mirror of
https://github.com/gravitational/teleport.git
synced 2026-09-21 14:35:22 +08:00
Ghassan Gedeon Achi
7bea6c9416
Adds a separate PEM-encoded TLS certificate on KeyRing
(AccessGraphTLSCert) used to authenticate directly to the proxy's
Access Graph API. It reuses TLSPrivateKey and is persisted alongside
the other per-proxy artifacts at
<baseDir>/keys/<proxy>/<username>-access-graph.crt.
Included wiring:
- KeyRing helpers: AccessGraphTLSCertificate,
AccessGraphTLSCertValidBefore, and AccessGraphClientTLSConfig.
AccessGraphClientTLSConfig builds a tls.Config that trusts system
CAs rather than the cluster CA, since the client is speaking
directly to the public proxy.
- FSKeyStore: read, write, and delete of the new cert file. The
write and read go through a small helper that holds the same
write/read lock on the TLS key file used by writeTLSCredential,
so the AccessGraph cert cannot drift from TLSPrivateKey under a
concurrent key rotation. Load is optional, so keyrings without
the cert still work.
- MemKeyStore.GetKeyRing propagates AccessGraphTLSCert for parity
with the FS store.
- Store.GetKeyRing parse-validates the AccessGraph cert when
present, mirroring the existing TeleportTLSCertValidBefore call
for the main TLS cert. Expired certs round-trip unchanged, matching
the main TLSCert contract ("it's the responsibility of the
TeleportClient to perform cleanup").
Note:
- The identity file format was not updated to carry an AccessGraph
TLS cert, which would be a breaking change to a long-lived,
externalizable artifact. The tctl access graph workflow mints the
cert against the proxy on demand and persists it in the client
keystore, so identity-file portability isn't needed.
Tests:
- keypaths.AccessGraphTLSCertPath path formatter.
- FSKeyStore + MemKeyStore round trip of a distinct AccessGraph cert,
minted via a new signAccessGraphCert helper that mirrors the
production identity shape (Usage=UsageAccessGraphAPIOnly plus a
WebSessionID). Plus delete behaviour for present and absent cert
files on the FS store.
- Store.GetKeyRing: absent, valid, expired, and unparseable
AccessGraph cert paths. Expired round-trips; only unparseable is
rejected.
- KeyRing AccessGraph helpers: NotFound paths and tls.Config
construction (system-CA trust, ServerName=ProxyHost, MinVersion
TLS 1.2).
This is the client-side plumbing required by the tctl access graph
commands to obtain, persist, and reuse a proxy-facing TLS cert across
runs. Server-side session lifetime decoupling will follow in a
separate change.