* Add type for GitLab ProvisionToken
* Add default behaviour for domain
* Add IDTokenClaims for GitLab
* Add gitlab token source and token validator
* Thread GitLab support through auth and tbot packages
* Adjust cluster name fetching in token validator
* Initialize GitLab token validator in auth
* Improve comment on `sub`
* Working GitLab CI delegated joining
* Add additional token rule fields
* Add checking for new configuration fields
* add additional test cases for validation of gitlab config struct
* Add TestAuth_RegisterUsingToken_GitLab
* Add tests for IDTokenSource
* Fix imports
* Add tests for GitLab Token Validator
* Fix some comments that were incomplete
* Add license headers
* build.assets Dockerfiles: Remove unnecessary ENV NODE_URL
NODE_URL is being redefined within the RUN instruction anyway. We suspect
it might be causing problems because sometimes the logs from build failures
suggest that the NODE_URL export was either ignored or ${NODE_URL} passed
to curl reads ENV NODE_URL and not the env var set within the shell.
* Pass fsSl flags to curl
* Rename old "quick input" to the current "command bar" feature name
* Remove 'Droid Sans Fallback' from Linux fonts
* Add docs for config
* Link to the proper documentation section
* Apply suggestions from @ravicious and @ibeckermayer
Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>
Co-authored-by: Isaiah Becker-Mayer <isaiah@goteleport.com>
* Adjust property descriptions with the names used in User Interface
* Drop `Courier New`
* Simplify `$schema` description
* Fix lint issues
* Add a break line after each heading
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Schema should not be modified
* Config file is created on first launch
---------
Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>
Co-authored-by: Isaiah Becker-Mayer <isaiah@goteleport.com>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Adds `UpsertCertAuthority` to the `teleport.v1.trust.TrustService`
and deprecates the HTTP api. The `services.Trust` interface was
also updated to include a `context.Context` in both
`CreateCertAuthority` and `UpsertCertAuthority.
To ensure backwards compatibility the `auth.Client` will first
attempt to use the gRPC client and if that fails with a not
implemented error it will fallback to using HTTP.
Part of #6394
This trigger allows a maintenance to start if the teleport-kube-agent is
unhealthy. A workload is unhealthy if at least one if its managed pods
is unhealthy. A pod is unhealthy if it has not been ready for 10 minutes
or more.
* Use serverUID for scp target
Revert unneeded hostname change
Remove comment
Get name
* Change name to serverId
* Fix lint errors
* Add comment
* Fix comment and signature format
* Update `crypto` in api
It was missed that cyrpto is being replaced in our `api` as well.
This commit updates the version to match the one in the repo root.
* Remove replacement for crypto in `api`
Replacement directives only function when defined at the main project level, they are not inherited. For that reason I believe here we need to only depend on the updated crypto package, rather than update our replacement.
---------
Co-authored-by: Jakub Nyckowski <jakub.nyckowski@goteleport.com>
* Update predeploy_job.yaml
Adding the ability to allow for requests and limits to be added to the predeploy_job like already done for deployments.
* Update predeploy_job.yaml
Add the ability for the proxy predeploy_job to have limits and requests like the deployment. Using same values from Values file.
* Update predeploy_test.yaml
Adding tests for resource limits on predeploy job for auth and proxy.
* Update examples/chart/teleport-cluster/tests/predeploy_test.yaml
Co-authored-by: Hugo Shaka <hugo.hervieux@goteleport.com>
* Update examples/chart/teleport-cluster/tests/predeploy_test.yaml
Co-authored-by: Hugo Shaka <hugo.hervieux@goteleport.com>
* Update examples/chart/teleport-cluster/tests/predeploy_test.yaml
Co-authored-by: Hugo Shaka <hugo.hervieux@goteleport.com>
* Update examples/chart/teleport-cluster/tests/predeploy_test.yaml
Co-authored-by: Hugo Shaka <hugo.hervieux@goteleport.com>
---------
Co-authored-by: Hugo Shaka <hugo.hervieux@goteleport.com>
* docs: Add instructions on uninstalling Teleport
* Add standalone RPM/DEB instructions and clarification for different OSes
* Language
* Suggestions from code review
* Add more specifics for Teleport Connect
* Address PR feedback
This tag includes the most recent updates from the upstream in order to address recently fixed CVE's.
