rosstimothy
9d066364a8
Migrate GetCertAuthorities to gRPC ( #22985 )
...
Adds a new `GetCertAuthorities` unary RPC to
`teleport.v1.trust.TrustService` and deprecates the equivalent
HTTP endpoint. All associated interfaces have been updated to remove
the marshal options as well.
2023-03-14 14:45:01 +00:00
rosstimothy
95d6d0fee1
Migrate GetCertAuthority to gRPC ( #22624 )
...
The HTTP client created by `auth.NewClient` has an idle timeout of
30s and each instance periodically gets cert authorities in
`TeleportProcess.syncRotationStateCycle`. If there has been no
activity when the ticker expires then the request will result in a
brand new connection to Auth to be established. This can cause a
spikes in open file descriptors on the Proxy when there are a large
number of instances connected via a tunnel.
To prevent periodic dialing when retrieving cert authorities the
endpoint has been migrated to the new Trust gRPC service. For now
only the get endpoint has been migrated but the rest of the CRUD
operations for cert authorities should be migrated from the HTTP
api to the gRPC service as well.
2023-03-10 14:32:34 +00:00
8e05bcbb1b
Export CRL and Database CA in DER format ( #22578 )
...
* feat(tctl): auth export type db der
* feat(tctl): add "crl" command to export revocation lists
* Apply suggestions from code review
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com >
* chore(tctl): change command description
* Apply suggestions from code review
Co-authored-by: Marek Smoliński <marek@goteleport.com >
* feat(auth): enable role admin to call generate crl
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com >
Co-authored-by: Marek Smoliński <marek@goteleport.com >
2023-03-10 14:30:07 +00:00
Marco André Dinis
8bdcd197f1
Add separation between keys when exporting CAs ( #18562 )
...
Adding a new line was sometimes not enough to separate the keys.
This was causing our tests to sometimes fail.
2022-12-05 11:11:59 +00:00
Jakub Nyckowski
0ee91f6c37
Enable GCI linter ( #17894 )
2022-10-28 20:20:28 +00:00
Marco André Dinis
e86e3960d9
Expose tctl auth export as a public endpoint ( #15491 )
...
Public endpoint that exports CA Certificates
It supports the same types that we currently support when running `tctl auth export --type=t`
Fix https://github.com/gravitational/teleport/issues/7413
Demo
```
marco@lenix ~> curl --insecure "https://127.0.0.1.nip.io:3080/v1/webapi/sites/lenix/auth/export "
@cert-authority lenix,*.lenix ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC0TxkYYZ+EKHdgA09h/fK0upJzaPe8Sxr63wxPLzqJNDr8O4mxy24UZ08t5tojyaEXHwRLvqOdUBXhbpQpmrUkuN2LLS/k1ijk+V98j+6vWaviL3fDPbZw4PRRl0QtCjAFE/kxH9uLmqvMwnCpeNOQaugq1slVOibDZDrP7FcKmrTzKldk5ohSJSTl0sH6TQzQG2Sj+awXLk7LWcYvE5PN0YVh/S9kzmTpCugaIGd5LOAL3JSuQJ+pwwKmVEg+EPYcbzv7lcLgnew9weCDK0uk4PuNnMXrt1KcCEFttMrceeGnnqOr5JogFLiWL/TP+9kBgleNZhXEaXSz2r1i7pNt type=host
cert-authority ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDHoDSouxSrXq/X+qZWBM8saHEIb3O3dXOfpRtGrkV6LymPpojhzN1dcYKUqYvWYMw2+WOKIyeAgg9p0zrIQaP7AQPP42sjDhB4keJMbSHh43Hnb7pITRBBpsSCGYMr1U1utQDdz1dbzp96OlvXoNL+ltZKPYNBvG7obqlqhFhHV6ReNvb7FT1OSrtC7UEElPyrYgd3+QMBTTNNYg3Lu+712ySKHqjdM6mLG8XWfSbkmLVbKRTcV3qPj6vEnarXHOnATv+AJElkIlaJjx+RmIxEA9AlE+mjxm2PR+uwsFLV+YD20oPWHaqVyKzT3x7/UNQttBTZD1G0D2fwZg2lDO29 clustername=lenix&type=user
marco@lenix ~> curl --insecure "https://127.0.0.1.nip.io:3080/v1/webapi/sites/lenix/auth/export?type=db "
-----BEGIN CERTIFICATE-----
MIIDcDCCAligAwIBAgIQUppf1u3b6mtJig/5GwAUNjANBgkqhkiG9w0BAQsFADBS
MQ4wDAYDVQQKEwVsZW5peDEOMAwGA1UEAxMFbGVuaXgxMDAuBgNVBAUTJzEwOTc5
ODI1MzIyNzkzMDM5OTA4OTE3NjQ1MzMyMDAzMDU1NzIzODAeFw0yMjA4MzAxMDA5
NThaFw0zMjA4MjcxMDA5NThaMFIxDjAMBgNVBAoTBWxlbml4MQ4wDAYDVQQDEwVs
ZW5peDEwMC4GA1UEBRMnMTA5Nzk4MjUzMjI3OTMwMzk5MDg5MTc2NDUzMzIwMDMw
NTU3MjM4MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4AyI3MnQHLjv
hko3qE1F0SqlPMKfCPaBaCHZj5yI7Gm/U6BKx+mm4zl0R7xqDjUIQo751DUVQoJh
etuHOpgJ9OyzTYG8BqqhuuGFqWy9RkPcMSup2gQInpcma+iVs6HPYeIZa4MlnYJH
nBVjRgXyiURAtdg0wlq12SNh0R0FUBAo4i6bqNLlqQkA9WJkea5RxIk337qgYo/r
pRb0QlOWaeUYsVU4yn21h1dnrZCg21iaxLDjV97dV47BYcK5yPFFSRAVVgyR74r2
SF3p6R45qH1Ll+gEwxZf7M0IFPAUbWxaZ3KPz11BE+ISKH1NN7j/Aj5rPqwAULnp
e79S94asmQIDAQABo0IwQDAOBgNVHQ8BAf8EBAMCAaYwDwYDVR0TAQH/BAUwAwEB
/zAdBgNVHQ4EFgQUOXJtvj3lcOi/epoPRO32lEHgM8wwDQYJKoZIhvcNAQELBQAD
ggEBAMe0zhNLzNNlxYWTgD5uefhP1KPb/44gmh7n1/xF3Wd11QktDraPN9cyy30R
qeMdBmwgn6Ek7Dy+E22nPSVLh49DSRPrXATgRetNW4g4iMvQKnZi8k7agnXedxWq
irLUsFApAagKwFNJyQQsGpdUxUgZiK43JaZ/dAHGvXYEJA4BYepIQRtEdraa/T5h
M9HDWVHEuPCjMH8/10wTWjDiikVHPCwAAab6/r7WJ7Jn+Bv4PBOxYOwHeuboBNgl
khF9lGAqonSP6kx3gLSApLW5S3QX0U+4qukmIE970evwIAzc43hwaNaI8gM9nswE
dpX8vd+vaed76+ZzxQmBlh4hgQU=
-----END CERTIFICATE-----
marco@lenix ~>
```
2022-10-27 14:53:29 +00:00
rosstimothy