Erik Tate e97acb335e Porting kube cluster APIs to scoped authZ (#67881) ...

* porting kube CRUD APIs to scoped authZ

* adding RO perms for KubeClusters to the scoped RoleKube definition and updating tests

* adding allowed scoped rule verbs for kube cluster resource

* fixing typos

2026-06-30 17:57:39 +00:00

..

expiry

Fix bug causing the expiry service to spin infinite loop (#63615)

2026-02-18 14:35:58 +00:00

local

Porting kube cluster APIs to scoped authZ (#67881)

2026-06-30 17:57:39 +00:00

readonly

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00

samltest

Add alerts for expiring/expired SAML signing certs (#64504)

2026-03-25 09:25:07 +00:00

testdata/roles

Add tests around Kubernetes CRD support in access request. (#55757)

2025-07-31 13:08:42 +00:00

access_checker_test.go

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00

access_checker.go

Implement auth checks for RBAC rule review_requests.submit_for_users (#66230)

2026-06-09 20:11:23 +00:00

access_graph_settings.go

…

access_graph.go

…

access_list_test.go

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00

access_list.go

Access Lists: Add status fixing functions (#62090)

2025-12-10 17:18:58 +00:00

access_monitoring_rules_test.go

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00

access_monitoring_rules.go

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00

access_request_cache_test.go

Modernize lib/client, lib/service, and lib/services (#55978)

2025-06-23 01:31:21 +00:00

access_request_cache.go

Guard against nil in notifications and access request caches (#62834)

2026-01-15 10:24:29 +00:00

access_request_test.go

Support resource constraints for narrower access request role suggestions (#67152)

2026-06-18 16:56:06 +00:00

access_request.go

Support resource constraints for narrower access request role suggestions (#67152)

2026-06-18 16:56:06 +00:00

access_test.go

…

access.go

Add Beam protobuf definition and backend service (#64863)

2026-04-08 11:25:06 +00:00

app_test.go

add scoped joining for app svc (#67101)

2026-06-24 18:22:29 +00:00

app.go

add scoped joining for app svc (#67101)

2026-06-24 18:22:29 +00:00

appauthconfig_test.go

[3] Final migration to the Opaque API (#67385)

2026-06-18 19:41:17 +00:00

appauthconfig.go

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00

audit.go

Modernize lib/client, lib/service, and lib/services (#55978)

2025-06-23 01:31:21 +00:00

authentication_test.go

…

authentication.go

Fix violations of non-constant format strings linter (#51812)

2025-02-04 16:43:35 +00:00

authority_test.go

Add AppClient CA (#66273)

2026-04-30 19:05:23 +00:00

authority.go

App service use upstream TLS options (#66454)

2026-05-27 13:41:28 +00:00

autoupdates.go

MWI: Generate AutoUpdateBotInstanceReport resource (#59738)

2025-10-07 14:32:36 +00:00

backendinfo.go

Fix major version check for stateless environment (#52837)

2025-05-05 22:51:24 +00:00

beam_test.go

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00

beam.go

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00

beams_config.go

[beams] beams_config storage, cache, presets (#67338)

2026-06-29 17:54:59 +00:00

bot_instance.go

MWI: Ignore user_login_state for bots (#66737)

2026-06-09 22:30:37 +00:00

cert_access_checker.go

scoped role reorg (#64973)

2026-03-31 03:11:24 +00:00

clustername.go

Fix violations of non-constant format strings linter (#51812)

2025-02-04 16:43:35 +00:00

common_access_checker.go

[2] Migration to the Opaque API (#67384)

2026-06-08 13:21:41 +00:00

configuration_test.go

Introduce modulestest package (#56721)

2025-07-14 21:55:07 +00:00

configuration.go

adding support for static scoped tokens in the file config (#61266)

2026-01-28 14:09:57 +00:00

connection_diagnostic.go

Fix violations of non-constant format strings linter (#51812)

2025-02-04 16:43:35 +00:00

crown_jewel.go

Remove superfluous DeleteAll methods (#54867)

