#### Proto Specification
- This ensures that all api changes are reviewed during the
design and not in a subsequent PR. This is also more closely
aligns with the design process we force on interview candidates.
#### Backward Compatibility
- Forces RFD authors to consider how there changes will interact
with older clusters and clients. Any migration steps should be
called out directly in the RFD so that when the feature is rolled
out there are no surprises.
#### Test Plan
- Causes the authors to think about what quality assurance measures
need to be in place to catch regressions before they happen. The
same testing should also occur prior to the initial release that
the feature will land in if said release isn't a major release.
* * Add proper context handling to auth.AuthenticateUser.
* Move PublicKey field to AuthenticateUserRequest where it can be used
for actual authentication.
* Use a simple switch statement in /webapi/ssh/certs logic to switch
between password, otp, and eventually headless login.
* Add Headless flow to /webapi/ssh/certs login enpdoint.
* Add 3 minute callback timeout.
expanded 'registering nodes' section to provide solution to stated problem
addressed feedback
Clarified RBAC section, added security and UX notes. Removed the
option of adding info to host certs, that actually won't work with how
SSH public key auth is currently implemented.
added details on new CA, fleshed out details on getting RBAC to work
addressed some feedback, renamed OpenSSH CA -> Agentless CA
added other RBAC implementation
minor changes addressing feedback
fix incorrect usage of 'preform'
added example of registered OpenSSH node resource
remove accidental reference to unregistered nodes
renamed sub-kind and CA; removed option 1 as it was unanimously rejected
added 'teleport' node sub-kind
add manual ca rotation details
address feedback
add section about SSH agent forwarding
clairified what SSH agents can be forwarded
addressed feedback
add future work
removed 'future work' section
clarified that proxy recording and direct dialing will be removed at the same time
address feedback
Update rfd/0098-registered-openssh-nodes.md
Co-authored-by: Jakub Nyckowski <jakub.nyckowski@goteleport.com>
* RFD: Agent Census
* Add install methods
* Add tarball
* Fill in TODOs
* Track multiple installation methods
* Detect EKS & GKE
* Add container runtime back
* Improve wording
* Use `/etc/os-release` for OS version
* Use `/.dockerenv` for Docker
* Improve wording
* Remove ps scripts
* Be less vague in goal
* Link to agent census section
Co-authored-by: Michelle Bergquist <11967646+michellescripts@users.noreply.github.com>
* Track `systemctl`
* Add new `UpstreamInventoryAgentMetadata` message
* ICS
* Improve wording
* Improve wording
* Improve wording
* Be more explict about the possible values in `UpstreamInventoryAgentMetadata` fields
* Improve wording
* Simplify agent metadata fetching flow
* Add note about command output parsing
* Add note about ICS flow
* Improve glibc description
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Fix typo
Co-authored-by: Walt <walt@goteleport.com>
* Add Teleport AMIs to list of install methods we want to track
* Add note about data sanitization
* RFD number
* Update required approvals
* Improve code sketch with suggestion
* Include git version in `UpstreamInventoryAgentMetadata.ContainerOrchestrator`
* Merge dev plan steps 2 and 3
* Remove `TeleportAccessProtocol` enum and detail how info will be stored in PostHog
* Update `UpstreamInventoryAgentMetadata` comments
* RFD number
* Fix PostHog data
* server_id -> host_id
* RFD number
* RFD number
---------
Co-authored-by: Michelle Bergquist <11967646+michellescripts@users.noreply.github.com>
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
Co-authored-by: Walt <walt@goteleport.com>
* Start machine id client analytics rfd
* Add notes on warnings to logs
* Add details on event collection
* Make it clear no additional anonymization is required
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Use environment variable for telemetry opt in
* Add proto for event submission
* Set RFD number
* Correct name for consistency.
