* add AWS RDS MariaDB e2e tests
* fix spurious teardown error logs
* if a role or user doesn't exist, that is not an error nor is it worth
logging during auto user teardown.
* check for admin option
* add some extra secret fetching checkings
* only drop redshift user if the user exists
* Add events for auto user provisioning
* Prettier
* Fix typo in event formatting
* Apply suggestions from code review
Co-authored-by: Lisa Kim <lisa@goteleport.com>
* Use shared base type for db session events
---------
Co-authored-by: Lisa Kim <lisa@goteleport.com>
* Implement label templates for db objects
- Expose template parsing utilities.
- Interpolate label templates using `typical` library.
- Validate label templates as part of import rule validation.
- Refactor code to fix cyclic imports.
* Use database_service_name and object_kind for label key in preset
* revert changes to `lib/utils/parse/parse.go`
* Reimplement splitExpression locally for import rules
* Update RFD with recent changes and mark it as implemented
* rename files, add test coverage, use empty spec for validation
* Log template errors directly with debug logs, log total error count as info.
* Update logs
* Remove logging from circuit breaker
The logging is never output, and if it was would be very verbose.
Instead of dropping the level down to trace the logger is removed
entirely.
* Add constants from trace library
The logging functionality in trace is being removed in an upcoming
release. To prepare the logging component keys are copied from trace
into teleport.
* Convert trace.ComponentFields to teleport.ComponentFields
* Replace trace.Component with teleport.ComponentKey
* Replace trace logging constants
* Implement granular db permissions for Postgres (RFD 151)
* docs, whitespace
* Make sure query is closed, even in case of errors along the way
* fix imports
Adds the new linter and configures it to prevent direct error
comparisions and type assertions in favor of errors.Is and errors.As.
All current violations caught by the linter have been updated
accordingly.
* User auto-provisioning support for MariaDB
* fix lint
* revoke all-in-one role on deactivation
* review comments
* MariaDB to fallback on DeleteUser
* move sql files to a folder
* Database Automatic User Provisioning support for Redshift
* capitalize sql script
* DeleteUser to fallback to deactivate.
* add TPxxx code to RAISE messages
* fix missing space in scripts
* feat: add auto-user deletion postgres
* refactor: change to IsEnabled func to check auto-user
* test: fix linting and test
* refactor(db): code review suggestions
* refactor: rename option to best effort drop
* refactor(api): rename createa database user mode property
* refactor(services): review suggestions
* feat(postgres): add log for user deletion result
* refactor(integrations): regenerate crd manifests
* feat(examples): update operator role spec
* refactor(db): use common sql state codes
Refactor `services.AccessMFAParams` and the accompanying `MFAParams` methods so
they may be extended to carry additional data (eg, information required to
perform device trust checks).
This PR refactors existing code without adding any new functionality, so it may
be backported to older branches to alleviate eventual conflicts. Follow up
changes will take advantage of it to add support for device trust.
Related to gravitational/teleport.e#514.
* Move GCP cloud clients into a separate interface
* Add azure mysql/postgresql flex server support
* Add teleport db configure create support for azure postgres/mysql flex servers
* discover both single and flexi server with 'mysql' and 'postgres' db types.
* go doc gcp interface
* Add is_flexi_server to database Azure config
* Recognize GSSEncRequest as postgres proto
* Respond to GSSEncRequest with 'N' for 'not supported' in postgres engine
* Add test for GSSEncRequest to postgres via proxy
* Save gssencmode=disable in .pg_service.conf and test it
* Check for repeated startup encryption request
* Refactor postgres startup test code into its own test
* Test covers all code paths in the proxy startup handler
* Make postgres proxy tests run in parallel
* Reduced test execution time from 15 seconds to 4.5 seconds.
* Ran with race detector and all tests passed.
* Make sure we read at least one byte
* Fix lint
* Fix lint
* Change err to bad parameter
* Update test
Replace role/authPref RequireSessionMFA (bool) with RequireMFAType
(string).
