Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix DynamicIdentityFileCreds being incompatible with L7 Loadbalancers #36411

Merged

Conversation

strideynet
Copy link
Contributor

@strideynet strideynet commented Jan 8, 2024

Closes #36229

changelog: Fixes refresh_identity = true preventing Access Plugins connecting to Teleport using TLS routing with a L7 LB.

api/client/contextdialer.go Outdated Show resolved Hide resolved
@strideynet
Copy link
Contributor Author

strideynet commented Jan 8, 2024

Tested locally with

package main

import (
	"context"
	glog "log"
	"os"
	"os/signal"

	"github.com/sirupsen/logrus"

	"github.com/gravitational/teleport/api/client"
	apidefaults "github.com/gravitational/teleport/api/defaults"
	"github.com/gravitational/trace"
)

func main() {
	err := run()
	glog.Fatal(err)
}

func run() error {
	ctx, cancel := signal.NotifyContext(context.Background(), os.Interrupt)
	defer cancel()

	log := logrus.StandardLogger()
	logrus.SetLevel(logrus.DebugLevel)
	log.SetLevel(logrus.DebugLevel)

	creds, err := client.NewDynamicIdentityFileCreds("./admin_identity")
	if err != nil {
		return trace.Wrap(err, "loading creds")
	}
	teleportClient, err := client.New(ctx, client.Config{
		Addrs:       []string{"leaf.tele.ottr.sh:443"},
		Credentials: []client.Credentials{creds},
	})
	if err != nil {
		return trace.Wrap(err, "connecting")
	}
	defer teleportClient.Close()

	nodes, err := teleportClient.GetNodes(ctx, apidefaults.Namespace)
	if err != nil {
		return trace.Wrap(err, "get nodes")
	}
	log.Infof("Nodes: %d", len(nodes))
	return nil
}

And Caddy configured as an L7 LB.

api/client/credentials.go Show resolved Hide resolved
api/client/credentials_test.go Outdated Show resolved Hide resolved
strideynet and others added 2 commits January 9, 2024 18:03
@strideynet strideynet added this pull request to the merge queue Jan 9, 2024
@github-merge-queue github-merge-queue bot removed this pull request from the merge queue due to failed status checks Jan 9, 2024
@strideynet strideynet added this pull request to the merge queue Jan 9, 2024
Merged via the queue into master with commit 8480371 Jan 9, 2024
34 checks passed
@strideynet strideynet deleted the strideynet/dyanmic-identity-creds-support-alpn-upgrade branch January 9, 2024 19:19
@public-teleport-github-review-bot

@strideynet See the table below for backport results.

Branch Result
branch/v12 Failed
branch/v13 Create PR
branch/v14 Create PR

ibeckermayer pushed a commit that referenced this pull request Jan 17, 2024
…#36411)

* DynamicIdentityFileCreds should correctly provide TLS root CAs to ALPN handshake

* Fix bug involving multiple credentials

* Add test case covering CA Cert Pool

* Update api/client/credentials_test.go

Co-authored-by: Alan Parra <alan.parra@goteleport.com>

---------

Co-authored-by: Alan Parra <alan.parra@goteleport.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Slack plugin fails to connect with "refresh_identity = true" to a cluster behind ALB
3 participants