* Extend Teleport RBAC to suport Kubernetes Verbs
This PR extends Teleport per-Resource RBAC to support Kubernetes verbs
restriction. With this change it's possible to restrict certain actions
allowed by the underlying `kubernetes_users` and `kubernetes_resources`.
Supported verbs:
- `get`
- `create`
- `update`
- `patch`
- `delete`
- `list`
- `watch`
- `deletecollection`
Fixes#27095
* address timr's comments
* assign wildcard to verbs for role <7
* address marco's reviews
Teleport assumes that the `google` claim is present in the identity token that the Teleport service shares with Auth server. This is valid for VMs but it's not valid for GKE clusters using Workload identity and other GCP services. Teleport requests the identity token with `format=full` to receive this enhanced token.
Example of an identity token with a `google` claim:
```json
{
"iss": "[TOKEN_ISSUER]",
"iat": [ISSUED_TIME],
"exp": [EXPIRED_TIME],
"aud": "[AUDIENCE]",
"sub": "[SUBJECT]",
"azp": "[AUTHORIZED_PARTY]",
"google": {
"compute_engine": {
"project_id": "[PROJECT_ID]",
"project_number": [PROJECT_NUMBER],
"zone": "[ZONE]",
"instance_id": "[INSTANCE_ID]",
"instance_name": "[INSTANCE_NAME]",
"instance_creation_timestamp": [CREATION_TIMESTAMP],
"instance_confidentiality": [INSTANCE_CONFIDENTIALITY],
}
}
}
```
The problem arises when one tries to use GCP joining for a Teleport service running on a GKE pod. When inside a pod with a binding between the Kubernetes Service account and the Google IAM Service Account, Google's metadata service token does not include the `google` claim. so it fails to join the cluster because of the unknown `project_id`.
To bypass this limitation, this PR extracts the `project_id` from the Google Service Account Email claim
`<service_account_name>@<project_id>.iam.gserviceaccount.com`. We use regex to extract the `project_id` and ensure the email follows the specified format above. Tests were introduced to validate the email.
Fixes#28636
Co-authored-by: Jakub Nyckowski <jakub.nyckowski@goteleport.com>
#28499 missed adding the augmented device certificates retrieved from
DeviceLogin to the local agent which causes TestNodeAccess to fail.
This was not caught in #28499 because TestNodeAccess is in `e` and
tests from `e` are not run on `oss` PRs.
* Test concurrent compare and swaps
The backend test suite was not validating that simultaneous CAS
operations result in only one attempt succeeding. The test now
runs multiple concurrent CAS operations and ensures that only a
single operation succeeds. This shortcoming with the test allowed
the Firestore backend to pass the compliance test while not perfoming
CAS in an atomic manner.
* Firestore backend improvements
1) CAS now utilizes a transaction to ensure the operation is atomic
The original implementation did not use transactions which violated
the atomic guarantees of the CAS operation. The backend compliance
test was able to catch this when it was updated to run concurrent
CAS opertations.
2) Update is limited to updating a value
The original implementation of Update was actually doing a get and
then upsert. However, there are no guarantees that prevent a delete
from occurring between get and upsert, which means Update would
upsert the value instead of failing. Instead of get and then upsert
we now update the document using the (firestore.DocumentRef) Update
method.
3) Watching items from the collection filters out any audit events
If Teleport is configured to use the same collection for backend state
and audit events the collection watcher ends up consuming all audit
events as empty backend items. To avoid this the watcher is now filtering
out any collections which have an empty key since it is not possible
for backend resources to be written without a key this will only
exclude audit events which have a different schema.
4) SearchEvents now filters out backend resources
Similar to above, the Firestore events implementation now excludes
any documents which have an empty session id to prevent backend
resources from getting included in queries for audit events if the
collection is being shared.
* speed up backend test suite
* conditionally delete expired items on get
* fix: cleanup tests
* tsh: Implement puttyconfig command to add saved PuTTY sessions to Windows registry
* Addressed comments from code review
* Add support for leaf clusters
* Refactoring from code review
Also moved registry/hostname functions into external packages
* Address more feedback from code review
* Rebase following tsh/common changes
* Fix up putty_config_windows
* Reorder command
* Remove surplus comment
* Use a separate list instead of overloading the 'extra' key
* Address Tim's code review comments
* Address some of Zac's comments
* Refactor formatLocalCommandString to use text/template
* Refactor non-Windows logic into puttyhosts
* Fix subcommand name
* Fix test structure
* Add some more hostnames test cases
* Apply suggestions from code review
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Fix up
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* log a warning when db/discovery service init is skipped but the service is enabled
* dont register discovery service event mapping when init is skipped to avoid log spam waiting on DiscoveryReady event
* fix godoc for DiscoveryReady event
* User groups in access requests will expand list of applications.
When requesting user groups in an access request, the applications associated
with the access request will now be expanded in the access request, requesting
both access to the group itself along with the associated applications.
* Don't duplicate apps if they're already being requested.
* Add clarifying comments to test, test equivalence against more fields.
