* add Redshift Serverless e2e tests
* update license year in new files
* use a test cleanup func to close local proxy
* adjust test timeouts
* use a longer conn retry interval
* Lint Terraform and Event-Handler
* lint terraform
* add Makefile lint targets for TF and event-handler
* address feedback
* Update integrations/event-handler/Makefile
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Vendor event-forwarder plugin
* fix tests + add Makefile + CI
* lint
* Fix broken test
* use a separate go.mod
* ignore event-handler in flaky tests + update go.mod
* go mod tidy
* add AWS RDS MariaDB e2e tests
* fix spurious teardown error logs
* if a role or user doesn't exist, that is not an error nor is it worth
logging during auto user teardown.
* check for admin option
* add some extra secret fetching checkings
* only drop redshift user if the user exists
* Refactors rust lint out into its own job which runs on a bare GH runner
Also adds -s to silence all make commands in workflows which are used as
some form of output in the workflow script. This is to prevent the
workflow from failing due to noise from the make command (such as when
make tells you it's entering a directory, etc).
Also updates to latest e-ref
* Removes `--no-print-directory` where `make` output is used as a variable
replaceing it with `-s` instead. `-s` is a universal POSIX standard and
makes sense in all such cases.
https://www.gnu.org/software/automake/manual/html_node/Tricks-For-Silencing-Make.html
* aligning e with master
* aligning e with master
* aligning e with master
* update AWS RDS db e2e tests
* update GHA workflow env vars to be RDS specific
* add auto db user provisioning tests
* provision any db users needed in test code as setup, instead of
relying on the cloud-terraform repo provisioning them
* fix data race
* rename myDBName to mysqlDBName
* fix flakiness on first run
* remove db_users for auto user roles
* test role assignments in postgres
* reuse rand string util
* test role assignments in mysql
* rearrange subtests to clearly outline dependencies
* verify AWS CA when provisioning
* fix imports
* Updates RUST_VERSION and IronRDP rev to latest, adds RUST_MIN_STACK to fix ARM builds
* Adds asn1-rs, asn1-rs-derive, asn1-rs-impl, and der-parser to the allow-dependencies-licenses. This is required because their crates do not currently have valid SPDX licenses, see https://github.com/gravitational/teleport/actions/runs/8453649354/job/23156810330?pr=39895
* Update Node.js to 20.11.1
* Update Electron to 29.1.1
* Update node-pty to 1.1.0-beta12
* Remove commands for building native deps manually
* Remove file skipping in electron-builder that seems to do nothing
* Regenerate `devbox.lock` using the same Devbox version as the CI (0.9.0)
* Update `devbox` to `0.9.1`
* Update `README.md`
* Update electron to 29.1.4
* Update devbox checksum
* Remove mention of Node.js version in teleterm/README.md
* Fix X11 forwarding with OpenSSH option control master when connecting through the Proxy ssh forwarding service.
* Add X11Forwarding integration test with ControlMaster subtest.
* Refactor forwarding server to always forward x11 channel requests.
* Address comments.
* Fix x11 forwarding integration tests.
* Add reconciler support for custom equals functions functions.
The `cmp` functions are not performant. The reconciler will now support an
IsEqual function if it is defined, and will use it if a resource has one.
Additionally, one has been added for Okta assignments and dependent objects.
* Use goderive instead of hand rolling this, move things into CompareResources.
* Correct error comment in make derive-up-to-date.
* GCI.
* Equivalence against the interface instead of the object directly.
* Apply suggestions from code review
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Do not specify the docker builder via `--builder` when using `docker
buildx`, as the method of determine the builder name is flawed and is
having local developer impact. The original reason for adding it was to
fix the CI build of the FIPS buildbox as building the FIPS buildbox
requires using the local docker image cache which is only available with
the `docker` builder.
Instead unify the centos7 and centos7-fips Dockerfiles and use
`--target` to select which bit to build up to for the `buildbox-centos7`
and `buildbox-centos7-fips` targets. As as multi-stage build, the
`docker-container` driver now does see the base buildbox and builds a
correct buildbox when not pushing to the registry (as occurs at the
start of tag builds). This is the recommended method in the Docker
documentation, with a more complex alternative being "bake files". They
are more appropriate when the separate image builds are rather separate.
In our case, the two are closely related and work well with the simpler
multi-stage build approach.
This approach should work for any of the docker builders used and allows
developers to select whichever builder works for them, while on CI we
will continue to use the `docker` default builder.
