* Add GetType() to Plugin
* Add Plugins feature flag to web
* Run prettier
* Update e_imports.go with slack plugin subpackage
Respective enterprise changes imports a new subpackage,
which pulls new dependencies.
* Expose `openConfigFile` IPC
* Add "Open Config File" to `NavigationMenu`
* Make `NavigationMenu` more concise
* Remove unused imports
* Call "three dots" menu "More Options" to make it easier to refer to in the docs
* Show a notification with a config file path
* Render the icon component only in `NavigationItem`
* Render the separator only with access request items
* Use just `separator` string instead of an object
* Render `StyledListItem` as a button
* Shorten the notification
Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>
---------
Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>
Removes unnecessary workflow arguments from the Drone workflow
invocation. Refactors some of the `dronegen` generators to make
this easier to express insife `dronegen`
The locks were not being properly upserted to the cache after the collections
refactor. This was due to a typo when writing the `upsert` logic for the locks
collection.
* Update the docs style guide
- Add the instruction not the recreate content where unnecessary to the
"How-to guides" section in addition to the "Getting started" section,
since this was intended to apply to both kinds of guides.
- Change the requirement to include a video with Getting Started guides
to a suggestion, matching our current practices.
- Add instructions to use technically precise language.
* Partially respond to PR feedback
* Respond to PR feedback
#### Proto Specification
- This ensures that all api changes are reviewed during the
design and not in a subsequent PR. This is also more closely
aligns with the design process we force on interview candidates.
#### Backward Compatibility
- Forces RFD authors to consider how there changes will interact
with older clusters and clients. Any migration steps should be
called out directly in the RFD so that when the feature is rolled
out there are no surprises.
#### Test Plan
- Causes the authors to think about what quality assurance measures
need to be in place to catch regressions before they happen. The
same testing should also occur prior to the initial release that
the feature will land in if said release isn't a major release.
* Fix uncaught exception handling in Connect's shared process
Without this patch, an uncaught exception being thrown would result in
the following error due to how binding methods to class instances works:
C:\Users\rav\AppData\Local\Programs\teleport-connect\resources\app.asar\
build\app\dist\main\sharedProcess.js:73614
this.getLogger().error(message, ...args);
^
TypeError: this.getLogger is not a function
at process.error (C:\Users\rav\AppData\Local\Programs\teleport-connect\
resources\app.asar\build\app\dist\main\sharedProcess.js:73614:10)
at process.emit (node:events:513:28)
at process._fatalException (node:internal/process/execution:167:25)
* Log the origin of the uncaught exception
* Filter version alerts out of the alerts list
* Use constants to alert names
* Update test
* Addres code review comment
* Use afterEach to undo cfg change
* Provide more context in the docs intro page
Closes#22469
The current docs landing page does not include enough context for new
readers. After the general description of Teleport, the rest of the
landing page is series of links, with little guidance for what a new
user should do first (or what an intermediate user should do after
completing the initial setup steps).
This change takes a more narrative approach to the landing page,
briefly describing the content of each top-level docs section and
putting it in context with the rest of the docs. This also helps users
find the right top-level docs section for their needs, since otherwise
the only way to do this is to visit each section.
This change is also more opinionated about which guide new users should
begin with. It recommends the guide to getting started with Teleport
Cloud, since this doesn't require setting up a Teleport cluster and
helps a user register a resource quickly.
The landing page links to the introduction page of each top-level docs
section. If a section does not have an introduction page, this change
adds one.
* Respond to zmb3 feedback
Reorder list items
* Linter fixes
* Respond to alexfornuto PR feedback
* Add CreatedBy and CreatedOn fields to locks.
* Move the setting of the CreatedBy and CreatedOn for locks to the server instead of the client.
* Add tests for the tctl resource lock import and for the tctl lock create command.
* Use clockwork for time in lock creation tests.
* Make fake clock optional and use the golang 0 date.
* Change CreatedOn to CreatedAt.
* Allow a custom time to be passed through as a fake clock.
* Actually accept a fake clock with useFakeClock.
* Pass Clock through as a configuration value when initializing Teleport for the tests.
* Test cleanup
* Set CreatedBy and CreatedAt values in test mocks.
* Fix failing test from enabling clock passthrough to auth.
