* Extend Teleport RBAC to suport Kubernetes Verbs
This PR extends Teleport per-Resource RBAC to support Kubernetes verbs
restriction. With this change it's possible to restrict certain actions
allowed by the underlying `kubernetes_users` and `kubernetes_resources`.
Supported verbs:
- `get`
- `create`
- `update`
- `patch`
- `delete`
- `list`
- `watch`
- `deletecollection`
Fixes#27095
* address timr's comments
* assign wildcard to verbs for role <7
* address marco's reviews
* Introduce Access List internal object.
The Access List internal object has been introduced. This object will be used
for backend storage and JSON/YAML unmarshaling.
This PR introduces a few concepts:
* Access List is intended to be created with a builder.
* Access List is a regular struct instead of an interface.
* There are common objects, which are largely copies of their current protobuf
counterparts, that also have builders.
* These common builders can be integrated with regular resource builders, like
the access list builder.
* Linting fixes.
* More linting.
* Remove builder.
* Modify to match most recent proto updates.
* Move IsValidLabelKey back to common.
* Tuning of function named returns, add in tests for IsValidLabelKey, expand IsValidLabelKey comment.
* SetKind/SetVersion at the end of CheckAndSetDefaults.
* Remove pointers from AccessList/Header objects.
* Move SetKind/SetVersion back to beginning of CheckAndSetDefaults.
* Generalize Kubernetes Resource RBAC
This PR generalizes the work introduced by #19613 to other resources
existent in the Kubernetes API.
It allows restricting access to different Kubernetes resources using a
single `kubernetes_group`.
`kubernetes_resource.kind` supports `*` and the following resources:
* Deployments
* Statefulset
* Secrets
* Configmap
* DaemonSet
* Job
* CronJob
* Namespace
* Services
* Nodes
* ReplicaSets
* Roles
* RoleBindings
* ClusterRoles
* ClusterRoleBindings
* PersistentVolumes
* PersistentVolumeClaims
* Ingress
* Certificates
* ServiceAccounts
Part of #20811
* address zac's feedback
* Adds automatic approver user for use with access plugins
Adds an internal user `@teleport-access-approval-bot` with the associated
role `@teleport-access-approver`. This new role has grants the right to
approve any and all role access requests, and both the user and role
resources are automatically created on startup if not already present.
While the `@teleport-access-approval-bot` should under no circumstances
be allowed to log into the cluster or appear in UI user listings of any
kind (except as the approver in an access request), this PR does not
implement any or the requisite filtering or enforcement. This is coming
in a future PR.
* Don't crash when building OSS
* fix test fixup
* Adds labels to the Preset approval bot user
Also ads basic update functionality for preset users, and tests
for same.
* typo fix
* Commentary
* linter appeasement
* Update tests
* Update docs
* Post-merge cleanup
* Update lib/auth/init_test.go
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
* Address review feedback
* Filter out user in WebUI and plumb Teleport user through
---------
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
* InstallScripts: pin teleport version using ServerVersion
When Automatic Upgrades are enabled and the current installation is an
enterprise build, it will install teleport using:
- stable/cloud repo channel (yum, apt)
- pin the version to the one present at:
https://updates.releases.teleport.dev/v1/stable/cloud/version
* improve comments
* Add option to allow for host users not to be deleted
This adds a new role option called create_host_users_mode which allows
for it to be configured to not delete users when a session ends. The
old `create_host_user` option will be deprecated with this.
If the deprecated option is set, the new mode option will default to
dropping users as is the current behavior.
* add generated protos
* use combined output for commands, dont set CreateHostUser
* fix tests
* ci fixes
* add godocs to HostUserMode constants, fix tests
* remain -> keep
* Use an enum instead of a string
* fix merge errors
* Add tests & resolve comments
* Resolve issues
* fmt
* Changes to PagerDuty plugin to support running as a hosted plugin
The major structural change is to provide a new PagerDuty app constructor
that allows the auth server to inject a Teleport client, rather than the
plugin automaticaly creating a GRPC client on startup.
Other changes include:
- Added more PagerDuty API types
- Extra logging
- Small refactors here & there
* Update integrations/access/pagerduty/app.go
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Shorten PagerDuty typenames
* Address review feedback
- Moved API URL to plugin parameters
- Removed obsolete settings loader
* Address @marcoandredinis' review feedback
---------
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Add reviewer and requester roles.
