* build: Select stage/prod env based on $(VERSION)
Select the appropriate `stage` or `prod` GitHub Actions environment when
running `tag-build` or `tag-publish` based on `$(VERSION)`. If a version
string has no pre-release suffix, or it has `-cloud.`, `-alpha.`,
`-beta.` or `-rc.` then it is considered a prod release and will be
built/published in the `build-prod`/`publish-prod` environment. Other
pre-release tags will be built/published in the
`build-stage`/`publish-stage` environment.
This can be overridden by specifying the environment name when building
or publishing:
make ENVIRONMENT=build-prod tag-build
make ENVIRONMENT=publish-prod tag-publish
* Update tag-(build|publish) targets to send alpha/beta/rc to staging
* bumped e ref
---------
Co-authored-by: Fred Heinecke <fred.heinecke@goteleport.com>
Co-authored-by: fheinecke <23390735+fheinecke@users.noreply.github.com>
* Remove goinstall make target
This target hasn't been updated in 7+ years and installs a version
of Teleport that won't actually run due to missing build tags.
* Use 'go run' to invoke addlicense
The go tool is smart enough not to download and build the tool if
the correct version is available, and this eliminates the need for
us to ask what the GOPATH is.
* Misc Makefile cleanup
Several new targets were added in the middle of sections that should
not have been broken up.
* Remove outdated comment
make all _does_ include webassets
* Remove old reference to GIT variable
Extends a few windows targets to build and sign tctl now that we
officially support it on windows. Release builds do NOT use the
Makefile and instead use buid.assets/windows/build.ps1 so this
should have no impact outside of building a release locally.
* Lint Terraform and Event-Handler
* lint terraform
* add Makefile lint targets for TF and event-handler
* address feedback
* Update integrations/event-handler/Makefile
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
This PR adds a special group (last one) to match the `terraform` and
`event-handler` integrations.
These two integrations aren't imported by teleport codebase but they
import teleport packages. The issue arrises from the fact that they have
their own module namespace. In order to distinguish their module
namespace, this PR proposes moving them into a new (last) import group
and keep Teleport into a separate group. Unfortunately, at the time of
writing `gci` doesn't support skip directories which causes problems for
our `lint` CI step as it will fail.
This results in the following structure for files within the two
integrations:
- standard
- default
- teleport
- specific integration
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Vendor event-forwarder plugin
* fix tests + add Makefile + CI
* lint
* Fix broken test
* use a separate go.mod
* ignore event-handler in flaky tests + update go.mod
* go mod tidy
* build: Sign mac artifacts using key name not hash
Tidy up the mac signing makefile magic to sign using the key name and
not the key hash. Since we look up the key has by the name, there's no
benefit to using the hash as all the signing commands will take the key
name as well. This removes a bunch of fragility around exporting
variables, make errors and running the key lookup commands only on a mac
that it leaves it quite a bit simpler.
The `CSC_NAME` variable used by electron-builder to build Teleport
Connect does not want the full key name - it wants the purpose part
stripped off the front (`Developer ID Application:`), so we do that. The
other signing commands take the full key name.
This also simplifies the `NOTARIZE_BINARIES` set of commands, allowing
them to be broken up removing the `&&` conjunction. This makes it clear
exactly what command fails if there is a failure as make runs them
one-by-one instead of all at once. It also allows the Makefile in
teleport.e a little simpler as it no longer needs to run the
notarization from the parent directory.
* build: Update darwin-signing for new GitHub Actions environment names
Update `darwin-signing.mk` to accept `build-prod` and `build-stage` as
environment names, leaving `promote` and `build` as deprecated, soon to
be removed. For this, `CLEAN_ENV_NAME` is introduced and signing
variables are defined in terms of that, where hyphens in the
`ENVIRONMENT_NAME` are replaced by underscores. This keeps the make
variables names as valid environment variable names.
Add a `print-darwin-signing-vars` target to print out the signing
variables in use for debugging purposes.
* Update e ref for darwin-signing changes to e/Makefile
This PR generates the stubs for `DiscoveryConfig.Equal` function based
on goderive code generation.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Refactors rust lint out into its own job which runs on a bare GH runner
Also adds -s to silence all make commands in workflows which are used as
some form of output in the workflow script. This is to prevent the
workflow from failing due to noise from the make command (such as when
make tells you it's entering a directory, etc).
