* Update labels datatype in Teleport crownjewel proto
This commit modifies the labels from a map to repeated TeleportLabel in CrownJewel proto, and accordingly updates the getter function in proto generated code. The newly introduced TeleportLabel type contains a Key and repeated values for improved flexibility.
Clean up
Update and restructure CrownJewel service proto
The code modifications include renaming and restructuring several types and altering various functions in the CrownJewel service proto. Major changes involve renaming DeleteCrownJewel
Rename 'kind' to 'kinds' in crownjewel API
This commit changes the 'kind' field to 'kinds' in the crownjewel API to better reflect its purpose of holding multiple resource types. Changes are made across several files - 'crownjewel.go', 'crownjewel.pb.go' and 'crownjewel.proto'.
After rebase fixes
Remove CrownJewel type from several files
This commit represents the removal of the CrownJewel type from several files. CrownJewel type references are deleted in certain Go files, and imports of CrownJewel in multiple files are being adjusted. The specifics of why this type is removed is not evident from the diffs, but the deletions will affect the related functionalities.
Add CrownJewel update functionality
This update enables the 'UpdateCrownJewel' functionality. If a 'CrownJewel' resource already exists, it can now be updated instead of returning an error. This enhances flexibility when dealing with resource management. It also introduces the ARN field into the 'AWSMatcher' service.
Update CrownJewel service with pagination and improve matchers
This update adds pagination to the CrownJewel service for more efficient data handling. It also improves the matching capabilities with the inclusion of Teleport and AWS matchers and allows for selective querying with these matchers. Additionally, it includes various changes to structure and naming for better clarity and ease of use.
Refactor CrownJewel protos to use ResourceHeader
This refactoring replaces the previous structure of CrownJewel proto's fields Kind, Sub_kind, Version, and Metadata with a single object called Header (ResourceHeader). It simplifies the code structure and harmonizes it with other protos. Now, Header contains the essential attributes that were previously distributed across multiple separate fields.
Add GetCrownJewels method to cache and accessgraph
The function GetCrownJewels has been added to the cache and the accessgraph. It retrieves all CrownJewel instances from the cache. Additionally, CrownJewel retrieval functionality has been removed from auth server and existing usages have been refactored.
Implement Crown Jewel creation feature
Updated the method `createCrownJewel` in the resources command to handle Crown Jewel creation. Introduced a new gRPC service `crownjewelv1` to handle client-server interactions for Crown Jewel objects. Crown Jewel expiry configuration has now also been enabled.
Add missing files
I have no words...
Update authentication and event handling
Refactored the argument from 'auth.ClientI' to '*auth.Client' in 'createCrownJewel' function in 'resource_command.go'. Removed unused import 'durationpb' in 'auth_with_roles.go'. Added a new event code 'AccessGraphAccessPathChangedCode' in 'codes.go' and 'AccessGraphAccessPathChanged' in 'api.go' for better monitoring and logging of access path changes.
Add access path changed event and relevant changes.
update api
add grpc
update api
add cache support
add protos
* Fixes after rebase
* Refactor Crown Jewel resource methods
Updated API methods related to the Crown Jewel resource to improve clarity and consistency. Renamed `GetCrownJewels` to `ListCrownJewels`, added pagination parameters, and ensured uniform handling of the Crown Jewel resource across different parts of the codebase. Updated relevant comments for better code understanding.
* Removed CrownJewel converter, updated CrownJewel references
This commit removes the CrownJewel converter and updates references from the old CrownJewel type to the new protobuf-defined CrownJewel type, streamlining the codebase. The commit also disables CrownJewel deletion since it is not supported yet. Some minor errors were fixed regarding CrownJewel resource names.
* Implement Crown Jewel deletion functionality
The crown jewel deletion feature has been enabled by uncommenting and simplifying the code block. Now, the delete action is directly performed on the specific 'crown jewel' mentioned based on its name. The previously unsupported action returns an informative success message after the deletion.
