* Vendor event-forwarder plugin
* fix tests + add Makefile + CI
* lint
* Fix broken test
* use a separate go.mod
* ignore event-handler in flaky tests + update go.mod
* go mod tidy
Similar to https://github.com/gravitational/teleport/pull/39315,
this updates the integrations test suite to use a regular
expression that will match output to know when the ssh_service is
ready now that Teleport is using slog instead of logrus.
* Bump github.com/gravitational/trace from 1.3.1 to 1.4.0
## Changelog
- Bump google.golang.org/grpc from 1.43.0 to 1.53.0 by @dependabot in #94
- Bump golang.org/x/net from 0.8.0 to 0.17.0 by @dependabot in #100
- Bump google.golang.org/grpc from 1.53.0 to 1.56.3 by @dependabot in #101
- Bump golang.org/x/crypto from 0.14.0 to 0.17.0 by @dependabot in #105
## Breaking Changes
- Remove logrus dependency by @rosstimothy in #107
- Remove references to UDP logrus hook from README by @rosstimothy in #108
Full Changelog: https://github.com/gravitational/trace/compare/v1.3.1...v1.4.0
* remove final references to removed trace functionality
* fix: formatter error handling
The change to migrate the TeleportProcess to use slog in
https://github.com/gravitational/teleport/pull/38551 was preventing
the regular expressions used by the operator tests to determine
when auth and proxy were ready. This lead to the tests hanging indefinitely
until the go test framework timed out. To remediate, the regular
expressions have been updated to match the output when using slog.
For example, the test was expecting the output in the format of:
```
Auth service 15.0.0:v15.0.0-0-ge126e8cd is starting on 192.168.50.108:3025. pid:61933.1 service/service.go:2072
```
#38551 moved the listen address to a field instead of being formatted
in the message:
```
Auth service is starting. pid:54159.1 version:16.0.0-dev git_ref:api/v13.4.16-31-g2b9ae35e31 listen_address:127.0.0.1:63152 service/service.go:2107
```
Adds the new linter and configures it to prevent direct error
comparisions and type assertions in favor of errors.Is and errors.As.
All current violations caught by the linter have been updated
accordingly.
* Remove `Dialer(client.Config)` from Credential interface
* Re-add support for address-less configuration
* Only use profile address if none are explicitly provided
* Try all methods with credential provided address
* Fall back to address from credential
* Remove log message
* Adjust log message
* Spell explicitly correctly
* Formalize CredentialsWithDefaultAddrs interface
* GetDefaultAddrs -> DefaultAddrs
* Introduce scaffolding for access list Slack notification.
The initial scaffolding for notification of the need for reviews for access
lists has been introduced. This is not expected to do anything just yet, but
will do so in a follow on PR.
This has additionally separated the plugin data from the dynamic access core,
as it no longer is tightly coupled to access requests. No effort was made to
refactor the existing plugin data backend logic.
* Ensure that the context is cancelled on process termination.
* Remove debug hour addition.
* Correct notification date calcs, add test for notifications.
* Expire the access list after two weeks, use a single map instead of multiple plugin data keys.
* Run GCI.
* Tune tests, retry period is now a duration.
* Get rid of gocron, use intervals, test using intervals.
* GCI.
* Renames, test tweaks.
* Refactor access plugins.
* GCI.
* Adjust tests, remove generics, plugin data uses JSON marshal instead of custom marshaling.
* Move recipient back to common.
* Missed a few recipients imports.
* Tweaks to logic, auto registration of apps, commenting and cleanup.
* This change introduces a new 'promoted' access request state. The state represents that an access request has been promoted to an access list.
Affected code was modified to adjust to the new promoted state and ensure correct system's behavior.
Added a new 'GetAccessRequest' method for internal use to retrieve access request info.
Disallowed direct promotion of access requests. Introduced 'SubmitAccessReviewAllowPromotion' for promotions.
Added 'PromoteAccessRequest' method and updated its usage to restrict direct promotions.
Refactored code for better readability and testing. Renamed some functions, simplified logic, added test helpers.
Introduced 'promoted' state for access requests to handle promotion workflow.
Added 'PromotedAccessListTitle' in 'AccessReview' to track promotion state.
* Refactor function and message names for better clarity
The function and message names related to the promotion of an access request to an access list were restructured for better readability and consistency. Names like 'PromoteAccessReqResponse' have been replaced with more descriptive names such as 'PromoteAccessRequestResponse'. This increases clarity and consistency across the project.
* Remove the hacky GRPC server implementation
* Change method names to be more descriptive
Renamed all instances of 'PromoteAccessRequest' to 'AccessRequestPromote' in multiple files. The new method name provides a more descriptive and clear understanding of the method's function, which improves code readability and maintenance. This change applies to method definitions, comments, and error messages.
