* add scoped role assignments for k8s
Fix tests and retrieving the scoped role assignments by adding subkind
Add additional catch to treat comparefailed error as not found for scoped role assignments
* fix merge conflict
* add scoped roles to k8s operator
scoped role reorg
fix build
Update scopedrole_controller_test.go
fix tests
Remove unneded kind constant in constants.go in favor of the one in access.go
Deleted DeleteTeleportResouce
update to readnosecrets
* update deletion logic to look for not found error
Update teleport_reconciler_tests.go
Add back missing comment
* Update scopedrole_controller.go
* Remove unnecessary string matching
Implements part of RFD 246
Help new users understand what is involved in deploying a Teleport
cluster by moving the self-hosting documentation into the Installation
section. This way, we can include all information related to running
Teleport processes in the same part of the docs.
Docs related to Teleport features but not first-time deployments do not
belong in the Installation section, so this change moves them into the
Management section instead:
- Configure Trusted Clusters
- TLS Routing Migration
- Guides in `zero-trust-access/deploy-a-cluster/reliability`
Also edit the Installation landing page to make self-hosting guidance
clearer. Merge the H2 sections re: self-hosting and cluster setup and
provide a clearer experience for users, with a table of cluster
components.
* Add APIs for handling Entra ID groups overage on SAML connectors
* Restore redacted client secret on connector update
* Add test case for missing creds
* Regenerate resource docs
* Regenerate derived functions
* Overide IsEqual for SAMLConnectorSpecV2
* Update generated CRD and docs
* Update generated TF
* Remove junk from failed command
* Add API comments and update docs
* Exclude client_secret from Terraform schema
* Exclude client_secret from Terraform schema
* Update Terraform docs
* Reorder refill and validate
* Strip client secret in user path
* Add marshaler for SAMLConnectorSpecV2 type
* Add tests for stripping client secret on all paths
* Tidy up tests a bit
* Use protojson+protoadapt instead of jsonpb
* Ignore unknown fields on unmarshal
* Use Empty instead of Equal
* Add custom marshaling methods for SAML connector
* Add comment for use of nolint:depguard
* Fix core issue with marshaling oneof fields
* Refactor credentials oneof handling
* Add comments to connector methods
* Add comments for custom marshaler/unmarshaler
* Fix spelling mistakes in comments
* Refactor credentials handling so future additions don't silently fail
* Ensure consistent marshaling/unmarshaling of empty credentials
* Don't ensure non-empty client secret
* Refactor to enumerating field instead of oneof
* Add comment around validation
* Align validation on Upsert (create) with Create paths
* Defer to Fill.. methods determination of SAML connector existence
* Disable follow URLs validation
* Update proto comment to remove extra spaces from generated docs
* Mark client secret as sensitive in TF schema/docs
* Combine credentials and signing key refills
* Tidy up
* Regenerate types and docs
* Add TODO for credential availability when provider is enabled
* Update error messages for missing skp and creds
* Return connector without secrets
* Revert "Return connector without secrets"
This reverts commit 2ab4aae7d4.
* Add comment on validation callsite for empty argument
* Add godoc for connector with secrets validation
* Add godoc for error consts in secret refill
* Fix spelling in comment
* Fix spelling in error
* MWI: Support scoped join tokens in the bound keypair join method
* Bot fields for scoped tokens
* Check bot scope
* Allow bound keypair tokens to pass scope validation
* Support bots
* Fix outstanding references to ProvisionTokenV2
* Zero check on MustRegisterBefore due to proto impl differences
* Properly pass through nil must_register_before
* Also fix nil timestamps in bound keypair status
* And fix rotate_after
* Add BotInternal certificate field
* Add 'bot' TokenUsageMode value and require for bot joins
* Fix mutator execution for scoped bound keypair joining
* Implement more ScopedToken StrongValidateToken checks for bots
Adds a few more of the bot-specific RFD validation checks for bots.
* Improve bot join checks for scoped joining
* Fix build after rebase and add additional RFD checks
This fixes builds after upstream updates and implements a few more
validations required by the RFD:
- AssignedScope field for bots must be empty
- Moved original AssignedScope check to validateNonBot() since it was
checked unconditionally before.
- BotScope must be a presumably-valid scope at creation time
* Use scope-aware access checker for initial bot certs
* Fix WeakValidateToken() for scoped tokens for bots
WeakValidateToken() was not updated to match the new checks in
StrongValidateToken(); this adds minimal bot-related exemptions
around `assigned_scope` for bots to allow it to be read without
error.
