Adds `UpsertCertAuthority` to the `teleport.v1.trust.TrustService`
and deprecates the HTTP api. The `services.Trust` interface was
also updated to include a `context.Context` in both
`CreateCertAuthority` and `UpsertCertAuthority.
To ensure backwards compatibility the `auth.Client` will first
attempt to use the gRPC client and if that fails with a not
implemented error it will fallback to using HTTP.
Part of #6394
Adds `DeleteCertAuthority` to the trust grpc service and deprecates
the legacy HTTP api. Additionally the `DeleteCertAuthority` method
in the `services.Trust` interface now takes a `context.Context` as
the first parameter. In order to plumb the context through from all
the call sites `DeleteRemoteCluster` from `services.Presence` was
also modified to take a `context.Context` as the first parameter.
Adds a new `GetCertAuthorities` unary RPC to
`teleport.v1.trust.TrustService` and deprecates the equivalent
HTTP endpoint. All associated interfaces have been updated to remove
the marshal options as well.
* Add CreatedBy and CreatedOn fields to locks.
* Move the setting of the CreatedBy and CreatedOn for locks to the server instead of the client.
* Add tests for the tctl resource lock import and for the tctl lock create command.
* Use clockwork for time in lock creation tests.
* Make fake clock optional and use the golang 0 date.
* Change CreatedOn to CreatedAt.
* Allow a custom time to be passed through as a fake clock.
* Actually accept a fake clock with useFakeClock.
* Pass Clock through as a configuration value when initializing Teleport for the tests.
* Test cleanup
* Set CreatedBy and CreatedAt values in test mocks.
* Fix failing test from enabling clock passthrough to auth.
This PR removes the `types.KindKubeService` objects that were
deprecated in Teleport 11.
Teleport 12 removed the double heartbeat and for Teleport 13 we can
safely drop the support of the old hearbeat based on `types.Server`
objects.
Clients older than Teleport 12 connecting to a Teleport 13 server will
fail since they cannot heartbeat using the old mechanism.
The HTTP client created by `auth.NewClient` has an idle timeout of
30s and each instance periodically gets cert authorities in
`TeleportProcess.syncRotationStateCycle`. If there has been no
activity when the ticker expires then the request will result in a
brand new connection to Auth to be established. This can cause a
spikes in open file descriptors on the Proxy when there are a large
number of instances connected via a tunnel.
To prevent periodic dialing when retrieving cert authorities the
endpoint has been migrated to the new Trust gRPC service. For now
only the get endpoint has been migrated but the rest of the CRUD
operations for cert authorities should be migrated from the HTTP
api to the gRPC service as well.
* Move configuration from lib/service to lib/service/servicecfg
The new servicecfg package will hold only configuration for services.
This will allow other packages (like tctl and tsh) to depend on
servicecfg without pulling in all of lib/service (which has a number
of platform-specific details).
This is the first step towards being able to build tctl for Windows.
* Move PAM and BPF config into servicecfg
This breaks a compile-time dependency on BPF/PAM for tctl.
* Move the authorizer into its own package.
The Authorizer and associated functions and constants have been moved into
their own package `authz`. This will allow us to more easily create separate
services for gRPC functionality so that we're not pushing as much into the
`lib/auth` package.
Though this PR is large, the only actual code change here is making
`ContextForLocalUser` exported and changing the `permissions_test.go` so that
it doesn't rely on the `lib/auth` package.
* Use context functions.
* Test and linting fixes.
* Add in a temporary alias file to ensure e still compiles.
* Use functions instead of var aliases for performance reasons.
* Adding in godocs, cleaning up tests.
* Fix tests.
* Add a few more aliases.
* make it easier to create registered openssh nodes with 'tctl'
Metadata.Name is set to a random UUID if it's unset, the requirement
to use '--force' when creating node resources is dropped, and more
checks for openssh node resources are added.
* added test coverage, renamed KindOpenSSHNode -> SubKindOpenSSHNode, added github.com/google/uuid to api/go.mod
* attempt to fix tests
* don't set node subkind if it's empty
* re-add test fix
* Allow devices writes with resource-like semantics
* Update generated protos
* Set `create_as_resource` in device-related `tctl` RPCs
* Do a few tweaks to `tctl` device resources
* Add UiConfig option to proxy service config
* Add uiConfig to GRV_CONFIG window object and use in terminal constructor
* Update configuration reference docs
* Remove extra structs and change property to scrollbackLines
* Update web/packages/teleport/src/config.ts
Co-authored-by: Jeff Pihach <hatched@users.noreply.github.com>
* Use a common struct and apply in applyProxyConfig
* Remove webclient dependency for fileconf
* Add missing doc comments
* Set individual properties of cfg.Proxy.UI
* Remove unneeded comment
* Add nolint rule
* Fix nolint
* Add test for UIConfig
* Cleanup tests
* Fix TestUIConfig context
* Allow dynamic config for web ui (#22097)
* Update protofiles
---------
Co-authored-by: Jeff Pihach <hatched@users.noreply.github.com>
* Automatically parse entity ID from SAML SP during CLI creation.