* Refactored function 'allCombinations' and added authorization checks
Moved 'allCombinations' function into 'utils' package, renamed it to 'Combinations', and updated its references in 'dbobjectimportrulev1' and 'dbobjectv1' tests. Additionally, introduced admin authorization checks to 'CreateCrownJewels', 'UpdateCrownJewels', and 'DeleteCrownJewels'. Created corresponding tests for these changes.
* Add CrownJewel service to cache tests
The CrownJewel service has been added to the cache test file. The service creation is implemented and assigned to new fields in multiple methods within the cache tests. A new test function `TestCrownJewel` has also been added to validate CRUD operations for the service.
* Add access path changed event and update Crown Jewel tests
Added a new event code for when an access path changes in the access graph, and introduced new API calls to handle these situations. Also, updated crown jewel related tests and fixed copyright year in several files.
* Update protobuf import path
The protobuf import path was updated from "github.com/golang/protobuf/proto" to "google.golang.org/protobuf/proto" to ensure correct use and to prevent potential issues, while maintaining functionality in crown_jewels.go.
* Refactor CrownJewel and AccessGraph services
This commit optimizes the ListCrownJewelsResponse in the CrownJewel service by directly assigning the response instead of using an extra loop. Additionally, the EventsStream in the AccessGraph service and related tests have been updated to EventsStreamV2, reflecting the implementation of new versions of these methods.
* Add CrownJewel resource in access controls and tests
In both the cache test and access control files, CrownJewel resource has been included. This provides the system's ability to manage and test CrownJewel resources. Additionally, it allows the handling of CrownJewel resources in client events.
* Simplify implementation
* Update copyright dates and add license headers
Updated the copyright dates in several files to reflect the new year. Additionally, license headers have been added to some files where they were previously missing, ensuring the proper copyrights and GPL notice are visible.
* Refactor CrownJewel codebase for better readability
Fixed various typographical errors in CrownJewel's related functions and removed a TODO comment. Improved function and function calls' names that were incorrectly referring to different modules, making the code easier to read and understand across different CrownJewel services.
* Add validation for Teleport and AWS matchers in service
The validation has been added for Teleport and AWS matchers in the service layer to ensure that essential details are not missed when setting matchers. This includes checks to ensure that kinds and labels for Teleport, and types and tags for AWS matchers are properly set.
* gci
* Add CrownJewel update functionality and refactor related services
This commit adds the ability to update a CrownJewel resource within the ResourceCommand. It also includes refactoring of related services, condensed code logic, and improved utilization of existing methods for marshaling/unmarshaling CrownJewel. Specific changes in service.go and crown_jewels.go files have reduced code redundancy and enhanced the code structure.
* Relocate and update crown_jewels_test file
This commit moves the crown_jewels_test from the local to the services library and adds test cases for unmarshalling Crown Jewels data. Also, import statements for labelv1 and utils were introduced to support these changes.
* Update crown jewels test with AWS matchers
Revised the crown jewels test file by including AWS matchers section in the CrownJewel object. The change ensures to specifically match AWS infrastructure following certain parameters, thus enhancing the specificity and flexibility of our matchers. Apart from this, minor reordering of objects has also been done for better code organization.
* Added upsertCrownJewel function and related proto message
The commit adds the UpsertCrownJewel function in the service.go file, which enables upsert operations on crown jewel resources. Alongside, the UpsertCrownJewelRequest proto message is added to the crownjewel_service.pb.go file to handle such requests.
* Refactor CrownJewelsClient to use upsert
This change refactors the CrownJewelsClient to use the upsert method when the force flag is on. The code has been streamlined by eliminating the need for 'already exist' error checking and separate create and update methods.
* Add GetCrownJewel functionality and refactor validation
A GetCrownJewel function has been added to the Service, which retrieves a specific CrownJewel resource. Also, the CrownJewel validation process has been refactored, moving the validateCrownJewel function from service.go into the crownjewel library and renaming it to ValidateCrownJewel. These changes improve modularity and code organization.
