* Factor teleport-proxy-lib library chart out of teleport-cluster helm chart
* Remove 'FQDN' suffix from variable name and clean up comments
* Restored $proxy in config templates to minimize differences in review.
* Restored unnecessary changes to ingress template
* Fix unnecessary change in predeploy job
* used deep copy for .Values
* Explain renter-time _validation in comment
* Set domain for proxy config test
* Fixed snapshot and test differences
* Cleaned up comments
* Replace mistakenly removed asserts
* Added forceHAReplicas tests
* Fixed edge case of replicas=0, preserving previous behavior
* Eliminated intermediate version/majorVersion templates and used util lib templates directly
* Update examples/chart/lib/teleport-proxy-lib/templates/_ingress.tpl
Co-authored-by: Hugo Shaka <hugo.hervieux@goteleport.com>
* Removed unneeded alias for teleport-proxy-lib
* Corrected teleport-cluster schema bugs and removed teleport-proxy-lib validation not also done by schema
---------
Co-authored-by: Hugo Shaka <hugo.hervieux@goteleport.com>
* Update Go version to v1.26.4
* Rm GO_VERSION from Makefile/Dockerfile and rely on go.mod to inform Go version. Update code to adhere to 1.26 deprecation/changes.
Signed-off-by: Chris Thach <chris.thach@goteleport.com>
* Bump e to 54d1d0cb67b71860b943de477b3146d32ccdd74a.
Signed-off-by: Chris Thach <chris.thach@goteleport.com>
---------
Signed-off-by: Chris Thach <chris.thach@goteleport.com>
Co-authored-by: teleport-renovate[bot] <275214890+teleport-renovate[bot]@users.noreply.github.com>
Co-authored-by: Chris Thach <chris.thach@goteleport.com>
This work is not production ready yet. While this work makes the
operator support running with a scoped token, this is not enough for a
public release.
Several failure modes must be addressed, including scoped name
conflicts, and operators fighting for ownership of a resource.
In how-to guides that include a "Step" section that consists entirely of
setting up a non-Teleport product, or that does not include any
concrete, achievable goals, move the content into either a Prerequisites
item or a "Next steps" section. This way, we can focus the "Step"
sections of our how-to guides on instructions that a user (humans and,
ideally, AI agents) can complete quickly.
- **sql-server-ad.mdx, mysql-postgres-mariadb.mdx:** Move an external
system setup step to the Prerequisites.
- **digitalocean.mdx:** Move cluster creation step to the Prerequisites,
since it takes place entirely in an external system.
- **openclaw.mdx:** Move Step 1 into the Prerequisites, since it
requires making open-ended choices about an external system (it's
already there, but in a shorter form, so this is actually a
consolidation).
- **netiq.mdx, ssh-keys-scan.mdx, session-summaries.mdx:** Move final
step, which is not a step to complete but more of a general thing
that's now possible once you complete the guide, out of the "Step"
sections.
- **elastic-stack.mdx:** Move the data view discussion, which is open
ended and requires a browser, to a Next steps section.
* Add disconnect expired cert and lock mode for scoped role
Update IAC docs
* respond to code review
Add a scoped authorizer in the forwarder_test
fix up proto comments
Update forwarder.go
* fix forwarder setting nil disconnectExpiredCert
* Update validate lock to accept empty string - will be treated as best_effort down the line
add comment
* Add protos
* implement validation and matching support
* generated integrations stuff
* De Morgan, and his faithful followers, have once again defeated me in battle
* Udpate tests in lib/kube/token
* Extend join_kubernetes_test.go
* Fix missing param
* Extend validation tests
* Fix minor nits
* qF1001: CoUld aPpLY de MORgan'S LaW (stAticCHEck)
* Remove redundant database configuration references
This:
1. Adds documentation for the mysql_server_version field of proxy_service
to the general config reference and improves formatting for a couple
of fields there.
2. Removes database config/resource references that are redundant due to
being covered by auto-generated docs or the more centralized teleport
config docs.
* Update docs redirects
* Update internal links pointing to deleted pages
* Update DatabaseSpecV3.Protocol comment with allowed database protocol types
- This PR is removing the old `db` resource reference.
- The new `db` resource reference is generated from the DatabaseV3
protobuf type.
- The old `db` resource reference defined the allowed values of the
protocol field, whereas this information is not in the `DatabaseV3` type.
- docs/pages/identity-security/session-summaries.mdx links to the `db`
resource reference, using it as a source of information on which values
are allowed for the protocol field.
Therefore, we must update the DatabaseV3 protobuf type with information
on which values are allowed for the protocol field.