* Add a function that returns error that might happen during loading the file
* Return validation and file loading errors from `ConfigService`
* Discard file storage updates when the file was not loaded correctly
* Do not show usage reporting dialog when the file was not loaded correctly
* Make title of notifications a little bit smaller, so longer titles do not look weird
* Get rid of sync fs functions wherever possible in file storage
* Move error handling code to `createFileStorage`
* Improve `getConfigError` comment
* Rename `discardUpdatesWhenLoadingFileFailed` to `discardUpdatesOnLoadError`
* Fix the error message in `notifyAboutConfigErrors`
* Revert "Make title of notifications a little bit smaller, so longer titles do not look weird"
* Make `writeSync` async too
* Return `unknown` from `FileStorage.get`
* Add a TODO comment about createFileStorage type
* Add "the" to "Using default config instead"
* Remove `toString()`
---------
Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>
This PR removes the `types.KindKubeService` objects that were
deprecated in Teleport 11.
Teleport 12 removed the double heartbeat and for Teleport 13 we can
safely drop the support of the old hearbeat based on `types.Server`
objects.
Clients older than Teleport 12 connecting to a Teleport 13 server will
fail since they cannot heartbeat using the old mechanism.
OSS Teleport supports access requests in a very limited fashion.
Make this clear by adding a separate page that covers the supported OSS
features.
Closes#4818Closes#13175Closes#14889Closes#15979Closes#22587
An assignment before checking the error was replacing the session event
emitter with a `nil` value which eventually panic when the caller
function tries to close the session.
* * Add proper context handling to auth.AuthenticateUser.
* Move PublicKey field to AuthenticateUserRequest where it can be used
for actual authentication.
* Use a simple switch statement in /webapi/ssh/certs logic to switch
between password, otp, and eventually headless login.
* Add Headless flow to /webapi/ssh/certs login enpdoint.
* Add 3 minute callback timeout.
* Define new endpoints and request fields
- Add MFA response field for test connection reqs
- Define new types for checking if MFA is required
* Implement logic to check if MFA is required
* Add MFA dialog to test connectors
Adds a new function field for ReAuthenticate dialog
that just returns the MFA response
* Update storybook
* Change json field names as a result of backend CR
* Address CRs
* Address CR 2
Prior to the NodeWatcher being successfully initialized, or when
it became stale any calls to `GetNodes` would return no data or
stale data. This behavior results in the problems described in
#22672.
The NodeWatcher will now fallback to pulling data from the cache
in the event that it has no data or stale data when callers attempt
to retrieve nodes. This should reduce the time that it takes the
a new Proxy or a Proxy with intermittent connectivity issues to
Auth be able to route to nodes.
The impact of this change should be noticeable in tests that
create a Proxy and several Nodes and then immediately try to
open a session on the Nodes.
Closes#22672
Now that the authorizer has been moved to the `authz` package, the
permissions alias has been removed. Additionally, the `contextKey` in
`permissions.go` has been unexported.
Sets `http.Server.IdleTimeout` and `http.Client.IdleConnTimeout`
on clients and servers which didn't have them set. A default of
360s was chosen to be on par with the default of an NLB without
being identical.
This was added as another safety measure to prevent leaking any
idle connections indefinitely as seen in #22757.
`apidefaults.DefaultDialTimeout` was also renamed to
`apidefaults.DefaultIOTimeout` to better reflect its usage.
The `http.Client.Transport` created in `newWebClient` wraps a
chain of `http.RoundTripper` over an underlying `http.Transport`.
Since we cannot guarantee that each `http.RoundTipper` has a
`CloseIdleConnections` method the usage of
`defer clt.CloseIdleConnections()` does not guarantee that the http
connections created during Find/Ping/etc are closed.
To prevent leaking connections implementations of `http.RoundTripper`
have added a `CloseIdleConnections` method added that forwards the
request on to the wrapped interface. The `otelhttp.Transport` does
not implement this method either so care has been taken to wrap it
in a `http.RoundTripper` which will call the root transport in
`enforceCloseIdleConnections`. An upstream issue has been filed
with otelhttp: https://github.com/open-telemetry/opentelemetry-go-contrib/issues/3543
to get the method added to their `Transport` implementation.
This wasn't noticed prior to upgrading to go1.20 becuase prior to
[this](https://github.com/golang/go/commit/4e7e7ae1406c70d9cc0809ec11105a55a60a0b70)
commit the `ReadHeaderTimeout` set on the Proxy web api http.Server
would cause the connection to appear idle and get terminated by the
server.
