* Connect: Remove leftovers from resource cache removal
* GetAll* RPCs were used in the resource cache and are no longer used.
* ListApps was pretty much never actually used as we didn't ever list apps
in Connect.
* ClusterContext.state.searchValue ceased to be used after we moved to
fetching resources from the backend.
* Remove remaining leftovers from tshd client mock
* Remove unused imports
* services.usagereporter to lib/usagereporter/teleport
* teleterm/daemon/usagereporter to usagereporter/daemon
* usagereporter/daemon type aliases
* Move UsageAnonymizable newtypes in a separate file
* DiscardUsageReporter should be passed by value
* Type renames in usagereporter/teleport
* Move audit event to usage event conversion to lib/usagereporter
* package import renames
* Don't break the e build for now
* move web usage report events to lib/usagereporter
* forgot license blurb
* lib/usagereporter/discover.go to types_discover.go
The Electron app no longer asks tshd to restart gateways. This was changed
in gravitational/webapps#1383.
This PR merely removes the tshd implementation of that RPC.
* Add integration/teleterm_test with tests for get* and list* clusters
Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>
* Move `testAddingRootCluster to integration/teleterm_test
* Add `ClusterWithDetails` type instead of enriching existing `Cluster` with optional properties
* Remove unnecessary condition
* Add license
* Bunch of renames
* Do more in mustLogin
* Remove watcher
---------
Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>
* Adjust go_package of lib/prehog Go protobufs
This makes them follow the pattern set out by api/proto and proto.
* Adjust go_package of lib/teleterm Go protobufs
* Use single buf.gen.yaml to generate JS protos
This also entailed changing the location of lib/teleterm protos and changing
the value of their package specifier to match the conventions in other parts
of the codebase. This is a breaking change but that is fine for Connect
as the protos are used locally only and each build ships with matching
protobufs.
* Make web/packages/teleterm use protobufs from gen-proto-js
We used to copy protobufs over to web/packages/teleterm/src/services/tshd
since webapps used to be in a separate repo.
This is no longer the case, so we can just make teleterm use protobufs
from gen-proto-js.
* Move prehog & teleterm protos into proto/teleport/lib
* Generate JS protos to gen/proto/js
* Move lib/teleterm Go protobufs to gen/proto/go
* Move lib/prehog Go protobufs to gen/proto/go
* Rename lib/teleterm proto package
* Re-enable linter rules for teleterm & prehog
* Update prehogv1 path in usagereporter_test.go
* Use except instead of ignore_only to allow Google API-style responses
* Add UNARY_RPC to api/proto & proto
* Ignore gen/ when running addlicense
* buf-js.gen.yaml: Remove comment about lack of go_package for JS
* Move prehog protos to proto/prehog/v1alpha
* Adjust prehog's go_package to match proto package
* Add TTL field to integration/helpers.UserCredsRequest
This will let us create expired user certs by providing a negative TTL.
* Reissue gateway cert if middleware detects it expired
* Add integration test for gateway cert renewal
* Log gateway.Close errors during test cleanups
Unless gateway.Close is called on a gateway that was already closed, it
shouldn't return an error.
However, when working on handling expired certs in Connect I ran into a
buggy test where that error from gateway.Close provided a crucial clue
in fixing the bug. But because initially it was simply ignored, it took
me a while to figure out what was going on.
That's why this commit adds logging around those errors.
2 out of those 3 places are helper functions which get used in a variety
of tests, hence why they call t.Cleanup. The other place does call
gateway.Close eventually but we still use t.Cleanup in case the
execution doesn't get to that point.
* Automatically add useful fields to gateway loggers
It's useful to see what resource the gateway is targeting and what is
the URI of the gateway.
Previously the field with URI was hardcoded in cluster_gateways.go or
added only when cfg.Log was nil, meaning that we weren't able to benefit
from it in places such as gateway_test.go.
This commit makes it so that the `resource` and `gateway` fields are
added to any logger that is passed through gateway.Config.
* Remove copylocks warning from Gateway.NewWithLocalPort
gateway.Gateway holds a mutex in one of its fields. NewWithLocalPort
accepted gateway by value so vet was issuing a warning about copying a
lock.
NewWithLocalPort doesn't actually use the copied lock. But it makes
sense to get rid of the warning anyway.
