The 24-hour grace period was kept in Teleport 10 for backwards
compatibility, but is no longer necessary for Teleport 11 due
to the session tracker system.
As a result, it takes about an hour to complete an abandoned upload
instead of 24 hours.
Prior to this change, each individual service (proxy, app, SSH, db, etc)
would spin up its own uploader service. If you are running multiple
Teleport services in the same process, this means you get multiple
uploaders all looking at the same directory, which can result in
duplicate upload events in the audit log.
Additionally, desktop access has (mistakenly) failed to set up this
service, so desktop sessions would only be uploaded if you happened
to also run some other service in the same process that does spin up
the uploader.
Solve these issues by centralizing the uploader service so that it
runs once per process, and each Teleport service doesn't need to think
about whether or not the service should run.
* Add Yubikey PrivateKey implementation for use by Teleport clients.
- Add yubikey login logic, reusing previously stored private keys.
- Fix identity file decoding with PIV keys, which sign ecdsa certificates.
- Add libpcsclite-dev pre-req for building on linux.
- Remove unnecessary keys.Signer interface and move its functionality to keys.PrivateKey.
- Move retry and jitter utils to new api/utils/retryutils package.
The upload completer would set the session end time based on the last
known event in the session, but it left the timestamp in the event's
metadata blank, which caused it to default to the time the upload was
completed.
Fixes#16555
* Fix incorrect use of loop variables
This commit fixes a few occurrences of loop variables being
incorrectly used in the context of Go-routines or (most frequently)
parallel tests. To fix the issues, we create a local copy of the range
variables before the parallel tests (or Go-routine), as suggested in
the documentation of the `testing` package:
https://pkg.go.dev/testing#hdr-Subtests_and_Sub_benchmarks
Issues were found using the `loopvarcapture` linter.
Signed-off-by: Roman Tkachenko <roman@goteleport.com>
* fix TestTraceProvider/spans_exported_with_gRPC+TLS
* run TestSSH serially
* operator: Conserve 'created_by' data in user spec
Signed-off-by: Roman Tkachenko <roman@goteleport.com>
Co-authored-by: Renato Costa <renato@cockroachlabs.com>
Co-authored-by: Tim Ross <tim.ross@goteleport.com>
Co-authored-by: Hugo Hervieux <hugo.hervieux@goteleport.com>
The code attempts to wait on an existing download if one is already
in progress rather than starting a concurrent download of the same
session. If this code path runs, we incorrectly defer a call to a
nil function, triggering a panic.
This bug was introduced in #7360.
* configure golangci-lint misspell to check for anglicized spellings
* Americanize spellings
* fix aws constant value with british spelling 🇬🇧
* update api types with americanized spellings
* use american spellings .cloudbuild/scripts
* Replace Upload completer grace period logic with session tracker checking to accurately determine whether an upload has been abandoned
* Update session tracker expiration to be 1 hour, and dynamically extend it while the session is active.
* Spread out UploadCompleter load
Replaces the use of a `Ticker` with an `Interval` to reduce the
chance of auth servers `UploadCompleter` from synchronizing `run`
loops. Without this auth servers are essentially racing against
each other to upload any unfinished uploads. This was causing
an increase in network utilization every 10 mins.
This also prevents any missing parts of an upload from prematurely
ending the unfinished upload process. Doing so only causes a back
log of uploads that will never be completed during any of the
subsequent calls to `CheckUploads` in the future.
Ensure that the logic which checks for (and emits) a session.end
event also applies for windows.desktop.session.end events.
For this to work, we use the StreamSessionEvents API instead of
GetEvents. This is because the streaming API works for any stream
of audit events, and GetSessionEvents is specific to SSH and the
chunks index format used by SSH sessions.
Lastly, ensure that desktop related events are also captured in the
session recording stream (but omitted when streaming the events to
the browser during session playback). This allows us to use the
start event in order to reconstruct a missing end event.
The upload completer scans for uploads that need to be completed,
likely due to an error or process restart. Prior to this change,
it only completed uploads that had 1 or more parts. Since completing
an upload is what cleans up the directory on disk (or in the case of
cloud storage, finishes the multipart upload), it was possible
for us to leave behind empty directories (or multipart uploads)
for uploads with no parts.
This change makes it valid to complete uploads with no parts, which
ensures that these directories get cleaned up.
Also fix an issue with the GCS uploader, which failed to properly calculate
the upload ID from the path. This is because strings.Split(s, "/") returns an empty
string as the last element when s ends with a /.
Updates #9646
This commit introduces GRPC API for streaming sessions.
It adds structured events and sync streaming
that avoids storing events on disk.
You can find design in rfd/0002-streaming.md RFD.
Tobiasz Heller