* Add VerbCreate check and test for CrownJewel validation
The checkAccessToKind function now also checks for the VerbCreate permission. Additionally, a new test file, object_test.go, was added to validate the functionality of the CrownJewel object. This includes various validation checks such as "NilCrownJewel", "ValidCrownJewel", "MissingMatchers", among others.
* Refactor CrownJewel resource handling and validation
The codebase was updated to improve CrownJewel resources handling. This includes modifications to list, get, create, update, upsert, and delete functions in several files. Additionally, a validation function has been implemented for CrownJewel objects, ensuring required fields are present. Depreciated logger service has also been removed.
* Add cache implementation to CrownJewel service
The CrownJewel service has been enhanced by integrating it with cache. The main changes include adding "Cache" as part of ServiceConfig and using cache to fetch crown jewels instead of directly using the backend services. The cache interface with the methods "ListCrownJewels" and "GetCrownJewel" has been added to handle these operations.
* Add Cache to service configuration in crownjewelv1 tests
In this commit, we added the Cache field to the service configuration used in the tests for the crownjewelv1 service. This ensures that the service configuration used in the tests matches the expected real-world configuration.
* Update CrownJewelsService to use ConditionalUpdateResource
This commit changes the CrownJewelsService's `UpdateCrownJewel` method to use the `ConditionalUpdateResource` method instead of the `UpdateResource` method. This change will provide a more appropriate update strategy for the specific needs of the CrownJewelsService.
* Replace 'Cache' with 'Reader' in crownjewel service & remove DeleteAllCrownJewelsRequest
The 'Cache' in crownjewel service has been replaced with 'Reader' to improve code readability and to match with its functionality. Also, the DeleteAllCrownJewelsRequest functionality was removed as it posed a high risk potential for data loss and it wasn
* Update tests for Crown Jewel service
This commit updates the test suite of the Crown Jewel service. An object is fetched from the backend before updating its expiry time, ensuring the revision is populated. In addition, a new test is introduced to handle the scenario where the revision is missing when updating a Crown Jewel.
* Refactor protobuf marshaling with utils
This commit replaces the usage of the `protojson` method for marshaling and unmarshaling protobuf objects in `crown_jewel.go` with the `FastMarshal` and `FastUnmarshal` methods from `utils`.
protojson is failing to unmarshal resources.
* Update CrownJewel test and serialization methods
Updated the test condition in crown_jewels_test.go to use Proto.Equal for object comparisons. Also, swapped out the FastMarshal and FastUnmarshal methods with protojson's Marshal and Unmarshal in the CrownJewels service.
* Add missing license
---------
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* fix: prevent deleting AWS OIDC integration used by EAS
The External Audit Storage feature for Teleport Cloud depends on an AWS
OIDC integration to exist in order to get credentials for the customer
AWS account.
It's currently possible for a customer to delete the AWS OIDC
integration referenced by the EAS configuration, leading to the EAS
integration breaking and the Auth service crashing the next time it's
started up.
This commit prevents deleting an AWS OIDC integration currently
referenced by and EAS integration, and prevents creating an EAS
integration referencing an unknown AWS OIDC integration.
* use PreDeleteCheck instead of calling EAS service
* reorder tests and add missing cleanup
* create integrations svc on the fly
* switch to AtomicWrite
* set revision of returned resources
* deprecate gRPC DeleteAllIntegrations and use more general cacheMode
* Don't watch web sessions with secrets by default; Deny users from watching web session secrets.
* Add backwards compatibility logic for old proxies
Fallback to web session permissions for users watching with secrets
Fix uncaught merge conflict
* CopyWithoutSecrets without proto.Clone to avoid gogoproto issue.
* Revert WebSession.CopyWithoutSecrets rename and instead add special case in fanoutv2.go since WebSessions can not implement ResourceWithSecrets without affecting upstream consumers negatively.
* Address slice iteration comment.