* Move CMC icon and setup document to common `ConnectMyComputer` directory
* Add permissions to show CMC
* Use `cluster.leaf` to check if a cluster is a root cluster
* Rename `isConnectMyComputerPermittedForRootCluster` to `canUseConnectMyComputer`
* Add licenses
* Rename `DocumentSetup` to `DocumentConnectMyComputerSetup`
* Check `cluster.leaf` flag to verify if the cluster is a root cluster
* Do not throw in `canUseConnectMyComputer`
* Add comments
* Use the same field name in a documentation comment
* Use relative import
The web tests don't need disk-based session recording, and they
occaisonally fail due to a race with tempdir cleanup. Fix that
by disabling the disk-based recording.
Closes#13944
* Enable muting tooltip info icon
* Require user group field
* Update snapshot as a result of changing css for tooltip
* Fix user group setting for UI
* Address CR
#24864 added a dependency of lib/web into tsh which broke windows
tsh builds because lib/web transiently depends on lib/srv which
has linux specific code. This shuffles around a few things so
that lib/web is no longer importing lib/srv at all by:
- Indirectly using the srv.SessionController to apply session
control for web ssh sessions
- Moving the common reversetunnel interfaces into
reversetunnelclient since lib/reversetunnel imports
lib/srv/forward which imports lib/srv.
- Directly converting mysql client errors in the connection
tester instead of calling a common function.
* Define a deployed_method field to discover deploy event
* Add deployed_method field to expected events
* Add deployed method type and define its field when emitting event from web UI
* Address CR and add another field
* Address CR
* Refactor websocket termination and stream handling
Refactored websocket stream shutdown and error handling. Replaced `Close()` with `SendCloseMessage()` for better control over the websocket connection termination process. Added checks for the validity of channels to prevent reading from closed channels.
The commit also includes minor typo fixes.
* Remove unused completedC
* Remove unnecessary select blocks in terminal.go
The select blocks used in terminal.go for reading data from channels were unnecessary as we were just pulling from a single channel. Removed the select block and directly attempted to read from the channel. These changes increase code readability and integrity by removing unnecessary select blocks. In the command_test.go, an explanatory comment was added for clarity.
* Remove commented code
* Replace trace.NewAggregate with trace.Wrap as aggregation is not needed.
* Generalize Kubernetes Resource RBAC
This PR generalizes the work introduced by #19613 to other resources
existent in the Kubernetes API.
It allows restricting access to different Kubernetes resources using a
single `kubernetes_group`.
`kubernetes_resource.kind` supports `*` and the following resources:
* Deployments
* Statefulset
* Secrets
* Configmap
* DaemonSet
* Job
* CronJob
* Namespace
* Services
* Nodes
* ReplicaSets
* Roles
* RoleBindings
* ClusterRoles
* ClusterRoleBindings
* PersistentVolumes
* PersistentVolumeClaims
* Ingress
* Certificates
* ServiceAccounts
Part of #20811
* address zac's feedback
* Add editor heartbeat ticker
* Emit all roles instead of only editor
* Revert "Emit all roles instead of only editor"
This reverts commit a29c9f3025.
* Revert "Add editor heartbeat ticker"
This reverts commit 78ee500084.
* (wip) emit event on user create/update/upsert/delete
* Add new event type
* Emit in separate goroutine
* Move EmitEditorChangeEvent to userevents package
* fix import order
* Add EditorChangeEvent to teleport.proto
* Remove new event from usageevents.proto
* Change empty string slice for nil
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Use slices.Contains
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* use var to start string slice
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* empty string slice -> nil
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Log telemetry err instead of returning on err
* Explictly set prevUser to nil on err
* Set prevUser to nil on err
* Update teleport.proto file
* Fix missing dependency
* Remove spawning new goroutine before submitting since it doesnt blocks the thread
* Dont emit event if reading from backend failed
---------
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
The t.Log() function calls have been removed from most tests. This is to keep our test logs cleaner and more focused on error messages. Logging every detail in tests makes it harder to spot actual errors and relevant information.
* "Improve error handling and embedding prompts; fix typos"
This commit encompasses several changes. First, an error handling routine has been added in AssistContext.tsx to properly close a WebSocket connection and finish all results. The intent is to ensure that execution fails gracefully when a session doesn't end normally. In tool.go, user instructions have been made more explicit to ensure users check access to nodes before generating any commands. It warns them that not checking access will cause error. Also, some minor typos were corrected in agent.go and messages.go for better readability.
* "Refactor 'hosts' to 'nodes' in AI Tool Descriptions"
This commit refactors the language from 'host' terminology to 'node' terminology in the AI tool's generated responses as the LLM seems to be confused when generating queries with embeddings.
* Update expected test values in chat_test.go
The expected values in three different tests in chat_test.go have been updated. This change was required because the underlying algorithm has been adjusted and these modifications will keep the tests aligned with the current algorithm's behavior.
This PR replaces the usage of `gravitational/oxy.Forwarder` in our codebase with `httputil.ReverseProxy`.
`httputil.ReverseProxy` is part of Go's standard library and thus it is
maintained by the Go team. Converting everything to use the std lib
allows us to drop our `oxy` fork.
