mirror of
https://github.com/gravitational/teleport.git
synced 2026-10-25 10:40:02 +08:00
Jake Alti
5e0a6513b5
* kube: add reusable-MFA requester for tsh proxy kube fan-out * Regenerate protos * update kube_proxy.go * pass client explicitly * change return type * add cert issuer * add tests * defer auth client close * replace fallback bool with requester state * rename concurrency env var to TELEPORT_UNSTABLE_ * rename receiver * apply review style suggestions * add integration test for kube cert reissuer * add distinct Teleport clusters issuer test * slice mfaOn once after first issuance * Add kubeClusterGroup for bounded cluster fan-outs * Add ReissueParams.FailOnExpiredReusableMFAResponse Add ReissueParams.FailOnExpiredReusableMFAResponse * Single-flight MFA ceremonies in kube cert issuer * Extend kube cert issuer tests * Fix kube proxy test * Add clusterConn for shared cluster connections update conn test * Rework kubeClusterGroup API and add tests update group test * Add reusableMFA for shared MFA ceremony state * Fix comment * Address review feedback * Add MFA challenge scope for kube local proxy multi * Document nil mfaCheck semantics on IssueCert * Skip NotFound key rings explicitly in loadKubeKeyRings * Update comment * Drop redundant requester check before Capture * Rename test to RootAndLeafTeleportClusters * Restore ephemeral kubeconfig before cert issuance in kube proxy reissuer * Add lingering to cluster conn * Fix misspelling in cluster conn test * Clarify linger wording in cluster conn test * Check positive condition in cluster conn close timer * Fix cluster client test missed by MFAChecker rename in master merge * Fail the issuance when taking the ceremony lock fails * Detect the masked MFA reuse rejection of old auth servers * Test kubeconfig restore on a failed reissue in kube proxy * Clone credential maps handed out by the in-memory key store * Invalidate the cluster conn on errors a relogin can resolve * Scope MFA fallback by rejection confidence * Fix scope name in issuer doc comment * Drop test-only FallbackActive method * Load kube key rings through the keystore seam * Share the reissue mutex across reissuer closures * Remove the kube cert reissuer integration test