2025-05-16 13:46:23 +00:00

crown_jewels_test.go

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00

database_test.go

Multiple hostnames & retries support for Oracle (#59901)

2025-10-16 07:07:05 +00:00

database.go

Multiple hostnames & retries support for Oracle (#59901)

2025-10-16 07:07:05 +00:00

databaseobject.go

…

databaseobjectimportrule.go

…

databaseserver.go

Fix violations of non-constant format strings linter (#51812)

2025-02-04 16:43:35 +00:00

databaseservice_test.go

…

databaseservice.go

Fix violations of non-constant format strings linter (#51812)

2025-02-04 16:43:35 +00:00

delegation_sessions_test.go

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00

delegation_sessions.go

Add Beam protobuf definition and backend service (#64863)

2026-04-08 11:25:06 +00:00

desktop.go

Fix violations of non-constant format strings linter (#51812)

2025-02-04 16:43:35 +00:00

device_test.go

…

device.go

…

discoveryconfig_test.go

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00

discoveryconfig.go

Fix violations of non-constant format strings linter (#51812)

2025-02-04 16:43:35 +00:00

doc.go

…

dynamic_desktop.go

Remove superfluous DeleteAll methods (#54867)

2025-05-16 13:46:23 +00:00

enroll_pairing.go

Add protos and OSS storage for EnrollPairing (#67862)

2026-06-23 10:24:02 +00:00

externalauditstorage_test.go

…

externalauditstorage.go

Fix violations of non-constant format strings linter (#51812)

2025-02-04 16:43:35 +00:00

fanoutv2_test.go

Modernize lib/client, lib/service, and lib/services (#55978)

2025-06-23 01:31:21 +00:00

fanoutv2.go

Modernize lib/client, lib/service, and lib/services (#55978)

2025-06-23 01:31:21 +00:00

fuzz_test.go

app: Consolidate app name and public_addr validation (#65728)

2026-05-20 05:04:19 +00:00

git_server.go

Remove superfluous DeleteAll methods (#54867)

2025-05-16 13:46:23 +00:00

github_test.go

Introduce modulestest package (#56721)

2025-07-14 21:55:07 +00:00

github.go

allow OSS GitHub connector with public github endpoint (#55405)

2025-06-09 15:19:46 +00:00

headlessauthn_test.go

Update error messages to remove duplicate strings (#65740)

2026-04-14 12:55:22 +00:00

headlessauthn.go

Update error messages to remove duplicate strings (#65740)

2026-04-14 12:55:22 +00:00

health_check_config_test.go

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00

health_check_config.go

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00

identity_test.go

[chore] clean up DELETE IN 18 comments (#55118)

2025-05-24 17:30:24 +00:00

identity.go

Add Beam protobuf definition and backend service (#64863)

2026-04-08 11:25:06 +00:00

identitycenter_test.go

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00

identitycenter.go

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00

impersonate_test.go

…

impersonate.go

Modernize lib/client, lib/service, and lib/services (#55978)

2025-06-23 01:31:21 +00:00

installer.go

Fix violations of non-constant format strings linter (#51812)

2025-02-04 16:43:35 +00:00

integration_test.go

…

integration.go

Adding OIDC auth functionality to the Azure integration (#51219)

2025-01-23 18:03:16 +00:00

inventory.go

…

kube_access_checker_test.go

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00

kube_access_checker.go

[2] Migration to the Opaque API (#67384)

2026-06-08 13:21:41 +00:00

kubernetes_test.go

…

kubernetes.go

[api] Add ListKubernetesClusters (#59820)

2025-10-08 15:01:19 +00:00

kubewaitingcontainer.go

…

label_expressions_test.go

Add set support in labels expressions (#65863)

2026-04-18 14:41:24 +00:00

label_expressions.go

Add set support in labels expressions (#65863)

2026-04-18 14:41:24 +00:00

license_test.go

chore: Bump golangci-lint to v2.7.2 (#62066)

2025-12-09 17:59:21 +00:00

license.go

Fix violations of non-constant format strings linter (#51812)