Reviewer and requester roles have been added to allow for easy defaults for
reviewing and requesting applications and user groups for the Okta service.
* Update comments, add in requester/reviewer references all over docs.
* Update constants.go
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Better names in resource-requests.mdx, no options for reviewer/requester presets.
* Add dbreviewer to cspell.json.
* Update init_test.go to handle the new number of presets.
* Remove access review/request role creation from resource-requests.mdx.
* Improve wording.
* Only add reviewer/requester/group access if in enterprise.
* Docs updates.
* Remove errant scoped block.
* Tune access controls getting started.
* Prevent customer roles from being overwritten by new defaults.
* Apply suggestions from code review
Co-authored-by: Nic Klaassen <nic@goteleport.com>
* Doc updates, function name updates, bootstrap label behavior changes.
* Adjust TeleportManagedLabel comment to sound less dire.
* Remove unnecessary references to reviewer/requester in the docs.
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Docs tweaks, removal of unnecessary login setting.
* Use internal resource type as discussed offline.
* Update api/types/constants.go
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
Co-authored-by: Nic Klaassen <nic@goteleport.com>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* AWS OIDC Integration: Deploy DB Service in a single click
This PR adds a new AWS OIDC Integration action: deploy database service
This uses Amazon ECS to deploy a Database and a Discovery Service in a
single click.
Please read `lib/integrations/awsoidc.DeployDBService` for more
information.
* set discovery group to uuid
* add agent matcher labels
* add tags to indicate ownership
* create deployment mode
* allow for dot named clusters
* rename service and taskdefinition to include deployment mode
* add ECS service dashboard url to the response
* change ownership tags
* remove delete service api call
* fix json indent in comment and iam token name
* Add mapping between user groups and applications.
Within Okta, user groups can assign permission to many applications and
applications can belong to many user groups. This commit establishes that
mapping so that the Okta service can perform more user friendly access
requests by adding all applications from a user group to the access request
and additionally allowing application access requests to request associated
user groups as well.
* Adjust NewUserGroup to take a spec.
* fix: set jamf plugin default checks to include PluginStaticCredentialsRef
* add labels check. move apiendpoint check to default checks
* check if setting is not nil
* At the notion of friendly names to access request details.
Access request details can now return friendly names. This will help display
access request resources in a way that allows easier reviewing of Okta apps
and user groups, where the names are not human readable.
* Use friendly name for nodes, tune variable names.
* Add in DetailsID helper function for use by the enterprise UI.
* Request apps instead of app servers, remove DetailsID as its no longer needed.
* Push friendly name into app and usergroup UI objects.
* Fix apps test.
* Linting.
* [Connect] Add FriendlyName to AccessRequest (#27694)
---------
Co-authored-by: Michael <michael.myers@goteleport.com>
This PR introduces a new role version - `v7` - to support other
Kubernetes resources such as `Deployments`, `Statefulsets`... while
keeping compatibility with previous role versions.
This PR adds the following validations:
- `v6`, `v5`, `v4`: `kubernetes_resources` can only include `kind: pod`
resources
- `v7`: `kubernetes_resources` can include wildcards or other
resourceces (to be introduced by #26244.
It also adds a role version downgrade (v13 clients connecting to v14
auth server) where we downgrade the role's version and remove unsuported
kubernetes_resources from the resource list.
Part of #20811
* Add types for storing Platform Attestation
* Add to/from resource conversion
* Use bytes for nonce field
* Tidy up usage of pointers
* Ensure tests cover multiple entries
* Adjust comments as per PR review
* Fix moderated session presence checking
Addresses all of the issues that were preventing presence checking during
moderated sessions from working as described in
[#18092](https://github.com/gravitational/teleport/issues/18092#issuecomment-1540900859).
Closes#18092
* make presence test clearer
* fix presence checking on the web ui
* Refactor web socket message handling
A single message processing loop handles retrieving the envelope
and passing it off to individual message handlers. This allows all
messages to be processed outside of `Read` which was dependent on
the terminal being active to process any messages.
The webauthn challenge response was also moved from a raw message
to a webauthn message. By sending it as a raw message it made
presence checking fail because the response has a `t` in it which
caused the session to be killed during moderated sessions.