`TestWebClientClosesIdleConnections` was added to capture the leak
in connections as reported in #22757 and prevent any regressions.
The HTTP client created by `auth.NewClient` has an idle timeout of
30s and each instance periodically gets cert authorities in
`TeleportProcess.syncRotationStateCycle`. If there has been no
activity when the ticker expires then the request will result in a
brand new connection to Auth to be established. This can cause a
spikes in open file descriptors on the Proxy when there are a large
number of instances connected via a tunnel.
To prevent periodic dialing when retrieving cert authorities the
endpoint has been migrated to the new Trust gRPC service. For now
only the get endpoint has been migrated but the rest of the CRUD
operations for cert authorities should be migrated from the HTTP
api to the gRPC service as well.
* Emit new `AgentMetadataEvent`
Part of https://github.com/gravitational/cloud/issues/3550.
This commits adds a new `UpstreamInventoryAgentMetadata` that is sent
from a Teleport agent to an auth server.
Once received, it is transformed into an `AgentMetadataEvent` and sent
to PreHog.
Most `UpstreamInventoryAgentMetadata` fields are intentionally kept as
empty in this PR. Follow up PRs will be opened with the mechanisms
required to fill them (as described in #21337).
* server_id -> host_id
* compute OS and host architecture
* Compute OS version and container runtime
* Close stream if agent receives an agent metadata message
* cmd -> exec ; file -> read
* implement fetchOSVersion for linux
* Remove unused import
* Add note about `agentMetadataCh`
* Allow commands with args
* Remove parseFun abstraction
* fetch glibc version
* fetch container orchestrator
* Fix lint
* Fix TODO
* Add note about glibc version
* cmd -> command
* fetch cloud environment
* fetch install methods
* GLibCVersion -> GlibcVersion
* Use `http.NewRequestWithContext`
* Add missing comment
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* GLibCVersion -> GlibcVersion
* Fix lint
* Fix helm unit tests
* Add missing comments
* 5 second timeout on http requests
* Spawn gorountine that fetches metadata on each new stream
* Use `defaults.HTTPClient()`
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Add missing import
* Handle error
* Revert "Spawn gorountine that fetches metadata on each new stream"
This reverts commit fe4f2790be.
* Send agent metadata to auth server once per stream
* Improve note about agentMetadataDone
* Don't process command output & file content on the agent
Since agents cannot be trusted, regex validation and sanitization should
happen in PreHog anyways. So this commit removes such logic in favor of
moving it to PreHog.
* Fix lint
* Trim space
* Move handling of `AgentMetadataEvent` to `handleControlStream`
* Use cached hello message
* Move metadata files to lib/inventory/metadata
* make sending of agent metadata more self contained
* Minimize diff
* Send all system roles to PreHog
* Remove unused import
* Add parsing of command output / file content back
* Usage reporter refactor
* Usage reporter refactor
* Add missing handling of inventory agent metadata msg
* Fix ICS usage reporter
* Improve comments
* Add cached `metadata.Get*` methods
* Use systemctl status instead of is-active
* Add `Metadata` struct
* return pointer in `FetchMetadata`
* Pass context to `GetMetadata`
* metadataFetchConfig -> fetchConfig
* GetMetadata -> Get
* Add note about `Get` result
* Ensure install methods are non-nil
* Exit `metadata.Get` if context is closed
* Replace sync.Once with atomic.Bool.Swap
* Initialize channel
* Fix lint
* Fix lint
* Make `metadata.Get` return an error instead of bool
* Allow multiple true/false values for env vars
* Use `strings.Cut`
* Use /etc/os-release ID instead of NAME
* Improve `autoEmitMetadata`
* Use `gnu_get_libc_version`
* Ubuntu -> ubuntu
* Use GOARCH
* gofmt
* Move import C up
* Variables may include quotes
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Default values for ID and VERSION_ID
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Blank lines are permitted
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Anonymize host id
---------
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Connect: Remove leftovers from resource cache removal
* GetAll* RPCs were used in the resource cache and are no longer used.
* ListApps was pretty much never actually used as we didn't ever list apps
in Connect.
* ClusterContext.state.searchValue ceased to be used after we moved to
fetching resources from the backend.
* Remove remaining leftovers from tshd client mock
* Remove unused imports
STeve (Xin) Huang