This makes two changes:
* Reduces action instance type to 16 cores. This will half the cost without a significant speed difference
* Switch from `make full` to CodeQL Auto Build. This speeds up the build by about 10 minutes. I confirmed there is not a reduction in the scan coverage
Drop warning about second_factor configured in clusters with local_auth:false.
This is a valid configuration for clusters with session MFA, regardless if their
authn method.
* Move configuration from lib/service to lib/service/servicecfg
The new servicecfg package will hold only configuration for services.
This will allow other packages (like tctl and tsh) to depend on
servicecfg without pulling in all of lib/service (which has a number
of platform-specific details).
This is the first step towards being able to build tctl for Windows.
* Move PAM and BPF config into servicecfg
This breaks a compile-time dependency on BPF/PAM for tctl.
* Introduce Okta gRPC and client interfaces.
To support the upcoming Okta integration, Okta gRPC calls and client
interfaces have been added. This utilizes a non-legacy proto to try to
get away from our reliance on gogo.
This commit does NOT add the OktaImportRules and OktaAssignments to the
cache, which will occur in a later commit.
* Intermediary.
* Modifications needed in order to move this to enterprise.
* Remove okta service from grpcserver.
* Add Plugins feature flag
* Add config for plugins runtime
* Allow reading OAuth secrets from files
* Rename Plugins to HostedPlugins
Make it clear that this is separate from the upcoming
self-hosted, standalone plugins that will be part of the Teleport
binary.
* Only allow to read client credentials from files
* Move the authorizer into its own package.
The Authorizer and associated functions and constants have been moved into
their own package `authz`. This will allow us to more easily create separate
services for gRPC functionality so that we're not pushing as much into the
`lib/auth` package.
Though this PR is large, the only actual code change here is making
`ContextForLocalUser` exported and changing the `permissions_test.go` so that
it doesn't rely on the `lib/auth` package.
* Use context functions.
* Test and linting fixes.
* Add in a temporary alias file to ensure e still compiles.
* Use functions instead of var aliases for performance reasons.
* Adding in godocs, cleaning up tests.
* Fix tests.
* Add a few more aliases.
* Add documentation for `tsh --trace-exporter`
Includes details on how to collect traces from `tsh` that are not
exported to the auth service. This can be especially helpful to
retrieve traces from `tsh` when the `tracing_service` has not been
enabled in the cluster.
* Update docs/pages/management/diagnostics/tracing.mdx
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
Our API module is not currently versioned to align with Teleport
major versions, but it's important for developers building integrations
to use a verison of the API that is compatible with their cluster.
Include a short snippet that can be used to identify the correct
version string to place in go.mod given a particular tag.
* Deduplicate multiplexer detection errors over 1-minute windows
This commit deduplicates errors returned by `Mux.detect` (which detects
the type of a new connection just established) over 1-minute windows.
This ensures that health checkers / malicious actors cannot pollute /
overpower the logs with warnings when such connections are invalid or
unknown to the multiplexer.
* Improve error message
* Fix lint
* Add `TestErrorDeduplicator`
* Multi-line Sprintf
* ErrorDeduplicator -> LogLimiter
* Improve `LogLimiter.Log` API
* Fix typo
* Remove `windowInfo`
* Improve test assertions
* Use new log limiter API
* Remove unnecessary append
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Fix `toLogMessages`
* Start log limiter in `Mux.New`
* Use public API in tests
* Make `Config` field private
* Improve godoc
* Remove channel size from log limiter config
* Use `assert` instead of `require` for log assertions
* Revert "Start log limiter in `Mux.New`"
This reverts commit 3554daa6db.
* Use mutex instead of `entryCh`
* Start log limiter goroutine in `loglimit.New`
* Use `context.Background` as default.
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
An interface has been created that will allow the signing of SAML IdP
requests on the auth server. This will eliminate the need for the SAML IdP
to have private key material.