* enforce mfa ceremony when joining and cluster wide mfa is enabled
* fix conflicts with master
* moderated tests
* Add moderated session tests for the UI
* Add moderated session integration test
* fix lints
* clean up presence test
* refactor envelope handling
* fix build
* fix: revert test debug timeout
* fix: use local context in tests
* simplify closing streams
* generalize waitForOutput to work with an io.Reader
* fix error handling in stream close
* unexport PresenceOptions
* Improve waitForOutput to match against output in successive reads
This commit adds the new function `labels_matching` to the label
expression syntax. It accepts a Teleport-style glob or regular
expression, and returns the aggregate of all values for keys matching
that expression.
Since it is now more likely for users to want to compare two slices,
I've also added the `contains_any` and `contains_all` functions to
complement the existing `contains` function.
This commit also adds the `email.local` function that is already
available in role templates and should be useful.
Some examples are included in the new test cases.
- downgrade roles with label expressions for older clients
- add teleport.internal/downgraded label to downgraded roles
- block UpsertRole if inventory contains servers without label expression support
* feat: partial label expression support
This commit implements support for label expressions (RFD 116) with the
exception that user traits can not yet be used in the expressions.
The user traits will be made available to the expressions in a following
PR.
* explicitly compare role condition with Allow
* add comment on label matcher templating
* reuse labelMatchersUnset loop
* improve debug messages
* Move Cloud Matchers to proto
As described in RFD0125, we are going to create a new resource:
DiscoveryConfig
This new resource will contain the Cloud Matchers as spec fields:
- AWSMatcher
- AzureMatcher
- GCPMatcher
To define grpc methods that use this new resource, we must create all
the matchers types as part of the proto definition.
This PR moves those definitions into types.pb.go and removes them from
`lib/services.{AWS,Azure,GCP}Matcher`.
This should have no side effect in business logic given that we re-use
the same field names everywhere.
* remove most of gogo tags
* Revert "remove most of gogo tags"
This reverts commit 5ecf8d0cec.
* fix typos
* feat: device resource in tctl get all
* check for device resource but ignore in favour of enterprise resource migration
* add firstStart indicator in auth service config. Tests
* remove device bootstrap from this PR
* multiple updates:
- remove resource marshaler, this will be added to e repo instead
- remove device resource checks in oss (not needed as resource marshaler now added to e). tests removed
* move device marshalers to service package
* run fix-imports, fix test
* remove device case from itemsFromResource
* feat: support authenticating with AWS IAM for MongoDB Atlas
* chore(lint): fix errors
* test(tsh): add missing database field
* refactor(mongodb): check for error on each authenticator branch
* refactor(mongodb): update log messages and atlas check
* refactor(auth): use IsRoleARN helper instead of IsARN
* chore(db): remove unused line
* chore(mongodb): split authenticator func
* refactor(db): rename get atlas token function
* tests(db): reuse already existent auth property
* chore(mongodb): add docs reference
* refactor(db): support role chaining
* feat(types): "require" iam role for atlas users
* refactor(db): use external id only on the first session
* refactor(services): add new database matcher for regular users and aws
* chore(db): rename functions to be more assertive
* chore(types): fix lint
* test(db): remove duplicated test
The test being removed here is covered by `TestMongoDBAtlas`
(lib/srv/db/auth_test.go).
This PR extends Teleport support for applying `tctl lock
--server-id=<host_id>` for other builtin roles besides `RoleNode`.
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
This PR adds a new gRPC service `AuditLogService` that allows clients to
request audit log events as unstructured data. Data is returned as
`structpb.Struct` representation which is convertible to JSON.
Unstructured data allows clients to receive audit events without
prior knowledge of their proto wire representation if their end goal is to
export the events as JSON to an upstream service. It allows clients
whose version is older than Auth's version to receive events that their
proto version doesn't support. Exporters can continue operating without
losing events or having to upgrade them each time Auth is upgraded.
Part of https://github.com/gravitational/teleport-plugins/pull/821
Part of https://github.com/gravitational/teleport/issues/23388
* Add static credentials reference to plugin credentials.
To support static plugin credentials, the plugin credentials have been given
a reference to static credentials that takes a set of labels. The additional
gRPC and backend work will be added in a follow on PR.
* Add static credentials to the plugin service.
* Correct misnumbered field in credentials ref.
* Okta requires static credentials.
* Update plugin tests.
* Introduce the Plugin Static Credentials object.
The Plugin Static Credentials object has been introduced to support storing
static credentials for plugins. The backend supporting the plugin static
credentials has been introduced as well.
Related RFD: https://github.com/gravitational/teleport/pull/26599
* Use MatchLabels instead of a custom rolled one, use named arguments for plugin static credentials interface, add type to error message.
