* Move configuration from lib/service to lib/service/servicecfg
The new servicecfg package will hold only configuration for services.
This will allow other packages (like tctl and tsh) to depend on
servicecfg without pulling in all of lib/service (which has a number
of platform-specific details).
This is the first step towards being able to build tctl for Windows.
* Move PAM and BPF config into servicecfg
This breaks a compile-time dependency on BPF/PAM for tctl.
* Add API types for CircleCI joining
* Add validation for CircleCI configuration
* Add JoinMethodCircleCI across codebase
* Add token validator and token source for circleci
* Update join methods RFD
* Add CircleCI token source to register.go
* Add serverside support for circleci joining
* Add test for TokenSource
* Add success case for token validation test
* Add expired test case
* Add test case for token from another org
* Test RegisterWithToken for CircleCI
* Refactor GitHub RegisterUsingToken tests
* Refactor CircleCI RegisterUsingToken tests
* Add tests for ProvisionTokenSpecV2
* Appease linters
* Go Imports files
* Fix failing test for msising IDtoken
* Update lib/auth/join_circleci.go
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Move test server cleanup closer to initialisation
* Fix weird import reordering
* Include unexpected type in error message
* Simplify boolean algebra :)
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
Introduce new make targets to check and add license headers to files
("make lint-license" and "make fix-license"). License checking is now a part of
"make lint" as well.
Initial attempts used goheader, but it caused "make lint-go" to become about 9x
slower (if not more), plus it only targets go files. Google's addlicense is fast
enough and targets however many file types we want.
Existing files that were missing licenses got the header added, using the
current year as the license date.
* Introduce lint-license and fix-license make targets
* Ignore generated files
* Add license to go files
* Replace irregular licenses with standard copyright/license
* Add license to proto files
* Install addlicense in build.assets Dockerfile
ignore (Go's runtime respects SIG_IGN, btw, by not setting a handler).
If the handler is reset unconditionally, no Go code can ask to be
notified of Interrupt signal as the system default handler obviously
knows nothing about Go code.
This commit introduces signal handling.
Parent teleport process is now capable of forking
the child process and passing listeners file descriptors
to the child.
Parent process then can gracefully shutdown
by tracking the amount of current connections and
closing listeners once the amount goes to 0.
Here are the signals handled:
* USR2 signal will cause the parent to fork
a child process and pass listener file descriptors to it.
Child process will close unused file descriptors
and will bind to the used ones.
At this moment two processes - the parent
and the forked child process will be serving requests.
After looking at the traffic and the log files,
administrator can either shut down the parent process
or the child process if the child process is not functioning
as expected.
* TERM, INT signals will trigger graceful process shutdown.
Auth, node and proxy processes will wait until the amount
of active connections goes down to 0 and will exit after that.
* KILL, QUIT signals will cause immediate non-graceful
shutdown.
* HUP signal combines USR2 and TERM signals in a convenient
way: parent process will fork a child process and
self-initate graceful shutdown. This is a more convenient
than USR2/TERM sequence, but less agile and robust
as if the connection to the parent process drops, but
the new process exits with error, administrators
can lock themselves out of the environment.
Additionally, boltdb backend has to be phased out,
as it does not support read/writes by two concurrent
processes. This had required refactoring of the dir
backend to use file locking to allow inter-process
collaboration on read/write operations.
Zac Bergquist