2025-02-04 16:43:35 +00:00

linux_desktop_test.go

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00

linux_desktop.go

Add LinuxDesktop gRPC and backend (#62974)

2026-04-21 20:51:35 +00:00

lock_test.go

MWI: Add lock targets for join token name and bot instance ID (#56021)

2025-06-26 22:58:02 +00:00

lock.go

MWI: Add lock targets for join token name and bot instance ID (#56021)

2025-06-26 22:58:02 +00:00

map_test.go

chore: Bump golangci-lint to v2.7.2 (#62066)

2025-12-09 17:59:21 +00:00

matchers_test.go

Trim Azure matcher selectors before dedup (#66450)

2026-05-06 18:18:47 +00:00

matchers.go

[refactoring] remove some deadcode (#66583)

2026-05-11 13:36:46 +00:00

namespace.go

Fix violations of non-constant format strings linter (#51812)

2025-02-04 16:43:35 +00:00

networking.go

Fix violations of non-constant format strings linter (#51812)

2025-02-04 16:43:35 +00:00

notifications_cache_test.go

[3] Final migration to the Opaque API (#67385)

2026-06-18 19:41:17 +00:00

notifications_cache.go

Guard against nil in notifications and access request caches (#62834)

2026-01-15 10:24:29 +00:00

notifications_test.go

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00

notifications.go

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00

oidc_test.go

Bump golangci-lint to v2 (#54410)

2025-05-07 22:14:51 +00:00

oidc.go

Fix violations of non-constant format strings linter (#51812)

2025-02-04 16:43:35 +00:00

okta_test.go

…

okta.go

Okta: Add assignments Upsert/UpdateCAS methods (#65590)

2026-04-17 13:24:18 +00:00

parser_test.go

Optimize contains(split()) in resource expression parser (#66645)

2026-05-14 21:34:38 +00:00

parser.go

Fix inverted log level check (#67412)

2026-06-03 13:53:22 +00:00

plugin_data.go

…

plugin_static_credentials_test.go

GitHub Proxy part 3.5: caching PluginStaticCredentials (#49472)

2024-12-03 15:32:00 +00:00

plugin_static_credentials.go

Allow unknown fields when unmarshaling protojson resources (#53469)

2025-03-27 14:35:37 +00:00

plugins_test.go

Move plugin CheckAndSetDefaults from marshal to write path (#67429)

2026-06-12 10:15:48 +00:00

plugins.go

Move plugin CheckAndSetDefaults from marshal to write path (#67429)

2026-06-12 10:15:48 +00:00

presence.go

Add secondary index for application server lookup by application name (#67099)

2026-06-04 13:31:12 +00:00

presets_test.go

[beams] beams_config storage, cache, presets (#67338)

2026-06-29 17:54:59 +00:00

presets.go

[beams] beams_config storage, cache, presets (#67338)

2026-06-29 17:54:59 +00:00

process_test.go

Remove unused ProcessReloadContext (#61136)

2025-11-07 21:14:10 +00:00

process.go

Remove unused ProcessReloadContext (#61136)

2025-11-07 21:14:10 +00:00

provisioning_test.go

Generic OIDC joining: protos (#67914)

2026-06-27 02:41:46 +00:00

provisioning.go

Wildcard support for kubernetes join method (#66520)

2026-05-13 08:47:24 +00:00

provisioningstates.go

Remove temporary AWS IC APIs (#58519)

2025-09-17 16:16:28 +00:00

reconciler_test.go

[3] Final migration to the Opaque API (#67385)

2026-06-18 19:41:17 +00:00

reconciler.go

Add ability to run Reconciler steps in Parallel (#66243)

2026-04-29 08:22:01 +00:00

recording_encryption.go

adding new protos for rotated keys and the local service for interacting (#57576)

2025-08-14 18:28:18 +00:00

relay_server.go

relay_server definition, CRUD api and caching (#55441)

2025-06-17 12:04:54 +00:00

remotecluster.go

…

resource_constraints_test.go

Support resource constraints for narrower access request role suggestions (#67152)

