opensource/teleport
3
0
Fork 0
mirror of https://github.com/gravitational/teleport.git synced 2026-11-01 05:27:24 +08:00
Code Issues Packages Projects Releases Wiki Activity
12,109 Commits 9,614 Branches 7,118 Tags
acb255cd883d3d94de949f54e322edacab736112
Commit Graph
31 Commits
Author SHA1 Message Date
Tiago Silva 1bbaf23d86 Add Pod resource search web API (#20183) 
This PR introduces a web API for users to search, from the UI, for Kubernetes pods whose access is only granted by their `search_as_roles`.
The new API can be used to create access requests for those resources.

The new API is located
```bash
curl 'https://<proxy_endpoint>:3080/v1/webapi/sites/<teleport_cluster>/pods?kubeCluster=<kube_cluster>&kubeNamespace=<kube_namespace|empty>&searchAsRoles=yes&limit=10&startKey=&query=&search=&sort=name:asc' \
   | jq .
```
The JSON response:

```json
{
  "items": [
    {
      "kind": "pod",
      "name": "coredns-6d4b75cb6d-k84h9",
      "labels": [
        {
          "name": "k8s-app",
          "value": "kube-dns"
        },
        {
          "name": "pod-template-hash",
          "value": "6d4b75cb6d"
        }
      ],
      "namespace": "kube-system",
      "cluster": "minikube"
    },
    {
      "kind": "pod",
      "name": "etcd-minikube",
      "labels": [
        {
          "name": "component",
          "value": "etcd"
        },
        {
          "name": "tier",
          "value": "control-plane"
        }
      ],
      "namespace": "kube-system",
      "cluster": "minikube"
    },
    {
      "kind": "pod",
      "name": "kube-apiserver-minikube",
      "labels": [
        {
          "name": "component",
          "value": "kube-apiserver"
        },
        {
          "name": "tier",
          "value": "control-plane"
        }
      ],
      "namespace": "kube-system",
      "cluster": "minikube"
    },
    {
      "kind": "pod",
      "name": "kube-controller-manager-minikube",
      "labels": [
        {
          "name": "component",
          "value": "kube-controller-manager"
        },
        {
          "name": "tier",
          "value": "control-plane"
        }
      ],
      "namespace": "kube-system",
      "cluster": "minikube"
    },
    {
      "kind": "pod",
      "name": "kube-proxy-g7j5r",
      "labels": [
        {
          "name": "controller-revision-hash",
          "value": "94985b49"
        },
        {
          "name": "k8s-app",
          "value": "kube-proxy"
        },
        {
          "name": "pod-template-generation",
          "value": "1"
        }
      ],
      "namespace": "kube-system",
      "cluster": "minikube"
    },
    {
      "kind": "pod",
      "name": "kube-scheduler-minikube",
      "labels": [
        {
          "name": "component",
          "value": "kube-scheduler"
        },
        {
          "name": "tier",
          "value": "control-plane"
        }
      ],
      "namespace": "kube-system",
      "cluster": "minikube"
    },
    {
      "kind": "pod",
      "name": "nginx-deployment-6595874d85-6j2zm",
      "labels": [
        {
          "name": "app",
          "value": "nginx"
        },
        {
          "name": "pod-template-hash",
          "value": "6595874d85"
        }
      ],
      "namespace": "default",
      "cluster": "minikube"
    },
    {
      "kind": "pod",
      "name": "nginx-deployment-6595874d85-7xgmb",
      "labels": [
        {
          "name": "app",
          "value": "nginx"
        },
        {
          "name": "pod-template-hash",
          "value": "6595874d85"
        }
      ],
      "namespace": "default",
      "cluster": "minikube"
    },
    {
      "kind": "pod",
      "name": "nginx-deployment-6595874d85-c4kz8",
      "labels": [
        {
          "name": "app",
          "value": "nginx"
        },
        {
          "name": "pod-template-hash",
          "value": "6595874d85"
        }
      ],
      "namespace": "default",
      "cluster": "minikube"
    },
    {
      "kind": "pod",
      "name": "storage-provisioner",
      "labels": [
        {
          "name": "addonmanager.kubernetes.io/mode",
          "value": "Reconcile"
        },
        {
          "name": "integration-test",
          "value": "storage-provisioner"
        }
      ],
      "namespace": "kube-system",
      "cluster": "minikube"
    }
  ],
  "startKey": "teleport-agent-0",
  "totalCount": 11
}
```

Part of #20324 and #19573
Updates #19573
 2023-02-09 21:29:58 +00:00
Noah Stride 476a4a7e82 context.TODO() tidying (#21288) 
* Use `ctx` rather than `context.TODO()` where available

* Further propagation of context

* Use `context.Background()` instead of `context.TODO()` where appropriate in tests

* Further remove `context.TODO` from tests

* Appease linter on parameter order
 2023-02-07 09:01:35 +00:00
Vitor EnesandRafał Cieślak 74e366231a Improve error message when trying to rename resource (#20413) 
* Improve error message when trying to rename resource

This commit improves the error message when a user tries to rename a
resource (role, auth connector and trusted cluster) using the web UI.