* Add conditional update methods for `AccessList` and `AccessListMembers`
This PR adds two new methods for conditinally update an AccessList and
AccessListMember resources to avoid overriding changed resources.
This is a preparation for a ineligible status reconciler.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Update lib/services/simple/access_list.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* handle review comments and drop copy methods
* simplify code
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
The existing resource parser was converted to use typical under
the hood. Aside from the type safety improvements the making the
switch allows a single predicate expression to be parsed once and
evaluated per resource. The previous parser worked backwards, it
created a parser per resource with the same expression which lead
to elevated memory consumption and poor performance.
An additional bug was fixed that prevented predicate filtering from
working properly with the unified resource API due to applying
predicates prior to filtering by kind. This resulted in queriers
for server specific things (resource.spec.hostname) to fail even
when only the server resource was specified in the resource kinds.
Benchamrk results for the changes in this commit compared to master
show a 75% reduction in the test time and a 96% reduction in allocations
during the tests.
```bash
$ benchstat e77e5e080b1848da830a9030d43c38be55a5b8d5.txt 8eff752a93dfe96225a71431af829015e83400fa.txt
goos: darwin
goarch: arm64
pkg: github.com/gravitational/teleport/lib/auth
│ e77e5e080b1848da830a9030d43c38be55a5b8d5.txt │ 8eff752a93dfe96225a71431af829015e83400fa.txt │
│ sec/op │ sec/op vs base │
ListUnifiedResourcesFilter/labels-12 73.88m ± 1% 64.74m ± 6% -12.37% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_path-12 294.06m ± 20% 74.83m ± 5% -74.55% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_index-12 307.63m ± 4% 76.32m ± 4% -75.19% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_lower-12 130.7m ± 5% 130.5m ± 4% ~ (p=0.971 n=10)
ListUnifiedResourcesFilter/search_upper-12 147.4m ± 5% 138.7m ± 2% -5.87% (p=0.003 n=10)
ListUnifiedResources/simple_labels-12 1.748 ± 2% 1.744 ± 2% ~ (p=0.631 n=10)
geomean 246.6m 150.6m -38.93%
│ e77e5e080b1848da830a9030d43c38be55a5b8d5.txt │ 8eff752a93dfe96225a71431af829015e83400fa.txt │
│ B/op │ B/op vs base │
ListUnifiedResourcesFilter/labels-12 735.2Ki ± 0% 724.6Ki ± 1% -1.44% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_path-12 238.873Mi ± 0% 7.585Mi ± 0% -96.82% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_index-12 238.869Mi ± 0% 7.587Mi ± 0% -96.82% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_lower-12 16.77Mi ± 0% 16.77Mi ± 0% ~ (p=0.436 n=10)
ListUnifiedResourcesFilter/search_upper-12 16.78Mi ± 0% 16.76Mi ± 0% ~ (p=0.052 n=10)
ListUnifiedResources/simple_labels-12 1.272Gi ± 0% 1.273Gi ± 0% ~ (p=0.739 n=10)
geomean 49.67Mi 15.69Mi -68.41%
│ e77e5e080b1848da830a9030d43c38be55a5b8d5.txt │ 8eff752a93dfe96225a71431af829015e83400fa.txt │
│ allocs/op │ allocs/op vs base │
ListUnifiedResourcesFilter/labels-12 11.45k ± 0% 11.41k ± 0% -0.37% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_path-12 4962.0k ± 0% 161.5k ± 0% -96.75% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_index-12 4812.0k ± 0% 161.5k ± 0% -96.64% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_lower-12 161.6k ± 0% 161.6k ± 0% ~ (p=0.419 n=10)
ListUnifiedResourcesFilter/search_upper-12 161.7k ± 0% 161.6k ± 0% ~ (p=0.116 n=10)
ListUnifiedResources/simple_labels-12 23.70M ± 0% 23.70M ± 0% +0.01% (p=0.019 n=10)
geomean 743.7k 238.5k -67.93%
```
* add kubernetes waiting container backend service and API
* remove other resource type
* add unit test
* fix after rebasing
* address feedback
* remove KubeWaitingContainerRequest
* check for nil in validation func
* remove UnwrapResource153
* fix test
* address feedback
* address linter issues
* fix cache watch kind test
* Remove logging from circuit breaker
The logging is never output, and if it was would be very verbose.