- Add new RequireMFAType constant values with custom boolean marshalling.
- Add RequireMFAType to role and auth preference and deprecate
RequireSessionMFA.
- Add session-mfa override login when hardware_key_touch is enforced.
- Add protobuf enum for RequireMFAType.
- Add support for proto enums in protoc-gen-crd and update Kubernetes
Operator manifests.
Update metalinter, fix a few lint warnings and replace deprecated linters.
`deadcode`, `structcheck` and `varcheck` are abandoned and now replaced by [`unused`][1].
Since 1.19, `go fmt` reformats godocs according to https://go.dev/doc/comment. I've done a bulk-reformatting of the codebase to keep the linter happy. Backporting is mostly harmless (the exception being `lib/services/role_test.go`, that for some reason breaks the _old_ linter using the new format).
[1]: https://golangci-lint.run/usage/linters/
* Bump golangci-lint version
* Replace abandoned linters
* Fix bodyclose on lib/auth/github.com
* Fix bodyclose on lib/kube/proxy/streamproto/proto_test.go
* Fix bodyclose on lib/srv/alpnproxy/proxy_test.go
* Fix bodyclose on lib/web/conn_upgrade_test.go
* Silence staticcheck on lib/kube/proxy/forwarder_test.go
* Silence staticcheck on lib/utils/certs_test.go
* Address BuildNameToCertificate deprecation warnings
* Run `go fmt ./...`
* Run `go fmt ./...` on api/
* Ignore formatting in role_test.go
* Remove redundant initializers in lib/srv/uacc/
* Update e/
Making all of our integration tests run in entirely parallel requires
a large engineering effort to enforce test isolation and remove all race
conditions between tests.
A lower-effort alternative may be to split apart the various test suites
into their own Go packages, and test those packages in parallel, even if
the tests inside are still executed serially. Auditing the test suites
for races on system-level resources (e.g. files, ports) is much easier
than chasing down every p[ossible race in the testing system.
This patch acts as a trial run, breaking a fairly well-defined and
self-contained test suite out into its own package. Note that the goal of
this change is not necessarily to shave minutes off the build (although
that would be nice), but to act as an illustration of how other, less
well-formed test suites might be broken apart.
See-Also: #12421
See-Also: #14408
Allow users to secure GCP Cloud SQL instances by setting "Allow only SSL
connections", which enforces client certificate authentication.
This implementation does not require any configuration changes for Teleport
users. Teleport will detect whether client certificate authentication is
required and handle either case automatically.
Client certificates are ephemeral. They are created for every connection by
calling the GCP Cloud SQL API's GenerateEphemeralCert function. Certificates
are only created when the destination Cloud SQL instance is configured to
require client certificate authentication. The configuration is detected by
requesting instance settings from the GCP Cloud SQL API on every connection
attempt.
A special case was implemented for MySQL. MySQL servers in GCP Cloud SQL do not
trust the ephemeral certificate's CA but GCP Cloud Proxy does. To work around
this issue, the implementation will connect to the MySQL Cloud Proxy port using
a TLS dialer instead of the default MySQL port when client certificate
authentication is required.
The common.CloudClients interface and implementation now return an interface
(GCPSQLAdminClient) from the GetGCPSQLAdminClient function instead of the GCP
client's sqladmin.Service. Returning an interface simplified calling code and
allowed for the client to be mocked for testing.
Existing GCP Cloud SQL tests are configured to not require client certificate
authentication by default. A new test named TestGCPRequireSSL was created to
simulate client certificate authentication for both Postgres and MySQL. This
required some minor changes to the test server code.
A new ConnectWithDialer function was added to the
github.com/gravitational/go-mysql fork. This function is available upstream in
v1.4.0 but other changes upstream resulted in a number of errors and a panic
processing network packets. So instead of upgrading, the dialer function was
copied to the Teleport fork and a custom version was created instead:
v1.1.1-teleport.1.
Gavin Frazar