Add the resource to the generator config and run the generator.
A bug in the generator causes it to split `ElastiCache` despite the
string being in the list of permitted camel-case exceptions. This change
fixes by bug by checking each word in an H2 section against the
exception list before potentially splitting it.
Also fix minor style/grammar and product naming issues in protobuf
messages related to the db_server resource reference.
* Generate an App V3 resource reference page
This change alters the configuration of the resource reference generator
to generate a page for the App V3 resource, and includes the new page.
* Correct spelling and grammar in proto comments
This PR adds a new field in the provision token, so that users can
define an integration whose credentials will be used to retreive the
organization id for a given account.
This will allow the Auth Server to call the AWS API
organizations:DescribeAccount using the integration credentials.
Previously, only self-hosted clusters could allow iam joins by
organization (by providing ambient credentials to the Auth Server)
* Add support for standard TLS secret key names for Event Handler helm chart
* Add support for Teleport Cluster helm chart
* Add support for Teleport Operator and Kube Agent; update comments for Teleport Cluster
* Re-render/update docs
* Minor fix for Teleport Cluster chart docs
* Remove redundant default in templates
* Add newline
* Add required and error msgs; standardize teleport-relay chart
* Re-render docs
This consolidates all references to BoringCrypto and FIPS-140-2 to
a single section of the docs, using more generic FIPS terminology
elsewhere. As a result, we only need to change one place when we
update our FIPS module in the future.
In addition, mention the specific versions of BoringCrypto and
associated CMVP certificate numbers.
Make it easier for readers to navigate this section by reducing noise in
the sidebar. This change modifies sidebar labels to reduce length,
remove repeated words, and add a more logical order.
This change also reorganizes some sections of the sidebar in order to
improve clarity and reduce the number of items in a given section:
- Move guides to enrolling specific databases to
`enroll-resources/database-access/enrollment`, and shorten individual
guide slugs since we don't need to include the substring `enroll-`.
- Move the Kubernetes application discovery reference to the Kubernetes
application discovery section. The reference is specific to Kubernetes
application discovery, and makes more sense in the Kubernetes
application discovery subsection.
- Remove the Server Access introduction page, since it is redundant with
the landing page.
- Replace the "Applications" section "Guides" with a "Configuration
Guides" section, which is more thematically specific.
- Move the Ansible guide from "Servers" to "User Guides". This doesn't
require tctl, and is for end-users who want to set up an Ansible
playbook using Teleport credentials. Rephrase a Troubleshooting item
that mentions `tctl` to indicate taht admins must complete the task.
* wip
* cleanup
* fix comment
* fix main
* fix chart
* add test
* missing test
* build with entitlements
* add configmap to role
* avoid oversharing configmaps
* linting
* fix cache init issue
* adjust role
* change default group
* fix test
* Apply suggestion from @hugoShaka
Co-authored-by: Hugo Shaka <hugo.hervieux@goteleport.com>
* update values.yaml
* lint
* remove warning for kube
* improve ID configmap management
* fix bug
* add negative test
* info log
* set spec if different
---------
Co-authored-by: Hugo Shaka <hugo.hervieux@goteleport.com>
Config check hooks don't run a full Teleport, they are only validate
that the config file is valid. Applying resoucre requests is not useful
and can block the rollout in smaller clusters.
Changelog: Prevented stuck `teleport-cluster` Helm chart rollouts in smaller clusters. Removed resource requests from configuration check hooks.
This commit updates the enroll Applications docs homepage with the new design. The introduction.mdx page is also being deleted because it's largely a page of links, the diagram is overly complicated, and the new page covers all the features and links. A redirect is added in config as well as files using that link.
* Support templating labels in tbot's `kubernetes/argo-cd` output
This PR makes it possible to copy the Kubernetes Cluster resource labels into
the created Argo CD cluster secrets, by making the `secret_labels` map values
templates and adding the `{{.Labels}}` variable.
If the label value template evaluates to an empty string, the label will not be
added to the secret.
Example tbot configuration:
services:
- type: kubernetes/argo-cd
cluster_selectors:
- labels:
department: engineering
secret_labels:
cloud: |-
{{index .Labels "cloud"}}
region: |-
{{index .Labels "region"}}
Example Helm values:
argocd:
enabled: true
clusterSelectors:
- labels:
department: engineering
secretLabels:
cloud: |-
{{index .Labels "cloud"}}
region: |-
{{index .Labels "region"}}
Closes#61347
* Fix wrong template package being used
* Make it clear that tbot is rendering the template, not Helm
* Added support for `role.spec.allow.request.reason.prompt` to specify custom reason prompts for requestable `roles`/`search_as_roles`
* Update terraform schema & docs
* Updated role-spec docs to include support for and updated UI for prompt displays
* Fix lint
* Update reference docs
* Include prompt output for tctl, update reference docs, and fix UI
* Update docs
* Fix e ref
* proto / docs: Update proto comments to match modified docs
Update `autoupdate.proto` doc comments to match changes manually made to
the docs. The docs are auto-generated from the proto comments, so those
manual changes are being reverted when running the autogen tools, and
the lint job checking this is failing.
Also update the lint job to update the changed paths for the docs - this
would have prevented the manual change to the docs from being merged in
the first place, but the paths were out of date.
Update generated files running:
make grpc/host
make -C integrations/operator crd
make -C integratios/terraform docs
* re-apply changes
---------
Co-authored-by: Marco Dinis <marco.dinis@goteleport.com>
* [examples] verify Teleport JWT in MCP servers by fastmcp and mcp-go
* readme minor fixes
* address review comments
* add some context to the get_json errors
* add a README to mcp-servers dir
* use httpx and revert .gitignore
* Add Env0 method
This adds a new `env0` join method to support joining from env0
workflows, and especially the embedded tbot in the Terraform provider
when running on env0.
This is the first OIDC join method on the new join service, and will
not support legacy joining. As such, it won't be backported beyond
v18.
Closes#53798
changelog: Add new `env0` join method to support joining within Env0 workflows
* Fix imports
* Fix failing test
* Add env0 token source
* Fix missing env0 join method in tbot
* Fix env0 validation
This fixes some issues in env0 token validation:
- azp check is disabled since it's set to a random (ish) value
- Use correct audience URL (their docs specified the wrong value)
* Fix incorrect date in new file copyright header
* Fix generated tfschema
* Fix failing test after adding the token source
* First round of code review
* Add example token claims in comment
* Move common OIDC handling logic into a separate handler
Specific validation logic is now separate and the validator is passed
as an argument to a generic `handleOIDCJoin()` handler.
* Fix imports
* Rename joinclient/join_env0.go to join_oidc.go
Erik Tate