Instead of dropping the level down to trace the logger is removed
entirely.
* Add constants from trace library
The logging functionality in trace is being removed in an upcoming
release. To prepare the logging component keys are copied from trace
into teleport.
* Convert trace.ComponentFields to teleport.ComponentFields
* Replace trace.Component with teleport.ComponentKey
* Replace trace logging constants
* AWSOIDC: Move enrollment of EKS clusters to the gRPC service.
* Fix after rebase.
* Add EKS auto discovery for dynamic integration based fetchers.
* Remove commented code.
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Remove unneeded code.
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
* Add missing godoc.
* Initiate map with length.
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Fix typo in the interface name.
* Introduce iam join method for EKS enrollment.
* Correctly process DiscoveredEKSCluster in kube watcher.
* Remove remaining CreateToken related code from Discovery service.
* Change var initialization.
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Remove dev version detection for EKS enrollment.
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Revert "Introduce iam join method for EKS enrollment."
This reverts commit 0eb3f4f1226239a5d4e768ebe9129535be318ccb.
* Fix usage of a missing function.
* Refactor cluster features to be a function.
* Change discovery to use gRPC call for EKS enrollment.
* Remove unused mock.
* Correct a comment.
* Remove token creation permission from Discovery service.
* Fix after rebase.
* Improve sorting clusters by region and integration.
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Return and error if cluster features are missing.
* Fix tests.
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
The access list interface now supports counting members without unmarshaling.
This method has been added to the generic backend service as well. This will
allow for quicker counts when necessary. This method has been added to the
cache.
Additionally, a status field as per RFD-153 has been added to access lists
that will house the new optional member count field.
* Remove marshal options from GetSessionRecordingConfig
* Add SessionRecordingConfig support to cluster configuration RPC service
Extends the clusterconfigv1.Service to implement RPCs for interacting
with SessionRecordingConfig. The various GetSessionRecordingConfig
interfaces were also all updated to remove the marshal options since
they were never used and served no purpose.
* Remove marshal options from GetClusterNetworkingConfig
* Add ClusterNetworkingConfig support to cluster configuration RPC service
Extends the clusterconfigv1.Service to implement RPCs for interacting
with ClusterNetworkingConfig. The various GetClusterNetworkingConfig
interfaces were also all updated to remove the marshal options since
they were never used and served no purpose.
When relative node expiry was originally implemented it only ran
on Auth and propagated delete events downstream. However, that
was quickly changed in #12002 because the event system could not
keep up in clusters with high churn and would result in buffer
overflow errors in downstream caches. The event system has been
overhauled to use FanoutV2, which no longer suffers from the
burst of events causing problems. The change to not propagate
delete events also breaks any node watchers on the local
cache from ever expiring the server since they never receive
a delete event.
This reverts some of the changes from #12002 such that relative
expiry now only runs on the auth cache and emits delete events.
Each relative expiry interval is however still limited to only
remove up to a fixed number of nodes.
Closes#37527
ListAppSessions was never added to the `auth.Cache` interface or
implemented by `cache.Cache` which means all session listing was
using the backend as the data source. This could cause backend
throttling if the number of sessions was large enough.
* fix WatchKind.Contains for ca filter
* add CA filter to caCollector
* require CA types in CA watcher config
* apply ca filter in EventsService parser
* Add access lists, members, and reviews to cache.
Access lists, members, and reviews have been added to the cache. To do this,
I have created a simple backend that doesn't perform the validation that is
performed by the main access list backend and only implements a subset of
actions that are needed by the cache.
