* Update labels datatype in Teleport crownjewel proto
This commit modifies the labels from a map to repeated TeleportLabel in CrownJewel proto, and accordingly updates the getter function in proto generated code. The newly introduced TeleportLabel type contains a Key and repeated values for improved flexibility.
Clean up
Update and restructure CrownJewel service proto
The code modifications include renaming and restructuring several types and altering various functions in the CrownJewel service proto. Major changes involve renaming DeleteCrownJewel
Rename 'kind' to 'kinds' in crownjewel API
This commit changes the 'kind' field to 'kinds' in the crownjewel API to better reflect its purpose of holding multiple resource types. Changes are made across several files - 'crownjewel.go', 'crownjewel.pb.go' and 'crownjewel.proto'.
After rebase fixes
Remove CrownJewel type from several files
This commit represents the removal of the CrownJewel type from several files. CrownJewel type references are deleted in certain Go files, and imports of CrownJewel in multiple files are being adjusted. The specifics of why this type is removed is not evident from the diffs, but the deletions will affect the related functionalities.
Add CrownJewel update functionality
This update enables the 'UpdateCrownJewel' functionality. If a 'CrownJewel' resource already exists, it can now be updated instead of returning an error. This enhances flexibility when dealing with resource management. It also introduces the ARN field into the 'AWSMatcher' service.
Update CrownJewel service with pagination and improve matchers
This update adds pagination to the CrownJewel service for more efficient data handling. It also improves the matching capabilities with the inclusion of Teleport and AWS matchers and allows for selective querying with these matchers. Additionally, it includes various changes to structure and naming for better clarity and ease of use.
Refactor CrownJewel protos to use ResourceHeader
This refactoring replaces the previous structure of CrownJewel proto's fields Kind, Sub_kind, Version, and Metadata with a single object called Header (ResourceHeader). It simplifies the code structure and harmonizes it with other protos. Now, Header contains the essential attributes that were previously distributed across multiple separate fields.
Add GetCrownJewels method to cache and accessgraph
The function GetCrownJewels has been added to the cache and the accessgraph. It retrieves all CrownJewel instances from the cache. Additionally, CrownJewel retrieval functionality has been removed from auth server and existing usages have been refactored.
Implement Crown Jewel creation feature
Updated the method `createCrownJewel` in the resources command to handle Crown Jewel creation. Introduced a new gRPC service `crownjewelv1` to handle client-server interactions for Crown Jewel objects. Crown Jewel expiry configuration has now also been enabled.
Add missing files
I have no words...
Update authentication and event handling
Refactored the argument from 'auth.ClientI' to '*auth.Client' in 'createCrownJewel' function in 'resource_command.go'. Removed unused import 'durationpb' in 'auth_with_roles.go'. Added a new event code 'AccessGraphAccessPathChangedCode' in 'codes.go' and 'AccessGraphAccessPathChanged' in 'api.go' for better monitoring and logging of access path changes.
Add access path changed event and relevant changes.
update api
add grpc
update api
add cache support
add protos
* Fixes after rebase
* Refactor Crown Jewel resource methods
Updated API methods related to the Crown Jewel resource to improve clarity and consistency. Renamed `GetCrownJewels` to `ListCrownJewels`, added pagination parameters, and ensured uniform handling of the Crown Jewel resource across different parts of the codebase. Updated relevant comments for better code understanding.
* Removed CrownJewel converter, updated CrownJewel references
This commit removes the CrownJewel converter and updates references from the old CrownJewel type to the new protobuf-defined CrownJewel type, streamlining the codebase. The commit also disables CrownJewel deletion since it is not supported yet. Some minor errors were fixed regarding CrownJewel resource names.
* Implement Crown Jewel deletion functionality
The crown jewel deletion feature has been enabled by uncommenting and simplifying the code block. Now, the delete action is directly performed on the specific 'crown jewel' mentioned based on its name. The previously unsupported action returns an informative success message after the deletion.
* Refactored function 'allCombinations' and added authorization checks
Moved 'allCombinations' function into 'utils' package, renamed it to 'Combinations', and updated its references in 'dbobjectimportrulev1' and 'dbobjectv1' tests. Additionally, introduced admin authorization checks to 'CreateCrownJewels', 'UpdateCrownJewels', and 'DeleteCrownJewels'. Created corresponding tests for these changes.