Also updates to latest e-ref
* Removes `--no-print-directory` where `make` output is used as a variable
replaceing it with `-s` instead. `-s` is a universal POSIX standard and
makes sense in all such cases.
https://www.gnu.org/software/automake/manual/html_node/Tricks-For-Silencing-Make.html
* aligning e with master
* aligning e with master
* aligning e with master
Update the `tag-build` and `tag-publish` recipes to call the tag-build
and tag-publish workflows with the `cloud-only` parameter set to `true`
if the `VERSION` variable contains `-cloud.` or `-dev.cloud.`, or if
`CLOUD_ONLY` is set on the `make` command line.
The cloud-only parameter builds the Linux tarballs and OS packages
and the distroless OCI images. This allows for a faster release build
for cloud-only releases which does not need any of the other release
artifacts. As a pre-release version, it will ultimately be superseded by
a regular release that does contain all the release artifacts.
Add a new `changelog.sh` script that has a couple of nice features over
the old one:
* Can run from the base release branch without args and it generates a
changelog since the last release. The base branch and tag are still
overrideable though if you need to
* Handles multiple changelog entries on one PR which can occasionally
happen.
* Cleans up the changelog entries a little (trailing period, cleans
whitespace).
* Marks entries that did not have a changelog where the PR title was
used. These need to be checked and likely re-written.
* Extracts enterprise changelogs.
The primary use case is to be able to run and re-run it easily as you
tweak the changelog entries on the PRs so you get a final generation run
that needs no changes to the changelog itself. It is also easy to update
the changelog if new PRs have been merged into the base branch before
the release PR was able to be merged.
* Add fake yubikey private key implementation for tests.
* Add TestHardwareKeyLogin.
* Simplify Hardware Key support test plan.
* Enable piv test package in tests.
* Add TestMarshalAndParsePrivateKey.
* Address simple comments.
* Remove *testing.T from mockSSOLogin in; Add and use better helper methods for mocking sso login.
* Refactor test to dynamically set mock attestation data; revert related changes.
* Add reconciler support for custom equals functions functions.
The `cmp` functions are not performant. The reconciler will now support an
IsEqual function if it is defined, and will use it if a resource has one.
Additionally, one has been added for Okta assignments and dependent objects.
* Use goderive instead of hand rolling this, move things into CompareResources.
* Correct error comment in make derive-up-to-date.
* GCI.
* Equivalence against the interface instead of the object directly.
* Apply suggestions from code review
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Remove `.drone.yml` and `dronegen` which generates it from the repo,
disabling drone on master. Remove references to drone in docs.
The remaining piplines in `.drone.yml` were the tag build and promote
pipelines which now run on GitHub Actions, the push build pipelines that
are currently of limited value and will be re-done differently with a
little thought, and the `teleport-docker-cron-ecr` pipeline which no
longer works as of v15 due to the removal of the legacy OCI images (the
teleport-labs stuff that the pipeline builds is to be removed shortly
too).
Add a `tag-build` recipe to the Makefile to kick off a tag build on
GitHub Actions. Currently we cannot trigger the tag build in GitHub
Actions as the teleport repository is public so we are very careful with
credentials in it, and credentials are needed to run the `tag-build`
workflow in the `teleport.e` repository.
The new process for building a tag is to run `make update-tag` as usual,
but to then follow that with `make tag-build` to start the build.
Add a `tag-publish` recipe to the Makefile to start a workflow run of
the tag-publish workflow. The tag published is the current version tag
as defined by `$(VERSION)` in the Makefile. The version of the
`tag-publish` workflow used is that one tagged with `v$(VERSION)`.
* build: Generate centos7 archive when building linux-amd64
When building a linux-amd64 archive, make a copy of it with the
`centos7` tag as the linux-amd64 build works on centos7. We stopped
doing a centos7-specific build a while ago, but we still have the
archive on our releases page.
This helps unify the `release-amd64` and `release-amd64-centos7`
targets, which currently do the same thing except for the GitHub Actions
workflow that creates the centos7 archive only for the latter target.
This will allow us to get rid of that target as that latter target will
no longer be called when Drone is removed.
Also add a `-p` when making RELEASE_DIR as sometimes the parent
directory has not yet been created.