* docs: add reference for workload-cluster
* docs: add workload clusters guide
* fix(docs): add words to ignore
* feat(build.assets): use resource-ref-generator
* fix(docs): clarify replacing account and arn
* docs(zta/wc): add How it works and clarify child cluster
* docs(zta/wc): make feature availability callout a warning
* docs(zta/wc): move IAM callout to paragraph
* docs(zta/wc): indent snippets
* docs(zta/wc): split up Go example
* docs(zta/wc): update example ARN to use assumed-role
* docs(refs/wc): update example to use assumed-role
* fix typo
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* docs(zta/wc): fix snippet indent
* docs(zta/wc): move wc Go to examples dir
* fix(examples/wc): uppercase log messages
* refactor(examples/wc): rename to timeoutCtx
* fix(examples/wc): log os.RemoveAll error
* fix(examples/wc): use fmt.Printf instead for actual output
* refactor(examples/wc): move replaceable values to vars block
* refactor(examples/wc): use ticker instead of timer
* docs(zta/wc): reword example usage
* fix(docs/wc): update example name
* fix(docs/zta/wc): fix cd command
* docs(zta/wc): clarify address
* fix(examples/wc): add license header
* refactor(examples/wc): move wc name to a var
* fix(api/proto/wc): improve godoc for bot.name
* docs(zta/wc): use company-organization as name
* fix(examples/wc): use deffered func to delete wc
* refactor(examples/wc): use consistent import naming
* refactor(examples/wc): avoid panics
* fix(examples/wc): fix log message
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Adds Kubernetes operator support for the RetrievalModel singleton. The
controller implements Get/Create/Update/Delete backed by the summarizer
gRPC service. Because RetrievalModel is a singleton, Get and Delete
ignore the name parameter and always operate on the fixed Teleport
resource.
Introduces withSingletonName(name string) as a typed CRD schema option that
emits a CEL x-kubernetes-validations rule enforcing metadata.name == name at
admission time. This is wired up for TeleportRetrievalModelV1, which must be
a cluster singleton named "retrieval-model".
On Kubernetes < 1.25, x-kubernetes-validations is not a recognized field in
JSONSchemaProps and causes helm to fail with a validation error. The Helm
CRD template now checks .Capabilities.KubeVersion against >= 1.25.0 and
strips the field from every CRD version's openAPIV3Schema before rendering
when the cluster does not support it.
A Mutate hook enforces that the Kubernetes CR must be named
"retrieval-model" before any Teleport call is made, surfacing a clear
status condition on wrongly-named CRs.
* add scoped role assignments for k8s
Fix tests and retrieving the scoped role assignments by adding subkind
Add additional catch to treat comparefailed error as not found for scoped role assignments
* fix merge conflict
* add scoped roles to k8s operator
scoped role reorg
fix build
Update scopedrole_controller_test.go
fix tests
Remove unneded kind constant in constants.go in favor of the one in access.go
Deleted DeleteTeleportResouce
update to readnosecrets
* update deletion logic to look for not found error
Update teleport_reconciler_tests.go
Add back missing comment
* Update scopedrole_controller.go
* Remove unnecessary string matching
Implements part of RFD 246
Help new users understand what is involved in deploying a Teleport
cluster by moving the self-hosting documentation into the Installation
section. This way, we can include all information related to running
Teleport processes in the same part of the docs.
Docs related to Teleport features but not first-time deployments do not
belong in the Installation section, so this change moves them into the
Management section instead:
- Configure Trusted Clusters
- TLS Routing Migration
- Guides in `zero-trust-access/deploy-a-cluster/reliability`
Also edit the Installation landing page to make self-hosting guidance
clearer. Merge the H2 sections re: self-hosting and cluster setup and
provide a clearer experience for users, with a table of cluster
components.
* Add APIs for handling Entra ID groups overage on SAML connectors
* Restore redacted client secret on connector update
* Add test case for missing creds
* Regenerate resource docs
* Regenerate derived functions
* Overide IsEqual for SAMLConnectorSpecV2
* Update generated CRD and docs
* Update generated TF
* Remove junk from failed command
* Add API comments and update docs
* Exclude client_secret from Terraform schema
* Exclude client_secret from Terraform schema
* Update Terraform docs
* Reorder refill and validate
* Strip client secret in user path
* Add marshaler for SAMLConnectorSpecV2 type
* Add tests for stripping client secret on all paths
* Tidy up tests a bit
* Use protojson+protoadapt instead of jsonpb
* Ignore unknown fields on unmarshal
* Use Empty instead of Equal
* Add custom marshaling methods for SAML connector
* Add comment for use of nolint:depguard
* Fix core issue with marshaling oneof fields
* Refactor credentials oneof handling
* Add comments to connector methods
* Add comments for custom marshaler/unmarshaler
* Fix spelling mistakes in comments
* Refactor credentials handling so future additions don't silently fail
* Ensure consistent marshaling/unmarshaling of empty credentials
* Don't ensure non-empty client secret
* Refactor to enumerating field instead of oneof
* Add comment around validation
* Align validation on Upsert (create) with Create paths
* Defer to Fill.. methods determination of SAML connector existence
* Disable follow URLs validation
* Update proto comment to remove extra spaces from generated docs
* Mark client secret as sensitive in TF schema/docs
* Combine credentials and signing key refills
* Tidy up
* Regenerate types and docs
* Add TODO for credential availability when provider is enabled
* Update error messages for missing skp and creds
* Return connector without secrets
* Revert "Return connector without secrets"
This reverts commit 2ab4aae7d4.