To support this, I've added in new gRPC methods:
ListAllAccessListMembers and ListAllAccessListReviews. These do not lock
any access lists and additionally do not perform any implicit or dynamic
members, but just simply return the full list of all members and reviews
so that these endpoints can be used to populate the cache.
The general thought here that, since the order of cache events cannot be
guaranteed, we'll rely on the auth server to perform the proper backend
validation and use a simplified backend that simply sees if the items
are present in the cache. If so, we'll return them.
I've had to update a few protos to support this. While I was here, I
fixed a bug in the access list gRPC client where the call tolist of reviews
was not supplying the access list name. Additionally, the user login
state generator will now use the cached access list values.
* Move simple backend to lib/services/simple
* Update to reflect new generic function signatures.
* Discovery: Use Integration credentials for fetchers
* fix typos, improve docs, add clients.closer
* be explicit about using ambient or integration credentials
* remove integration assignment when using ambient credentials
* be explicit about using ambient credentials in db service
* fix cache key for region only sessions
* re-trigger license/cla check
Listing users is different from most existing list operations
because multiple resource types are stored under the users prefix.
Care was taken to ensure that these extra resources(passwords,
mfa devices, etc) do not cause lising to omit any users.
The access lists and members have been removed from the cache. There's not
a lot of value having them in there and they create some uncomfortable
questions since members are dependent on access lists and the cache isn't
designed for dependent operations like this. By removing them we avoid a
lot of pain here.
* DiscoveryConfig: init service and add it to `tctl`
This PR starts the DiscoveryConfig service in gRPC server and allows
`tctl` to interact with those records.
It also adds access to the `editor` role.
Users should be able to RW any DiscoveryConfig.
DiscoveryService should be able to watch those resources, so that it can
act upon any changes.
* add revision
* add upsert method
* improve tctl -f command
* Update e ref
* Complete services.Users interface refactoring
Removes temporary functions required to migrate the interface
without breaking e.
Closes#32949.
services.UsersService now takes a context and returns the user
from write operations as shown in the diff below. The bulk of the
changes are from modifying code to account for the additional
parameter and/or return value. Functional changes to better make
use of the new API will come in follow up PRs.
```diff
// UserGetter is responsible for getting users
type UserGetter interface {
// GetUser returns a user by name
- GetUser(user string, withSecrets bool) (types.User, error)
+ GetUser(ctx context.Context, user string, withSecrets bool) (types.User, error)
}
// UsersService is responsible for basic user management
type UsersService interface {
UserGetter
// CreateUser creates user, only if the user entry does not exist
- CreateUser(user types.User) error
+ CreateUser(ctx context.Context, user types.User) (types.User, error)
// UpdateUser updates an existing user.
- UpdateUser(ctx context.Context, user types.User) error
+ UpdateUser(ctx context.Context, user types.User) (types.User, error)
// UpdateAndSwapUser reads an existing user, runs `fn` against it and writes
// the result to storage. Return `false` from `fn` to avoid storage changes.
// Roughly equivalent to [GetUser] followed by [CompareAndSwapUser].
// Returns the storage user.
UpdateAndSwapUser(ctx context.Context, user string, withSecrets bool, fn func(types.User) (changed bool, err error)) (types.User, error)
// UpsertUser updates parameters about user
- UpsertUser(user types.User) error
+ UpsertUser(ctx context.Context, user types.User) (types.User, error)
// CompareAndSwapUser updates an existing user, but fails if the user does
// not match an expected backend value.
CompareAndSwapUser(ctx context.Context, new, existing types.User) error
// DeleteUser deletes a user with all the keys from the backend
DeleteUser(ctx context.Context, user string) error
// GetUsers returns a list of users registered with the local auth server
- GetUsers(withSecrets bool) ([]types.User, error)
+ GetUsers(ctx context.Context, withSecrets bool) ([]types.User, error)
// DeleteAllUsers deletes all users
- DeleteAllUsers() error
+ DeleteAllUsers(ctx context.Context) error
}
```
Depends on gravitational/teleport.e#2346
Implements step 3 of #32949
* Start migrating services.Identity to use context and return users
Adds new variants of existing methods that are going to be updated
to support propagating context and return users from create, update
and upsert. This is an unfortunate step required because e utilizes
the interface for various functionality. In order to prevent breaking
builds, the temporary methods were added so that e can be converted
to them first, then oss can be updated to the new version of the
interface. Once that is done e will be converted and then the temp
methods will be removed.
