mirror of
https://github.com/gravitational/teleport.git
synced 2026-09-19 11:00:37 +08:00
Ghassan Gedeon Achi
c3d03ddce1
* feat(tctl): credential management for Access Graph
Adds the `tool/tctl/common/accessgraph` package with the credential
helpers shared by the upcoming experimental Access Graph tctl
subcommands. Helpers only — no subcommand wiring lands here.
Surface:
- `resolveAccessGraphCredentials`: looks up the keyring by the
profile's `Name` / `Cluster` / `Username` and bundles it with the
proxy address.
- `ensureAccessGraphCert`: fast-paths on a valid cached cert,
otherwise checks the precondition and re-issues via
`GenerateUserCerts(Usage=AccessGraphAPI)`.
- `validateAccessGraphCert{,Expiration,PrivateKey}`,
`checkAccessGraphSupported`, `issueAccessGraphCert`,
`issueAndStoreAccessGraphCert`.
Splitting the helpers from the command tree lets this code merge
ahead of #65949 (vendored Access Graph REST client), which is still
in review.
* fix: tighten TTL and share tctl config resolution
Address #66270 review feedback:
- Split the AG persistence floor (accessGraphMinPersistTTL = 5m)
from the validity buffer (accessGraphCertExpiryBuffer = 2m).
- Add a separate auth-host credential resolver that skips disk
persistence by returning clientStore = nil.
- Widen tctlcfg.ApplyConfig to return ResolvedConfig{Auth,
ClientStore, Profile} so the upstream AG dispatcher reuses the
same profile / identity-file / auth-host detection as every other
tctl command.
* fix: resolve proxy address from auth Ping
Identity-file mode with `--auth-server=<host>:3025` was wrongly using
that auth address as the AG proxy address. Always backfill
`creds.proxyAddr` from `ping.GetProxyPublicAddr()` on the issue path;
non-`tsh login` resolvers leave it empty. Ping fetch consolidated to
a single call site so `checkAccessGraphSupported` becomes a pure
function over the response.
* fix: set proxy-url from ping when not already set
* fix: exercise private funcs and policy check
* fix: lint error kebab vs snake case
* refactor: drop auth-host flow for tctl ag
Issuing an Access Graph cert on the auth host requires picking an
cluster user to mint the certificate for. Though this is a `valid`
operation in terms of permissions, it's a bit of a footgun so at least
for now we are dropping support for it and replacing it with a more
detailed error message.
* chore: add missing space in auth host error