* Add CrownJewel service to cache tests
The CrownJewel service has been added to the cache test file. The service creation is implemented and assigned to new fields in multiple methods within the cache tests. A new test function `TestCrownJewel` has also been added to validate CRUD operations for the service.
* Add access path changed event and update Crown Jewel tests
Added a new event code for when an access path changes in the access graph, and introduced new API calls to handle these situations. Also, updated crown jewel related tests and fixed copyright year in several files.
* Update protobuf import path
The protobuf import path was updated from "github.com/golang/protobuf/proto" to "google.golang.org/protobuf/proto" to ensure correct use and to prevent potential issues, while maintaining functionality in crown_jewels.go.
* Refactor CrownJewel and AccessGraph services
This commit optimizes the ListCrownJewelsResponse in the CrownJewel service by directly assigning the response instead of using an extra loop. Additionally, the EventsStream in the AccessGraph service and related tests have been updated to EventsStreamV2, reflecting the implementation of new versions of these methods.
* Add CrownJewel resource in access controls and tests
In both the cache test and access control files, CrownJewel resource has been included. This provides the system's ability to manage and test CrownJewel resources. Additionally, it allows the handling of CrownJewel resources in client events.
* Simplify implementation
* Update copyright dates and add license headers
Updated the copyright dates in several files to reflect the new year. Additionally, license headers have been added to some files where they were previously missing, ensuring the proper copyrights and GPL notice are visible.
* Refactor CrownJewel codebase for better readability
Fixed various typographical errors in CrownJewel's related functions and removed a TODO comment. Improved function and function calls' names that were incorrectly referring to different modules, making the code easier to read and understand across different CrownJewel services.
* Add validation for Teleport and AWS matchers in service
The validation has been added for Teleport and AWS matchers in the service layer to ensure that essential details are not missed when setting matchers. This includes checks to ensure that kinds and labels for Teleport, and types and tags for AWS matchers are properly set.
* gci
* Add CrownJewel update functionality and refactor related services
This commit adds the ability to update a CrownJewel resource within the ResourceCommand. It also includes refactoring of related services, condensed code logic, and improved utilization of existing methods for marshaling/unmarshaling CrownJewel. Specific changes in service.go and crown_jewels.go files have reduced code redundancy and enhanced the code structure.
* Relocate and update crown_jewels_test file
This commit moves the crown_jewels_test from the local to the services library and adds test cases for unmarshalling Crown Jewels data. Also, import statements for labelv1 and utils were introduced to support these changes.
* Update crown jewels test with AWS matchers
Revised the crown jewels test file by including AWS matchers section in the CrownJewel object. The change ensures to specifically match AWS infrastructure following certain parameters, thus enhancing the specificity and flexibility of our matchers. Apart from this, minor reordering of objects has also been done for better code organization.
* Added upsertCrownJewel function and related proto message
The commit adds the UpsertCrownJewel function in the service.go file, which enables upsert operations on crown jewel resources. Alongside, the UpsertCrownJewelRequest proto message is added to the crownjewel_service.pb.go file to handle such requests.
* Refactor CrownJewelsClient to use upsert
This change refactors the CrownJewelsClient to use the upsert method when the force flag is on. The code has been streamlined by eliminating the need for 'already exist' error checking and separate create and update methods.
* Add GetCrownJewel functionality and refactor validation
A GetCrownJewel function has been added to the Service, which retrieves a specific CrownJewel resource. Also, the CrownJewel validation process has been refactored, moving the validateCrownJewel function from service.go into the crownjewel library and renaming it to ValidateCrownJewel. These changes improve modularity and code organization.
* Add VerbCreate check and test for CrownJewel validation
The checkAccessToKind function now also checks for the VerbCreate permission. Additionally, a new test file, object_test.go, was added to validate the functionality of the CrownJewel object. This includes various validation checks such as "NilCrownJewel", "ValidCrownJewel", "MissingMatchers", among others.
* Refactor CrownJewel resource handling and validation
The codebase was updated to improve CrownJewel resources handling. This includes modifications to list, get, create, update, upsert, and delete functions in several files. Additionally, a validation function has been implemented for CrownJewel objects, ensuring required fields are present. Depreciated logger service has also been removed.
* Add cache implementation to CrownJewel service
The CrownJewel service has been enhanced by integrating it with cache. The main changes include adding "Cache" as part of ServiceConfig and using cache to fetch crown jewels instead of directly using the backend services. The cache interface with the methods "ListCrownJewels" and "GetCrownJewel" has been added to handle these operations.
