mirror of
https://github.com/gravitational/teleport.git
synced 2026-09-19 11:00:37 +08:00
Julia Ogris
005a2aa755
* app: Consolidate app name and public_addr validation Consolidate app `name` and `public_addr` validation to fix six issues where Teleport rejects valid app names, accepts invalid ones, or crashes on startup. Preserve backwards compatibility for dynamic and heartbeat paths: clusters with mixed-case records already in the backend keep working. Strict write validation (admin writes + static config): - App name, static: `IsDNS1123Label` - no dots, max 63 chars. - App name, dynamic: `IsDNS1123Subdomain` - dots OK for AWS-OIDC, max 253 chars. - `public_addr`: `IsDNS1123Subdomain` - dots OK (it is a hostname), max 253 chars. All three k8s validators also enforce lowercase. RFC 1123 itself does not -- lowercase is a Teleport convention for interop with Kubernetes object names. `ValidateApp` is the single write-time validator, called from `CreateApp`, `UpdateApp`, `UpsertApplicationServer`, the inventory control stream, and app service startup. Heartbeats run `NormalizeAppServerForHeartbeat` first, which lowercases both `name` and `public_addr` and strips URL schemes and ports, so heartbeats from older agents end up stored lowercase. Link: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/ * app: Apply review feedback Address review nits from the PR: - Use t.Context() in new tests; add t.Cleanup for client Close. - Drop double Close() in inventory controller tests. - Use proto getters in identitycenter to avoid panic on nil Spec. - Replace multi-hyphen regex with strings.ReplaceAll loop. - Collapse mockRolesAnywhereClient.profiles into pages. - Retitle and flesh out the CHANGELOG entry. - Revert accidental enterprise submodule bump. * app: Apply review feedback Use proto getters for the remaining `acct.Spec.*` accesses in `IdentityCenterAccountToAppServer` so the function stays nil-safe end to end. Fix grammar in the app name doc bullet ("as is a duplicate name" -> "as are duplicate names"). * app: Preserve Identity Center launch URL Identity Center accounts surface in the unified-resource cache as synthetic AppServers and never traverse `ValidateApp` / `ValidateAppServer`, so the DNS-1123 normalization the previous commits introduced in `IdentityCenterAccountToAppServer` had no write path to satisfy. Keep the raw StartUrl in both `URI` and `PublicAddr`: the web Launch button builds the SSO launch href as `${publicAddr}&role_name=...`, so stripping scheme, path, port, or case breaks every Identity Center app launch. Drop the matching lowercase on `metadata.Name` for the same reason, and restore the delete handler in `processEventsAndUpdateCurrent` to its pre-PR shape (rebuild a `KindAppServer` header from the IC account event, no lowercase). Rewrite `TestIdentityCenterAccountToAppServer` to assert StartUrl passes through verbatim; remove the `ValidateApp` round-trip assertion, which was checking a path the synthetic AppServer never takes in real callers. * app: Apply review feedback * app: Apply review feedback Tighten the "Stricter application validation" CHANGELOG entry to focus on the three backwards-incompatible cases: static-config DNS label, unrecoverable public_addr, and duplicate names within one agent's teleport.yaml. Expand the write-path list to include the Terraform provider, Kubernetes operator, and direct API calls. Note that multi-agent same-name heartbeats remain supported for load balancing. * app: Allow underscores in dynamic app names Swap IsDNS1123Subdomain for IsDNS1123SubdomainWithUnderscore in ValidateApp, the required_apps loop, and ValidateAppServer. The strict variant rejected snake_case names that Teleport Cloud and self-hosted clusters both accept today, breaking the Terraform provider tests as the canary. Static yaml (lib/service/servicecfg/app.go) remains strict, since the rule there is a deliberate breaking change. public_addr also stays strict, since it is the actual hostname used for routing. Document the new rule and the strict-TLS-client caveat in the "Application name" section of connecting-apps.mdx.