It was discovered that some customers' EKS clusters did not have their IMDSv2 hop limits
set correctly, causing requests for key functionality to attempt IMDSv1 fallback and failing.
For now, re-enable IMDSv1 fallback by way of removing the explicit disabling of
`EC2MetadataEnableFallback` until better documentation, error handling, and other work
can be done to inform customers that they need to correctly set their IMDSv2 hop limits.
* Remove logging from circuit breaker
The logging is never output, and if it was would be very verbose.
Instead of dropping the level down to trace the logger is removed
entirely.
* Add constants from trace library
The logging functionality in trace is being removed in an upcoming
release. To prepare the logging component keys are copied from trace
into teleport.
* Convert trace.ComponentFields to teleport.ComponentFields
* Replace trace.Component with teleport.ComponentKey
* Replace trace logging constants
Adds the new linter and configures it to prevent direct error
comparisions and type assertions in favor of errors.Is and errors.As.
All current violations caught by the linter have been updated
accordingly.
* Sanitize backend keys with .. in them.
Backend keys with .. in them have been added to the regex for patterns in
keys that are denied.
* Deny ., .., use regexes.
Modifies the type constraint on the generic backend service so
that it can be used with legacy and new resource variants. A few
additional helper methods were added to types to pull resource
information from the correct location depending on the resource
type.
Prefer the stdlib version of the experimental package.
Includes a depguard update to prevent future regressions,
as well as an e-ref update to appease depguard.
Generated with:
$ gofmt -w -r '"golang.org/x/exp/slices" -> "slices"' . && \
make fix-imports
DynamoDB Streams and Application Auto Scaling do not currently have FIPS endpoints in
non-GovCloud, leading to invalid endpoints for FIPS users running in AWS Standard.
See also: https://aws.amazon.com/compliance/fips/#FIPS_Endpoints_by_Service
Regression from #34170.
Fixes#34804.
Additionally, clean-up a few more AWS session initiations to be consistent and clear.
Two changes to AWS SDK usage:
Teleport should never use AWS IMDSv1 for requests, so disable the
ability to fallback to it, as it could be a malicious attempt to
downgrade security.
Teleport generally prefers FIPS endpoints when in FIPS mode, but
there were a few places that were not selecting the FIPS endpoints.
Ensure that the FIPS endpoints if BoringCrypto is being used.
After upgrading Auth to include support for revisions when using
dynamo as the backend, updates to any pre-existing resources would
result in an error. The conditional expression provided to the
dynamo query would always fail because the item did not yet
contain a Revision attribute. We can achieve the same conditional
update by altering the conditional expression to assert that the
revision attribute does not exist if the item being updated does
not contain a revision.
* Prevent blank revisions from being read from the backend
Overwrites any empty resource revisions with a placeholder value to
prevent any blank revisions from being provided to users.
* Prevent backend items with empty revisions
All resource revisions are now being set on a backend.Item before
persisting the item to the backend.
* Revert "Error when redundant prefixes are detected in events. (#32652)"
This reverts commit 84dbc45e1d.
* Error when redundant prefixes are detected in events.
When creating a new events watcher, redundant prefixes will be detected
and produce an error. This should prevent developer mistakes where watched
prefixes overlap, causing subsets of events not to be parsed. This has been
verified manually.
* Fix buffer_test.go
* Update lib/services/local/events.go
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
---------
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Error when redundant prefixes are detected in events.
When creaeting a new events watcher, redundant prefixes will be detected
and produce an error. This should prevent developer mistakes where watched
prefixes overlap, causing subsets of events not to be parsed. This has been
verified manually.
* Add in test for event watcher verification.
* Run GCI.
Updates the reporting and sanitzer backends to implement the
conditional backend interface. With these two now supporting
optimistic locking the `conditionalBackend` interface used by the
backend test suite can now be promoted into `backend.Backend`.
Contributes to #30416.
A new revision column is added to the kv table to accomodate
storing the resource revision. A schema migration for the table
was added to ensure any existing databases have the table added.
Additionaly the meta table and its associated import functionality
was removed since it was unused. Various other small clean up
operations were also done to eliminate warnings and remove unused
functionality.
Contributes to #30416.
Implements ConditionalUpdate and ConditionalDelete for the
memory backend and extends existing backend methods to take
the revision into account. The backend test suite has also been
updated to run optimisitic locking tests on any backends that
support it.
Contributes to #30416
* Use pgx.Identifier whenever possible
* always qualify column names
* pgbk schema 2, more robust change feed
* Convert events' expiry to UTC for consistency
* Add comments on COALESCE and how we parse the data
* Move gRPC error intercetpors to api/utils/grpc/interceptors.
* Use error interceptors in api client and mock server.
* Apply suggestions from CR.
* Unwrap FromGRPC errors in middleware.
* Use gRPC auth service in tests instead of external example service.
* It's gRPC!!!
* Fix unit test.
* Add error interceptor to proxy client.
* Fix merge conflict.
This test starts a session and then immediately tries to join it.
Sometimes we're too fast, and the session tracker doesn't yet exist
so the join fails.
Fix by waiting for the session tracker to show up before attempting
the join.
Closes#13607
Forrest