* AWS OIDC: Script to configure EC2 Auto Discover with SSM
There's a new teleport command that adds an inline policy which enables
the AWS OIDC Integration to handle EC2 Auto Discover using the script
mode (SSM).
It also adds the SSM Document used in the teleport installation.
There's also a new endpoint which returns the one off script that uses
that command.
* Update lib/integrations/awsoidc/ec2_ssm_iam_config.go
Co-authored-by: Edward Dowling <EdwardDowling@users.noreply.github.com>
---------
Co-authored-by: Edward Dowling <EdwardDowling@users.noreply.github.com>
* Add e imports for MS Graph SDK
* Add ability to sign Entra ID OIDC JWTs, rework KID handling
- Synthesize Key IDs for our JWT keys. For backwards compatibility, also
include the same keys with an empty `kid` in JWKS.
- Sign AWS OIDC tokens with a `kid=""` header claim,
rather than omitting the `kid` claim altogether.
See comment for details.
* Add validation for Entra ID plugin
* Fix typo in assertion function name
* Update the OIDC JWKS test to expect the same key twice
* Add Entra ID plugin type constant
* go mod tidy
* Fix expected JWKS size in integration test
* Add basic tests for KeyID
* Move Azure auth settings from Plugin to Integration
* Address review comments
* Add a unit test to ensure KeyID compatibility
* Add license header to token_generator.go
* Rename validation function per new conventions
* Add new flags to modules
* Add deprecated comments to isTeam
* Make support flag an enum
* Add a TODO instead of deprecating flag right away
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Add gogoproto.jsontag to new fields
* remove meaning from enum zero value
* Reuse proto.SupportType instead of suping
* Replace isTeam for new flags in web app
* Update proto file: rename enum 0 value to unspecified;fix json tag casing
* Reuse proto file instead of aliasing it
* undo removing method by accident
* Add MobileDeviceManagement field to web config struct
* Improve comments
* Fix tests
* Simplify lockedFeatures object
* Include JoinActiveSessions in the web config object
* Remove more instances of isTeam
* Apply suggestions from code review - improve comments
Co-authored-by: Michelle Bergquist <11967646+michellescripts@users.noreply.github.com>
* Use consistent comments to remove isTeam
* Update godocs comments
* Revert removign `isTeam` from stories it still should
* Fix godoc typo
Co-authored-by: Michelle Bergquist <11967646+michellescripts@users.noreply.github.com>
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
Co-authored-by: Michelle Bergquist <11967646+michellescripts@users.noreply.github.com>
When using AWS Integration to access global services, the region is not
required. PR #40188 introduced a validation of the region which caused
troubles when using the integration with empty regions like when
accessing the STS endpoint to discover the AWS AccountID.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* AWS OIDC: IAM set up for AWS App Access
AWS App Access using AWS OIDC Integration requires a new policy in the
AWS OIDC Role.
This PR adds a one-off script that executes the configuration command
that adds said policy.
* improved comments, remove dead code, improve logging
* improve comment and http client var name
* move back to interface
* remove default client
* rename role to rolename
* enable fips endpoint support
* restrict target roles by their tags
* use true for tag value
* DiscoveryService: exclusive worker per Discovery Group
This PR ensures only one DiscoveryService is running per DiscoveryGroup.
It does so using a SemaphoreLock.
This should prevent any duplicate API calls and also prevent duplicate
resources on Teleport side.
* improve eice server name and releaseGroupLockFn init
* review pt2
* improve error handling
* re-organize lock acquire
* improve eice node name handling
* simplify lock on discovery group
* Remove lock logic and rely on node name to prevent dups
* improve test comment
* change comment about skipping nodes
In the latest release, we added support for S3 bucket as OIDC Provider
URL.
There are two places were the Token is generated.
One used in Discover Wizard, EICE access and Auto-Discover.
Another one for the External Audit Storage.
The first was updated to include the S3 Bucket as possible Issuer.
EAS flow was not updated.
This PR merges both flows.
* configure GCP workforce api client
* add 'integration configure samlidp gcp-workforce' command to teleport ctl
* update api to fetch metadata file from remote Teleport prox.