* Make ReissueDBCerts accept tlsca.RouteToDatabase as arg
ReissueDBCerts used to accept a full-blown types.Database object just to
read a couple of fields from it. In the context of Connect, such object
is obtainable only by making a request to the cluster.
However, in the upcoming PR we want to be able to reissue the cert
without having to perform an unnecessary request to the cluster.
gateway.Gateway already holds all data we need to reissue the cert, so
let's make ReissueDBCerts accept tlsca.RouteToDatabase instead of
types.Database to avoid making that extra request.
* Add Gateway.ReloadCert
In the upcoming PR, after we reissue the db cert, we need to be able to
update the cert used by the running alpn.LocalProxy. This commit exposes
exactly that functionality.
Also, this commit adds RWMutex to Gateway to avoid a situation where
multiple goroutines attempt to reload the cert. This shouldn't happen
under normal circumstances but better safe than sorry.
RWMutex is also used for any field on Gateway that has a setter.
* Add basic implementation of LocalProxyMiddleware
* Add OnExpiredCert callback to gateway.Config
This callback will let the layer above gateway.Gateway handle a
situation in which the cert used by the gateway has expired but there's
a client that tries to make a connection through the gateway.
gateway.Gateway doesn't have the ability to reissue the cert by itself,
hence why we need to accept a callback from above.
To enable feature detection in the Connect application, we need to
ping the auth server to understand which features are enabled.
Previously, we could get away with any cluster information stored in the
cluster profile but a proxy dial is necessary now to get an auth ping response.
* access requests for teleterm
* removed unused imports and named returns
* remove comment
* using timestamppb instead of string for access requests
* updated proto with some more comments
* updated protos with comments
* using clusterClient, comments, and moving validation to daemon for access request delete
* separated GetAccessRequests into separate RPCs
* protobuf updates
* moved requestid check before resolving cluster
* fullstops in comments
* used standard access_request_id through rpc messages
* updated protofiles
* updated daemon service types to match grpc
* added kube advanced search support
* updated protos for kubes in access requests
* testing tag build
* fix detached head
* new tag build
* protobuf update
* lint fixes
* allow drone windows Connect build to include webapps.e
* protobuf files
* remove drone changes and updated comment
* proto changes with comment fixes and changed field order
* protobuf updates
* daemon: Put gateway-related methods next to each other
* Remove unused fields from daemon.Config
* Make Config a private field instead of embedding it
* Add tests for gateway CRUD
* Remove unnecessary ctx and error from daemon.Service gateway methods
* Refactor daemon.Service.gateways to a hash map
* Add comment explaining error handling in removeGateway
Edoardo asked about it some time ago. I forgot to add the explanation to
the code.
https://github.com/gravitational/teleport/pull/14135#discussion_r914687662
* Do not return pointers from ListGateways()
* Remove FindGateway, fix lock issues in RestartGateway() and RemoveGateway()
* Make it possible to test gateway opening/closing in Connect
Open() and Close() used to not return any error and Open() used to start
the gateway in a goroutine, making it rather hard to write tests for it.
This commit makes it so that Open() and Close() return errors and Open()
blocks.
Adjustments have been made to other places in lib/teleterm to account
for that missing goroutine and returned errors.
* Close httptest server in alpnproxy/local_proxy_test.go
While writing tests for the gateways, I was relying heavily on tests for
the local proxy. I noticed that it starts the server but doesn't close it
so I added an appropriate call to the cleanup function.
* Rename Gateway.Open to Gateway.Serve
* clusters.CreateGateway: Trim spaces when building a CLI command
If cliCommand.Env is empty, the returned command has an empty space at
the front.
* Do not pass TargetSubresourceName when fetching certs for gateway
Since we want to be able to freely specify the db name after the gateway
creation, let's not pass the db name when creating the gateway to show
the intent more clearly.
* Make CLICommand a method on Gateway rather than a field
* Extract getting cluster by resource URI to Storage
* Add RestartGateway RPC
* Add daemon.Service.RestartGateway
It's a fusion of both Service.RemoveGateway and Service.CreateGateway.
Both of those methods used to hold the mutex from Service, so I created
private versions of them which assume that a public method holds
the mutex instead.
This way I was able to reuse both methods in RestartGateway.
Rafał Cieślak