* Update predeploy_job.yaml
Adding the ability to allow for requests and limits to be added to the predeploy_job like already done for deployments.
* Update predeploy_job.yaml
Add the ability for the proxy predeploy_job to have limits and requests like the deployment. Using same values from Values file.
* Update predeploy_test.yaml
Adding tests for resource limits on predeploy job for auth and proxy.
* Update examples/chart/teleport-cluster/tests/predeploy_test.yaml
Co-authored-by: Hugo Shaka <hugo.hervieux@goteleport.com>
* Update examples/chart/teleport-cluster/tests/predeploy_test.yaml
Co-authored-by: Hugo Shaka <hugo.hervieux@goteleport.com>
* Update examples/chart/teleport-cluster/tests/predeploy_test.yaml
Co-authored-by: Hugo Shaka <hugo.hervieux@goteleport.com>
* Update examples/chart/teleport-cluster/tests/predeploy_test.yaml
Co-authored-by: Hugo Shaka <hugo.hervieux@goteleport.com>
---------
Co-authored-by: Hugo Shaka <hugo.hervieux@goteleport.com>
* Emit new `AgentMetadataEvent`
Part of https://github.com/gravitational/cloud/issues/3550.
This commits adds a new `UpstreamInventoryAgentMetadata` that is sent
from a Teleport agent to an auth server.
Once received, it is transformed into an `AgentMetadataEvent` and sent
to PreHog.
Most `UpstreamInventoryAgentMetadata` fields are intentionally kept as
empty in this PR. Follow up PRs will be opened with the mechanisms
required to fill them (as described in #21337).
* server_id -> host_id
* compute OS and host architecture
* Compute OS version and container runtime
* Close stream if agent receives an agent metadata message
* cmd -> exec ; file -> read
* implement fetchOSVersion for linux
* Remove unused import
* Add note about `agentMetadataCh`
* Allow commands with args
* Remove parseFun abstraction
* fetch glibc version
* fetch container orchestrator
* Fix lint
* Fix TODO
* Add note about glibc version
* cmd -> command
* fetch cloud environment
* fetch install methods
* GLibCVersion -> GlibcVersion
* Use `http.NewRequestWithContext`
* Add missing comment
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* GLibCVersion -> GlibcVersion
* Fix lint
* Fix helm unit tests
* Add missing comments
* 5 second timeout on http requests
* Spawn gorountine that fetches metadata on each new stream
* Use `defaults.HTTPClient()`
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Add missing import
* Handle error
* Revert "Spawn gorountine that fetches metadata on each new stream"
This reverts commit fe4f2790be.
* Send agent metadata to auth server once per stream
* Improve note about agentMetadataDone
* Don't process command output & file content on the agent
Since agents cannot be trusted, regex validation and sanitization should
happen in PreHog anyways. So this commit removes such logic in favor of
moving it to PreHog.
* Fix lint
* Trim space
* Move handling of `AgentMetadataEvent` to `handleControlStream`
* Use cached hello message
* Move metadata files to lib/inventory/metadata
* make sending of agent metadata more self contained
* Minimize diff
* Send all system roles to PreHog
* Remove unused import
* Add parsing of command output / file content back
* Usage reporter refactor
* Usage reporter refactor
* Add missing handling of inventory agent metadata msg
* Fix ICS usage reporter
* Improve comments
* Add cached `metadata.Get*` methods
* Use systemctl status instead of is-active
* Add `Metadata` struct
* return pointer in `FetchMetadata`
* Pass context to `GetMetadata`
* metadataFetchConfig -> fetchConfig
* GetMetadata -> Get
* Add note about `Get` result
* Ensure install methods are non-nil
* Exit `metadata.Get` if context is closed
* Replace sync.Once with atomic.Bool.Swap
* Initialize channel
* Fix lint
* Fix lint
* Make `metadata.Get` return an error instead of bool
* Allow multiple true/false values for env vars
* Use `strings.Cut`
* Use /etc/os-release ID instead of NAME
* Improve `autoEmitMetadata`
* Use `gnu_get_libc_version`
* Ubuntu -> ubuntu
* Use GOARCH
* gofmt
* Move import C up
* Variables may include quotes
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Default values for ID and VERSION_ID
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Blank lines are permitted
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Anonymize host id
---------
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Describe node instance usage in AWS Terraform
* Include link to AWS Terraform Guide
* minor wording update
* phrasing update
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* phrasing update
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* Update language
* Update AWS language
---------
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
Update the helm chart for kube-agent.
The image swap logic was already there.
Update the UI to include `enterprise: <isEnterprise>` when installing
the kube-agent.
Clarify the usage of the `attributes_to_roles` parameter and reorder some
mapping keys for clarity in the example SAML connector resource.
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Reuse auth token when upgrading an Helm chart without token
When upgrading an Helm chat and not providing the auth token because it
was previously set, Helm deleted the secret and Statefulset pods become
stuck because the secret does not exist.
This PR reads the secret value from the previous upgrade/install and
reuses it during the upgrade.
Fixes#20761
* remove secret lookup
* helm: allow to set `initSecurityContext` in `teleport-kube-agent`
* Apply suggestions from code review
Co-authored-by: Gus Luxton <gus@goteleport.com>
* fixup! helm: allow to set `initSecurityContext` in `teleport-kube-agent`
---------
Co-authored-by: Gus Luxton <gus@goteleport.com>
* helm: disbale PSPs on 1.23 and document PSA usage
In 1.25 Kubernetes removes PSP support, this has 2 consequences:
- Helm will break after upgrading if PSPs are deployed
- We cannot set security policies anymore
This commit documents those two behaviours and makes the chart disable
PSPs on 1.23 and higher to ensure a smooth upgrade path.
