This change adds tracking for AI-generated session summaries so we can monitor feature usage and token costs.
Two new events are introduced:
- `SessionSummaryAccessEvent` tracks when users view AI summaries and which session types and resources are accessed.
- `SessionSummaryCreateEvent` tracks when summaries are generated, including input and output token counts for cost and capacity planning.
Events are aggregated in 15-minute windows by session type (SSH, Kubernetes, database, desktop) and resource name.
User access data is added to `UserActivityReport` via a new `SessionSummariesAccessedRecord`. AI generation metrics are reported in a new `IdentitySecuritySummariesGeneratedReport`, which tracks token usage per resource.
All resource names are anonymized with HMAC-SHA-256 before submission.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Add `sub_kind` and `permission_sets` to `App` message
* Allow launching AWS IAM IC
* Add AWS domain to allowlist
* Fix makeApp helper
* Add story
* Validate path and host parts, add test
* Support US gov partition addresses
* Update proto message
* Use more realistic publicAddr in test
---------
Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>
Updates the RegisterRequest proto to support multiple Host CA certificates
by introducing a new host_ca_pems repeated field while maintaining backwards
compatibility by deprecating the existing host_ca_pem field. This enables
proper authentication during Host CA rotation and HSM scenarios where
multiple certificates may be active simultaneously.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
The scope of the certificate presented by agents to the reversetunnel
server is now tracked and stored with the remoteConn. Dial requests,
both local and via peers, are now populated with the scope the user
is logged into which the reversetunnel server uses to enforce that
dials for hosts are only honored if the target scope matches.
* Include expiration time in `LoggedInUser`
This will allow the profile watcher to detect when the user relogged.
* Display expiration time in UI
* Add `ClearStaleClusterClients` RPC
* Implement `ClearStaleClusterClients`
* Clear stale clients when profile changes
* Improve session expiration component
* Move refresh button back to top
* `ClearCachedStaleClientsForRoot` -> `ClearStaleCachedClientsForRoot`
* `unchanged` -> `stale`
* Make "closing stale clients" a subtest
* Add `clientcache` test
* Remove `getProfile` error wrapping
* Improve comment
* Convert story to controls
* Add signaling for supported tunnel types to relay tunnel
* Enable relay tunnel client for kubernetes_service
* Add kube_server to the relay cache
* Add passive forwarder for kubernetes access through the relay
* Add wildcard SNI suffix to kube service SANs if a relay is configured
* Add SNI-dispatching grpc transport for the relay transport server
* Enable kubernetes forwarding in the relay service
* Advertise support for kube tunnels in the relay
* Add tests
* Remove `ClusterRemove` RPC, make logging out idempotent
* Move calling `removeKubeConfig` and `maybeRemoveAppUpdatesManagingCluster` to main process
The main process should not depend on the renderer to clean up its own resources.
* Remove cleaning up kube dir
* Lint
* Do not read root cluster name from profile's `cluster` field
* Update docs for `name` field
* Use profile name in places that refer to workspace
* Improve comments
* `clusterName` -> `profileName`
* Get rid of `nameOrProfile`
* Add JSDoc for `captureUserLogin`
* `cluster` -> `certificate`
* proto/accessgraph: Add RPC for sending k8s audit logs to Access Graph
Add a `KubeAuditLogsStream()` rpc to the `AccessGraphService` for
streaming Kubernetes apiserver audit logs from the Teleport discovery
service to access graph. This is intended for EKS audit logs which are
made available via CloudWatch, but can accommodate other k8s services.
The audit log messages are represented as a `google.protobuf.Struct` so
as to not depend on the k8s.io .proto files, but also as k8s typically
uses protos internally only - the expectation is that we'll receive the
apiserver audit logs as json-encoded strings. This encode easily as a
`google.protobuf.Struct`.
* proto: Generate protos for accessgraph
Generate proto and grpc code for changes to accessgraph/v1alpha1:
make grpc/host
These changes add the `KubeAuditLogsStream()` rpc and associated types.
* Move PTY host service to proto/teleport/web/teleterm/ptyhost/v1
* Migrate code to use new protos and protobuf-ts client
Previously the grpc-js client was in use.
* Remove PtyEventResize from PtyServerEvent
* Remove lint ignore for pty_host_service.proto
* Add comments
* Rename proto service
* Rename messages and RPCs, ignore lint enforcing unary RPCs
* Rename exchangeEvents in code to managePtyProcess
* Adjust formatting of protos
* Renumber fields and drop reservations
* Add missing awaits, rename _write to send, remove ManagePtyProcessRequest
Adds health status indicators for Kubernetes clusters on the Resources
page. Unhealthy clusters are highlighted, and clicking them opens a side
panel displaying server information.
