* Factor teleport-proxy-lib library chart out of teleport-cluster helm chart
* Remove 'FQDN' suffix from variable name and clean up comments
* Restored $proxy in config templates to minimize differences in review.
* Restored unnecessary changes to ingress template
* Fix unnecessary change in predeploy job
* used deep copy for .Values
* Explain renter-time _validation in comment
* Set domain for proxy config test
* Fixed snapshot and test differences
* Cleaned up comments
* Replace mistakenly removed asserts
* Added forceHAReplicas tests
* Fixed edge case of replicas=0, preserving previous behavior
* Eliminated intermediate version/majorVersion templates and used util lib templates directly
* Update examples/chart/lib/teleport-proxy-lib/templates/_ingress.tpl
Co-authored-by: Hugo Shaka <hugo.hervieux@goteleport.com>
* Removed unneeded alias for teleport-proxy-lib
* Corrected teleport-cluster schema bugs and removed teleport-proxy-lib validation not also done by schema
---------
Co-authored-by: Hugo Shaka <hugo.hervieux@goteleport.com>
* docs: distinguish host user creation from host sudoers in SSH guides
* clarified conflicting language, added missing comma to yaml as it was causing syntax errors when testing, and clarified examples
* post-feedback: clarifications and corrections
* added note about insecure-drop users
Rename encodeSessionRecordingThumbnail and its result type
sessionRecordingThumbnailResponse to the exported
EncodeSessionRecordingThumbnail and SessionRecordingThumbnailResponse so
the enterprise session search web handler can reuse the proto-to-JSON
thumbnail conversion instead of duplicating it.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Composite the cursor in Rust during ResizeCrop
* Apply code review feedback
* Update test
* Move CursorBitmap to an enum, remove Cow, avoid cloning the bitmap
* Remove dereference
* Invalidate E2E Rust cache on decoder changes
VERSION can be empty if there is an error running get-version.
Quote the arg so that empty VERSION is detected and returns
an error when running make docs.
* MWI: Ignore `user_login_state` for bots
This change is part of a fix for gravitational/teleport#63920, where
the Okta usermonitor will inadvertently create unneccessary ULS
entries for bots when they are deleted. Normally, these ULS entries
are sane, but if the bot is deleted and recreated too quickly, there's
a race.
Here's the sequence of events:
1. The user creates a bot (`tctl bots add` or similar)
2. The usermonitor watcher catches the OpPut and creates a sane ULS
entry
3. The user deletes the bot (`tctl bots rm ...`)
4. The usermonitor watcher catches the OpDelete and replaces the sane
ULS with an empty variant, with no roles or labels.
5. The user recreates the bot (`tctl bots add ...`)
6. One of two events happens first:
1. The usermonitor watcher catches the OpPut and replaces the bad
ULS with a sane variant.
2. The bot joins and receives certificates
If 6.1 occurs before 6.2, the bot joins normally and receives valid
certificates. If 6.2 occurs before 6.2, the bot is issued certs with
roles derived from the bad ULS (i.e. empty list) and fails to start
due to the invalid cert bundle.
In my testing, the race window is ~1 second. I see a ~10% failure rate
if the bot is joined within 0.5 seconds of being recreated, and a 50%
failure rate if the bot is joined immediately (well, as immediately as
tbot can start after `tctl bot add ...` returns). Bot joins generally
succeed if there's >= 1 second between recreate and join.
The associated teleport.e makes the usermonitor ignore bots so new
invalid ULS entries won't be created. However, this isn't sufficient
to fix the bug for existing clusters. This PR adds 2 additional fixes:
- `GetUserOrLoginState()` always returns the user variant for bots,
ignoring any potential ULS.
- Deleting a bot now deletes any ULS entry for the bot
See also: https://github.com/gravitational/teleport.e/pull/8773
* Fix failing test
* First Draft of teleport-session-review skill
Framework based on ACL skill
* Adds Examples and Playbook for how to use Session Search
* Add a preflight check
* Feedback from Docs
* Extra Testing on a Teleport Cloud Tenant
* Docs to Skill
* Remove local dev for now
* update locate commands to include $TSH
* Update docs/pages/identity-security/session-summaries/session-search.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Remove Filter caveats
These have been fixed
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Document user display names and how Teleport derives them
* remove redundant notes on display name behavior in user types documentation
* drop unnecessary word
* refine user display name mapping for Okta, Microsoft Entra ID, SAML/OIDC, and SCIM integrations
* refactor: streamline display name documentation across identity provider integrations
* update user display name documentation
* improve clarity and consistency in user display name documentation
* Add public docs for the CA override feature
* Use `code` blocks instead of `shell`
* Number steps as n/d. Move alternatives to H3.
* Move intro paragraphs to "How it works"
* Remove "Supported CAs" section, move its contents to other sections
* Mention specific commands in the info box
* Emphasize future growth
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Add proxy verb to kubernetes_resources
* Preserve upstream kube Status code in forwarder
* Readable comment
* Strip [scheme:]name[:port] on kube proxy paths
* Use SplitSchemeNamePort from k8s apimachinery
When Discovery Service tries to install teleport in a given instance, so
that it can join the cluster, it first does a couple of preflight checks:
- sudo, bash, curl commands exist?
- enough disk space?
- ...
When checking for disk space we are using /opt folder.
Howevers VMs can have a specific mount point for the /opt/teleport.
This changes ensures we check the correct folder, and in order.
So, if /opt/teleport exists, that's the folder that will be used when
checking for required space.
* Surface user display names in web Users page and user details
* Refactor user authentication type display and update related tests
* reduce code churn
* add 16px back
* Refactor UserDisplayName component for improved layout and update related tests
* Refactor UserDetails tests to improve rendering checks and remove unnecessary assertions
* add session filter, access predicate, impersonate checks; fail fast on invalid expressions at create/update
* add list indexes to role validation error messages
* reject wildcards in search_as_roles and preview_as_roles
* validate join_sessions and require_session_join fields
* include index and tool value in mcp.tools validation error
* update commentary
* aggregate errors in ValidateRole
* aggregate errors in ValidateAccessPredicates
* validate linux_desktop_logins templates
In the fallback path when addresses are pulled from the context,
we were incorrectly setting the destination address to the source
address, which results in incorrect auditing.
Edoardo Spadolini