* Add Cache to service configuration in crownjewelv1 tests
In this commit, we added the Cache field to the service configuration used in the tests for the crownjewelv1 service. This ensures that the service configuration used in the tests matches the expected real-world configuration.
* Update CrownJewelsService to use ConditionalUpdateResource
This commit changes the CrownJewelsService's `UpdateCrownJewel` method to use the `ConditionalUpdateResource` method instead of the `UpdateResource` method. This change will provide a more appropriate update strategy for the specific needs of the CrownJewelsService.
* Replace 'Cache' with 'Reader' in crownjewel service & remove DeleteAllCrownJewelsRequest
The 'Cache' in crownjewel service has been replaced with 'Reader' to improve code readability and to match with its functionality. Also, the DeleteAllCrownJewelsRequest functionality was removed as it posed a high risk potential for data loss and it wasn
* Update tests for Crown Jewel service
This commit updates the test suite of the Crown Jewel service. An object is fetched from the backend before updating its expiry time, ensuring the revision is populated. In addition, a new test is introduced to handle the scenario where the revision is missing when updating a Crown Jewel.
* Refactor protobuf marshaling with utils
This commit replaces the usage of the `protojson` method for marshaling and unmarshaling protobuf objects in `crown_jewel.go` with the `FastMarshal` and `FastUnmarshal` methods from `utils`.
protojson is failing to unmarshal resources.
* Update CrownJewel test and serialization methods
Updated the test condition in crown_jewels_test.go to use Proto.Equal for object comparisons. Also, swapped out the FastMarshal and FastUnmarshal methods with protojson's Marshal and Unmarshal in the CrownJewels service.
* Add missing license
---------
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* fix: prevent deleting AWS OIDC integration used by EAS
The External Audit Storage feature for Teleport Cloud depends on an AWS
OIDC integration to exist in order to get credentials for the customer
AWS account.
It's currently possible for a customer to delete the AWS OIDC
integration referenced by the EAS configuration, leading to the EAS
integration breaking and the Auth service crashing the next time it's
started up.
This commit prevents deleting an AWS OIDC integration currently
referenced by and EAS integration, and prevents creating an EAS
integration referencing an unknown AWS OIDC integration.
* use PreDeleteCheck instead of calling EAS service
* reorder tests and add missing cleanup
* create integrations svc on the fly
* switch to AtomicWrite
* set revision of returned resources
* deprecate gRPC DeleteAllIntegrations and use more general cacheMode
* Don't watch web sessions with secrets by default; Deny users from watching web session secrets.
* Add backwards compatibility logic for old proxies
Fallback to web session permissions for users watching with secrets
Fix uncaught merge conflict
* CopyWithoutSecrets without proto.Clone to avoid gogoproto issue.
* Revert WebSession.CopyWithoutSecrets rename and instead add special case in fanoutv2.go since WebSessions can not implement ResourceWithSecrets without affecting upstream consumers negatively.
* Address slice iteration comment.
* Add conditional update methods for `AccessList` and `AccessListMembers`
This PR adds two new methods for conditinally update an AccessList and
AccessListMember resources to avoid overriding changed resources.
This is a preparation for a ineligible status reconciler.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Update lib/services/simple/access_list.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* handle review comments and drop copy methods
* simplify code
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
The existing resource parser was converted to use typical under
the hood. Aside from the type safety improvements the making the
switch allows a single predicate expression to be parsed once and
evaluated per resource. The previous parser worked backwards, it
created a parser per resource with the same expression which lead
to elevated memory consumption and poor performance.
An additional bug was fixed that prevented predicate filtering from
working properly with the unified resource API due to applying
predicates prior to filtering by kind. This resulted in queriers
for server specific things (resource.spec.hostname) to fail even
when only the server resource was specified in the resource kinds.
Benchamrk results for the changes in this commit compared to master
show a 75% reduction in the test time and a 96% reduction in allocations
during the tests.
