This PR introduces a gRPC service to retrieve the pods available using the `search_as_roles` configured in the user's roles.
This gRPC service receives a TLS identity and manipulates it to access the Teleport Kubernetes Proxy and retrieve the pods available for a hypothetical user that has the `search_as_roles` defined for its roles.
The response does not leak the certificate nor the pod details other than `name`, `namespace` and `labels`.
```mermaid
sequenceDiagram
participant User as User
participant gRPC as grpc Server
participant Auth as Auth Server
participant KubeProxy as Kube Proxy
participant KubeSVC as Kube Service
User->>+gRPC: ListKubeResources(cluster,namespace)
Note left of gRPC: Includes search_as_roles <br/> and preview_as_roles <br/>into identity!
gRPC-->>+Auth: Sign cert with ProcessKubeCSR
Auth-->>-gRPC: Signed certificate
gRPC->>+KubeProxy: list pods "v1.../namespaces/{namespace}/pods"
KubeProxy-->>+KubeSVC: list pods "v1.../namespaces/{namespace}/pods"
KubeSVC-->>-KubeProxy: filtered response
Note left of KubeSVC: Applies Pod RBAC filtering!
KubeProxy-->>-gRPC: response
gRPC->>-User:Return name, namespace and labels
```
Part of #21107 and #19573
This PR fixes the impersonation headers propagation when using the SPDY
roundtrip. SPDY roundtrip creates a new http request and loses the
impersonation headers received from the client. When this happens for
users that define multiple `kubernetes_users`, the requests are denied
because Teleport forces you to select a user.
With the changes introduced we conserve the headers received from the
client.
Fixes#21088
This PR replaces the following PRs opened by dependabot:
- #19678
- #19677
It also bumps:
- Bump k8s.io/api from v0.25.4 to v0.26.0
- Bump k8s.io/apiextensions-apiserver from v0.25.4 to v0.26.0
- Bump k8s.io/apimachinery from v0.25.4 to v0.26.0
- Bump k8s.io/apiserver from v0.25.4 to v0.26.0
- Bump k8s.io/cli-runtime from v0.25.4 to v0.26.0
- Bump k8s.io/kubectl from v0.25.4 to v0.26.0
- Bump k8s.io/utils v0.0.0-20220728103510-ee6ede2d64ed to v0.0.0-20221128185143-99ec85e7a448
- Bump sigs.k8s.io/controller-runtime from v0.13.1 to v0.14.1
This PR extends the Kubernetes Service to support the WebSocket
protocol in Kubernetes Porforward calls.
The Websocket protocol is required so that Kubernetes clients
like C#, Python, and Javascript can create portforward requests
to Kubernetes PODs. Although Teleport supports clients using WebSocket
protocol, it still uses SPDY protocol when connecting to upstreams -
Teleport Services or Kubernetes API.
Contrary to requests through SPDY, WebSocket requests do not support any
concurrency or multiplexing. This is a protocol limitation since
it only creates a single stream pair per port. When using it
concurrently, the requests will be mixed and fail.
Fixes#18783
When any peer disconnects from a session without closing it, Teleport marks it as active and does not publish the session recordings.
This PR closes the session once every peer disconnects to avoid leaving zombie sessions when a user intentionally blocks traffic or when a VPN disconnects.
It also waits until all events are pushed before closing the recorder.
Fixes#17848Fixes#18194
This PR presents a watcher for dynamic `kube_cluster` resources. The cluster credentials can be set using a `kubeconfig` whose payload is defined in `KubernertesClusterV3.Spec.Kubeconfig`. These credentials are used to connect to the Kubernetes API server and if invalid, the cluster is not served and returns an error.
Currently, `kube_cluster` resources created via the API with a kubeconfig payload can be dynamically served by the `kubernetes_service` by enabling dynamic resources.
```yaml
kubernetes_service:
enabled: true
resources:
labels:
'*': '*'
```
# Future work
- The discovery service will have to create these resources.
- Support Azure and AWS dynamic authentication
Part of #16135, #13376
Related to #12048, #16276
Tiago Silva