Provides a solution for #9298
This removes an unnecessary limitation of the Helm chart: `.Values.tls.existingCASecretName` can now be used without `.Values.tls.existingSecretName`. This allows users to trust their own CAs without building custom images.
Context:
- go's x509 library supports loading system certs based on the SSL_CERTS_FILE environment variable
- we are already using this in the chart to trust private CAs (teleport proxy needs to trust its own certs to start)
- users might want to trust custom CAs to
- speak with a S3 backend (minio)
- validate upstream app certs (unlike DB access you can't trust certs per-application)
- trust another cluster
- call an OIDC provider
- teleport-kube-agent chart already has the feature
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Fixes#14576
- Add updated instructions, as the behavior and configuration settings
for the PagerDuty plugin have changed since we first added this guide.
- Ensure the guide can be followed as a set of step-by-step
instructions. For example, this change tells the user to create two
PagerDuty services and refers to these services throughout the page.
- Also edits example configs for the PagerDuty and Mattermost plugins.
* Add documentation for Jira Helm chart
It includes an updated guide and the reference of the new Helm chart.
* Fixed some minor mistakes in the guides
* Reorganized Helm related examples
* Fixed a few minor mistakes
* Alphabetized jira.* settings
* Renamed Cloud to Executable in Testing
* Extended YAML config example with explanation
* Edit Jira Access Request plugin Helm chart docs
- Edit the configuration instructions so we don't instruct Helm users to
use the `configure` subcommand. Also use the `Tabs` component's
dropdown functionality so we can include both self-hosted and Teleport
Cloud instructions for Helm and VM users.
- Minor style tweaks.
* Add Helm Chart example to Installation section
* Removed confusing (and broken) link
git push
* Fixed wrong default value
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Kubernetes v1.24 enabled, by default, the LegacyServiceAccountTokenNoAutoGeneration feature.
This feature prevents Secrets containing service account tokens from being automatically created for every ServiceAccount.
Instead, when enabled, it requires a manual action for creating the Secret bound to the SA.
Fixes#15611
Fixes#4218
This commit:
- Bumps the grafana version
- Fixes the packer script failing when `DEBUG` is unset
- Makes nginx propagate the Host header required since
https://grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes/
- Makes nginx proxy websocket calls properly (since grafana 8)
- Retab nginx conf files that were a mix of tabs and spaces
- Makes Terraform compute s3 files md5 to detect and apply changes
* Stop validating schema for labels (#15204)
* operator: support receiving invalid TeleportRole CRs
This PR makes the controller-runtime manager decode TeleportRole
resource in an unstructured object. This avoid errors during decoding.
The resource is later decoded as a TeleportRole, with proper error
handling.
Fixes#12974
This commit introduces a new `authentication` value controlling:
- the authentication type (previously `authenticationType`)
- the second-factor (previously under `authenticationSecondFactor`)
- if local auth is enabled (new feature)
- the connector name (new feature)
- the locking mode (new feature)
If previous values `authenticationType` and `authenticationSecondFactor`
are specified we'll prefer them for backward compatibility.
This MR introduces Kubernetes Secret storage for Teleport Kubernetes Agent state.
When running Teleport Agent inside a Kubernetes cluster where TELEPORT_REPLICA_NAME and KUBE_NAMESPACE exist, the agent will store identities and states in a Kubernetes Secret instead of local storage.
Otherwise, if the above environment variables are not present or not in Kubernetes, the agent persists state in SQLite.
Notes:
Fresh installs will enable the Kubernetes Secret Storage by default.
If PV storage is configured, the agent will store its identity in a Secret and use the PV for non-identity objects.
If the operator is upgrading from an existing release that didn't support Secret storage, the Helm chart will convert the objects to enable Kube Secret Storage. If the current object is a Deployment, the Helm chart installs a new Statefulset side by side and will trigger a Helm hook that is responsible for deleting the Deployment once Statefulset pods are healthy. Otherwise, if upgrading from a Statefulset the agent will read the credentials stored in PV and move them into Kube Secret.
Implementation of #12958
Related to #5585
This commit adds the Teleport operator. The operator reconciles
TeleportUsers and TeleportRoles Kubernetes resources with Users and
Roles Teleport resources.
The PodSecurityPolicy specifies `MustRunAsNonRoot` but the image runs as root.
`Error: container has runAsNonRoot and image will run as root (pod: "<redacted>", container: teleport).`
We expose the securityContext to allow forcing to run as a non-root user such as 99 (nobody) and respect the psp.
Co-authored-by: daquinoaldo <aldd@bendingspoons.com>
* Add S3:AbortMultipartUploads to AWS IAM policies
Searched for all locations where s3:ListBucketMultipartUploads is currently required and added it.
* Fix permission name (it's singular)