```bash
$ benchstat e77e5e080b1848da830a9030d43c38be55a5b8d5.txt 8eff752a93dfe96225a71431af829015e83400fa.txt
goos: darwin
goarch: arm64
pkg: github.com/gravitational/teleport/lib/auth
│ e77e5e080b1848da830a9030d43c38be55a5b8d5.txt │ 8eff752a93dfe96225a71431af829015e83400fa.txt │
│ sec/op │ sec/op vs base │
ListUnifiedResourcesFilter/labels-12 73.88m ± 1% 64.74m ± 6% -12.37% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_path-12 294.06m ± 20% 74.83m ± 5% -74.55% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_index-12 307.63m ± 4% 76.32m ± 4% -75.19% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_lower-12 130.7m ± 5% 130.5m ± 4% ~ (p=0.971 n=10)
ListUnifiedResourcesFilter/search_upper-12 147.4m ± 5% 138.7m ± 2% -5.87% (p=0.003 n=10)
ListUnifiedResources/simple_labels-12 1.748 ± 2% 1.744 ± 2% ~ (p=0.631 n=10)
geomean 246.6m 150.6m -38.93%
│ e77e5e080b1848da830a9030d43c38be55a5b8d5.txt │ 8eff752a93dfe96225a71431af829015e83400fa.txt │
│ B/op │ B/op vs base │
ListUnifiedResourcesFilter/labels-12 735.2Ki ± 0% 724.6Ki ± 1% -1.44% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_path-12 238.873Mi ± 0% 7.585Mi ± 0% -96.82% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_index-12 238.869Mi ± 0% 7.587Mi ± 0% -96.82% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_lower-12 16.77Mi ± 0% 16.77Mi ± 0% ~ (p=0.436 n=10)
ListUnifiedResourcesFilter/search_upper-12 16.78Mi ± 0% 16.76Mi ± 0% ~ (p=0.052 n=10)
ListUnifiedResources/simple_labels-12 1.272Gi ± 0% 1.273Gi ± 0% ~ (p=0.739 n=10)
geomean 49.67Mi 15.69Mi -68.41%
│ e77e5e080b1848da830a9030d43c38be55a5b8d5.txt │ 8eff752a93dfe96225a71431af829015e83400fa.txt │
│ allocs/op │ allocs/op vs base │
ListUnifiedResourcesFilter/labels-12 11.45k ± 0% 11.41k ± 0% -0.37% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_path-12 4962.0k ± 0% 161.5k ± 0% -96.75% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_index-12 4812.0k ± 0% 161.5k ± 0% -96.64% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_lower-12 161.6k ± 0% 161.6k ± 0% ~ (p=0.419 n=10)
ListUnifiedResourcesFilter/search_upper-12 161.7k ± 0% 161.6k ± 0% ~ (p=0.116 n=10)
ListUnifiedResources/simple_labels-12 23.70M ± 0% 23.70M ± 0% +0.01% (p=0.019 n=10)
geomean 743.7k 238.5k -67.93%
```
This PR adds the `patch_type` to `KubernetesWaitingContainer` objects.
This patch type is used to decode the contents correctly depending on
different patch strategies allowed by Kubernetes clients.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* add kubernetes waiting container backend service and API
* remove other resource type
* add unit test
* fix after rebasing
* address feedback
* remove KubeWaitingContainerRequest
* check for nil in validation func
* remove UnwrapResource153
* fix test
* address feedback
* address linter issues
* fix cache watch kind test
* Remove logging from circuit breaker
The logging is never output, and if it was would be very verbose.
Instead of dropping the level down to trace the logger is removed
entirely.
* Add constants from trace library
The logging functionality in trace is being removed in an upcoming
release. To prepare the logging component keys are copied from trace
into teleport.
* Convert trace.ComponentFields to teleport.ComponentFields
* Replace trace.Component with teleport.ComponentKey
* Replace trace logging constants
* AWSOIDC: Move enrollment of EKS clusters to the gRPC service.
* Fix after rebase.
* Add EKS auto discovery for dynamic integration based fetchers.
* Remove commented code.
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Remove unneeded code.
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
* Add missing godoc.
* Initiate map with length.
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Fix typo in the interface name.
* Introduce iam join method for EKS enrollment.
* Correctly process DiscoveredEKSCluster in kube watcher.
* Remove remaining CreateToken related code from Discovery service.
* Change var initialization.
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Remove dev version detection for EKS enrollment.
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Revert "Introduce iam join method for EKS enrollment."
This reverts commit 0eb3f4f1226239a5d4e768ebe9129535be318ccb.
* Fix usage of a missing function.
* Refactor cluster features to be a function.
* Change discovery to use gRPC call for EKS enrollment.