* Update `e` ref for enterprise Makefile changes
* chore: Use golangci-lint version from versions.mk
* gravitational/teleport.e#3488
* Fix Access Monitoring prebuild query
* gravitational/teleport.e#3482
* ci: Switch tag build workflows to artifact@v4 GHA action
* gravitational/teleport.e#3510
* ci: Fix RPM build with release-amd64{,-fips} targets
* gravitational/teleport.e#3500
In CI we run parallel make, and as a result the linker sometimes
tries to link librdp_client.a before the Rust build has completed.
We could fix this, but our unit tests for Rust and Go are separate
and there are no Go tests that require the Rust library to be present,
so for now we remove the Rust build as a prerequisite.
This should fix the random test failures and also improve the speed
of all test runs.
* Add wasm32-unknown-unknown target to docker images
wasm-pack will do this at build time if the target is not available,
but by baking it into the image we avoid having to do it during each
build.
* Update wasm-bindgen to 0.2.91
And make sure that we always install the version from the lockfile,
which prevents wasm-pack from failing with --mode=no-install.
The arm build for Teleport Enterprise has started failing due to its
size, resulting in the following error during the build:
/opt/go/pkg/tool/linux_amd64/link: running arm-linux-gnueabihf-gcc failed: exit status 1
/usr/lib/gcc-cross/arm-linux-gnueabihf/10/../../../../arm-linux-gnueabihf/bin/ld: BFD (GNU Binutils for Debian) 2.35.2 assertion fail ../../bfd/elf32-arm.c:9876
[...]
Adding the `--long-plt` option to the linker allows the build to work
again.
Link: https://sourceware.org/legacy-ml/binutils/2014-02/msg00053.html
* Remove restricted sessions
* Remove missing reference to restricted session
* Update CHANGELOG.md to remove outdated SSH feature
The commit removes the reference to the deprecated and removed SSH restricted sessions feature from the CHANGELOG.md file. The restricted session feature had been phased out since Teleport 14, and this update reflects its removal in Teleport 15.
* Rephrase the changelog note that it's recommends the implementation of network restrictions outside of Teleport like iptables and security groups.
Update master as the now-source of v16 when it gets cut:
* Update `VERSION` in `Makefile` to 16.0.0-dev
* Update `BUILDBOX_VERSION` in `build.assets/Makefile` to `teleport16`
* Update a couple of mentions of v13 in `README.md` to v16
* Run `make update-version`
* Run `make dronegen`
Some workflows are to be updated once v15.0.0 is actually released.
* adds ironrdp client and has it connect, alongside rdp-rs
* Integrates IronRDP client into the TDP png-response system. Instead of sending back chunks of the screen, its sends the full screen every time, and this is my running hypothesis for the current sticking point: a "Maximum call stack size exceeded" from the tdp client in the react app
* Changes arrayBufferToBase64 to use reduce, which fixes the "Maximum call stack size exceeded" bug
* removes convert_bgra_to_rgba which isn't needed with the bitmaps being produced by IronRDP
* Adds support for updating only a specific image region
* removes mistaken read_rdp_output_inner call from connect_rdp_inner
* Adds support for mouse input. I believe this code has race conditions for client.write_frame though this requires more research.
* Patches things up with the new IronRDP structure
Requires some modifications to IronRDP, see the corresponding commit hash
for IronRDP in lib/srv/desktop/rdp/rdpclient/Cargo.toml.
Started getting call stack overflows when manual testing again, but I'm
going to ignore those for now and focus on the version of this architecture
that passes the remoteFX encoded messages over TDP.
* Adds RemoteFX Frame to the backend
* Proof of concept for integrating a wasm module into the frontend
Building the wasm module still needs to be done manually, this was
just to get to a point where tools are configured and it can be successfully
called in both dev and prod modes.
Required that I comment out "default-src 'self'" in the CSP, this will
need to be figured out later.
We're also using a package called vite-plugin-wasm-pack whereas ironrdp
uses vite-plugin-wasm. I'm not sure why, I'm going to look into this and
swap out to vite-plugin-wasm if possible.