* Add tests for scoped bot tokens, fix role bug
This adds a set of additional token tests for scoped bot tokens, and
fixes an issue where WeakValidateToken() was erroneously rejecting
invalid system roles.
* Properly initialize bound keypair scoped tokens on creation/upsert
We weren't applying the same initialization logic for scoped tokens
that we did for ProvisionTokenV2; this is required for registration
secrets to work properly.
* Update CRDs
* Fix failing test
* Specify types for bound keypair timestamp fields
* Update terraform resources
* Fix lint
* Include bot scope in BotJoin audit events
This includes the bot scope in audit events. It includes the user
label bot scope for successful joins where the user has been fetched,
and otherwise includes the bot scope configured on the token.
* Reject `token` join method for scoped bot tokens
Bot joining should use `bound_keypair`, so reject scoped bot tokens
that attempt to join with the traditional `token` join method.
* Fix failing test due to BotInternal cert parameter
TestRegisterBotInstance wasn't updated to include the BotInternal
flag on initial identity, so this includes it.
* Actually include Scope in bot audit events
* Mutate correct token status in `patchToken`
The mutate result was discarded because the wrong status object was
passed to `mutateScopedToken`.
* Use ScopedAuthorizer in join/Server.authenticate()
`authenticate()` currently rejects scoped identities which prevented
clients from reauthenticating with an existing identity, which is
important for bot renewal and bound keypair joining.
* Pass `BoundHostID` through properly in `GetBoundKeypairStatus()`
* Add basic TestJoinBoundKeypair_ScopedToken test
* Fix lint
* Update join server comments, add note about feature flag edge case
* Target correct provision token for standard token mutations
* Return correct mutated token in patchToken()
* Hide bound keypair registration secrets when `WithSecrets` is unset
* Avoid possible nil pointer dereference
* Address proto comment suggestion from review
* Deduplicate bound keypair mutator validation logic
Validation logic has been pulled out into a `validate()` interface
function and unified for both token types; scoped token bound keypair
fields are converted to their equivalent ProvisionTokenV2 variant
using existing helper logic.
* Nil check in consumeRecoveryMutator.validate()
* Simplify lastRotatedAtMutator
This removes the confusing switch with fallthroughs in favor of 2
simple ifs and a helper function.
* Ensure bound keypair status is non-nil before mutating
* Note non-nil requirement for new lastRotatedAt value
* Update generated operator resources
* Also nil-check status for standard tokens
* Mirror secret censoring for bound keypair secrets in tctl
This mirrors the existing secret censoring in tctl. It doesn't
actually work since the conditional can never be true.
* Use StrongValidate() on BotScope in token StrongValidate()
`validateBotToken()` was incorrectly calling `scopes.WeakValidate()`
on the bot scope. This changes it to call `scopes.StrongValidate()`
instead.
* Mark scoped token bound keypair registration_secret field as sensitive
* Make lastRotatedAtMutator's `mutateScopedToken` nil-safe
* Tag mutator validation errors with a unique name of the mutator
Errors are tagged with the primary field that mutator modifies to
help identify the failing mutator without necessarily identifying
the specific failing check.
* Address code review feedback
* Wait for ScopedRoleAssignment to become available
SRAs don't always propagate immediately, so adds a
`require.EventuallyWithT()` check to ensure it exists before
continuing.
* Add test for scoped bot joining via kubernetes
* Fix formatting
* Add SAML IdP Service Provider support to k8s operator
changelog:
- Add SAML IdP Service Provider support to k8s operator
See integrations/operator/CONTRIBUTING.md for operator resource pattern.
* Fixed typo in comment and unnecessary log message change
* Added V1 to SAML IdP Servicce Provider k8s kind
* chore: Bump otel packages to v1.40.0
* Bump otel contrib packages
* Tidy modules
* Bump otel in examples
* fix: Use a local copy of otelhttp.DefaultClient
* Move otelhttp to lib/observability/
Each go tool will now reside in a isolated dir under
`build.assets/tools`, this allows us to isolate the
deps of each tool from both main module without
merging them for tools. This should make reviewing
tools and dep changes easier at a glance and remove
noise from main module dep manifest.
Each tool is a Makefile var to allow easy overrides
over a macro which cannot be temporarily unset/overriden.
The tools have been added to common.mk for easy reuse
across OSS and e.
williamong-tel