- minor comment copy and log copy edits
* gcp resource name validation, checkandsetdefault funcs
* use gcp-workforce subcommand path, rename gcpworkforce config as APIParams
* return early on pending provider status
* update comments and godoc
* use slog
* apply review suggestions:
- use 2*minute instead of 120*seconds
- use default http client and add redirect to the client
- NewGCPWorkforceService test
* update logger to use InfoContext. improve wait message, run fix-imports
* update ticker to 5 second from 1 second
* use underscore in log field instead of space. add missing trace.Wrap in waitForPoolStatus
* update NewGCPWorkforceService comment
* review suggestions:
- increase wait timer to 5 mins
- iamv1 migration comment
- move http redirect checker to checkAndSet default
* check for 409 response so that pool provider create op can continue if we timedout after creating pool
* fix package import comment style to make linter happy
* move default http client to gcpworkforce service checkandset defaults. update tests to relax on httpclient input param
* AutoDiscover: add support for EICE nodes
* ignore openssh nodes when updating labels from serverinfo
* downcase imports
* improve comment on why we need account/instance and subkind
* add applyovertime method
* skip nodes that wont expire in the near future
* create helper functions
* Add TELEPORT_EXT_UPGRADER env to AWS OIDC deployments
* Add unit tests
* Fix import
* Remove subtest
* Remove constants pkg
* Iterate over all container definitions
* Remove TELEPORT_EXT_UPGRADER from ensured env var
TELEPORT_EXT_UPGRADER=awsoidc_integration is not supported when
attempting to initialize a new exporter. Instead of including version
checks, it is safer to use the install method environment variable to
populate the upgrader value in the heartbeat.
* Use constant
* Remove comment
* AWS OIDC: Accept custom issuers
This PR adds a new field into the AWS OIDC fields:
- issuer
This is the issuer that was configured in AWS.
It is used by teleport to set the `issuer/iss` field when generating the
JWT.
This way we'll be able to set a custom issuer.
As an example, we could set this to be a public S3 bucket which doesn't
suffer from the thumbprint validation issuer.
* ensure issuer is a valid https url
* use s3 uri instead of any url for issuer
* typo and require s3 fields
* add missing s3 location when creating integration
* improve error messages
It was discovered that some customers' EKS clusters did not have their IMDSv2 hop limits
set correctly, causing requests for key functionality to attempt IMDSv1 fallback and failing.
For now, re-enable IMDSv1 fallback by way of removing the explicit disabling of
`EC2MetadataEnableFallback` until better documentation, error handling, and other work
can be done to inform customers that they need to correctly set their IMDSv2 hop limits.
* Remove logging from circuit breaker
The logging is never output, and if it was would be very verbose.
Instead of dropping the level down to trace the logger is removed
entirely.
* Add constants from trace library
The logging functionality in trace is being removed in an upcoming
release. To prepare the logging component keys are copied from trace
into teleport.
* Convert trace.ComponentFields to teleport.ComponentFields
* Replace trace.Component with teleport.ComponentKey
* Replace trace logging constants
* AWSOIDC: Move enrollment of EKS clusters to the gRPC service.
* Fix after rebase.
* Add EKS auto discovery for dynamic integration based fetchers.
* Remove commented code.
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Remove unneeded code.
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
* Add missing godoc.
* Initiate map with length.
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Fix typo in the interface name.
* Introduce iam join method for EKS enrollment.
* Correctly process DiscoveredEKSCluster in kube watcher.
* Remove remaining CreateToken related code from Discovery service.
* Change var initialization.
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Remove dev version detection for EKS enrollment.
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Revert "Introduce iam join method for EKS enrollment."
This reverts commit 0eb3f4f1226239a5d4e768ebe9129535be318ccb.
* Fix usage of a missing function.
* Refactor cluster features to be a function.
* Change discovery to use gRPC call for EKS enrollment.
* Remove unused mock.
* Correct a comment.
* Remove token creation permission from Discovery service.
* Fix after rebase.
* Improve sorting clusters by region and integration.
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Return and error if cluster features are missing.
* Fix tests.
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* AWSOIDC: Move enrollment of EKS clusters to the gRPC service.
* Add missing godoc.
* Remove unneeded code.
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
* Fix after rebase.
* Remove proxyPublicAddr field from grpc request.
* Change test address.
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Remove isCloud and enableAutoUpgrades fields from grpc request.
* Update EKS cluster name field in AWSOIDC integration
* Fix tests.
* Refactor variable initiation.
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Fix after rebase
* Remove unused code.
---------
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
This PR creates a new method on the AWS OIDC gRPC service that deploys
multiple EC2 Instance Connect Endpoints.
This is part of a refactor that moves the API calls behind the Auth
Service.
* AWS OIDC: DeployService service
This PR creates a new method on the AWS OIDC gRPC service that deploys
an ECS Service.
This is part of a refactor that moves the API calls behind the Auth
Service.
* add rbac test and rename teleport config string
* revert e
* Fix logging output for 'teleport configure' commands.
* Change imported log package name and don't overwrite debug level.
* Use Infof() instead of Printf()
* Use InitLogger to reset loglevel
* Remove unneeded code.
* AWS OIDC: DeployDatabaseService implementation
This PR creates a new method on the AWS OIDC gRPC service that deploys a
database service.
The deployment logic already existed.
* review pt1
* AWSOIDC: ListDatabases service
This PR implements the ListDatabases service.
The Web API will now use this service instead of calling the
GenerateAWSOIDC Token.
* log and skip instead of failing when convertion fails
* AWS OIDC: remove dependency on servicecfg
Currently the ExternalAuditStorage methods require the `servicecfg` package
to re-use the configuration struct used in `teleport integration configure`.