* Refine error message and introduce IsPromoted method
Refined the error message in 'access_request.go' to better indicate that only promoted requests can set the promoted access list title, not just have one. This enhances clarity of error message. Additionally, introduced 'IsPromoted' method in 'access_request.go' file. This method will be useful for quickly checking if a request is in the PROMOTED state.
* Rename variable in SubmitAccessReview method
Renamed the variable "params" to "submission" in the 'SubmitAccessReview' function, in 'auth_with_roles.go' file. The name "submission" provides clearer indictation of its role in submitting access review. This enhances code readability and understandability. No logic changes were made during this update.
* Add initial servicenow plugin
* Add missing servicenow plugin checks
* Make omit empty fields in servicenow incident type
* Enforce https for servicenow requests
* Make servicenow plugin always pass clustername
* Add in missing returned errors in servicenow plugin
* Remove unused code form servicenow plugin
* Add missing godocs to servicenow types
* Use parseint over Sscanf in decodeplugindata
* Fix minor formating issues in servicenow bot
* Fix min version for servicenow plugin
* Rename servicenow to serviceNow
* Add more context to servicenow logs and send time as utc
* Fix misleading comment in servicenow plugin
* Add more context to servicenow plugin logging
* Refactor servicenow plugin to reduce indentation
* Refactor resolution tag check to use a switch case
* Change from sscanf anf sprintf for int formating and parsing
* Add missing close code logic to servicenow bot
* Add tests for servicenow plugin and mocked servicenow
* Refactor servicenow plugin to use slice.Contains
* Enforce https only for non localhost in servicenow plugin
* Add more context to servicenow close code comments
* Fix typo in error message and encode systemAnnotations in plugindata
* Match host for servicenow client as whole instead of via prefix
And fix capitalisation in some error messages.
* Merge denied and approved cases in servicenow on watcher event
* Lower excessive timeout in servicenow tests
* Swap to using apiurl.hostname of net.splithostport
* Fix access_request plugindata test, rename servicenow rota
* Move close code configuration to plugin instead of role
* Remove unused fields and fix minor linting issues
* Remove unused code to fix linting
* Remove unused assignment to fix linting
* Fix assignment error in servicenow tests
* Remove use of require assertions inside Eventually calls
require.Eventually runs the predicate function in a background
goroutine. It is invalid to use require to make assertions
inside the eventually, because require will fail the test if the
assertion fails, and tests can only be failed from the test's
main goroutine.
* Use EventuallyWithT
* integrations/access: avoid infinite retry on broken connection
This commit changes the watcherjob retry behaviour. Instead of relying
on gRPC's retry mechanism, the plugins will now fail fast when something
happens to the connection. This means the plugin will exit in error more
often, but it won't be stuck in a retry loop, silently smallowing
connection errors.
* Add TELEPORT_PLUGIN_FAIL_FAST environment variable
* fixup! Add TELEPORT_PLUGIN_FAIL_FAST environment variable
* Add initial auto approval flow for opsgenie plugin
* Fix logging fields in opsgneie plugin
* Add context to opsgenie config
* Use systemAccessApprover user in opsgenie plugin
* Rename error used by opsgneie plugin to denote missing annotations
* Fix grammer in comments for opsgenie plugin
* Remove embeded baseapp from opsgenie plugin
* Add error message for missing annotations
* Remove ctx from opsgenie config stuct
* Change warning log in opsgneie plugin to be clearer
* Add config tests to opsgenie plugin
* Add remaining opsgenie tests and minor fixes
* Fix broken tests for opsgneie plugin and add missing one
* Remove unused code from opsgenie tests
* Changes to the Jira plugin required to run as a hosted integration
Includes:
* Jira plugin settings types
* The ability to optionally enable the Jira Webhook server (so
that it can be left disabled when run as a hosted plugin)
* Only creating a GRPC Teleport client if no client is provided
from configuretion
* Optional status reporting via plugin StatusSink
* Fix test failure
* Switch default behaviour to running the webhook receiver
* Apply suggestions from code review
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Remove Username, rename Project in Jira settings
* Comment update
* Lint & US-ify spelling
* USify spelling
* Update plugin.go
* Tests
---------
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
The t.Log() function calls have been removed from most tests. This is to keep our test logs cleaner and more focused on error messages. Logging every detail in tests makes it harder to spot actual errors and relevant information.
* Changes to PagerDuty plugin to support running as a hosted plugin
The major structural change is to provide a new PagerDuty app constructor
that allows the auth server to inject a Teleport client, rather than the
plugin automaticaly creating a GRPC client on startup.
Other changes include:
- Added more PagerDuty API types
- Extra logging
- Small refactors here & there
* Update integrations/access/pagerduty/app.go
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Shorten PagerDuty typenames
* Address review feedback
- Moved API URL to plugin parameters
- Removed obsolete settings loader
* Address @marcoandredinis' review feedback
---------
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Compile binaries for access plugin tests
* Fix PD test asserts for newer Teleport versions
* Unpin role from V6 in access plugin tests
* Remove license from OSS plugins tests
We now run tests against OSS Teleport in the OSS repo,
and against Enterprise Teleport in the E repo.