There are some operational changes between the two versions:
1. `httputil.ReverseProxy` handles WebSockets upgrades internally and
reuses the `Transport` provided for the initial request. Thus, it does
not require any special dialer or rewriter mechanisms for WebSockets only.
2. `httputil.ReverseProxy` calls the `ErrorHandler` with the request
after it was rewritten and after roundtrip was called. This was a
problem because our `web.transport` deletes Teleport associated
cookies and when the request failed, the request received by the
`ErrorHandler` missed the cookies to generate a new session. This was
fixed by cloning the request at `web.transport` round tripper.
3. `httputil.ReverseProxy` uses std's `log.Logger`. `logrus` exposes a
method `Writer` that allows it to be used with standard lib logger.
The API is similar to what our `oxy` fork has available.
Fixes#27412
* Teleport Proxy Behind ALB support for IP Pinning
* move X-Forwarded-For handling to a middleware
* fix where middleware should be nil
* minor refactor based on review comments
* remove TODO and use contains
* use_x_forwarded_for -> trust_x_forwarded_for
* add NoopHTTPMiddleware
* Support specifiying `assume_role_arn` for Kube cluster matchers
This PR allows users to assume different AWS roles when interacting with
AWS EKS API. It allows users to proxy EKS clusters in different AWS
accounts using the same Teleport Kubernetes Service.
Example configuration:
```yaml
kubernetes_service:
enabled: true
resources:
- labels:
'a': 'b'
aws:
assume_role_arn: "arn:aws:iam::0987654321:role/KubeAccess"
external_id: "0987654321"
- labels:
'c': 'd'
aws:
assume_role_arn: "arn:aws:iam::123456789012:role/KubeAccess"
external_id: "123456789012"
```
* reuse eks token validation
* Introduce new tbot output configuration
* Remove code that will be included in future test refactor PR
* Add config version header
* Fix TestInitSymlink
* Add support for `standard` database type
* Set CA type
* `make fix-imports`
* More closely mimic original database output behaviour
* Make output of additional TLS files for application output optional
* Spell compatability properly
* Add test for config marshalling
* Fix cluster field yaml name
* Fix YAML marshalling/unmarshalling
* Fix sidecar invocation of tbot
* Add WrapDestination helper function to protect wrappedDestination
* Apply changes to sidecar
* Spell Marshalling the way the linter insists
* Fix some logging
* Tidy mutex usage on outputRenewalCache
* Fix ssh_host generation
* TBot Config V2 migration support
* Fix misspelling
* Get rid of `destinationWrapper`
* Single l in Unmarshaling
* Fix operator sidecar tbot
* Add UnmarshalYAML for SSHHostOutput
* Fix migration for removed destinationWrapper
* Use updated KubernetesCluster field name
* Add real world test case for migration
* Add additional migration tests
* Use `KubernetesCluster` instead of `ClusterName` for clarity
* Add additional "real-world" migrations from customer feedback
* Rename `Subtype` -> `Format` for `DatabaseOutput`
* Rename Subtype -> Format for DatabaseOutput
* Remove a very british "u" from Behaviour
* Add godoc for interfacemethods
* Fix double dot in comment
Co-authored-by: Michael Wilson <mike@mdwn.dev>
* Use const for database formats
* Reuse constant type string in Stringer
* Add godoc comment explaining behaviour if no destination found
* Inject executablePathGetter rather than using package level variable
* Use correct case in error
* Add warning for destination reuse
* Try to improve confusing log message
* Remove 'u' from behaviour
* Emit error when v2 config possibly being migrated as v1
* Fix imports
* Ensure they dont overwrite original config
* Remove redundant check
---------
Co-authored-by: Michael Wilson <mike@mdwn.dev>
* Add ACL to Connect
* Apply Zac's suggestions
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Rename `convertToApiResourceAccess`
* Use `recorded_sessions` and `active_sessions` instead of `sessions` to avoid confusion.
Web has two fields for "sessions", and we should have too.
* Reserve "sessions" too
* Rename `ACL` to `acl`
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* [Assist] Include embeddings in the prompt
* Add comments
GCI
Minor fixes
* Move stuff
* Fix tests
* Fix tests
* Fixes after rebase
Apply code review suggestions.
* Address review comments
* After rebase fix
* ai: compute opportinistic summary of command execution
* ai: add streaming summary back after rebase on new front-end
* Lint and fix tests pt.1
* reference nodes by name and add tests
* Lint, fix tests and address feedback
* Attempt to tame the stream close monster
* fixup! Attempt to tame the stream close monster
* [Assist] Do not close the WS after command execution (#28246)
* Revert "fixup! Attempt to tame the stream close monster"
This reverts commit 8537aa2163.
* Revert "Attempt to tame the stream close monster"
This reverts commit e0c861df40.
* Do not close the WS after command execution
* Fix tests and lint
* fixup! Fix tests and lint
* undo put web test command into constant
---------
Co-authored-by: Jakub Nyckowski <jakub.nyckowski@goteleport.com>
rosstimothy