When a SAML IdP service provider is created in the CLI, the entity ID will
be automatically parsed out of the entity descriptor and pushed into the
object before pushing the object to the backend.
Additionally, a small bug was found with the SAML IdP service provider get
logic and fixed.
* Update tool/tctl/common/collection.go
Co-authored-by: Andrew Burke <31974658+atburke@users.noreply.github.com>
* Update tool/tctl/common/resource_command_test.go
Co-authored-by: Andrew Burke <31974658+atburke@users.noreply.github.com>
* Bring back copy loop.
* Remove the SkipCheckAndSetDefault.
* Removing the check for the entity ID in the SP object.
* Restore missing comment.
* Parse entity ID as part of check and set defaults.
* Cleanup api go.mod/go.sum.
---------
Co-authored-by: Andrew Burke <31974658+atburke@users.noreply.github.com>
The SAML IdP service provider collections object in the CLI was inadvertently
appending to the end of a preallocated array instead of using the array
directly.
* format collected data nicely
* remove name prefix
* update comment
* Update tool/tctl/common/device/resource.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* fix test
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* handle tctl create device.yaml
* delete + fix create
* delete by asset tag
* factor out finder
* tctl get device
* gci
* use unmarshaler
* device
* test + unmarshal version check
* improve error
* fix device asset search
* fix parse shortcut bug
* various fixes
* rename CheckAndSetDefaults to checkAndSetDefaults
* Update tool/tctl/common/device/resource.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Update tool/tctl/common/collection.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Update tool/tctl/common/resource_command.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* fix import
* improve findDeviceByIDOrTag and allow multiple returns for fuzzy asset tag searching in tctl get devices/
* update create/delete messages
* print warn instead of error
* mark sanity check
* resource rework
* add comments
* fix typo
* Update tool/tctl/common/resource_command.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Update tool/tctl/common/resource_command.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Update tool/tctl/common/resource_command.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* drop findmultiple
* Update tool/tctl/common/resource_command.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Update tool/tctl/common/device/resource.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* various feedback updates
* user friendly enum for ostypes
* add comments
* Update tool/tctl/common/resource_command.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Update tool/tctl/common/device/resource.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Update tool/tctl/common/device/resource.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Update tool/tctl/common/device/resource.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Update tool/tctl/common/device/resource.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* gci
* feedback
* typos
* Update tool/tctl/common/device/resource.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Add check on apiserver upserUser to ensure all roles on user exist
* Move role check on upsert user to client side
* Move user role checks on upsert to tctl
* Add err to message about missing role
* Start removing generateToken
* Refactor `tokens add` to use `CreateToken` RPC
* Correct deprecation version
* Remove calls to GenerateToken
* Start tests for token crud
* Allow user role rules to be provided wth CreateUserAndRole helper
* Add TestCreateToken to tls_test
* Add TestUpsertToken
* Add GetTokens test
* Add TestGetToken
* Add test for DeleteToken RPC
* Dedupe error assertions
* Add support for emitting trusted cluster token creation events to Create/UpsertToken
* Fix imports
* Change parameter order to appease linter
* Fix broken token expiry test
* Fix token expiry time for TestAuth_RegisterUsingToken
* Remove unnecessary cleanup
* Apply suggestions from code review
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Change test comment from deprecation notice
* `make gprc` after code review changes
* Update lib/auth/tls_test.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Update lib/auth/tls_test.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Update lib/auth/tls_test.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Update lib/auth/tls_test.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Rename tests
* Update lib/auth/tls_test.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* More test cases for GetTokens
* Improve message on duplicate token
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
Fixes#19293
The error message "missing parameter hostname" wasn't very clear what hostname
was missing. Fail faster further up the stack and print a better error message
explaining what is happening.
This applies some checks aroung argument parsing while also adding some
belt-and-suspenders validation into `NewClientStoreFromIdentityFile`
* Add Device to LocketTarget proto
* Refactor LockTarget.Match
* Test lib/srv.ComputeLockTargets
* Test lib/services.LockTargetsFromTLSIdentity
* Test device lock during cert issuance
* Add device lock targets where applicable
* Add --device to `tctl lock`
* Fix godocs (unrelated)
* Review: Drop redundant comments
* Allow the creation and usage of expiryless tokens
* Tidy up loose ends
* Fix imports
* Add tests for changes to expiryless behaviour
* Use new RPCs for new expiryless behaviour
* Add tests for new RPCs
* Remove unused import
* Recreate behaviour for tokens expiring in past
* Missing NoError check int ests
* Correctly americanize behavior
* Add SAML IdP service providers to the cache and CLI.
SAML IdP service providers have been added to the cache and are now manageable
via the CLI. Some alterations to role permissions have occurred to ensure that
the system and users can manage these.
* Tiago's feedback.
* Update tool/tctl/common/collection.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Tim's feedback.
* Update lib/cache/collections.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Adding in a new SAML IdP certificate authority.