* Remove unused mock.
* Correct a comment.
* Remove token creation permission from Discovery service.
* Fix after rebase.
* Improve sorting clusters by region and integration.
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Return and error if cluster features are missing.
* Fix tests.
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
The access list interface now supports counting members without unmarshaling.
This method has been added to the generic backend service as well. This will
allow for quicker counts when necessary. This method has been added to the
cache.
Additionally, a status field as per RFD-153 has been added to access lists
that will house the new optional member count field.
* Remove marshal options from GetSessionRecordingConfig
* Add SessionRecordingConfig support to cluster configuration RPC service
Extends the clusterconfigv1.Service to implement RPCs for interacting
with SessionRecordingConfig. The various GetSessionRecordingConfig
interfaces were also all updated to remove the marshal options since
they were never used and served no purpose.
* Remove marshal options from GetClusterNetworkingConfig
* Add ClusterNetworkingConfig support to cluster configuration RPC service
Extends the clusterconfigv1.Service to implement RPCs for interacting
with ClusterNetworkingConfig. The various GetClusterNetworkingConfig
interfaces were also all updated to remove the marshal options since
they were never used and served no purpose.
When relative node expiry was originally implemented it only ran
on Auth and propagated delete events downstream. However, that
was quickly changed in #12002 because the event system could not
keep up in clusters with high churn and would result in buffer
overflow errors in downstream caches. The event system has been
overhauled to use FanoutV2, which no longer suffers from the
burst of events causing problems. The change to not propagate
delete events also breaks any node watchers on the local
cache from ever expiring the server since they never receive
a delete event.
This reverts some of the changes from #12002 such that relative
expiry now only runs on the auth cache and emits delete events.
Each relative expiry interval is however still limited to only
remove up to a fixed number of nodes.
Closes#37527
ListAppSessions was never added to the `auth.Cache` interface or
implemented by `cache.Cache` which means all session listing was
using the backend as the data source. This could cause backend
throttling if the number of sessions was large enough.
* split database CA into server/client CAs
* update migration logging
* include auth component in migrations
* debug log when skipping db client ca migration
* update tctl auth sign for cockroachdb
* update tctl auth sign for oracle
* set ExtKeyUsage for DB certs
* clientAuth for DB Client CA
* serverAuth for DB Server CA
* inject filter for pre-v14.3.1 clients
* inject a filter instead of dropping events in grpcserver
* add DatabaseClientCA type
* debug log when skipping filter injection
* update CA filter injection version check func name and doc
* fix WatchKind.Contains for ca filter
* add CA filter to caCollector
* require CA types in CA watcher config
* apply ca filter in EventsService parser
* Add access lists, members, and reviews to cache.
Access lists, members, and reviews have been added to the cache. To do this,
I have created a simple backend that doesn't perform the validation that is
performed by the main access list backend and only implements a subset of
actions that are needed by the cache.
To support this, I've added in new gRPC methods:
ListAllAccessListMembers and ListAllAccessListReviews. These do not lock
any access lists and additionally do not perform any implicit or dynamic
members, but just simply return the full list of all members and reviews
so that these endpoints can be used to populate the cache.
The general thought here that, since the order of cache events cannot be
guaranteed, we'll rely on the auth server to perform the proper backend
validation and use a simplified backend that simply sees if the items
are present in the cache. If so, we'll return them.
I've had to update a few protos to support this. While I was here, I
fixed a bug in the access list gRPC client where the call tolist of reviews
was not supplying the access list name. Additionally, the user login
state generator will now use the cached access list values.
* Move simple backend to lib/services/simple
* Update to reflect new generic function signatures.
Prefer the stdlib version of the experimental package.
Includes a depguard update to prevent future regressions,
as well as an e-ref update to appease depguard.
Generated with:
$ gofmt -w -r '"golang.org/x/exp/slices" -> "slices"' . && \
make fix-imports
* Discovery: Use Integration credentials for fetchers
* fix typos, improve docs, add clients.closer
* be explicit about using ambient or integration credentials
* remove integration assignment when using ambient credentials
* be explicit about using ambient credentials in db service
* fix cache key for region only sessions
* re-trigger license/cla check
* Add user login state original traits and indicator that original values set.
Original traits has been added to the user login state for use by a watcher in
the enterprise repo that will react to user access changes. This field will be
used to rebuild the last known good state when user access changes.