* Describe node instance usage in AWS Terraform
* Include link to AWS Terraform Guide
* minor wording update
* phrasing update
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* phrasing update
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* Update language
* Update AWS language
---------
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* Allow multiple batch submissions in a row
* Test the new behavior
* Rework usagereporter's submission logic
* Fix tests
* Tweak the batch age timer logic
* len(foo) is never supposed to be negative
* Naming
This PR introduces the static label's key validation to Kubernetes Service.
Services with invalid labels fail to hearbeat their clusters but the
service is kept working. This change forces the service to fail fast
during startup if any key is invalid.
Fixes#22696
* Integrate GHA OCIU publishing pipeline with Drone
Adds new drone pipelines for building and promoting distroless
images. The pipelines themselves invoke workflows on GHA and
await their completion.
* Revert dev version
* restore -dev suffix
* Review Comments
* Address review comments
* Swap out select for poll
wait_for_fd now uses poll instead of select, allowing us to wait for
file descriptors > 1024.
* Restructuring the function to simplify and adds a log statement on error
* Puts poll in a loop that checks for EINTR and EAGAIN
and calls it again if either of those errors were the source
of the error.
* Always return unauthorized if the user doesn't have access to the cert.
In order to avoid exposing whether or not a cert authority exists, we should
return Unauthorized if the cert authority shouldn't be accessible. Prior to
this, the recent change would expose NotFound even if the user didn't have
permission to it.
* Return unauth for cert authorities we don't have access to.
* Add in separate call to actionWithContext on the actual CA.
* Update lib/auth/auth_with_roles.go
Co-authored-by: Isaiah Becker-Mayer <isaiah@goteleport.com>
---------
Co-authored-by: Isaiah Becker-Mayer <isaiah@goteleport.com>
* Improve error messages for tsh login connectivity and ssh port connection errors
* spell fix
* lint fix
* lint fix
* suggestion applied
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Moved message to helper function for ssh proxy connection error
* format function
* Include error message on non-specified port login
* Give error message on attempted proxy hosts
* style coding
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* change to string construction
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* bytes buffer update
* lint fix
* Update message
* Update lib/client/api.go
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Update lib/client/api.go
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Update tool/tsh/tsh.go
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Swap out select for poll
wait_for_fd now uses poll instead of select, allowing us to wait for
file descriptors > 1024.
* Restructuring the function to simplify and adds a log statement on error
Most of the cache collections had an extremely similar structure. Where
possible, the cache collections have been adjusted to make use of common
functions to minimize the amount of duplication within the cache collections.
When the SAML IdP CA was added, it was not added to `checkResourceConsistency`
during `auth.Init`. This made bootstrapping a fresh server from a cluster state
impossible from versions of Teleport that support the SAML IdP CA, as the
`auth.Init` process couldn't recognize the CA.
With this change, the SAML IdP CA is now handled properly by
`checkResourceConsistency`, which makes bootstrapping a cluster from a cluster
state possible again.
Closes#22662
* Rename `putAllSync` to `writeSync`
* Extend `FileStorage` with functions to replace an entire state and return file path used to create it
* Add `updateJsonSchema` function
* Generate schema for the app config
* Always return a string from `createMockFileStorage().getFilePath()`
* Add missing license headers
* Rename 'teleport_connect_config_schema.json' to 'schema_app_config.json'
* Rename `getKeyboardShortcutDescription` to `getShortcutDesc`
* Rename `keyboardShortcutSchema` to `shortcutSchema`
* Update a valid shortcut message
* Rename `configJsonSchemaFile` to `jsonSchema`
* Simplify `updateJsonSchema`
* Set `$refStrategy` to none
* Add missing description for `usageReporting.enabled`
* Bump zod to the latest (improves TS performance)
* Move `configService` implementation to `configStore`
* Rename `configStore` to `configService`
* Move `updateJsonSchema` to `createConfigService`
* Move `validateStoredConfig` outside `createConfigService`
* Rename `createAppConfigSchema.ts` to `appConfigSchema.ts`, `getKeyboardShortcutSchema.ts` to `keyboardShortcutSchema.ts`
* Export `createKeyboardShortcutSchema`
* Add license header
Andrew Burke