* Stop validating schema for labels (#15204)
* operator: support receiving invalid TeleportRole CRs
This PR makes the controller-runtime manager decode TeleportRole
resource in an unstructured object. This avoid errors during decoding.
The resource is later decoded as a TeleportRole, with proper error
handling.
Fixes#12974
This commit introduces a new `authentication` value controlling:
- the authentication type (previously `authenticationType`)
- the second-factor (previously under `authenticationSecondFactor`)
- if local auth is enabled (new feature)
- the connector name (new feature)
- the locking mode (new feature)
If previous values `authenticationType` and `authenticationSecondFactor`
are specified we'll prefer them for backward compatibility.
This MR introduces Kubernetes Secret storage for Teleport Kubernetes Agent state.
When running Teleport Agent inside a Kubernetes cluster where TELEPORT_REPLICA_NAME and KUBE_NAMESPACE exist, the agent will store identities and states in a Kubernetes Secret instead of local storage.
Otherwise, if the above environment variables are not present or not in Kubernetes, the agent persists state in SQLite.
Notes:
Fresh installs will enable the Kubernetes Secret Storage by default.
If PV storage is configured, the agent will store its identity in a Secret and use the PV for non-identity objects.
If the operator is upgrading from an existing release that didn't support Secret storage, the Helm chart will convert the objects to enable Kube Secret Storage. If the current object is a Deployment, the Helm chart installs a new Statefulset side by side and will trigger a Helm hook that is responsible for deleting the Deployment once Statefulset pods are healthy. Otherwise, if upgrading from a Statefulset the agent will read the credentials stored in PV and move them into Kube Secret.
Implementation of #12958
Related to #5585
This commit adds the Teleport operator. The operator reconciles
TeleportUsers and TeleportRoles Kubernetes resources with Users and
Roles Teleport resources.
The PodSecurityPolicy specifies `MustRunAsNonRoot` but the image runs as root.
`Error: container has runAsNonRoot and image will run as root (pod: "<redacted>", container: teleport).`
We expose the securityContext to allow forcing to run as a non-root user such as 99 (nobody) and respect the psp.
Co-authored-by: daquinoaldo <aldd@bendingspoons.com>
* feat(helm): add priorityClassName and extraLabels to kube-agent
Signed-off-by: Roman Tkachenko <roman@goteleport.com>
Co-authored-by: daquinoaldo <aldd@bendingspoons.com>
* examples/chart/teleport-cluster/templates/deployment.yaml: set strategy to 'Recreate' if chartMode is 'standalone' (fixes#11484)
Signed-off-by: Johannes Kastl <kastl@b1-systems.de>
* examples/chart/teleport-cluster/tests/deployment_test.yaml: add test for strategy in standalone mode
Signed-off-by: Johannes Kastl <kastl@b1-systems.de>
* update examples/chart/teleport-cluster/tests/__snapshot__/deployment_test.yaml.snap after running local tests
Co-authored-by: Johannes Kastl <kastl@b1-systems.de>
* Allow for probe timeouts to be configurable
When setting up a new Teleport enterprise cluster on GCP,
I noticed that I needed to set the probe timeouts to get the
cluster to be healthy. This seems to be a known issue (https://github.com/kubernetes/kubernetes/issues/89898).
As a "stopgap", I've updated the helm chart to allow for end users
to be able to configure these timeouts.
* Update configuration option name and add documentation
* Update docs/pages/kubernetes-access/helm/reference.mdx
Co-authored-by: Gus Luxton <gus@goteleport.com>
* Add tests for probeTimeoutSeconds
* Add probeTimeoutSeconds to required values
* Add probeTimeoutSeconds to teleport-kube-agent
* Add tests for probeTimeoutSeconds to teleport-kube-agent
* Add probeTimeoutSeconds to teleport-kube-agent reference
Co-authored-by: Hunter Madison <hunter.madison@instana.com>
Co-authored-by: Hunter Madison <hmadison@users.noreply.github.com>
* helm: Update NOTES.txt for AWS ACM
* Add support for separate Postgres/MongoDB listeners in teleport-cluster chart
* Special case backend listener protocol based on presence of ACM annotation
* Add tests for separate listeners
* Add tests for ACM annotation setting backend protocol
* Don't add AWS annotations when not in AWS mode
* Adds for separatePostgresListener/separateMongoListener
Also adds missing example for setitng proxyListenerMode
* Add continuous backups permission to DynamoDB policy
Fixes#11411
https://github.com/gravitational/teleport/pull/10817 states in the docs that the default for `authenticationSecondFactor.secondfactor` is `otp`, but it didn't actually update the values.yaml file to make this change the default. This PR addresses that mistake and brings the chart in-line with the docs.
* POC for Helm unit tests
This uses https://github.com/vbehar/helm3-unittest to define
expectations of our helm templates
* Test that enterprise is configured correctly
* Added tests for teleport-cluster
* Added tests for teleport-kube-agent
* Removed tests for teleport chart
* Add tests for teleport-cluster Deployment
* Run shorter tests first
* Fix Docker plugin installation and add update-helm-snapshots target
* Add README
* Fix lint syntax error and add some missing linters
* Add missing ImagePullPolicy to Deployment and StatefulSet
* Add Deployment tests for teleport-kube-agent
* Fix replicaCount logic
* Add clarification to values
* Add StatefulSet suite for teleport-kube-agent
* Update snapshots after merge with master
* Helm tests are quicker than bash tests
* Add tests for extraEnv
* Random space
* Tidy up formatting of multiple tests
* [debug] List helm plugins and directories
* Special case Helm linting when running in CI
* Make trailing line breaks consistent
* Special case Helm linting when running in CI
* Add contribution guidelines for Helm charts
* Add contribution guidelines to READMEs
* Deprecate old charts
* Typo
* Spacing
* Clarification
* Update examples/chart/CONTRIBUTING.md
* Don't erroneously set extraEnv for initContainers
* Rename update-helm-snapshots -> test-helm-update-snapshots for clarity
Co-authored-by: Gus Luxton <gus@goteleport.com>
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* helm: Adds extraArgs and extraEnv to teleport-kube-agent
These were present in teleport-cluster but not teleport-kube-agent. This PR fixes that.
* Line breaks
* Also add to StatefulSet
* Helm chart - teleport-cluster - add issuer group argument for custom issuer groups such as AWS ACM PCA
* Update documentation reference for helm chart and remove trailing whitespace
* Fix --set typo in documentation and add lint values.
* Update docs/pages/kubernetes-access/helm/reference.mdx
* Add commonName field as optional
Co-authored-by: Gus Luxton <gus@goteleport.com>
* [helm] Re-add space after type in service definition (#9503)
The whitespace after `type:` was being trimmed, which was causing a lint error. Not sure how this got through the linter in the first place.
* helm: Adds log configuration to teleport-kube-agent chart
* Remove erroneous value
* Update reference.mdx
Remove shell prompt character