* Swaps out vite-plugin-wasm-pack for vite-plugin-wasm and adds build-wasm script to the teleport package.json.
vite-plugin-wasm-pack looks relatively unmaintained in comparison
to vite-plugin-wasm-pack.
build-wasm script is needed to build the wasm binary before calling vite [build]
* Adds backend structure for RPC PoC
Untested as of yet and it isn't pretty, but this more or less imitates the
RPC approach we have for directory sharing.
* hack solution which calls everything 'static. THIS IS VERY UNSAFE, WE SHOULD DO SOMETHING ELSE
* Gets the full display working end to end
with a particular commit of IronRDP. Unfortunately this commit is now
well out of date, and IronRDP had some bugs that were preventing RemoteFX
frames from being sent back.
* Full display working end to end with the updated IronRDP
* updates init_wasm_log to enable logging in the console
* updates hardcoded io_channel_id and user_channel_id
* Uses specific IronRDP sub-crates (i.e. ironrdp-session, ironrdp-tokio, etc.) rather than relying on whatever is re-exported from the ironrdp sub-crate itself
* Gets FastPathFrameResponse up to speed and the PoC is now working
* deletes all the rpc stuff which it turns out we don't need
* more cleanup including consolidating the FastPathFrame message between wasm and js, adding some comments
* Updates the documentation string for top level Client in lib.rs
* Removes hardcoded rdp server address, screen size, and username
* Swaps to online IronRDP repo
* Updates the TDP RFD with new messages
renaming them to be precise.
* remove hardcoded ip
* creates asRustBackedSlice
* removing some old todos
* Add cleanup for wasm-pack build artifacts to make clean
* Fix wasm in production builds (#27428)
* Converts the default Content-Security-Policy representation to a map
which makes it easier to programmatically add-to/overwrite the defaults
for special cases.
Also adds tests for the various custom CSPs.
* Alphabetize CSP directives for ease of testing/debugging in the future
* makes maps more easily composable
* removes commented code, and topLevelAwait() which was causing production builds to break
* Adds 'wasm-unsafe-eval' to the script-src section of the Content-Security-Policy
when a desktop session's url is detected.
The app already enforces no caching via the Cache-Control, Pragma, and
Expires headers (SetNoCacheHeaders), which means that any time the app
is requested in a new tab, the browser will always request a new index.html
which can be sent back with a new Content-Security-Policy header.
Since the only way to get to a desktop session is to either
click a link in the app which opens a new tab, or to open a new tab and
navigate to the url manually (this differs from most components, which can
be navigated to without a page reload using React Router), we can reliably
check each index.html request for a characteristic desktop session url path,
and only include the 'wasm-unsafe-eval' directive when strictly necessary
(in the spirit of the principle of least privilege).
* Removes vite-plugin-top-level-await from package.json
* moves regex to global so that it only need be compiled once
* CR fixes
updates Cargo.lock
removes commented feature flag
removes -framework SystemConfiguration
fixes makefile comment
* unsafe.SliceData
* fixes phrasing
* changes to docstring
* changes handle_tdp_fast_path_response to handle_tdp_rdp_response_pdu
so that its name is in line with its definition in RFD 0037 and
adds a more descriptive docstring.
* small fixes to comments
* preallocate RDPFastPathPDU Encode buffer
* updating comments
* Adds a detailed discussion of the Go/Rust Interface to the README (#29762)
* Aligns the codebase with the Go/Rust interface principles in the README (#29764)
* Move client functionality into Client (#29765)
* Adds the RDP Channel IDs TDP message (#27514)
* Refactoring `rdpclient` (#29766)
* Ironrdp recording playback (#28228)
* httplib.SetIndexContentSecurityPolicyWithWasm for recordings as well as desktop sessions so that the ironrdp wasm client can be used for recording playback
* Adds desktopplayback path to websocket proxy definitions so that it can be used with the dev server
* adds tdp.TypeRDPFastPathPDU as a tdp message to be recorded
* With this commit, recordings can be played back with the FastPathProcessor
Refactors tdp Client and subclass PlayerClient
such that now the classes are always constructed the same way,
and the internal representation of the screen size (the FastPathProcessor)
is either:
1. Created upon the call to Client.connect(spec) when spec is !undefined.
This is the case when the Client is being used for a desktop session.
2. Created when a client screen spec is received from the server. This is
the case when PlayerClient is being used for playback.