* Fix tests

* gofmt

* resourceExists -> getResource

* Improve comment.

Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>

* Improve error message

Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>

---------

Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>
 2023-02-02 20:50:17 +00:00
Michael Wilson 7c4bba7414 Add IdP options to role and auth preferences. (#20999) 
* Add IdP options to role and auth preferences.

Both role and auth preferences have IdP options added to them. At the auth
preferences level, if the SAML IdP option is set to false, the IdP will be
disabled globally. At the role level, it will control which roles allow
access to the IdP.

* Make SAML access by default.

* Fix tests.

* Fix config test.
 2023-02-01 18:45:49 +00:00
rosstimothy 3aa295c87c Convert usages of types.NewRoleV3 to types.NewRole (#19793) 
Closes #14345
 2023-01-11 16:58:22 +00:00
Tiago Silva 40861809a6 Add RoleV6 resource type (#19324) 
This PR includes a new Role resource version that is compatible with V5 spec.

The new resource introduces the `kubernetes_resources` definition that allows operators to limit the Kubernetes resources that each member can access. The `kubernetes_resources` entries must follow the following format: `{"kind":"<kind>", "namespace":"<namespace>","name":"<pod>"}`. Currently, it only supports objects of `kind` `pod`. Valid examples `<namespace>/<name>:
- `*/*`: matches all pods in all namespaces.
- `default/*`: matches all pods in the `default` namespace.
- `*/nginx-*`: matches every pod prefixed with `nginx-` in every namespace.

For older resource versions - V5, V4, V3 - `kubernetes_resources` is automatically populated with `{"kind":"pod","namespace":"*","name":"*"}` to keep compatibility. For the newest version, it's mandatory to define its value otherwise access to pods will be denied.

Part of #18434
 2023-01-05 09:58:12 +00:00
Andrew LeFevre ba9fd70a92 Add ability to have multiple Github auth connector implementations (#17293) 
* added Github auth creator

This will allow for multiple implementations of Github
auth connectors.

* work to allow multiple github auth connector implementations

* auth works, need to fix upserts

* fix upserting, add comments

* fix imports from merge

* removed now unused error

* point e submodule to master branch

* fix unit test

* use correct capitalization of 'GitHub'

* move Github auth connector conversions out of api module

* fix linter warning
 2022-11-16 15:35:21 +00:00
Jakub Nyckowski 0ee91f6c37 Enable GCI linter (#17894) 2022-10-28 20:20:28 +00:00
Andrew LeFevre 7edf9c333f Merge pull request #15144 from gravitational/capnspacehook/file-copy-role-option 
Added file copying role option and node config option
 2022-08-24 20:13:41 +00:00
Lisa Kim f53f3e77d6 [Discover] Check if user has access to any registered resource (#15637) 
* Add connection diagnostic access to UI user context
* Implement resource checker in the web api layer
* Remove setting NeedTotalCount flag for web api list resources
 2022-08-24 16:33:03 +00:00
Lisa Kim a61d38a1a7 Add de-duplicating apps, dbs, and desktops when sorting/totalCount is needed (#12685) 
Fixes total count errors for the web UI:
- Adds de-duplicating matches for `FakePaginate` func. 
- This change does makes `FakePaginate` less efficient b/c 
  it will always run filter for every resource per fetch versus just 
  running it on the initial fetch to get the total count. 
- Removes inaccurate de-dupping in the web api layer since we 
  do it from the back now
- Adds another criteria when de-duplicating `applications` by checking 
  for its `public_addr` as well as its name.
 2022-06-13 19:45:22 +00:00
Przemko Robakowski 951aff47ed IP-based validation for SSH (#13243) 
This change adds IP-based validation for SSH certificates.
There's new option in role definition:

kind: role
metadata:
  name: dev
spec:
  options:
    pin_source_ip: true
When that is set to true client IP must be the same when generating certificates and using them. It uses source_address critical option that should be supported by both teleport and sshd and only applies to certificates we send to user (like in tsh login), we don't pin IP in certificates issued for web UI as they can't leak.
This change also omits machine ID (it uses different code path) - it will be added in separate PR.

