[v10] Check manifest before attempting to push docker images #15094

logand22 · 2022-08-01T19:09:30Z

Backport of #15093

Testing

➜  teleport git:(logan/reentrable-docker-push-amazon-ecr) ✗ export DOCKER_IMAGE_STAGING=146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:10.1.2
➜  teleport git:(logan/reentrable-docker-push-amazon-ecr) ✗ if docker manifest inspect ${DOCKER_IMAGE_STAGING} 2>&1 >/dev/null; then echo "Image already exists"; else echo "Push new image"; fi
no such manifest: 146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:10.1.2
Push new image
➜  teleport git:(logan/reentrable-docker-push-amazon-ecr) ✗ export DOCKER_IMAGE_STAGING=146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport:10.1.1
➜  teleport git:(logan/reentrable-docker-push-amazon-ecr) ✗ if docker manifest inspect ${DOCKER_IMAGE_STAGING} 2>&1 >/dev/null; then echo "Image already exists"; else echo "Push new image"; fi
Image already exists

Drop the `v` from the tsh installer version number, which was inadvertently changed by #12751. Makes the installer reappear as a download option in Houston. Note that the final .app name still has the `v`. Ie: * tsh-10.0.0-dev.pkg (installer) tsh-10.0.0-dev.pkg.sha256 (installer hash) * tsh-v10.0.0-dev.app (Application package) Backport #13896 to branch/v10

#13903) updates rdp-rs ref to new HEAD where scroll wheel delta is fixed

…3846)

* Add Machine ID enterprise license enforcement This adds two checks to Machine ID for license enforcement: one on initial bot create, and another on join. * Use modules.SetTestModules(); fix failing test

* Update Video URL * extra labs and video update

Use high-cpu pools for CI tasks

…#14037)

Apply traits to Windows Desktop labels It was noticed that this functionality has been missing. Updates #5973

…f requiring a trait be templated. (#14038) Prefix sudoers lines with user being logged in as

Document new pin_source_ip role option (#13495)

)

Backport #14033 to branch/v10 Add a credential picker to the tsh FIDO2/WebAuthn backend. The PR pulls a recent patch in our go-libfido2 fork that makes it correctly return multiple assertions from the authenticator. This allows us to implement the credential picker for FIDO2, simplify our implementation and provide the exact same UX that browsers use (always 1-touch for bio, touch->PIN->touch otherwise). I've dropped concepts like "optimistic assertions" and "eager PIN prompts" in favor of a simple, uniform implementation. Issue #13901. * Prompt for credentials in LoginPrompt * Update go-libfido2 * Implement FIDO2 credential picker * Drop optimistic assertions, only set user if explicit * Add license to fido2_prompt_test.go

Update CAs on connection in remoteSite

Backport of #14062

Add networking with TLS routing (#13762) * Add networking with TLS routing, fixes #13751

#14048) * pass and preserve a path parameter during the app access authentication process * added missing semicolons * more javascript formatting * removed incorrect path redirect. replace URL with URL.Path * added a test for HasName * added another test for default path * ensure path param is valid path * build url without string concat

Add documentation for automatic host user creation

* Fix drone pipeline * Update drone signature

helm: Deploy CRDs when the operator is enabled

…15033) This is a twofold change with the aim of reducing possible pains with the tsh installer. - Dropping the version number from "tsh.app" makes it more alike other apps (including Connect) - Making the installer non-relocatable makes it easy to reason about (and ensures our postinstall script is correct!) A relocatable installer will look for the app in places other the specified install path, according to the bundle ID. This means that if the user moves or renames the app, the installer will overwrite it no matter where it is. It also means our path assumptions can be wrong. Note that the installer itself is still numbered, so it won't break Houston or change the downloads page. Backport #15018 to branch/v10

Download mTLS files from Web (#14526) In the context of Teleport Discover we are trying to ease the usage of Teleport for the user's first interaction. When adding a new database resource the user must, among other things, generate the mTLS files Examples: https://goteleport.com/docs/database-access/guides/postgres-self-hosted/#step-25-create-a-certificatekey-pair https://goteleport.com/docs/database-access/guides/mysql-self-hosted/#step-24-create-a-certificatekey-pair This PR aims to reduce this friction: the user should be able to setup the resource without prior setup of local tools (`tsh login`) We're doing this by providing an endpoint that will return those exact files Demo ```shell marco@lenix ~/p/downloadmtls> curl --silent --insecure 'https://127.0.0.1.nip.io:3080/v1/webapi/sites/lenix/sign' --dat a '{"hostname":"discover.example.com", "ttl":"9999h", "format": "db"}' --header 'Authorization: Bearer 308bf3dd3019ddc4 2cff44a48e028480' --header 'Content-Type: application/json' -OJ marco@lenix ~/p/downloadmtls> tar -xvf teleport_mTLS_discover.example.com.tar.gz server.key server.crt server.cas marco@lenix ~/p/downloadmtls> head -1 server.* ==> server.cas <== -----BEGIN CERTIFICATE----- ==> server.crt <== -----BEGIN CERTIFICATE----- ==> server.key <== -----BEGIN RSA PRIVATE KEY----- ``` Fixes #14049