* Switches from sending the width/height via ur parameter string
to sending it via the client screen spec tdp message.
* changes tdpCli* to client* and adds a canvas* to the canvas related functions
* Static tokio (#30066)
* Beginnings of RdpdrBackend integration (#32814)
* Adds handling for the EstablishContextCall (#32971)
* Adds support for `ListReadersCall` and `ListReadersReturn` (#33004)
* Adds support for `GetStatusChangeCall`/`GetStatusChangeReturn` (#33056)
* Adds support for ConnectCall and ConnectReturn (#33136)
* Better error handling (#32925)
This change removes couple of unwrap that could cause panics on the Rust side and prevents panics from invalid cgo handle on the Go side.
It also sends error message from IronRDP to UI and cleans up a little final sequence of closing various goroutines in case of error or sessions end.
* Adds support for `HCardAndDispositionCall` with `ScardIoCtlCode::BeginTransaction` (#33192)
* `TransmitCall` and `TransmitReturn` (#33282)
* `StatusCall` and `StatusReturn` (#33284)
* `ReleaseContext` and refactor `handle_scard_call` (#33434)
* IronRDP clipboard sharing (#33335)
This change adds clipboard sharing to our IronRDP migration using ironrdp_cliprdr crate with out TDP-based backend (reused from rdp-rs times)
* Adds EndTransaction, Disconnect, Cancel, and IsValidContext (#33612)
* Adds support for `GetDeviceTypeId` (#33613)
* Adds support for `ReadCacheW` (#33618)
* `WriteCacheW` (#33620)
* Smartcard Login (#33712)
* `GetReaderIcon` (#33779)
* Update to IronRDP latest commit
* Removes a bunch of old deprecated code (including `rdp-rs`) (#33786)
* Pipes in `SharedDirectoryAnnounce` (#33911)
* Use tokio-boring for TLS upgrade (#33900)
This change switches TLS upgrade in our new RDP approach to tokio-boring in FIPS-compliant builds.
It also adds runtime check for FIPS mode.
Tested locally in custom Docker image.
* Update sspi (#34558)
* Break up rdpdr.rs, add support for the first directory sharing pdus (#34009)
* Adds support for `SharedDirectoryCreateRequest` and `SharedDirectoryCreateResponse`. (#34011)
* `SharedDirectoryDeleteRequest` and `SharedDirectoryDeleteResponse` (#34051)
* remove leftover code
* Server drive query information request (#34082)
* Rdp client refactor (#34122)
* Add handling for `DeviceCloseRequest` (#34139)
* Updates to `IronRDP` latest (#34744)
* Updates to IronRDP latest with a slightly different API
* remove defunct comment
* `ServerDriveQueryDirectoryRequest` and `SharedDirectoryListRequest/Response` (#34746)
* `ServerDriveQueryVolumeInformationRequest` and `ClientDriveQueryVolumeInformationResponse` (#34871)
* `DeviceControlRequest` (#34898)
* `Read` (#34914)
* `Write` (#34919)
* `SetInformation` (#35092)
* `LockControl` (#35146)
* Stack pr feedback and other cleanup (#35306)
* Adds desktop access websocket pattern to vite config
* Updates IronRDP to latest, removes manual context strings in favor of automatically generated (by this latest IronRDP commit) (#35392)
* Small line fixes, comment removal, changing license to AGPL
* Update Go/Rust interface section of README (#35590)
* Ironrdp manual docs (#35455)
* Remove unnecessary whitespace
* Refactor navigation paths in Active Directory documentation for clarity
Replaced textual descriptions with formatted paths using `>` symbols for better readability.
Having been subject to going through many such tutorials myself, I find this to be a more
user-friendly way of presenting the information. It's very common to need to go back and
forth between the documentation and the group policy manager, and having these paths in a
format that can catch the eye quickly is a big help. This also appears to be common practice
e.g.
- https://softwarekeep.com/help-center/how-to-enable-remote-desktop-on-windows
- https://www.helpwire.app/blog/remote-desktop-group-policy/
* Add instructions for enabling RemoteFX
* Add an optional step to the end of each GPO update subsection
This lets us point users to subsections individually without worrying
about reminding them that they need to run a `gpupdate /force` each
time (because its already right there in the subsection).
