* Switch `tbot` to use `slog.Logger` from logrus
* Pick up a few spots I forgot to convert
* Fix tctl logging
* Avoid using Context-less variants of logger
* Convert logpoints in tool/tbot to use context based loggers
* Fix use of multiline string
* Move tbot log initialization before first logging message
* Switch "err" to "error" in log attributes
* Use `NewPackageLogger`
* reserve 40, 41 tag numbers for RoleConditions
* remove GetSAMLIdPServiceProviderLabels and SetSAMLIdPServiceProviderLabels
* remove SAMLIdPServiceProviderLabels from label matchers and rolev6 test
* run make -C integrations/operator manifests
* document creating SSH servers via IAC
* add links and index page
* Apply suggestions from code review
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* address feedback + fix Var XML tags
* test tctl flow and fill tctl command outputs
* fix kubernetes and terraform documentation
* make docs linter happy
---------
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Removes the entire notion of a DynamicAccessList from Teleport
Insurmountable security issues were found with the notion of dynamic
AccessList ownership and membership, so the entire concept is being
removed.
This PR removes all internal usage of the Dynamic access list
concept. The corresponding protobuf updates are coming in a later
PR.
Changelog: Removed Dynamic AccessList
* Fix API tests
* More API test fixes
* Fix integrations tests
* Refactor operator resource reconciler to support resource153 + add label propagation
I initially just wanted to add label propagation (which is required for
OpenSSH and OpenSSHEICE servers).
However I ran into an issue: not all Teleport resources implement the
`ResourceWithLabels` interface. Basically we have 4 cases:
- resources implementing `ResourceWithLabels` (e.g. User, Role, ...)
- resources implementing `ResourceWithOrigin` but not
`ResourceWithLabels` (e.g. GitHub connector, ProvisionToken, ...)
- resources that have been tweaked to implement only the operator
`TeleportResource` interface (`LoginRule`)
- resources implementing `Resource153`
To support all those resoucres, we can either:
- edit each resource so they expose the same methods (e.g.
ProvisionToken exposes `GetLabels` instead of `GetStaticLabels`)
- wrap each ressource in a wrapper that implements the operator
TeleportResource interface
- add multiple reconcilers, one for each resource kind
I don't think it's sane for the operator to force changes on Teleport
resources. Especially as those are known to be non consistent. I also
don't want the operator to maintain a copy of each resource, this is not
viable on the long term.
For those reasons I chose the 3rd approach and built 3 reconcilers. Then
I deducplicated the code to end up with a generic reconciler that can be
tuned by passing an adapter. The adapter is an empty struct that has all
the methods to extract the information the operator requires from the
resource.
The resulting PR is large and heavily uses generics but the amount of
logical changes is quite low (the only diff is that we now copy labels).
I can walk you through the PR if needed.
With this PR, the operator supports properly any resource implementing
`types.Resource153`, this will be useful to add `TeleportBotV1` support.
* Update integrations/operator/controllers/reconcilers/base.go
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
* use structured logging
---------
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
* SAMLIdPServiceProviderLabels and SAMLIdPServiceProviderLabelsExpression proto def
* GetSAMLIdPServiceProviderLabels and SetSAMLIdPServiceProviderLabels funcs
* add KindSAMLIdPServiceProvider to labellabel and Set/GetLabelMatchers
* add to SAMLIdPServiceProviderLabels CheckAndSetDefaults, tests
* remove default SAMLIdPServiceProviderLabels wildcard value. Merge checkAndSetDefault test
* run make -C integrations/operator manifests
* rerun make -C integrations/operator manifests
* update e-ref to current master
The access list interface now supports counting members without unmarshaling.
This method has been added to the generic backend service as well. This will
allow for quicker counts when necessary. This method has been added to the
cache.
Additionally, a status field as per RFD-153 has been added to access lists
that will house the new optional member count field.
* integrations/operator: Add openSSH and openSSHEICE servers
* lint
* Update integrations/operator/controllers/resources/openssheiceserverv2_controller.go
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
* rename Openssh to OpenSSH and fix comments
* hide cmdlabels
---------
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
* Workload ID RBAC changes
* Update api/proto/teleport/legacy/types/types.proto
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
* Validate IPSANs CIDRs are good
* Improve regex matching for SPIFFE conditions
* Remove unused globMatch function
* Prefer using utils.MatchString
* make grpc
* Update the charts
---------
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
* Add DatabasePermissions field to role.
* Change error wording in a minor way
* Update api/types/role.go
Co-authored-by: STeve (Xin) Huang <xin.huang@goteleport.com>
* Update api/proto/teleport/legacy/types/types.proto
Co-authored-by: STeve (Xin) Huang <xin.huang@goteleport.com>
* Update autogenerated files
* Guard against wildcards in `spec.allow.db_permissions`
---------
Co-authored-by: STeve (Xin) Huang <xin.huang@goteleport.com>
* Remove account lockout from failed recovery attempts
This account lockout looks to be unecessary and potentially problematic. Recovery codes and recovery through MFA are not possible to brute force.
In addition the potential to lockout an account from being able to use a recovery method could result in them being unable to unlock their account from other potential abuse cases (for example an attacker locking the account from failed password attempts).