* fix typos in comment
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* fix: don't set metadata on existing item in CAS
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* fix: gci
* fix: set resource id on update
---------
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Add access list members to the cache.
Access list members have been added to the cache. To support this, the access
list member gRPC client methods have been implemented. A few extra gRPC
methods were added to the access list service. Additionally, a few changes
were made to the cache tests since the backend for the access list now
performs multiple backend calls.
* Further tuning of backend.
* Revert removal of access list members assignment.
* Update lib/cache/cache_test.go
Co-authored-by: Jakub Nyckowski <jakub.nyckowski@goteleport.com>
* Remove debugging statements, tune legacy header conversion.
* Remove AccessListMembers reference, as it's no longer needed.
---------
Co-authored-by: Jakub Nyckowski <jakub.nyckowski@goteleport.com>
* Adds a UnifiedResource watcher to the auth server. This watcher
will watch all the types that are displayed in the web UI and store
them in-memory to allow us to search/filter/query and get multiple
kinds returned at the same time.
[RFD](https://github.com/gravitational/teleport/pull/28162)
* Add ListUnifiedResources gRPC and web endpoints (#29661)
Adds the `ListUnifiedResources` grpc endpoint that returns paginated unified resources and exposes it in the web apiserver
* Fix test
* Add user login state to the cache.
The user login state has been added to the cache. This will allow user login
state lookups to be quickly looked up on login.
* Add in user login state service to attach to cache.
* Use fallback for user login state.
* Defer after checking branch, address new logger.
* Add the AccessList to the cache.
The AccessList has been added into the cache. The AccessList resource
and its supporting resources had to be moved back into api for this so that
it can be properly referenced in api/client/events.go, which is necessary
for cache propagation.
* Address remaining lib/types references.
* Add in additional test to events_test.go.
* GCI.
* Add back in client wrapper so that the cache will work properly.
* Traits ToProto order is deterministic.
* Add in compile time access list client check.
* Simplify Okta assignment statuses.
The Okta assignment statuses have been simplfieid so that there's only a
status on the Okta assignment object itself and the number of states is
reduced.
* Fix tests, remove unused code.
* Add in Duration for update statuses to prevent changing status too soon.
* Make sure LastTransition is UTC.
* Remove actions in favor of targets, make cleanup time non-nullable.
* Add CA, Role, Lock AuthPreference RO persmissions to RoleOkta.
RoleOkta now has read only access for CertAuthority, Role, Lock, and
ClusterAuthPreference objects so that it can utilize an authorizer when
redirecting apps.
* Remove lock from Okta cache, remove tasks*.go.
* Allow Okta service reverse tunnel access.
In order to allow the Okta service to be connectable via the reverse
tunnel, the following things were added.
* The cache has permissions to retrieve cluster configuration objects.
While here, I removed access to the App objects, which was not necessary.
* The permissions have been updated to allow for AppServer access and
ClusterNetworkingConfig access.
* The cache has been updated to cache app servers and cluster networking
configuration resources. While here, access to App objects has been
removed.
* The reverse tunnel now recognizes the Okta role.
* Add in ListResources to the Okta access point.
* Remove access to apps and to access requests.
* Add in Semaphore read/write permission.
* Include cache entry for app server. Remove read access for access request.
* Refactor UserGroups local service to use generic service.
The UserGroups local service now uses the generic service. This came about
due to a bug in the pagination logic for the user group listing. This fixes
that issue and simplifies the user group service logic.
* Turn *Svc vars into *Cache vars to make things uniform.
Marek Smoliński