* helm: Remove stale 'migrate from legacy charts' guide
Fixes#20960
etcd had a previously unknown TTL limitation (TTL is stored as
nanoseconds in a signed int64, max TTL is ~= 29 years). Creating
very long-lived resources with expiry higher than the max TTL is not
supported and the process crashes on startup as it cannot apply the
token.
* helm: Expose ports on containers
Some Kubernetes tooling expects to see the ports that a container exposes registered on the individual containers themselves as well as the underlying Service. This change makes it a little easier for users to deploy the teleport-cluster chart behind their own load balancers or using a ClusterIP, by being explicit about exactly which ports are expected to be routed to each container.
* Expose tls port 3080
* Expose port 3080 before others
* Rename https -> tls
* Add 3021 for proxy peering when enterprise is true
Fixes an issue where the operator sidecar tries to mount the public TLS certificates but the volume is not declared.
```
$ helm install -n teleport teleport-repro /home/shaka/work/teleport/examples/chart/teleport-cluster --set teleportVersionOverride=12.0.0-alpha.1 --set clusterName=teleport.example.com --set tls.existingSecretName=my-tls-secret --set tls.existingCASecretName=my-root-ca --set operator.enabled=true
# [...]
Error: INSTALLATION FAILED: Deployment.apps "teleport-repro-auth" is invalid: spec.template.spec.containers[1].volumeMounts[0].name: Not found: "teleport-tls"
```
The operator does not need those certs to work.
This change adds support for FIDO2/webauthn/hardware tokens by default.
OTP 2fa fill remains functional. This is a major change and should be
part of a major release, even if this should be seamless for most users.
Warning: `webauthn.rp_id` should not change in the cluster life, else
2fa tokens will have to be re-registered.
Users accessing the cluster under a different name than `clusterName`
will have to set rp_id
(`auth.teleportConfig.auth_service.authentication.webauthn.rp_id`) to be
able to register second factors. As we strongly encourage users to have
a resolvable `clusterName` and `publicAddr` support got added recently,
this seems an acceptable edge case.
Part of [RFD-096](https://github.com/gravitational/teleport/pull/18274): managing the major upgrades safely
This commit's main purpose is to block proxies running a new Teleport major version from connecting to auth pods running an old Teleport version.
This commit does 3 things:
- adding initContainers and preStop hooks to the `teleport-cluster` Helm chart (initContainers were designed in RFD 096, preStop was a nice additoin coming from [the wait PR](https://github.com/gravitational/teleport/pull/19277))
- fixing a bug in the `wait` command (the DNS error was not properly unwrapped and not recognized as a DNS error)
- fixing missing override support on some auth Deployment values. As a rule of thumb for future review, we should not use .Values directly and prefer using $auth and $proxy
This PR adds a `post-delete` hook that cleans the state secret that each Pod creates when it receives the identity from the Teleport Auth Server.
Fixes#20035Fixes#18854
This commit implements arbitrary configuration passing to Teleport, like what was done for the `teleport-cluster` in https://github.com/gravitational/teleport/pull/18857. This allows users to deploy services or set fields the chart does not support.
The huge snapshot diffs are caused by order changes in the config (the YAML export orders keys alphabetically). I validated that the old and new snapshots were strictly equivalent with the following python snippet:
```python
import yaml
import pathlib
import deepdiff
old = yaml.safe_load(Path("./config-snapshot.old").open())
new = yaml.safe_load(Path("./config-snapshot.new").open())
old_content = { k: yaml.safe_load(yaml.safe_load(v[1])["data"]["teleport.yaml"]) for (k,v) in old.items() }
new_content = { k: yaml.safe_load(yaml.safe_load(v[1])["data"]["teleport.yaml"]) for (k,v) in new.items() }
diff = deepdiff.DeepDiff(old_content, new_content)
print(diff)
```
This commit refactors the `teleport-cluster` Helm chart to deploy separately proxy and auth pods.
It allows users to pass raw teleport configuration to the deployed Teleport nodes.
Finally, it removes the `custom` chart mode as the mode was broken by the split. A new `scratch` mode has been introduced.
See [the corresponding RFD](https://github.com/gravitational/teleport/pull/18274) describing the design.
This PR includes a new Role resource version that is compatible with V5 spec.
The new resource introduces the `kubernetes_resources` definition that allows operators to limit the Kubernetes resources that each member can access. The `kubernetes_resources` entries must follow the following format: `{"kind":"<kind>", "namespace":"<namespace>","name":"<pod>"}`. Currently, it only supports objects of `kind` `pod`. Valid examples `<namespace>/<name>:
- `*/*`: matches all pods in all namespaces.
- `default/*`: matches all pods in the `default` namespace.
- `*/nginx-*`: matches every pod prefixed with `nginx-` in every namespace.
For older resource versions - V5, V4, V3 - `kubernetes_resources` is automatically populated with `{"kind":"pod","namespace":"*","name":"*"}` to keep compatibility. For the newest version, it's mandatory to define its value otherwise access to pods will be denied.
Part of #18434