Changes included: https://github.com/gravitational/crypto/compare/903e65687e59...c3f983bc73dcf711908e49d91bda9cffbecb13cd
In addition this adds `utils/bcrypto.go` to restore the prior crypto behavior of truncating input > 72 chars.
This commit in Crypto breaks functionality with long passwords or more commonly our reset tokens which are > 72 characters: https://github.com/gravitational/crypto/commit/bc7d1d1eb54b3530da4f5ec31625c95d7df40231
As described in the commit message, the prior behavior was to ignore the extra data. Since 72 bytes are plenty of data to prevent brute force attacks, there is not a significant need to report this error to the user.
A new `api/client/proxy/Client` has been added to interact with
the SSH and gRPC servers that the Proxy serves on its SSH port.
The client will first try connecting to the gRPC server and if
that fails it will fall back to the SSH server.
Much of the SSH functionality mimics the existing behavior of the
`ProxyClient` in `lib/client`. This is the first part of phasing
out that client in favor of the new client. There will be a follow
up PR that migrates `lib/client` to make use of the new client instead.
Part of #19812
Adds `DeleteCertAuthority` to the trust grpc service and deprecates
the legacy HTTP api. Additionally the `DeleteCertAuthority` method
in the `services.Trust` interface now takes a `context.Context` as
the first parameter. In order to plumb the context through from all
the call sites `DeleteRemoteCluster` from `services.Presence` was
also modified to take a `context.Context` as the first parameter.
Add a couple of parameters for the developer key ID and bundle ID for
signing/notarizing binaries. Keep the hard-coded values as defaults for
now, but we will remove these soon when all the call sites of the tool
have been updated to pass these values.
We want to parameterize these values so we can use different signing
keys in GitHub Actions and to make the tool agnostic to which binaries
it is signing.
This removal is primarily cost motivated. We will continue to have scheduled scans executed by ossfuzz, but for now we are disabling this job from our PR / merge queue workflows.
* Fix TestDiagnoseSSHConnection to be less strict on the exact unknown user error message, which may vary between OS's.
* Decouple/refactor SkipLocalAuth, UseKeyPrincipal, and static auth methods.
* Resolve comments.
* * Add tests for new methods
* Update proxy ssh principal test to catch regression
* Bump predicate error in switch case priority
* Adds bypass for lint go for RFD and Docs changes.
* spacing
* Update docs test to only check for docs, examples changes or bypass
* include merge groups
* test docs change
* remove change
* Test go change
* remove go test change
* test doc changes
* remove docs test change
* fix indentation
* fix indentation
* Add a guide to writing an Access Request plugin
Closes#22227
This guide uses a minimal working example of an Access Request plugin to
demonstrate some of the key libraries that Teleport makes available to
plugin developers. The guide is based on a 270-line plugin that manages
Access Requests using Google Sheets.
* Respond to hugoShaka feedback
* Respond to zmb3 feedback
* Add some minor tweaks
- Update the line of code count in the demo program
- Mention Machine ID
* Respond to alexfornuto PR feedback
To prevent users from being able to directly connect to registered
OpenSSH (Agentless) nodes, the OpenSSH CA was introduced. When
connecting to Agentless nodes, the Proxy will forward the connection
so the session can be recorded. The forwarding SSH server is configured
to authenticate to the target node with a certificate signed by OpenSSH
CA, which users do not have access to.
The Okta service and client have been introduced. This will allow for the
maintenance of Okta objects via our gRPC server and auth client. Some
additional improvements have been made so that the local okta service now
better reflects the gRPC definition.
Additionally, the gRPC authorization mechanism has been lifted out of
`lib/auth/grpcserver.go` and moved into a common authorizer. Finally, the
ability to check access to verbs has been lifted out of the `pluginsv1`
service into that same authorizer. This will hopefully provide a good base
for separate gRPC services in the future.
Adds a new `GetCertAuthorities` unary RPC to
`teleport.v1.trust.TrustService` and deprecates the equivalent
HTTP endpoint. All associated interfaces have been updated to remove
the marshal options as well.
Noah Stride