2026-06-18 16:56:06 +00:00

resource_constraints.go

Support resource constraints for narrower access request role suggestions (#67152)

2026-06-18 16:56:06 +00:00

resource_test.go

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00

resource.go

Add Classifier backend storage, cache, gRPC service, and tctl support (#67761)

2026-06-16 14:47:39 +00:00

restrictions.go

Fix violations of non-constant format strings linter (#51812)

2025-02-04 16:43:35 +00:00

role_test.go

Make spiffe role deny rules greedy (#67020)

2026-06-30 17:14:26 +00:00

role.go

Make spiffe role deny rules greedy (#67020)

2026-06-30 17:14:26 +00:00

saml_idp_service_provider_test.go

…

saml_idp_service_provider.go

Fix violations of non-constant format strings linter (#51812)

2025-02-04 16:43:35 +00:00

saml_test.go

Add APIs for handling Entra ID groups overage on SAML connectors (#65653)

2026-04-21 13:32:53 +00:00

saml.go

Add APIs for handling Entra ID groups overage on SAML connectors (#65653)

2026-04-21 13:32:53 +00:00

scim.go

Add SCIM PATCH Proto (#61427)

2025-11-21 14:25:54 +00:00

scoped_access_checker_context_test.go

porting GetUser, GetRole, EmitAuditEvent, CreateAuditStream, and ResumeAuditStream to support scopes (#67879)

2026-06-29 22:29:18 +00:00

scoped_access_checker_context.go

porting GetUser, GetRole, EmitAuditEvent, CreateAuditStream, and ResumeAuditStream to support scopes (#67879)

2026-06-29 22:29:18 +00:00

scoped_access_checker.go

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00

scoped_tokens.go

MWI Scopes[4]: Scoped bot joining and bound keypair support (#65366)

2026-04-16 02:06:24 +00:00

scoped.go

relax scoped resource write validation (#65333)

2026-04-07 17:28:11 +00:00

secreports_test.go

…

secreports.go

Convert security reports to new in memory cache collection (#54391)

2025-05-23 16:31:56 +00:00

semaphore_test.go

…

semaphore.go

Update the semaphore expiry in AcquireSemaphoreWithRetry (#59372)

2025-09-22 08:15:23 +00:00

server_info.go

Fix violations of non-constant format strings linter (#51812)

2025-02-04 16:43:35 +00:00

server.go

adding immutable labels to scoped tokens and host certificates (#62941)

2026-02-06 20:57:03 +00:00

servers_test.go

adding immutable labels to scoped tokens and host certificates (#62941)

2026-02-06 20:57:03 +00:00

services_test.go

Introduce logtest package (#56741)

2025-07-15 18:11:10 +00:00

services.go

…

session_recording_test.go

extend session RBAC for SearchSessionEvents (#58409)

2025-09-01 13:41:15 +00:00

session_recording.go

extend session RBAC for SearchSessionEvents (#58409)

2025-09-01 13:41:15 +00:00

session.go

[api] Add ListWebTokens (#59895)

2025-10-15 09:57:26 +00:00

sessionrecording_test.go

Add missing handling for recording encryption configs and keys (#57279)

2025-08-13 15:14:20 +00:00

sessionrecording.go

Add missing handling for recording encryption configs and keys (#57279)

2025-08-13 15:14:20 +00:00

sessiontracker.go

fix: session trackers participants inconsistencies (#58853)

2025-09-08 16:07:11 +00:00

sigstore_policies_test.go

[3] Final migration to the Opaque API (#67385)

2026-06-18 19:41:17 +00:00

sigstore_policies.go

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00

spiffe_federations_test.go

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00

spiffe_federations.go

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00

ssh_access_checker_test.go

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00

ssh_access_checker.go

[2] Migration to the Opaque API (#67384)

2026-06-08 13:21:41 +00:00

sso_mfa.go

[Browser MFA] Add Browser MFA to challenge request flow (#63936)

2026-03-26 12:24:12 +00:00

stableunixusers.go

Stable UNIX users: storage and auth API (#51102)