Changes include:
- New `KubeServer` protobuf message and `ListKubernetesServers` RPC
- Web and Connect API endpoints for fetching Kubernetes server data
- Health status filtering in `matchAndFilterKubeClusters`
- `TargetHealth` fields added to frontend/backend types
- Updated `StatusInfo.tsx` to display `kube_cluster` data
Part of #58413
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* proto: relay tunnel messages
* make grpc
* Relay tunnel server and client
* Explain tls and yamux configs
* clarify logger adapter
* clarify reserved fields
* Clarify serverConn selection logic
* add a todo to handle the control stream messages more efficiently
- Add Kubernetes label matchers to `Matcher` for `HealthCheckConfig`
- Add message `KubernetesServerStatusV3`
- Add `status` field to `KubernetesServerV3`
- Add `target_health` field to `Kube` for UI
- Regenerate Terraform schema and docs for `HealthCheckConfig`
- Add Kubernetes label matchers to Terraform test `TestImportHealthCheckConfig`
Relates to #58413
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* proto: relay tunnel grpc discovery service
* make grpc
* Tunnel discover server implementation
* Describe ALPN protocol name constant
* Fix double import
* Avoid false positive in unused linter
* explicit trace.Wrap in discover
* avoid unnecessary pointer conversions
* prioritize tunnel protocol in ALPN
* make the server credentials a separate struct
* avoid false positive in unused linter again
* access-graph: Add KMS resource protos
Add the `AWSKMSKeyV1` protobuf messages to support importing KMS key
into the access graph.
This new type is added to the `AWSResource` oneof.
The Go bindings were regenerated using `make grpc`.
* access-graph: Add AWS KMS key discovery to access graph
Implement AWS KMS keys discovery and ingest into access graph. The
fetcher discovers keys across all specified regions.
For each KMS key, the fetcher retrieves the following details:
* Key metadata, including ARN, creation date, and HSM cluster ID
* Resource tags
* Key aliases
* The key policy document
Add a mock KMS client to support comprehensive unit testing of the new
fetcher, covering various key configurations and error cases.
The new KMS key resource is integrated into the existing discovery framework,
including the merge, deduplication, and reconciliation steps.
The required IAM policy for access graph discovery is updated to include the
necessary `kms:` permissions.
Correct typo in the `GlueTableName` field name.
* Address review feedback
* Address second set of review feedback
* Regenerate go-bindings for proto
* Fix golden files with new AWS KMS actions
* Add utility function to extract major version from semver string
* Implement version resolution algorithm
* Enable reading and storing managing cluster in app state
* Enable fetching `getClusterVersions` and `getDownloadBaseUrl` from tshd
* Use the resolved auto updates status to tell the custom updater function if an update is available; emit the status in updater events
* Do not use `getDownloadBaseUrl` to resolve auto updates status
* Split `resolveAutoUpdatesStatus` into two functions
* Correctly check if fetch response is ok
* Improve comments and names
* Use `semver` package instead of implementing it by hand
* `autoUpdateState.test.ts` -> `autoUpdateStatus.test.ts`
* Add missing proto comments
* Consider all clusters when resolving version
* Add test for pre-releases
* Improve handling clusters managing updates but being unreachable or with disabled updates
* Remove redundant `clustersUri` field
* `get` -> `put`
* Improve comments and test names
* Drop `candidate` from `candidateClusters`
* Switch `shouldAutoDownload` function to switch-case
* Improve log message
* Centralize generating baseURL
* Add RPCs to get auto-update versions and base URL
* Revert `baseURL` and context
* Add missing mocks
* Lint
* Add autoupdate service, do not ignore errors
* Add "Limitations of the OSS version"
* Revert "Centralize generating baseURL"
This reverts commit a23bb34e
* Move `resolveBaseURL` function to lib/teleterm
* Get rid of `ResolveClusterURI`, add `cluster.WebProxyAddr`, read insecure flag from passed config
* Do not block goroutines with unnecessary lock
* auditlog: introduce `USER_KIND_SYSTEM` for system roles
Teleport allows that system roles perform certain actions like creating,
updating or deleting users, roles and access lists when performed by the
Okta integration or creating, updating and deleting apps, kube, dbs
when performed by the discovery service.
When https://github.com/gravitational/teleport/pull/35881 was
implemented, it only contemplated two states: bot or human. If the
identity wasn't a bot, it was automatically tagged as a human.
This behavior is fine if we only emited audit logs for actions
performed by bots or users, but that's not the case. We also emit for
certain system actions.
When reading the audit log, one can see that the audit log is marked as
user although the username has the format: `<uuid>.<teleportClusterName>`.