A new SAML IdP certificate authority has been added. It has been added to
initialization, the cache, and the certificate can be rotated.
* Update lib/services/authority.go
Co-authored-by: Sam Freiberg <sfreiberg@goteleport.com>
* Update api/types/trust.go
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Only validate private key if it's present.
---------
Co-authored-by: Sam Freiberg <sfreiberg@goteleport.com>
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
Ensure that tctl edit does the equivalent of
tctl get --with-secrets
Without this, the resource we fetch may be missing important details
that get overwritten when the edit completes.
Fixes#20326
User certs for desktop access are only valid for a few minutes
and are never written to disk. This can make it difficult to
troubleshoot cert validity.
This commit adds support for generating Windows user certificates
which can be exported to the Windows environment for validation.
Note: at this time, we only write the certificate and not the
corresponding private key, making it impossible to use the generated
cert for any real purpose.
* feat: login rule tctl CRUD commands
This commit implements the `create`, `get`, and `rm` `tctl` commands for
login rule resources.
Much of the Resource <-> Protobuf type conversion code is already
present in teleport.e and is being copied here so that it can be used in
OSS tctl (there is no longer an enterprise-specific resource command for
tctl, everything is in OSS).
https://github.com/gravitational/teleport.e/pull/699 removes the now
redundant code in teleport.e
* WIP adding OpenSSH CA
* fix creating OpenSSH CA for tests
* fix a test name and tctl usage flag
* fix 'tctl status' not displaying openssh CA sometimes
* add OpenSSH CA to TestInit_bootstrap, remove TLS key pair
* add OpenSSH CA to a few more places
* make help text of 'tctl auth rotate' more helpful and accurate
* fix web cert export test
* tbot doesn't need to know about OpenSSH CA
* address feedback
* fix comment formatting
- Add a generalized client store made up of a key, profile, and trusted certs store. Each sub store can support different backends (~/.tsh, identity_file, in-memory).
- Replace custom identity file handling with in-memory client store.
- Fix issues with trusted certs handling.
This PR includes a new Role resource version that is compatible with V5 spec.
The new resource introduces the `kubernetes_resources` definition that allows operators to limit the Kubernetes resources that each member can access. The `kubernetes_resources` entries must follow the following format: `{"kind":"<kind>", "namespace":"<namespace>","name":"<pod>"}`. Currently, it only supports objects of `kind` `pod`. Valid examples `<namespace>/<name>:
- `*/*`: matches all pods in all namespaces.
- `default/*`: matches all pods in the `default` namespace.
- `*/nginx-*`: matches every pod prefixed with `nginx-` in every namespace.
For older resource versions - V5, V4, V3 - `kubernetes_resources` is automatically populated with `{"kind":"pod","namespace":"*","name":"*"}` to keep compatibility. For the newest version, it's mandatory to define its value otherwise access to pods will be denied.
Part of #18434
This command allows you to modify a resource in place by opening
the resource YAML in your text editor.
The editor is selected by checking the following, in order of
precedence:
- the TELEPORT_EDITOR environment variable
- the VISUAL environment variable
- the EDITOR environment variable
- defaulting to 'vi'
We also prevent renaming resources with this command.
See gravitational/webapps#1465 where we do the same for the web UI.
This commit adds a new Prometheus gauge `teleport_migrations` that
tracks for each migration if it is active (1) or not (0).
This gauge is then leveraged in `tctl top` to show a set of active
migrations.
n the context of Teleport Discover, we must be able to known if there's any DatabaseService available to proxy a given Database resource.
If there's none available, we will offer a script for the user to run and install a DatabaseService which proxies the desired Database resource.
By DatabaseService, we mean the process that Teleport binary manages when the `teleport.yaml` config has the following section:
```yaml
db_service:
enabled: "yes"
```
To accomplish this we are creating a new resource: DatabaseService.
The UI will fetch all DatabaseServices and check if there's any ResourceMatcher that matches the DatabaseLabels.
Previous PRs created the DatabaseService resource and its CRUD methods.
This PR adds an heartbeat for DatabaseServices similar to what we have for Databases.
There's also a new command to list DatabaseServices using `tctl`:
```
$ tctl get db_service --format text
Name Resource Matchers
------------------------------------ --------------------------------------
a6065ee9-d5ee-4555-8d47-94a78625277b (Labels: <all databases>)
d4e13f2b-0a55-4e0a-b363-bacfb1a11294 (Labels: env=[prod],aws-tag=[xyz abc])
```
Test using Teleport Cloud
```
dinis@lenix ~/p/cloudagents> tctl get db_services
kind: db_service
metadata:
expires: "2022-12-21T18:05:10Z"
id: 1671645310983808522
name: 2a28d394-900c-42ea-a120-eed918e4526b
spec:
resources:
- labels:
aws-tag:
- xyz
- abc
env: prod
version: v1
dinis@lenix ~/p/cloudagents> tctl status
Cluster marcoacme.cloud.gravitational.io
Version 12.0.0-dev
```
Part of #19032
Related #19363#19469
rosstimothy