Additionally, an internal annotation that indicates the original role/trait
fields have been set in the user login state has been introduced so that the
watcher knows whether the user login state can be used by this watcher.
* GCI.
* Tweak tests.
* Further tweak tests.
* Formatting.
* Fix missing argument.
* Standardize delete comment.
Listing users is different from most existing list operations
because multiple resource types are stored under the users prefix.
Care was taken to ensure that these extra resources(passwords,
mfa devices, etc) do not cause lising to omit any users.
In addition to adding server and backend handling for create and
update roles, the services.Access interface was updated to return
a role from the existing Create/UpsertRole methods. Bumps the e
ref to incorporate the associated changes needed there to prevent
breaking the build.
The access lists and members have been removed from the cache. There's not
a lot of value having them in there and they create some uncomfortable
questions since members are dependent on access lists and the cache isn't
designed for dependent operations like this. By removing them we avoid a
lot of pain here.
* DiscoveryConfig: init service and add it to `tctl`
This PR starts the DiscoveryConfig service in gRPC server and allows
`tctl` to interact with those records.
It also adds access to the `editor` role.
Users should be able to RW any DiscoveryConfig.
DiscoveryService should be able to watch those resources, so that it can
act upon any changes.
* add revision
* add upsert method
* improve tctl -f command
* Update e ref
* Complete services.Users interface refactoring
Removes temporary functions required to migrate the interface
without breaking e.
Closes#32949.
services.UsersService now takes a context and returns the user
from write operations as shown in the diff below. The bulk of the
changes are from modifying code to account for the additional
parameter and/or return value. Functional changes to better make
use of the new API will come in follow up PRs.
```diff
// UserGetter is responsible for getting users
type UserGetter interface {
// GetUser returns a user by name
- GetUser(user string, withSecrets bool) (types.User, error)
+ GetUser(ctx context.Context, user string, withSecrets bool) (types.User, error)
}
// UsersService is responsible for basic user management
type UsersService interface {
UserGetter
// CreateUser creates user, only if the user entry does not exist
- CreateUser(user types.User) error
+ CreateUser(ctx context.Context, user types.User) (types.User, error)
// UpdateUser updates an existing user.
- UpdateUser(ctx context.Context, user types.User) error
+ UpdateUser(ctx context.Context, user types.User) (types.User, error)
// UpdateAndSwapUser reads an existing user, runs `fn` against it and writes
// the result to storage. Return `false` from `fn` to avoid storage changes.
// Roughly equivalent to [GetUser] followed by [CompareAndSwapUser].
// Returns the storage user.
UpdateAndSwapUser(ctx context.Context, user string, withSecrets bool, fn func(types.User) (changed bool, err error)) (types.User, error)
// UpsertUser updates parameters about user
- UpsertUser(user types.User) error
+ UpsertUser(ctx context.Context, user types.User) (types.User, error)
// CompareAndSwapUser updates an existing user, but fails if the user does
// not match an expected backend value.
CompareAndSwapUser(ctx context.Context, new, existing types.User) error
// DeleteUser deletes a user with all the keys from the backend
DeleteUser(ctx context.Context, user string) error
// GetUsers returns a list of users registered with the local auth server
- GetUsers(withSecrets bool) ([]types.User, error)
+ GetUsers(ctx context.Context, withSecrets bool) ([]types.User, error)
// DeleteAllUsers deletes all users
- DeleteAllUsers() error
+ DeleteAllUsers(ctx context.Context) error
}
```
Depends on gravitational/teleport.e#2346
Implements step 3 of #32949
* Start migrating services.Identity to use context and return users
Adds new variants of existing methods that are going to be updated
to support propagating context and return users from create, update
and upsert. This is an unfortunate step required because e utilizes
the interface for various functionality. In order to prevent breaking
builds, the temporary methods were added so that e can be converted
to them first, then oss can be updated to the new version of the
interface. Once that is done e will be converted and then the temp
methods will be removed.
* fix typos in comment
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* fix: don't set metadata on existing item in CAS
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* fix: gci
* fix: set resource id on update
---------
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
Access Lists now have audit review recurrence presets. These allow users to
specify review frequencies of 1, 3, 6, or 12 months, and specify the 1st,
15th, or last days of the target month. Presets have been used for their
simplicity over other various recurrence definition mechanisms, as these
presets are much clearer than many of the other options.
Yassine Bounekhla