teleport

mirror of https://github.com/gravitational/teleport.git synced 2026-11-03 07:40:28 +08:00

Files

T

Tiago Silva 3ad31fb222 Kubernetes License check for Kubernetes Proxies (#24543 )

* Kubernetes License check for root clusters

This PR ensures that a given Teleport root cluster is licensed for
Kubernetes access when forwarding credentials to leaf clusters.

Previously, the root Kube proxy would call auth server to generate a new
cert-key pair with the user identity and during the call Auth ensured
that it was licensed for Kubernetes usage. Given the recent developments
for #22533, the call mentioned was removed and it's now possible for a
root enterprise cluster to forward requests to a OSS leaf cluster
without validating its license.

Auth server already enforces Kubernetes license for Kubernetes service
when it tries to heartbeat the cluster. If the cluster is not properly
licensed, it's not possible to register kubernetes clusters.

Part of #22533

* remove watcher and use in process.getClusterFeatures callback

* add test to validate kube api license enforcement

* move err code to forbidden

2023-04-18 09:37:14 +00:00

servicecfg

Prevent multiple discovery agents to race against each other (#24214 )

2023-04-18 09:33:14 +00:00

acme.go

Use x/exp/slices instead of home grown utilities (#18524 )

2022-11-17 15:25:46 +00:00

certreloader_test.go

Refactor tctl's dependencies (#22693 )

2023-03-09 17:48:36 +00:00

certreloader.go

Refactor tctl's dependencies (#22693 )