Remove the `PULL_ON_CI` logic as that is not needed because of the use
of `--cache-from` and `-cache-to` used for all buildboxes.
Use a `make` trick in `build.assets/arch.mk` to only run `go env GOARCH`
once max, or not at all if not needed, and use `GOTOOLCHAIN=local` so we
don't update the go toolchain unnecessarily. The GitHub Actions runner
has an older version of Go than we specify in our `go.mod` so every time
`make` ran on a fresh runner, it would download go1.22.0 even though it
was not needed.
- **Don't run vale linters on the changelog:** The changelog has
different requirements than other docs pages. For example, we can
publish releases after changing product language, meaning that
language that applied at one release doesn't apply at another release.
This causes friction when, say, using the vale linter to check product
language.
- **Restrict the vale linter to changed lines, not whole files:** This
makes following vale style rules less onerous for docs authors.
* Add linters for consistent docs product language
Closes#19214
Maintaining a consistent language for talking about Teleport products is
important for ensuring clarity in the documentation. This change adds
rules to our Vale linting config for docs to help maintain a consistent
product language:
- **Teleport account URL examples:** Require `example.teleport.sh`
unless the text is mentioning the status page.
- **Service names:** Require these to be capitalized.
- **Enforce consistency in other areas where we often get
discrepancies:** e.g., "Auth Service instances" instead of "auth
servers".
This change also renames the `messaging` style rule to
`consistent-terms` so we don't have a `messaging.messaging` rule.
Note that these linters overlap with similar ones that we run from the
`gravitational/docs` repo. The plan is to remove the latter once we
merge the linters here.
* Respond to zmb3 feedback
* Use buildx's `docker` driver for buildbox-oriented GHA jobs
setup-buildx-action uses the docker-container buildx driver by default,
which is useful for advanced buildx features like customizing buildkit,
doing multi-arch builds, and advanced cache import/export (particularly
as it pertains to multi-arch builds).
However, we're not using these features in our buildbox-oriented GHA
jobs, and in fact the `docker-container` driver is not well suited for
our `buildbox-centos7-fips` Make target, which relies on "old school"
(`docker` driver) behavior that expects to find an updated version of
the image built by `buildbox-centos7` (`Dockerfile-centos7`) to pass as
the FROM argument to the `buildbox-centos7-fips`.
(`Dockerfile-centos7-fips`). Since the `docker-container` driver runs
each build in a separate container, the `buildbox-centos7-fips` build
can't see the updated image built by `buildbox-centos7`, and so resorts
to the stale image in the remote docker repository.
We could restructure our docker buildx commands to work around this, but
that would result in a much more complicated, distributed build process
that would potentially increase cloud spend, for marginal benefit to the
status quo at best. Instead we can just use the `docker` driver for our
buildbox-oriented GHA to keep things simple, and only update to the
`docker-container` driver when we need to use its advanced features.
Refs:
- https://github.com/docker/setup-buildx-action
- https://docs.docker.com/build/drivers/
* Adds `BUILDKIT_INLINE_CACHE=1` to `buildx build` commands that use `--cache-from`.
The `--cache-from` flag is used to specify a cache source. This "cache" is
a special buildx cache that improves on the traditional docker layer-based cache.
While there are advanced options for exporting/importing this advanced cache separately
from the image (layer-based cache), the simplest way to make use of it is to just
embed the advanced cache inline in the image itself. This is what this BUILDKIT_INLINE_CACHE=1
does.
* Release v16.0.0-dev.isaiah.18
* swaps --build-arg BUILDKIT_INLINE_CACHE=1 for --cache-to type=inline
* adds DOCKER_BUILDER_NAME
* Revert "Release v16.0.0-dev.isaiah.18"
This reverts commit 6107dae6d8.
* simplify DOCKER_BUILDER_NAME
* clarify comment wording
* updating e-ref to latest
* chore: Bump golangci-lint to v1.56.0
* Use only enable linters for testifylint
* Fix various testifylint offenders
* Fix testifylint offenders in api/
This workflow is already narrowly scoped to only the relevant files. We
*want* to check that dependabot doesn't break anything if it updates these
files.
This commit temporarily disables the AWS Database E2E tests because the
infrastructure isn't available at the moment.
This will unblock any merges to [`master`, `branch/v15`, `branch/v14`]
since this is a required step.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Gavin Frazar