introduced in #54394 for the `tsh` CLI reference.
Also remove the environment variable override for
`TELEPORT_LOGIN_BROWSER`, which is a hidden flag.
Note that the following hidden global environment variables are present
in the manually maintained guide but, because they are hidden, absent in
the generated guide:
- TELEPORT_LOGIN_BROWSER
- TELEPORT_USE_LOCAL_SSH_AGENT
The guide is also missing the `tsh puttyconfig` command, which is only
present when we build `tsh` for Windows. However, since VNET for SSH
fulfills much of the use case for `tsh puttyconfig`, and generating the
docs adds entries for around 33 more `tsh` commands, this is an
acceptable tradeoff.
Edit some help text to conform to the standards of the documentation.
The MDX parser encounters errors when parsing square and angle brackets
in argument and flag descriptions, since these look like malformed links
and tags. Escape these characters so generated CLI reference pages
render correctly.
Sort the flag and argument tables of generated CLI docs. Do so
alphabetically by the value of the first column, disregarding non-word
characters and character case.
* Allow nodes to join the cluster based on their AWS Organization
* remove unused struct field
* add cache to the DescribeAccount API response
* review pt1
* review pt2
* remove setter
* Add support for Teleport applications to verify Teleport-issued JWT tokens via standard OIDC discovery (/.well-known/openid-configuration)
* review comments
* IssuerForCluster to take paths args
* const egress auth types
This commit introduces a watchdog mechanism to agent side ssh connections, allowing
the agent to detect stale connections and reconnect when needed.
The reverse tunnel server will now respond to keep alive messages as a out of band request, which the client will start sending to detect the health of the connection. This watchdog is only enabled if the server successfully responds to the first request, otherwise the agent will await a response until the connection is dropped. This way we do not require extra
feature detection on the agent side.
The agent mirrors the server side behaviour and calculates the watchdog to be:
keepAlive * keepAliveCount,
The agent behaviour can be disabled by setting TELEPORT_UNSTABLE_DISABLE_AGENT_STALE_CONN_TIMEOUT to yes
or other truthy value.
This change also adds missing replies to ping messages where appropriate. Note that internally r.Reply checks the WantReply field.
Testplan:
Manually test happy path locally.
Manually verify backwards compatibility.
Manually verify remote clusters work correctly including backwards compatibility.
Changelog: Adds support for reverse tunnel agent stale connection timeout detection and recovery.
* CLI reference generator: load default env variables from a YAML file
* - Add the 'sidebar_label' and 'tags' frontmatter fields
- Adjust the template and anyEnvVarsForCmd to prevent listing empty environment variable / flag lists
* Clean up the CLI doc generator
Remove unnecessary intermediate values: pass the unmarshaled YAML data
structure directly from `loadDefaultEnvVars` to `UpdateAppUsageTemplate`
without converting it from a `[][4]string`.
* Improve CLI doc generator error handling
Instead of silently exiting with no error if it is not possible to read
the CLI doc generator config file, print an error message.
If there is no CLI generator config file, skip manual environment
variable additions and print a message. (Not using structured logging
since this will only ever be run manually and in CI.)
---------
Co-authored-by: Aatu Väisänen <aatu.vaisanen.ext@goteleport.com>
* add client side reloading to certreloader
Moves certreloader to its own package to avoid cyclic dependency.
Adds client side cert check as well as postgres specific function for
certificate reloading.
* remove duration
* refactor certreloader to include expiry metric
* rework to callback
* fix nil check on callback
* fix lint
* feedback
* AWS EC2 Discovery: support multiple accounts under Organization
* fix loop
* review
* move assume role to role name
* move assume role to role name
* remove wildcard from exclude possible values
* remove list all accounts api call
* expose logs of Teleport child processes
Configures Teleport child proceses to log with the exact same
configuration as the parent process. Logs from child processes
previously were essentially discarded.
* Fix issues around os_log; Fix log spam from child process.
* Address comments; Fix lint.
* * Only write remote command failure errors to client tty
* Don't try to write errors to unserviced os.Stderr/Stdout of child process
* Don't connect networking stderr to parent process, just use logger
* Don't log client-responsible shell errors, e.g. shell interrupt
* Mention running teleport as root for common subprocess permission errors.
* Pass io.Discard pipe to child process if a log writer is not available.
* Fix tests with nil log writer.
* Add default child logger for tests.
* Fix lint.
* default to discard writer for tests.
* Write reexec errors to os.Stdout for parent process to digest.
* Address comments.
* Clean up child pipe copy logic.
* Cleanup log config inheritance.
* Address comments.
* Revert whitespace change.
* Fix typo.
* Fix merge conflict.
---------
Co-authored-by: joerger <bjoerger@goteleport.com>
* Port `spacelift` join method to new join service
This ports the `spacelift` join method to the new join service. It
moves the core validation logic from `lib/spacelift` into `lib/join`,
and adds a small compatibility layer to allow it to be reused between
the new and legacy join services. Where possible, existing logic
remains untouched.
See also: [RFD 27e](https://github.com/gravitational/teleport.e/blob/master/rfd/0027e-auth-assigned-uuids.md)
* Remove duped error declaration
* Move errMockInvalidToken again
This change allows tsh to treat corrupted private keys as though
they were not present (and trigger relogin flows) It also attempts
to prevent said corruption in the first place.
Julia Ogris