ami auto branch 1620236164 #6745
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
* Delete old docs * Move docs to parent folder
Fixes #5708 OSS users loose connection to leaf clusters after upgrade of the root cluster (but not leaf clusters). Teleport 6.0 switches users to ossuser role, this breaks implicit cluster mapping of admin to admin users. The fix downgrades admin role to be less privileged in OSS.
e61e2b2 Backport(v6): Fix cn dialog err handling and disable ace web workers (#234) gravitational/webapps@e61e2b2 [source: -w teleport-v6] [target: -t branch/v6]
…rds compatibility (#5731)
c01b39b Implement OAuth-style state token for AAP auth flow gravitational/webapps@c01b39b [source: -w teleport-v6] [target: -t andrej/v6/security-fixes]
In `auth.Context`, the `Identity` field used to contain the original caller identity and `User` field contained the mapped local user. These are different, if the request comes from a remote trusted cluster. Lots of code assumed that `auth.Context.Identity` contained the local identity and used roles/traits from there. To prevent this confusion, populate `auth.Context.Identity` with the *mapped* identity, and add `auth.Context.UnmappedIdentity` for callers that actually need it. One caller that needs `UnmappedIdentity` is the k8s proxy. It uses that identity to generate an ephemeral user cert. Using the local mapped identity in that case would make the downstream server (e.g. kubernetes_service) to treat it like a real local user, which doesn't exist in the backend and causes trouble. `ProcessKubeCSR` endpoint on the auth server was also updated to understand the unmapped remote identities. Co-authored-by: Andrew Lytvynov <andrew@goteleport.com>
* docs: correct footnote * docs: consistent 2fa * docs: consistent sentence header casing * docs: port tics * docs: correct proper noun * docs: slightly improve prereqs * docs: reword limitations * docs: correct wording, typos * docs: improve getting started page * docs: improve user manual * docs: casing in adopters page * docs: oxford commas * docs: improved faq * docs: tsh in tic marks * docs: admin and prod guide
* docs: couple more tics * docs: few more tics * docs: improve kub and app access
* docs: best practices * docs: requested changes * docs: slight rewording * docs: make changes
* docs: improve enterprise rbac * docs: correct links and editions * docs: correct links and editions * docs: correct editions * docs: database access * docs: database access * docs: access controls * docs: more edits * docs: infra guides * docs: enterprise guides * docs: enterprise guides * docs: correct session tables * docs: cloud * docs: reference * docs: architecture * docs: linting fixes * docs: corrected * docs: improved score for 6.1 * docs: improve scores * docs: few more improvements
* docs: rename workflows * docs: updated supported features * docs: slight rewording * docs: requested changes
* docs: reword * docs: reword * docs: correct typo
627ef3f Update e-ref on billing chart ytick formatting fix (#291) gravitational/webapps@627ef3f [source: -w teleport-v6.1] [target: -t branch/v6.1]
Co-authored-by: Alexander Klizhentas <klizhentas@gmail.com>
manual implementation to avoid issues with proto-based type merge panics. Fixes #5691.
Updated TLS handshake timeout. During some operations, Teleport can flood the network with traffic which causes the TLS handshake to occur slower than 1 second. One example is during SSO login. The initial connection is an unauthenticated connection, and upon successful SSO login a "types.User" is created and replicated to all nodes. For large clusters this can mean 10k+ "types.User" objects getting replicated at the same time the user attempts to re-establishing another connection to Auth this time with valid identity credentials. This connection sometimes can take longer than the original 1 second timeout.
This commit removes copying of stdout and stderr from non-interactive ssh commands to stdout and stderr of the teleport server process. This was introduced in e65eac5 and appears to have been put in for debugging.
webvictim
requested review from
alex-kovoy,
klizhentas,
r0mant and
russjones
as code owners
webvictim
added
automated
|
Whoops! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
tctl get. Haddeleteinstead ofget(Fixedtctl get. Haddeleteinstead ofget#5814)tsh playwith file arg (Backporttsh playwith file arg #6162)