This PR attempts to introduce a third user kind - system - that should
identity when the action was performed by a system component. This is a
requirement so that Identity Security can distinguish user actions and
system actions.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* add unit tests
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* [vnet] feat: show SSH status in VNet slider
* rename rpc
* simplify when app and ssh zones match
* Avoid making DNS zones bold
* Fix the check for equal sets
* Add presets to VnetSliderStep story
* Fix case and punctuation
* Fix positioning of inline warning icon
* fix test
---------
Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>
* [vnet] feat: add SSH configuration diagnostic
This commit adds a VNet diagnostic that reports whether the default user
OpenSSH config file (`~/.ssh/config`) includes VNet's generated SSH
config file.
* fix lint
* fix license
* Render paths as code, use TextSelectCopy for snippet
* add code stying for path
* add ssh report to diag story
* handle ~/.ssh/config not existing
* handle unescaped windows path separators and single quotes
* fix typo in comment
* Diag report story: Include error when sshConfigAttempt is set to "error"
* read ~/.ssh/config as part of the diag instead of abusing cat
* fix lint
---------
Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>
The UI will now show the warning indicator if the health status is
either "unhealthy" or "mixed".
The status panel will now show the health statuses of all servers for
the resource.
Co-authored-by: Lisa Kim <lisa@goteleport.com>
* [iac] add github organization name to proto
This PR adds the github organization name to GithubConfigV1 proto
message.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* add github plugin type
* add secret plugin
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Register directory access when starting a desktop session
* Add RPC to attach a directory to desktop session
* Do not allow `attachDirectoryToDesktopSession` to be called from the renderer process
* Open the directory picker and send the selected path to tshd
* Intercept file system events coming from the server and handle them
* Disallow file system messages to be sent from the renderer
* Refactor dir sharing
* `AttachDirectoryToDesktopSession` -> `SetSharedDirectoryForDesktopSession`
* Improve comments
* Small fixes
* Add missing defer for `s.dirAccessMu.RUnlock()`
* `TestOpenSharedDirectory` -> `TestNewDirectoryAccess`
* Add a comment for JS file system handlers
* `make grpc`
---------
Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>
* Teleterm: define target health fields for db_servers
* Teleterm: add target health field to unified resource db resource
* Add ListDatabaseServers handler
* Enable rendering status panel on click
* Address CRs
* protos: Add protos for Identity Activity Center
Add new and extend protos for the new Identity Activity
Center feature in Access Graph. Identity centers around activities of user,
allows to easily correlate log items by identity target or type and proactively
provides alerts such as impossible travel.
* Fix according to review
Fix according to review comments.
Whenever the user clicks the save button, report whether the standard
and YAML modes were used and whether there were any YAML fields that
prevented the user from accessing the standard editor.
* Extract reusable function for establishing connections to Windows Desktop Service
* Add `ProxyWindowsDesktopSession` proto
* Implement `ProxyWindowsDesktopSession`
* Enable fetching desktops and desktop services in remote proxy cache
* Implement dialing windows desktop
* Implement client
* Support Windows desktop certs in tsh
* Fix incorrect `windowsDesktop` URI
* Add proto for `ConnectToDesktop`
* Implement `ConnectToDesktop`
* Do not log requests/responses for `ConnectToDesktop` RPC
* Add boilerplate for `DocumentDesktopSession`
* Open a desktop connection
* Relax ArrayBuffer type passed to encode methods, ignore tshd abort errors
In tshd stream, the buffer is of type `ArrayBufferLike` (which is `ArrayBuffer` & `SharedArrayBuffer`). To allow assigning it to the type in our TDP code, we make it more general.
* Ensure WASM IronRDP code is initialized only once
* Use `utils.ShuffleVisit`
* Improve stream cancellation handling
* Leave a TODO about ListWindowsDesktops
* Do not return empty data slice
* Provide non-nil src and dest addresses to `streamutils.NewConn()`
* Do not emit an empty message to indicate a successful connection
* Fix test
* Simplify code
* Add missing `WindowsDesktopTLSCredentials` initialization
* Require that the first message is only a dial request and the subsequent ones are only data
* Add explicit `stop()` check
* Hold cluster name and desktop name in a struct for the map key
* Do not return early on non-connection problem errors
* Handle io.EOF error specifically in BidiStreamingClient.Send instead of in `tlsConn.HandshakeContext`
* Extract a common function to proxy TDP connections
* Improve proto comments and connection setup
* Add comments and logs
* Lint
* Explain why there's a special handling for abort error
* Bring back the original `proxyWebsocketConn` behavior when it comes to error handling
* Post merge fixes
* Adjust proxying TDP connection to changes from master
* Lint
* Channels improvements
* Post merge fixes
* Supply command for context on hardware key prompt.
* * Include command in Teleport Connect hardware key prompts, excluding tshd commands
* Fix proxy host context passed to Teleport connect hardware key prompts
* Only use direct service for `tsh login` to avoid jumping between clients
* Add new line before command.
* Fix story.
* Address comments.
* Trim forward slash for windows.
* Change proxy_host to proxy_hostname; Update comment.
Tiago Silva