* lowercase "open"
* Updates configuration script to enable RemoteFX (#35461)
* Restructure Cargo workspace (#35591)
* Update `IronRDP` to latest, fix key log leak (#35707)
Updates IronRDP to latest with the changes necessary to keep up with the changes in https://github.com/Devolutions/IronRDP/pull/328. We select the `"rustls"` feature explicitly now, this is in line with our implicit choice of it as [the default](https://github.com/Devolutions/IronRDP/pull/325/files#diff-1f64036f3e460819b2b1e954803b7f266feca0e2787ca0614ae1253323944f59L19) before these latest changes.
Also creates a custom debug for `ScardBackend` so as to not leak `key_der` in the logs.
* Don't leak pin in the logs
* Updates CI to fix broken checks and builds caused by WASM introduction (#35401)
* removes SystemConfiguration framework (not sure why it was there).
* Updates cspell
* fixes TestSetRedirectPageContentSecurityPolicy
* Updates e ref to a currently-draft-PR ref.
* Fix per session mfa (#35902)
* Updating e-ref to tip of `master`
* dependency-review: Ignore cargo dependencies with invalid license specifications
* Updates OSS build-macos.yaml to support wasm-pack
---------
Co-authored-by: Przemko Robakowski <przemko.robakowski@goteleport.com>
Co-authored-by: Mike Jensen <mike.jensen@goteleport.com>
Replace `Dockerfile-centos7-fips` with a simple version that just uses
the existing `Dockerfile-centos7` image with some extra modifications
(specifically, enabling BoringCrypto for Go and configuring OpenSSL to
use FIPS mode).
Several changes were made to `Dockerfile-centos7` to support this.
There is a mix of `public.ecr.aws` and `ghcr.io` being used for the
buildboxes. The default now uses `ghcr.io`.
Buildbox images did not handle varying architectures well, so use
docker buildx multi-architecture support to make it easy to target
specific architectures. `--platform` usage has been removed for
the time being, as it wasn't correctly implemented.
Additionally, start building arm and CentOS 7 FIPS buildbox images
in GHA to bring it in sync with `dronegen/buildbox.go`.
This does not include any drone/dronegen changes yet. Changes will
come in a separate PR once this groundwork has been done.
Ref #5068.
Ref #10581.
The test-go/test-api commands algorithmically create and remove
directories under the ./target path. The previous unqualified `find .`
would sometimes be traversing these directories when they were
destroyed, resulting in spurious `test-sh` failures such as the
following:
make -j"$(nproc)" test-go test-sh test-api
...
CGO_ENABED=1 ... go test -cover -json -tags "pam bpf desktop_access_rdp" -test.run=TestChaos ./lib/events/filesessions
...
find: ‘./target/release/deps/rmetaWJZ5A1’: No such file or directory
bats ./assets/aws/files/tests
ok 1 [agent-app] config file was generated without error
...
ok 393 [starter-cluster-tlsrouting] node_service.listen_addr is set correctly
make: *** [Makefile:888: test-sh] Error 1
make: *** Waiting for unfinished jobs....
In this case, find tripped over a directory that a separate test process
was actively creating/destroying.
Instead of trying to do something smart, we can drop the find/unique
logic entirely, since all bats tests currently reside in a single
directory.
* tooling: introduce helm reference generator
This commit introduces a Helm reference generator. It reads the
description of the values from the chart's values.yaml and generates a
markdown file that can be included in our user documentation.
The check will be enabled in later commits as we start generating doc
reference with this tool.
* license
This PR fixes the version reported by `tsh kubectl version` at compile time.
Currently, the package reports:
`v0.0.0-master+$Format:%H$`
The version is derived from the `k8s.io/kubectl` version we import in Teleport main repo where we replace the `v0` with `v1` to follow `kubectl` versions.
Unfortunately, k8s.io packages don't expose an api where we can replace the version at runtime (they have something that allows replacing the Git commit but the semantic part must not change).
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Terraform automation for Teleport load tests on Azure
* Update cleanup instructions
* Add `make destroy`
* Split things into multiple files, minor refactors
* version bumps
* Don't block IDMS for control plane
* default to 14.0.0
Without this, the helm lint prints hundreds of lines of messages
that just tell you that everything was good. This makes it harder
to spot real problems.
Michael