2025-01-28 17:08:20 +00:00

statichostuser_test.go

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00

statichostuser.go

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00

statictokens.go

Fix violations of non-constant format strings linter (#51812)

2025-02-04 16:43:35 +00:00

status.go

Delete StatusInternal which is unused (#63226)

2026-01-28 17:28:36 +00:00

subca_test.go

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00

subca.go

Add ConditionalDelete to CA overrides and generic.Service (#67870)

2026-06-18 16:09:41 +00:00

summarizer_test.go

Add Classifier backend storage, cache, gRPC service, and tctl support (#67761)

2026-06-16 14:47:39 +00:00

summarizer.go

Add Classifier backend storage, cache, gRPC service, and tctl support (#67761)

2026-06-16 14:47:39 +00:00

traits_test.go

…

traits.go

Convert lib/services to use slog (#50348)

2024-12-21 02:06:10 +00:00

trust.go

Migrate GetTunnelConnections/GetAllTunnelConnections to gRPC (#66066)

2026-06-11 12:44:50 +00:00

trustedcluster.go

Adds services for pruning roles when requesting remote resources. (#57227)

2025-09-10 04:03:19 +00:00

tunnel_test.go

Modernize lib/client, lib/service, and lib/services (#55978)

2025-06-23 01:31:21 +00:00

tunnel.go

Fix violations of non-constant format strings linter (#51812)

2025-02-04 16:43:35 +00:00

tunnelconn.go

Fix violations of non-constant format strings linter (#51812)

2025-02-04 16:43:35 +00:00

ui_config.go

Fix violations of non-constant format strings linter (#51812)

2025-02-04 16:43:35 +00:00

unified_resource_test.go

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00

unified_resource.go

fix: Compute features for agentless AppServer resources (#67489)

2026-06-05 22:40:07 +00:00

user_login_state_test.go

MWI: Ignore user_login_state for bots (#66737)

2026-06-09 22:30:37 +00:00

user_login_state.go

MWI: Ignore user_login_state for bots (#66737)

2026-06-09 22:30:37 +00:00

user_task_test.go

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00

user_task.go

Remove superfluous DeleteAll methods (#54867)

2025-05-16 13:46:23 +00:00

user_test.go

Add Shared Server-Side Username Display Resolver (#67411)

2026-06-08 16:16:09 +00:00

user.go

Add Shared Server-Side Username Display Resolver (#67411)

2026-06-08 16:16:09 +00:00

useracl_test.go

Add mobile_device.create_enroll_token permission; make boombuler/barcode a direct dep (#67863)

2026-06-26 15:53:20 +00:00

useracl.go

Add mobile_device.create_enroll_token permission; make boombuler/barcode a direct dep (#67863)

2026-06-26 15:53:20 +00:00

usergroup_test.go

…

usergroup.go

Fix violations of non-constant format strings linter (#51812)

2025-02-04 16:43:35 +00:00

userpreferences.go

…

usertoken_test.go

…

usertoken.go

Fix violations of non-constant format strings linter (#51812)

2025-02-04 16:43:35 +00:00

usertokensecrets.go

Fix violations of non-constant format strings linter (#51812)

2025-02-04 16:43:35 +00:00

vnet_config.go

…

watcher_test.go

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00

watcher.go

fix: allow joining with CA pin when any lock is in force (#65992)

2026-04-22 23:15:43 +00:00

workload_identity_test.go

RFD 229C: Add scope field to WorkloadIdentity resource and validation rules (2/5) (#67891)

2026-06-24 10:10:18 +00:00

workload_identity_x509_overrides.go

SPIFFE X.509 issuer override: issuance (#53145)

2025-04-11 13:50:38 +00:00

workload_identity_x509_revocation_test.go

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00

workload_identity_x509_revocation.go

Initial migration to the Opaque API (#67279)

2026-06-05 14:52:58 +00:00

workload_identity.go

RFD 229C: Add scope field to WorkloadIdentity resource and validation rules (2/5) (#67891)

2026-06-24 10:10:18 +00:00

wrappers_test.go

…