SSH request tracing (#14124) Add tracing support for ssh global requests and channels. Wrappers for `ssh.Client`, `ssh.Channel`, and `ssh.NewChannel` provide a mechanism for tracing context to be propagated via a `context.Context`. In order to maintain backwards compatibility the ssh.Client wrapper tries to open a TracingChannel when constructed. Any servers that don't support tracing will reject the unknown channel. The client will only provide tracing context to servers which do NOT reject the TracingChannel request. In order to include pass tracing context along all ssh payloads are wrapped in an Envelope that includes the original payload AND any tracing context. Servers now try to unmarshal all payloads into said Envelope when processing messages. If there is an Envelope provided, a new span will be created and the original payload will be pass along to handlers. Part of #12241

github-actions · 2022-08-01T19:10:03Z

@logand22 - this PR is large and will require admin approval to merge. Consider breaking it up into a series smaller changes.

codingllama and others added 30 commits June 29, 2022 17:50

[v10] updates rdp-rs ref to new HEAD where scroll wheel delta is fixed (

a1c1637

#13903) updates rdp-rs ref to new HEAD where scroll wheel delta is fixed

[v10] Add error check before handle_bitmap (#13899)

5056b2c

[v10] Fix nil pointer exception when joining non-existent session (#1…

1fdf687

…3846)

[v10] Add Machine ID enterprise license enforcement (#13981)

9def3b5

* Add Machine ID enterprise license enforcement This adds two checks to Machine ID for license enforcement: one on initial bot create, and another on join. * Use modules.SetTestModules(); fix failing test

(v10) Speed up app access integration tests (#13984)

40f0c4f

[v10] Fix v9 trusted cluster DB CA sync (#14001)

e739224

[v10] Update Header Videos for Getting Started. (#13986)

c3bba74

* Update Video URL * extra labs and video update

add peer addr substitution to control-stream hb

d2e05e6

fix ec2 join check

0022d62

[v10] Add resource IDs to tsh request ls (#13941)

ecf3e0a

don't precompute keys on peripheral agents

0b4afb9

[v10] Fix TDP/RDP termination (#14023)

ce72efc

[v10] Use high-cpu pools for CI tasks (#13919)

1b8624d

Use high-cpu pools for CI tasks

[v10] Fix an issue DB rotation event get send to older remote cluster (…

1ffeb51

…#14037)

[v10] Fix resource access requests for apps (#14026)

d84f7fb

[v10] Apply traits to Windows Desktop labels (#14016)

e873191

Apply traits to Windows Desktop labels It was noticed that this functionality has been missing. Updates #5973

[v10] Prefix sudoers lines with the user that is logging in instead o…

354e97e

…f requiring a trait be templated. (#14038) Prefix sudoers lines with user being logged in as

[v10] Document new pin_source_ip role option (#13939)

25cf548

Document new pin_source_ip role option (#13495)

[v10] Remove duplicate parties in kube and ssh session trackers. (#13987

b2dbb6a

)

[v10] Push CAs after establishing watchers in remoteSite. (#14043)

c873fa4

Update CAs on connection in remoteSite

[v10] Handle SHA1 certificates in ssh proxy command (#14057)

6f82676

[v10] Use CentOS 7 for building release binaries (#14064)

9b20565

Backport of #14062

Release 10.0.0-rc.1 (#14055)

2f66271

[v10] Try to fix TestAppServersHA flakiness (#14004)

094db97

[v10] Add networking with TLS routing (#13762) (#14070)

bd37343

Add networking with TLS routing (#13762) * Add networking with TLS routing, fixes #13751

[v10] Add documentation for automatic host user creation (#14098)

7199d63

Add documentation for automatic host user creation

[v10] Add docs for resource access requests (#13996)

b613684

logand22 and others added 8 commits July 29, 2022 19:03

[v10] Fix drone teleport operator publishing (#15066)

6e6e548

* Fix drone pipeline * Update drone signature

[v10] helm: Deploy CRDs when the operator is enabled (#15006)

be8fc1b

helm: Deploy CRDs when the operator is enabled

Release 10.1.1 (#15067)

2e683bf

Updaetd makefile

74d49f5

Updated e commit

808df5f

github-actions bot requested review from avatus, ptgott, r0mant, sagesyr, smallinsky, xinding33 and zmb3 August 1, 2022 19:09

logand22 closed this Aug 1, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[v10] Check manifest before attempting to push docker images #15094

[v10] Check manifest before attempting to push docker images #15094

logand22 commented Aug 1, 2022

github-actions bot commented Aug 1, 2022

[v10] Check manifest before attempting to push docker images #15094

[v10] Check manifest before attempting to push docker images #15094

Conversation

logand22 commented Aug 1, 2022

Testing

github-actions bot commented Aug 1, 2022