So the assumption that CI always needs an enterprise license
is incorrect.
* Only compile the required binaries
This PR introduces a new role version - `v7` - to support other
Kubernetes resources such as `Deployments`, `Statefulsets`... while
keeping compatibility with previous role versions.
This PR adds the following validations:
- `v6`, `v5`, `v4`: `kubernetes_resources` can only include `kind: pod`
resources
- `v7`: `kubernetes_resources` can include wildcards or other
resourceces (to be introduced by #26244.
It also adds a role version downgrade (v13 clients connecting to v14
auth server) where we downgrade the role's version and remove unsuported
kubernetes_resources from the resource list.
Part of #20811
* Vendors the `pagerduty` plugin source into `teleport`
This commit vendors the PagerDuty Access Plugiun code into the `teleport`
repo (from `teleport-plugins`), with only the minimal set of changes
required to get it to compile and tests to pass.
Changes include:
- updating the package name (`main` -> `pagerduty`)
- removing `main.go`
- removing installation scripts
- minor testing tweaks to aid local debugging
* Revert test change
* `go mod tidy`
* fmt
* linter appeasement
* Move opsgenie client code to integrations/access
* Add initial opsgenie bot skeleton and stubs
* Add opsgenie check and set default to pluginv1
* Fix check and set defaults for opsgenie plugin config
* Fill out bot stubs for opsgenie bot
* Add loadOpsgenieConfig to integrations
* Swap to using bearer token for opsgenie plugin
* Fix formating in opsgenie bot
* Reorder imports to fix lint errors
* Add config field to plugins to allow for different recipient logic
Allows bots that use schedules as recipients to determine their own
logic for defaulting etc
* Add notimplemented err for check health for opsgenie bots
* Add check health to opsgenie client and bot
* Rename recipientsAreSchedules to usersAsRecipients
* Add pluginBearertokencredentials checkAndSetdefaults
* Add resolveAnnotations to reqdata and use schedules from that
* Update integrations/access/opsgenie/bot.go
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Prevent default schedules being processed if annotations are set
* Remove loadOpsgenieConfig
* Rename opsgneie addr field
* Add more verbose error messages to opsgenie client
* Update api/proto/teleport/legacy/types/types.proto
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Update integrations/access/opsgenie/bot.go
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Fix error message for recipients field in opsgenie bot
* Change apiEndpoint field name
* Remove check for unused field from opsgenie config
* Remove usersAsRecipients flag
* Reserve addr and change change field number of api_endpoint
* Update integrations/access/opsgenie/client.go
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Rename reqAnnotationresponderskey to reqannotationscheduleskey
* Remove unused check and set defaults
* Rename REqAnnotationScheduleskey
* Use types.Labels alias where possible
* Simplify loop in opsgenie bot to satisfy linter
---------
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
This commit updates all `err == io.EOF` comparisons to use
`errors.Is(err, io.EOF)`. This is necessary when the error may have been
wrapped and fixes at least one current breakage (in `tsh request ls`).
`golang.org/x/tools/refactor/eg` was very handy for this, I used the
following template:
```go
package teleport
import (
"errors"
"io"
)
func before(err error) bool { return err == io.EOF }
func after(err error) bool { return errors.Is(err, io.EOF) }
```
* Add initial opsgenie client
* Embed opsgenie client config in client and move some helper funcs
* Fix mod and sum and call to opsgenie client buildalertbody
* Add more godocs and use vendored teleport plugins lib
* Rename opsgenie client and config to prevent repetition
* Fix struct tag in opsgenie alertbody
* Fix misleading comment
* Add tests to opsgenie client to check note bodies are formatted
* Wrap errs with more descriptive types
* Close response bodies and fix error handling
* Add missing godoc and fix defer and return order
* Add missing godocs to opsgenie types
* Change opsgenie client test to not depend on json indent etc
* Add example of api url to godoc
* Undo unnecessary mod and sum changes
* Fix go sum
* Move opsgenie client code to integrations/lib
* Fix typos
When gravitational/teleport-plugins imports this test suite
in CI, the repo root gravitational/teleport/... is not writable.
This uses GitHub's `RUNNER_TEMP` instead, if it is set.
* Vendor slack plugin and supporting libraries
* Fix up plugin integration tests (wip)
* Run GCI on vendored code
* Use newtype instead of type alias
golangci-lint currently panics on this,
"skip-files" et al don't help, as it is a linter panic, not an error
See https://github.com/dominikh/go-tools/commit/d717045480130461e1e777ead7f2981621f0d9f0
* Remove long-runing plugins tests from difftest
* Move access plugin tests to unit-tests-integrations
Hugo Shaka