This PR adds support for `gzip` compressed responses received from
the Kubernetes API.
Most Kubernetes vendors run with compression disabled since it causes a lot of CPU
spikes and timeouts but at least IBM cloud has it enabled.
(https://github.com/kubernetes/kubernetes/issues/112296)
Fixes#20980
This PR introduces support for creating resource access requests to `pod` resources to `tsh` and their approval from `tsh` and `tctl`.
Adds support `tsh request create --resource /<cluster>/pod/<kube_cluster>/<namespace>/<podname>`.
Part of #18434
Running computationally expensive tests causes connection failures that lead to test failures.
This PR tries to overcome this problem by making only the subtests run in parallel.
This PR introduces a mechanism to control access to Pods in Kubernetes clusters based on access criteria defined in user Roles or Resource Access Requests.
New `Role` version - `v6` - introduced a new field `kubernetes_resources` that allows admins to restrict access to a subset of cluster resources based on the configuration provided.
This PR implements the resource control for `pods` and allows
```yaml
kubernetes_resources:
- kind: pod
name: nginx-*
namespace: default
- kind: pod
name: *
namespace: dev
```
It also implements the logic blocks for supporting Resource Access Requests to Kubernetes Pods. The tsh boilerplate is not included in this PR and will be included in future PRs.
An example of usage:
```
tsh request search --kind pod --kube-cluster=minikube
Name Namespace Labels Resource ID
--------------------------------- --------- -------------------------------------- ---------------------------------------------
nginx-deployment-6595874d85-6j2zm default app=nginx,pod-template-hash=6595874d85 /tele.teleport.local/pod/minikube/default/...
nginx-deployment-6595874d85-7xgmb default app=nginx,pod-template-hash=6595874d85 /tele.teleport.local/pod/minikube/default/...
nginx-deployment-6595874d85-c4kz8 default app=nginx,pod-template-hash=6595874d85 /tele.teleport.local/pod/minikube/default/...
test default run=test /tele.teleport.local/pod/minikube/default/...
To request access to these resources, run
> tsh request create --resource /tele.teleport.local/pod/minikube/default/nginx-deployment-6595874d85-6j2zm --resource /tele.teleport.local/pod/minikube/default/nginx-deployment-6595874d85-7xgmb --resource /tele.teleport.local/pod/minikube/default/nginx-deployment-6595874d85-c4kz8 --resource /tele.teleport.local/pod/minikube/default/test \
--reason <request reason>
```
Part of #18434
This PR extends the Kubernetes Service to support the WebSocket
protocol in Kubernetes Porforward calls.
The Websocket protocol is required so that Kubernetes clients
like C#, Python, and Javascript can create portforward requests
to Kubernetes PODs. Although Teleport supports clients using WebSocket
protocol, it still uses SPDY protocol when connecting to upstreams -
Teleport Services or Kubernetes API.
Contrary to requests through SPDY, WebSocket requests do not support any
concurrency or multiplexing. This is a protocol limitation since
it only creates a single stream pair per port. When using it
concurrently, the requests will be mixed and fail.
Fixes#18783
When running tests in GitHub Actions, Teleport automatically imports the Azure instance labels as service labels.
It results in the TestListKube test failing since it receives unexpected labels.
This PR replaces the default IMDSClient with a fake one to avoid introducing labels imported from the CI env where the test is running.
It also removes an unrelated error message - self-subject access review failed - that is printed but had no impact on the test result.
Fixes [#17864 (comment)](https://github.com/gravitational/teleport/issues/17864#issuecomment-1297030770)
Tiago Silva