We are refactoring the AWS OIDC actions to use a gRPC Service.
Importing the `sevicecfg` package makes this refactoring a bit difficult
because of a cycling dependency: `awsoidc` requires `servicecfg` which
requires `auth` which will require the `awsoidc service` which requires
the `awsoidc` package.
This PR removes the usage of the `servicecfg` package in `awsoidc` package.
* move to easconfig
* chore: Bump golangci-lint to v1.56.0
* Use only enable linters for testifylint
* Fix various testifylint offenders
* Fix testifylint offenders in api/
* AWS OIDC: remove config dependency
Currently the DeployService and DeployDatabaseService require the
`config` package to create a `teleport.yaml` configuration that is used
to start the `teleport` process on the ECS containers.
We are refactoring the AWS OIDC actions to use a gRPC Service.
Importing the `config` package makes this refactoring a bit difficult
because of a cyclic dependency.
This PR removes the usage of the `config` package in `awsoidc` package.
* rename field name
* AWS OIDC - Deploy ECS Service: increase number of replicas to 2
This PR sets the number of replicas to 2 when starting a Database
Service using Amazon ECS.
This increases the availability of the service.
* Add task placement strategy note for fargate compute
* AWS OIDC: remove config dependency in ExternalAuditStorage
Currently the ExternalAuditStorage methods require the `config` package
to re-use the configuration struct used in `teleport integration configure`
We are refactoring the AWS OIDC actions to use a gRPC Service.
Importing the `config` package makes this refactoring a bit difficult
because of a cycling dependency: `awsoidc` requires `config` which
requires `auth` which will require the `awsoidc service` which requires
the `awsoidc` package.
This PR removes the usage of the `config` package in `awsoidc` package.
* rename type and godoc
* move type to servicecfg
* fix gci
* AWSOIDC: Compute Proxy's Endpoint for issuing a token
Instead of receiving the issuer URL as param, use the internal state of
the proxies to fetch the public endpoint.
This deprecates the field so that old clients can still talk to the
AuthServer, but their Issuer param is ignored.
* Add single param for cached resources
* use cache for everything except keystore
Some consts in the `auth` package are used in a lot of other packages.
This increases the probality of getting a cyclic dependency error.
This PR moves some of those consts to the defaults package and updates
all the required locations of their usage.
Only one is missing in the `/e/` repo, which I'm going to open a PR for
it.
After merging, we can also remove the `lib/auth.TokenLenBytes`
* Add backend code for listing EKS clusters through AWS OIDC integration.
* Remove leftover commented code.
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
* Add backend code for enrolling EKS clusters through AWS OIDC integration.
* Add autoupdater installation for the cloud.
* Use awslib to get principal role arn.
* Don't use frontend to set isCloud or enable automatic upgrades.
* Use version from stable/cloud for automatic upgrades on cloud.
* Create joinTokens for enrollment on the backend and per cluster. Return resourceId per cluster.
* Return early when we know access entry is present.
* Rename kubeConfig to kubeClientGetter
* Replace ctx with the groupCtx
* Add explanatory comment to the cluster admin policy const.
* Remove unnecessary config parameters settings.
* Fix value name
* Clean up downloaded chart.
* Name enrolled EKS cluster in Teleport according to EKS discovery pattern.
* Fix lint issues.
* Add missing article.
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
* Fix typo.
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Add missing godoc.
* Fix tests.
* Add missing godocs
* Improve description of the EnrollEKSClusters function.
* Do not enable app discovery on v13 version of the chart.
* Add enrolled eks cluster arn to internal label for kube agent
* Fix typo
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Improve error message.
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Improve error message.
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Improve error message.
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Improve error type.
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Reduce EKS join token TTL to 15 minutes.
* Increase concurrent EKS enrollment limit to 5
* Fix loopvar
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Add todo.
* Use params for installKubeAgent func and log error of chart file cleanup
* Create temp directory for each EKS enrollment and delete that directory afterwards.
* Increase join token ttl to 30 minutes.
* Return eks cluster arn when listing.
* Fix getting helm settings.
* Fix tests
* Fix imports.
---------
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
The new DeployService adds some non-determenistic logic with regards to
the deployed ECS Services.
Instead of looking for a specific ECS Service, we now iterate over all
the ECS Services of a well-known ECS Cluster (same as before) and update
the container image (as long as the tags are the Teleport ones).
Not everyone will have the new set of permissions which are created when
using the new flow.
For those situations, we keep the old behaviour where we know the
exact ECS Service name.
Most Linux instances have their PlatformDetails set to Linux/UNIX.
However, that's not the case for RHEL AMIs.
We were wrongly filtering those instances.
Now, instead of adding a filter to the API request, we filter on client
side and remove all the `windows` Platform.
According to AWS API:
> The platform. This value is windows for Windows instances; otherwise, it is empty.
Nic Klaassen