As discussed in the RFD (https://github.com/gravitational/teleport/pull/35533) this includes the removal of all the API used for this locking mechanism.
* accountrecovery: Update `WithLock` function names
* accountrecovery: Combine verifyRecoveryCode and verifyRecoveryCodeWithRecord into one function
* Further GRPC cleanup after PR feedback
* Apply PR Feedback
The commit contains the following changes:
- add multi-version support by creating new kinds. This is currently done via an override to maintain compatibility. At some point, we might migrate unversioned kinds (TeleportRole) to versioned kinds (TeleportRoleV5) and remove the override
- unify all resource statuses in a single struct. This simplifies the CRD building because we are not trying to guess which package is correct anymore when parsing go's AST
- update crdgen snapshots
This PR does not update the base CRDs in the operator or the Hlem chart. This will happen in the next PR, adding go types and controller support.
Note for reviewers: the changeset might seem large, but the changes are split into commits that are much more reviewable. You only need to review the first two commits.
* Document resource version in proto files
This will be useful when generating documentation from proto for the TF
provider. With this change, we will display which version value should
be set.
This change is required so we can make version mandatory in TF.
* docs: always set version when using the TF provider
* docs: re-generate the TF reference, with the version updates
* Apply suggestions from code review
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
* re-generate grpc client
* fix typos
* re-generate CRDs
---------
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
This commit prepares everything for us to switch to a single reconciler for all resources. Part of https://github.com/gravitational/teleport/issues/21416
This commit does the following changes:
- setup controllers for the unstructured objects instead of the structured ones (like `Role` was doing). This is due to the bad behaviour of `utils.Strings` of serializing as a single string if the list contains a single element.
- use a single scheme for everything instead of multiple ones. We suffered from drifts between main and tests in the past.
- fetch the GVK for the unstructure objects from the scheme. This operation can fail and now a bunch of builder/init functions can return errors
- Introduce a new `Reconciler` interface to hide the controller internals
- unify how controllers are started in main and tests. This is not directly related to the PR goal (preparing the ground for a unified controller) but I was drawn into this when I made the constructors return errors.
* Add role grants for access list owners.
Access list owners can now have their own individual role grants.
* Update operator CRDs.
* Update access list reference with owner grants.
* gRPC update.
* Fix tests.
This commit creates a standard set of compare options for all tests that
handles the common use cases:
- ignore ID, labels and other dynamic metadata
- apply sane time comparison by default
- equates nil maps and empty maps (caused by proto serialization)
This solves a couple of comparison issues I faced in another PR.
Prefer the stdlib version of the experimental package.
Includes a depguard update to prevent future regressions,
as well as an e-ref update to appease depguard.
Generated with:
$ gofmt -w -r '"golang.org/x/exp/slices" -> "slices"' . && \
make fix-imports
* Add support for `include_enterprise_slug` in `github` joining
* Correct assertiosn in github validator token test
* Remove `want` in TestIDTokenValidator_Validate
* Fix missing `should` in docs
Co-authored-by: Krzysztof Skrzętnicki <krzysztof.skrzetnicki@goteleport.com>
* Fix spelling of customize in docs
* Update operator CRDs
* Regen protos
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Try both under same header
* Try H4
* Remove spurious period
* Use bold rather than heading
---------
Co-authored-by: Krzysztof Skrzętnicki <krzysztof.skrzetnicki@goteleport.com>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
While the api client already had support for the new upsert method
it was unimplemented server side and would always fallback to the
legacy UpsertOIDCConnector RPC. This implements the RPC handler
and updates the signature of UpsertOIDCConnector to return the
upserted connector in the same manner that Create and Update do.
While the api client already had support for the new upsert method
it was unimplemented server side and would always fallback to the
legacy UpsertSAMLConnector RPC. This implements the RPC handler
and updates the signature of UpsertSAMLConnector to return the
upserted connector in the same manner that Create and Update do.
While the api client already had support for the new upsert method
it was unimplemented server side and would always fallback to the
legeacy UpsertGithubConnector RPC. This implements the RPC handler
and updates the signature of UpsertGithubConnector to return the
upserted connector in the same manner that Create and Update do.
Fix the operator `Dockerfile.gha` to copy the correct paths from the
context for the build. These paths changed pretty much at the same time
as `Dockerfile.gha` was added - just an overlap in development - in
commit f31a90d4a4, which modified the
original `Dockerfile` on which `Dockerfile.gha` is based.
Add a new `Dockerfile.gha` alongside the existing `Dockerfile` that can
build the operator container image without any build args. The build
args it had could be determined from inside the Dockerfile, so doing
this removes the need to pass them in. This in turn makes it simpler to
call from CI and to build locally.
In particular, `GOLANG_VERSION` and `PROTOC_VERSION` are taken from
`build.assets/versions.mk`, and `COMPILER_NAME` is determined from the
predefined `$TARGETARCH` arg.
Once Drone no longer builds the operator on any branch, this
`Dockerfile` will replace the previous one, with the `Makefile` updated
to remove the build args. It is done this way as previous changes to the
build of the operator were not backported to v12 and v13, complicating
backporting changes to existing files.
Zac Bergquist