Most of the lines changed are from regenerating types.proto, change itself is not that big

Relates #11719
 2022-06-08 22:49:37 +00:00
Joel efd10847bf Modernize role mapping in github connectors (#10456) 2022-06-08 15:34:15 +00:00
Alex McGrathandEdoardo Spadolini 581efdc60f Add support for automatic user provisioning (#11830) 
* Add support for automatic user provisioning

* Add UID parker to reexec

* Add a `teleport park` subcommand that does nothing

Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
 2022-06-08 12:24:13 +00:00
Gabriel Corado c459ddbbe6 SSH Session recording modes (#12916) 2022-06-06 20:29:35 +00:00
Lisa Kim dd02c79604 Add searchAsRoles flag to ListResources request in web (#13149) 
* Add searchAsRoles flag to ListResources request in web
* Update e-ref with search based changes required in e
 2022-06-03 20:38:44 +00:00
Krzysztof Skrzętnicki 9377f7c681 New commands: tctl sso test, tctl sso configure for GitHub (#12783) 
* Implement `tctl sso` commands for GitHub auth.

* Mark RFDs as implemented.
 2022-05-26 23:26:35 +00:00
Isaiah Becker-Mayer 4346f91974 RBAC for directory sharing (#12684) 2022-05-17 12:08:23 -04:00
Lisa Kim ad1f826824 [forward port] Grammar fixes and updating a test (#11016) (#12115) 
Addressing minor code reviews received on a backport
 2022-04-20 22:06:41 +00:00
Lisa Kim 6b3d7eb368 Use the new ListResources in the webapi layer (#11019) 
Supports pagination and filtering for the web UI
Part of RFD 55
 2022-04-20 04:16:41 +00:00
Brian Joerger 600022b290 Change NewRole to use V5 by default, old consumers now user NewRoleV3. (#10884) 2022-03-08 21:11:53 +00:00
Joel ea810d30d9 Implement Moderated Sessions (#8563) 
* Implement Moderated Sessions
 2022-02-15 17:02:10 +01:00
Zac BergquistandIsaiah Becker-Mayer 69a96d4b2c Add desktop_clipboard role option (#10165) 
* Add desktop_clipboard role option

As described in RFD 49, desktop_clipboard defaults to true.

Since sharing clipboards with a remote machine requires a high level
of trust, the presence of a single role in a role set which disables
the clipboard will result in the feature being disabled.

(This is in contrast to session recording, for example, where all
roles in a set must disable recording to turn it off.)

* completing TestBoolOptions

Co-authored-by: Isaiah Becker-Mayer <isaiah@goteleport.com>
 2022-02-07 16:03:43 +00:00
Zac Bergquist 878e71e685 Add role option for record_desktop_session (#9523) 
This option defaults to true, as defined in RFD #0033.

The preset editor and audit roles disable desktop session recording,
as they aren't permitted access to desktops. The preset access role
enables desktop session recording. The implicit role applied to all
role sets also disables recording, otherwise it would be impossible
to disable.
 2022-02-04 16:06:16 +00:00
Brian Joerger 9b8b9d6d0c rollback - Upgrade api version. (#7751) 2021-07-30 15:34:19 -07:00
Brian Joerger c040aca4c1 Upgrade api version. (#7609) 2021-07-28 13:51:21 -07:00
Brian Joerger bd07d7be20 CheckAndSetDefaults sets all defaults. (#6846) 2021-06-18 12:57:29 -07:00
Nic Klaassen 109fa7443d Add V4 Roles (#7118) 2021-06-10 11:52:10 -07:00
Brian Joerger 4398797f14 Pass context through new gRPC converted endpoints. (#6118) 2021-03-23 18:26:52 -07:00
Brian Joerger 494782fe12 Convert Role endpoints to gRPC. (#5458) 2021-03-10 17:54:08 -08:00
Lisa Kim 2669e7aef2 Open source UI users, roles, github cn, trusted cluster (#5540) 
* Transferred user endpoints/handlers from e
* Transferred and refactored endpoints/handlers for roles, trusted clusters, and github cn from e
* Export ok() func so e can use
* Silence rbac auth connector access denials on first check failure
* Update e-ref
 2021-02-22 08:54:36 -08:00