Updates app server heartbeats to use srv.Heartbeatv2 in order to
leverage the inventory control stream instead of the legacy mechanism.
The new srv.heartbeatV2Driver implementation for app servers detects
the version of Auth and falls back appropriately if the Auth server
is too old to know about the new field added to the InventoryHeartbeat
message. The connected_resources metric should be accurate if the
auth and app service are on the same version or if the auth service
is on a more recent version. If the app service is newer than auth
and the new app server driver kicks into fall back mode then the
connected resource metric will not be updated.
Partially addresses #40917
This commit fixes three issues:
- Terraform and event-handler integratiosn were still using hardcoded
versions instead of looking up the Teleport version
- The version was not detectde properly when building access pluigin in
docker
- The event-handler Dockerfil was not importing the whole teleport
repo as context which is required since the teleport-plugins
-> teleport migration (we use the go.mod from the root)
* Add warning to previous command
* Hash out basics of new tbot proxying command use
* Avoid passing full botConfig into `tbot ssh-proxy-command`
* wip
* simplify impl
* Set up test suite for ssh config generation
* Add support for checking if ALPNConnUpgrade is required
* Cache the alpn upgrade result
* Americanize Spellings
* Update lib/tbot/config/template_ssh_client.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Add CHANGELOG.md entry for breaking change
* Update tool/tbot/proxy.go
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Update lib/tbot/tbot.go
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Switch to `--no` variants rather than `={bool}`
* Use SingleFlight on alpn proxy upgrade cache
* Improve singleflight
* Add rudimentary shell quoting
* Uniformly pad the templating
* Rename shellQuote -> proxyCommandQuote
* Fix imports
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Add a vale linter for accurate step numbering
The linter adds a `script` vale rule that ensures that H2-level headings
beginning `Step [0-9]+/[0-9]+` are numbered correctly, and that the
total number of steps shown in each heading matches the actual number of
steps.
* Apply suggestions from code review
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
---------
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Keep SIGHUP handled while there's a pidfile on disk
* Make checkServerIdentity more verbose
* Use a buffered channel that was filled
* Clarify that it's fine if the channel is full
* Use signal.Notify outside of WaitAndReload
Allow the call site to specify component that will be displayed in the welcome
flow and add some icons required to implement the new UI on the Enterprise
side.
`ListPlugins` endpoint doesn't enforce `size>0` nor it assumes the
default page size when `pageSize = 0` is passed.
This results in the agent being in a deadloop because it cannot iterate
through results.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* AWS OIDC App Access: add PublicAddr to App
This PR adds a missing field to the App created to handle the AWS App
Access when using the AWS OIDC credentials
The PublicAddr is required and was not being set.
* fix identation
* Break up /database-access/guides/
Closes#17641
Organize the guides to enrolling databases in specific cloud providers
(or self-hosted databases) into separate subsections of the "Database
Actions" section, organized by cloud provider (or self-hosted).
We can later add general information to the index page of each
subsection about how Teleport database access works for each cloud
provider. The remaining guides in the "Guides" subsection have to do
with database-agnostic functionality of the Teleport Database Service.
This change also adds a redirect for each page it moves.
* Respond to greedy52 feedback
- In the "Database Access" intro page, move the self-hosted section
first in the list of links to database-specific guides so it's less
easy to miss.
- Change "AWS" to "Amazon" in product names.
* Fix linter issues
* Remove redirects added by the DB guide reorg
This prevents us from running into Vercel route limit issues, since the
number of redirects is large.
* Update app access rfd
* Clarify
* Clarify
* Add missing cookies and mismatch token state
* Clarify
* Remove forward slash for domain already specified
* Rename auth service to auth server in mermaid
* Add AWSSAMLProviderV1 to access graph proto
* Access Graph: sync AWS SAML Providers
* Parse SAML entity descriptor before sending to TAG
* Add protos for AWS OIDC providers
* Fetch AWS OIDC providers
* Fetch signing certificates for AWS SAML providers
* Deflake identity provider fetch test
The concrete implementation of IAM mock uses a map,
resulting in non-deterministic iteration order.
Sort the results before comparing to alleviate.
* Update lib/srv/discovery/fetchers/aws-sync/iam_test.go
Co-authored-by: Jakub Nyckowski <jakub.nyckowski@goteleport.com>
---------
Co-authored-by: Jakub Nyckowski <jakub.nyckowski@goteleport.com>
On a busy cluster, Teleport can issue hundreds or even thousands
of TLS certificates in a short period of time. This can clutter
the logs and make troubleshooting difficult.
- Decrease the severity from INFO to DEBUG
- Log only the common name, not the full subject
This starts separating the lib/auth client and server code into
distinct packages to reduce the dependency tree of client tools.
For the time being aliases were left to all things moved into
lib/auth/authclient to reduce the changeset and ensure code still
compiles. Future changes will be built off this to convert code
to use lib/auth/authclient where applicable, this was intentionally
left to a minimum amount of changes to facilitate backports.
* webclient.Ping: Return err on unsuccessful response
* Log mangled response, add test case
* Point towards possible causes of errors
Co-authored-by: Krzysztof Skrzętnicki <krzysztof.skrzetnicki@goteleport.com>
---------
Co-authored-by: Krzysztof Skrzętnicki <krzysztof.skrzetnicki@goteleport.com>
The session closing in TerminalHandler.Close did not always close
established ssh sessions if the client closed the web socket
at any point between the new browser tab being opened and the session
being established. In these cases the SSH connection was leaked for
the duration of the Proxy process. To ensure sessions are always
terminated a check to see if the client closed the web socket was
added prior to writing the session metadata and after the shell
is established for the ssh session.
Yassine Bounekhla