* Add comment on validation callsite for empty argument
* Add godoc for connector with secrets validation
* Add godoc for error consts in secret refill
* Fix spelling in comment
* Fix spelling in error
* MWI: Support scoped join tokens in the bound keypair join method
* Bot fields for scoped tokens
* Check bot scope
* Allow bound keypair tokens to pass scope validation
* Support bots
* Fix outstanding references to ProvisionTokenV2
* Zero check on MustRegisterBefore due to proto impl differences
* Properly pass through nil must_register_before
* Also fix nil timestamps in bound keypair status
* And fix rotate_after
* Add BotInternal certificate field
* Add 'bot' TokenUsageMode value and require for bot joins
* Fix mutator execution for scoped bound keypair joining
* Implement more ScopedToken StrongValidateToken checks for bots
Adds a few more of the bot-specific RFD validation checks for bots.
* Improve bot join checks for scoped joining
* Fix build after rebase and add additional RFD checks
This fixes builds after upstream updates and implements a few more
validations required by the RFD:
- AssignedScope field for bots must be empty
- Moved original AssignedScope check to validateNonBot() since it was
checked unconditionally before.
- BotScope must be a presumably-valid scope at creation time
* Use scope-aware access checker for initial bot certs
* Fix WeakValidateToken() for scoped tokens for bots
WeakValidateToken() was not updated to match the new checks in
StrongValidateToken(); this adds minimal bot-related exemptions
around `assigned_scope` for bots to allow it to be read without
error.
* Add tests for scoped bot tokens, fix role bug
This adds a set of additional token tests for scoped bot tokens, and
fixes an issue where WeakValidateToken() was erroneously rejecting
invalid system roles.
* Properly initialize bound keypair scoped tokens on creation/upsert
We weren't applying the same initialization logic for scoped tokens
that we did for ProvisionTokenV2; this is required for registration
secrets to work properly.
* Update CRDs
* Fix failing test
* Specify types for bound keypair timestamp fields
* Update terraform resources
* Fix lint
* Include bot scope in BotJoin audit events
This includes the bot scope in audit events. It includes the user
label bot scope for successful joins where the user has been fetched,
and otherwise includes the bot scope configured on the token.
* Reject `token` join method for scoped bot tokens
Bot joining should use `bound_keypair`, so reject scoped bot tokens
that attempt to join with the traditional `token` join method.
* Fix failing test due to BotInternal cert parameter
TestRegisterBotInstance wasn't updated to include the BotInternal
flag on initial identity, so this includes it.
* Actually include Scope in bot audit events
* Mutate correct token status in `patchToken`
The mutate result was discarded because the wrong status object was
passed to `mutateScopedToken`.
* Use ScopedAuthorizer in join/Server.authenticate()
`authenticate()` currently rejects scoped identities which prevented
clients from reauthenticating with an existing identity, which is
important for bot renewal and bound keypair joining.
* Pass `BoundHostID` through properly in `GetBoundKeypairStatus()`
* Add basic TestJoinBoundKeypair_ScopedToken test
* Fix lint
* Update join server comments, add note about feature flag edge case
* Target correct provision token for standard token mutations
* Return correct mutated token in patchToken()
* Hide bound keypair registration secrets when `WithSecrets` is unset
* Avoid possible nil pointer dereference
* Address proto comment suggestion from review
* Deduplicate bound keypair mutator validation logic
Validation logic has been pulled out into a `validate()` interface
function and unified for both token types; scoped token bound keypair
fields are converted to their equivalent ProvisionTokenV2 variant
using existing helper logic.
* Nil check in consumeRecoveryMutator.validate()
* Simplify lastRotatedAtMutator
This removes the confusing switch with fallthroughs in favor of 2
simple ifs and a helper function.
* Ensure bound keypair status is non-nil before mutating
* Note non-nil requirement for new lastRotatedAt value
* Update generated operator resources
* Also nil-check status for standard tokens
* Mirror secret censoring for bound keypair secrets in tctl
This mirrors the existing secret censoring in tctl. It doesn't
actually work since the conditional can never be true.
* Use StrongValidate() on BotScope in token StrongValidate()
`validateBotToken()` was incorrectly calling `scopes.WeakValidate()`
on the bot scope. This changes it to call `scopes.StrongValidate()`
instead.
* Mark scoped token bound keypair registration_secret field as sensitive
* Make lastRotatedAtMutator's `mutateScopedToken` nil-safe
* Tag mutator validation errors with a unique name of the mutator
Errors are tagged with the primary field that mutator modifies to
help identify the failing mutator without necessarily identifying
the specific failing check.
* Address code review feedback
* Wait for ScopedRoleAssignment to become available
SRAs don't always propagate immediately, so adds a
`require.EventuallyWithT()` check to ensure it exists before
continuing.
* Add test for scoped bot joining via kubernetes
* Fix formatting
