The new subcommand is meant to be a replacement for tbot proxy ssh
which does the ssh proxying entirely within tbot to reduce resource
consumption. The old mechanism spawned a tsh process to perform the
proxying which leads to increased CPU and memory consumption - which
can be quite problematic when used as an OpenSSH ProxyCommand for
an ansible playbook.
The new command also deviates in behavior from tsh proxy ssh in that,
for the moment, it requires users to explicitly dictate whether
tls routing, alpn connection upgrades instead of guessing by making a
call to webapi/ping. This again turns out to be quite resource
intensive when tbot is used as an OpenSSH ProxyCommand for an ansible
playbook.
In the future tbot can look this information up out of band and store
it in the proper location so that tbot ssh-proxy-command can consume
it directly without users needing to provide it. The behavior as is
provides a path toward the future while also allowing users to gain
the performance improvements now.
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Add backend handler for Web UI kube exec functionality.
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Log error on sending it to websockete connection.
* Remove duplicate user key creation.
* Use scoped context.
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Use local site cache.
* Simplify creating rest kube rest config.
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Don't set stdErr on pod execution options, if it's interactive shell.
* Don't use public proxy addr when getting kubeconfig server address/name.
* Don't set stdErr on stream options if it's interactive shell.
* Provide local host CA to podHandler directly, instead of access point.
* Add integration test for kube exec handler.
* Use read deadline instead of closing reader.
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* dont allow disabling second factor
* update docs for 2fa change
* add environmental variable to work around disabled 2fa
* check if its cloud
* update todos
* add a test
* introduce insecure test mode
* fixes for tests
* add spanner to tsh and teleterm
* handle spanner events in web ui
* update web audit events test snapshot
* customize web ui connect for spanner
* update ConnectDialog snapshot
* Add CreateAppSessionFromReq.
* Deprecate passing route_to_app.session_id in cert requests.
* Automatically create app sessions for app cert requests.
* Deprecate client use of CreateAppSession for app cert requests.
* Fix affected tests.
* Use traits and roles from existing user certificate for app sessions.
* Fix app access integration tests.
* go mod tidy.
* Fix TestTCP.
* Fix TestALPNSNIProxyAppAccess.
* Revert "go mod tidy."
This reverts commit cc6caa2485.
* Convert recursive listing to use Proxy gRPC API
Removes deprecated usage of ProxyClient in getClusterClients used
for tsh ls -R and tsh db ls -R.
* Remove unsued helper functions
* Replace removed test
* Remove unused db listing function
* convert tsh apps ls -R and tsh kube ls -R
* remove unused function and tweak IsExpired
* create common testcase for listing resources
Updates the proxy.Client to allow loading specific tls.Config for
individual clusters. This prevents issues when trying to access
leaf resources via the root cluster if WithAllCAs is not set.
Replaces the legacy ssh connection mechanism to the proxy for kube
presence checks with the new gPRC mechanism. In the future the
handleMFA function should be refactored to be passed in an auth
client instead of creating a new connection to the proxy and auth
server to reduce latency.
Replaces the deprecated SSH connection mechanism to the cluster
in favor of using the gRPC mechanism. The WithRootClusterClient
has also been deprecated as it requires at worst two dials to
a Teleport cluster for a single function. Callers should instead
explicitly create and reuse clients where possible so that no
extraneous dialing is required for each action being performed
against a cluster.
Updates the ClusterClient to support issuing user certificates,
possibly with MFA, for all protocols. This should be the last
bit of functionality required to allow Connect to convert to
using the ClusterClient. Once that is done the deprecated
ProxyClient should be one step closer to deletion.
Updates #38239
Updating the ClusterClient to support generating new user certs
covers some of the exiting missing functionality that is required
by some components to migrate fully off of the deprecated ProxyClient.
The ClusterClient implementation is almost a verbatim copy from
the ProxyClient.
The ProxyClient method was not removed because Connect does not
use the ClusterClient yet. That will be addressed after the
ClusterClient has complete feature parity with the ProxyClient.
Updates #38239.
* Use dbcmd.WithPrintFormat only for preview of teleterm gateway command
* Update comments for GatewayCLICommand message
* Mark check funcs as helpers, verify args length first
The Proxy web api now requests that Auth include allowed logins
per resource instead of guessing logins per resource based on the
information it has cached. However, due to the way SSH sessions
are authorized, the logins are not provide to users verbatim.
Any sessions created via the root web ui to a leaf resource will use
the SSH certificate created for that user in the root cluster. New
certificates are not minted per leaf cluster. This is important
because the nodes only allow os logins for a session if they are
present in the valid prinicpals of the SSH certificate. So even
though we are now capabale of displaying all allowed logins for
leaf SSH servers in the root web ui, the user is only able to use
a subset of them. To avoid any odd UX, the Proxy will filter out
any allowed logins which do not exist in the principals of the
root SSH certificate.
The above only holds for SSH, windows desktops are not as strict
and any allowed login from a leaf cluster is now visible in the
root web ui.
Fixes https://github.com/gravitational/teleport/issues/5041
Converts both tools to use the ListUnifiedResources RPC instead of
the ListResources RPC to improve performance. While there may only
be marginal gains when listing the entire set of nodes, there are
substantial improvements when filtering via predicate, labels, or
search.
tctl was also changed slightly to make use of server side filtering
when tctl get node/foo is run. Prior to this change the entire node
set was always retreived and tctl performed the filter client side
if the user provided a hostname or UUID.
* Remove logging from circuit breaker
The logging is never output, and if it was would be very verbose.
Instead of dropping the level down to trace the logger is removed
entirely.
* Add constants from trace library
The logging functionality in trace is being removed in an upcoming
release. To prepare the logging component keys are copied from trace
into teleport.
* Convert trace.ComponentFields to teleport.ComponentFields
* Replace trace.Component with teleport.ComponentKey
* Replace trace logging constants
* Fix X11 forwarding with OpenSSH option control master when connecting through the Proxy ssh forwarding service.
* Add X11Forwarding integration test with ControlMaster subtest.
* Refactor forwarding server to always forward x11 channel requests.
* Address comments.
* Fix x11 forwarding integration tests.
* Require admin MFA to list cert authority secrets.
* Allow reuse of Admin MFA for GetCertAuthorities.
* Add tctl tests.
* Reuse MFA for tctl auth export with keys and add tests.
* Fix lint; fix test panic.
* Check for admin MFA after RBAC check.
The tsh status command attempts to decode one profile per YAML
file in $TSH_HOME. If an error is encountered along the way,
the entire command fails and tsh does not display information
about any profiles.
An especially confusing corner case is when a user mistakenly
places tsh's configuration at $TSH_HOME/config.yaml instead of
$TSH_HOME/config/config.yaml. In this case, the config file is
assumed to be a profile and the user is presentedc with a
confusing error message.
Fix this by skipping over profiles that fail to load but continuing
to report on the ones that load successfully.
Closes#38302
This legacy connection mechanism uses SSH to connect to the Proxy
and tunnel the Auth connection. It was replaced by the
(TeleportClient) ConnectToCluster which uses gRPC to reduce latency
when connecting to the cluster.
newTestListener would call (*testing.T).Log when the Accept call
fails. This resulted in racy behavior due to the log sometimes
happening after the test completes (it's normal for accept to
return an error after the listener is closed, which we do on
test cleanup).
Adds the new linter and configures it to prevent direct error
comparisions and type assertions in favor of errors.Is and errors.As.
All current violations caught by the linter have been updated
accordingly.
The multiline string was indented in such a way that made the source
code look nice, but also put 3 leading tabs on each line, which
renders awkwardly in the terminal.
rosstimothy