* Remove ok references from credentials objects.
* Use protojson instead of jsonpb.
* Rename header unmarshal function.
* Update api/proto/teleport/legacy/types/types.proto
Co-authored-by: Sakshyam Shah <sshah@goteleport.com>
* Update api/types/plugin_static_credentials.go
Co-authored-by: Sakshyam Shah <sshah@goteleport.com>
* Use OAuth instead of Oauth, rename functions.
* Correct initialism.
* Use protojson instead of jsonpb, add an explanatory comment in MessageWithHeader.
---------
Co-authored-by: Sakshyam Shah <sshah@goteleport.com>
* Move opsgenie client code to integrations/access
* Add initial opsgenie bot skeleton and stubs
* Add opsgenie check and set default to pluginv1
* Fix check and set defaults for opsgenie plugin config
* Fill out bot stubs for opsgenie bot
* Add loadOpsgenieConfig to integrations
* Swap to using bearer token for opsgenie plugin
* Fix formating in opsgenie bot
* Reorder imports to fix lint errors
* Add config field to plugins to allow for different recipient logic
Allows bots that use schedules as recipients to determine their own
logic for defaulting etc
* Add notimplemented err for check health for opsgenie bots
* Add check health to opsgenie client and bot
* Rename recipientsAreSchedules to usersAsRecipients
* Add pluginBearertokencredentials checkAndSetdefaults
* Add resolveAnnotations to reqdata and use schedules from that
* Update integrations/access/opsgenie/bot.go
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Prevent default schedules being processed if annotations are set
* Remove loadOpsgenieConfig
* Rename opsgneie addr field
* Add more verbose error messages to opsgenie client
* Update api/proto/teleport/legacy/types/types.proto
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Update integrations/access/opsgenie/bot.go
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Fix error message for recipients field in opsgenie bot
* Change apiEndpoint field name
* Remove check for unused field from opsgenie config
* Remove usersAsRecipients flag
* Reserve addr and change change field number of api_endpoint
* Update integrations/access/opsgenie/client.go
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Rename reqAnnotationresponderskey to reqannotationscheduleskey
* Remove unused check and set defaults
* Rename REqAnnotationScheduleskey
* Use types.Labels alias where possible
* Simplify loop in opsgenie bot to satisfy linter
---------
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Send EKCert if one is present
* Consistent naming
* Add configuration types for EKCertAllowedCAs
* Add fileconfig support for EKAllowedCAs
* Add test cases for fileconf loading and parsing
* Rename helper functions for consistency
* Correct GoDoc format
* Add source URL for pem file
* Add new role defaults to allow requesting and reviewing user groups.
User groups are now default requestable by the access role and default
reviewable by the editor role. This will make the onboarding experience
for the Okta service much easier, as there will be no need to set up
new roles to support it.
A new role called group_access has also been added to support it, which
allows read access to all groups.
* Tweak group access name, add in IsEmpty functions, add in tests for AddRoleDefaults.
* Only inject access request/access review conditions if the build type is enterprise.
* Add in tests for enterprise role logic.
* GCI.
`tsh login` was fetching each role for a user during login to perform
calculations required to determine if auto access requests were
required. To reduce some of the login latency this logic was moved
to `proto.AuthService/GetAccessCapabilities` so that only a single
RPC to Auth is required instead of one per role.
Resolve comments
Remove the agentless watcher and re-use the existing ec2 watcher
Fix getMostRecentRotationForCAs logic
use the clustername from conn.ClientIdentity
get instances once initially and then only from channels
After or Equal last rotation when fetching nodes
resolve comments
Remove the ca rotation watcher and rely on the timer
Resolve comments
resolve comments
* Add MDM and TPM fields to device resources
* Update generated protos
* Add new fields to device/resource conversions
* Test conversions for all enum values
* s/ResourceEnrollStatusToString/ResourceDeviceEnrollStatusToString/g
* Introduce group and app name Okta import rule regexes.
Okta import rules now support regex name matching. This will allow for
matching any group or application which conforms to a given regex, which
will make generating import rule matches less verbose as users won't have
to list out groups and applications by ID.
Validation of regexes happens at create and update time. This is to avoid
compilation of regexes every time an Okta Import Rule unmarshaled. The Okta
service will compile these regexes as needed.
* Use multiple regexes instead of just one.
Tiago Silva