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Name fields for consistency
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* rename continous -> daemon
* Reflow text after PR fixes
* Add distinct_id field to event request
* Describe the UUID field
* Shorten and clarify attributes related to destinations
* Change env var for enabling telemetry
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Add agentless mode section to ec2 discovery rfd
* Update the labels section
* use `teleport join` command instead of secret-manager
* update to include a full teleport join command example
* Add cert rotation section
* remove AWS Tags section
* Add draft for RFD/0090 - DB MFA Sessions
* Fix title
* Update 0090-db-mfa-sessions.md
* Update 0090-db-mfa-sessions.md
Remove extra line breaks
* Update 0090-db-mfa-sessions.md
* Update 0090-db-mfa-sessions.md
* Update rfd/0090-db-mfa-sessions.md
* Update api section to explain why 'always' is ok
* Update details section
* mention that we will disable commands that save certs to disk when per-session-mfa is required
* Fixup formatting
* Add section about Teleport Connect
* Add section about PIV yubikey
* Add Teleport Discover metrics RFD
* Fix
* Update Events
This commit includes some nit changes:
- adding the unspecified as the first enum
- renaming some messages to add the Discover namespace
Some other changes:
- added the Skipped status to accomodate for when we don't have to
install the DatabaseService
- merged deploy of services into a single event (deploy of an ssh agent,
kube agent and database agent)
- added the started event to capture when the wizard is launched
* Remove prefix on enums
Co-authored-by: Marco Dinis <marco.dinis@goteleport.com>
Ensure that users can access nodes via `tsh ssh` when there is intermittent or no connectivity to Auth.
Connectivity to the Auth server is a single point of failure which can result in not being able to access
a resource. If a user already has already obtained a valid certificate (via `tsh login`) there are certain
scenarios when a connection to Auth should not required to gain access to a node. This would reduce the burden
on cluster admins when performing an Auth upgrade. On top of the potential downtime during the upgrade, any issues found as a result of the upgrade require a rollback, which can further extend downtime and lack of connectivity.
* Add API types for CircleCI joining
* Add validation for CircleCI configuration
* Add JoinMethodCircleCI across codebase
* Add token validator and token source for circleci
* Update join methods RFD
* Add CircleCI token source to register.go
* Add serverside support for circleci joining
* Add test for TokenSource
* Add success case for token validation test
* Add expired test case
* Add test case for token from another org
* Test RegisterWithToken for CircleCI
* Refactor GitHub RegisterUsingToken tests
* Refactor CircleCI RegisterUsingToken tests
* Add tests for ProvisionTokenSpecV2
* Appease linters
* Go Imports files
* Fix failing test for msising IDtoken
* Update lib/auth/join_circleci.go
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Move test server cleanup closer to initialisation
* Fix weird import reordering
* Include unexpected type in error message
* Simplify boolean algebra :)
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Start work on OIDC joining RFD
* Better explain why GCE as first platform
* Explain registration flow
* Correct behaviour for bot certificates
* Change structure of configuration to use array
* Add notes on JWT exfilitration security issues
* Adjust RFD for GCP specific configuration
* Add zone to extracted claims from GCP token
* Introduce new ProvisionTokenSpec
* Add migration strategy todo
* Simply GCP OIDC joining config schema
* Remove irrelevant line
* Update GCP example to reference TokenV3
* Notes on certificate pinning mitigation for mitm
* add notes on clock skew
* JWT cache configuration
* fix rfd line wrapping
* Update RFD79 for implementation
This includes 3 optimizations to improve performance of desktop sessions:
1. Reuse the same image object when encoding PNGs. This prevents us from making
a 16KB allocation for every single bitmap that comes through.
2. Introduce a new PNG frame message that has a length as part of the header.
The original message had no length, which required a costly decode operation
just to find the message boundary. This fixes a performance regression in the
proxy for v10.2.x.
3. Eliminate the use of binary.Write when encoding the most common message types.
While convenient, binary.Write uses reflection to detect the type of the input, which slows encoding down.
Co-authored-by: Isaiah Becker-Mayer <isaiah@goteleport.com>
rosstimothy