Skip to content

Commit 5ed70a3

Browse files
r0mantr0mant
committed
Release 17.0.0
1 parent af5b777 commit 5ed70a3

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

47 files changed

+362
-223
lines changed

‎CHANGELOG.md

Lines changed: 141 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,148 @@
11
# Changelog
22

3-
## 17.0.0 (11/xx/2024)
3+
## 17.0.0 (11/15/2024)
4+
5+
Teleport 17 brings the following new features and improvements:
6+
7+
- Refreshed web UI
8+
- Modern signature algorithms
9+
- (Preview) AWS IAM Identity Center integration
10+
- Hardware key support for Teleport Connect
11+
- Nested access lists
12+
- Access lists UI/UX improvements
13+
- Signed and notarized macOS assets
14+
- Datadog Incident Management plugin for access requests
15+
- Hosted Microsoft Teams plugin for access requests
16+
- Dynamic registration for Windows desktops
17+
- Support for images in web SSH sessions
18+
- `tbot` CLI updates
419

5-
### ** Not yet released **
20+
### Description
21+
22+
#### Refreshed Web UI
23+
24+
We have updated and improved designs and added a new navigation menu to Teleport
25+
17’s web UI to enhance its usability and scalability.
26+
27+
#### Modern signature algorithms
28+
29+
Teleport 17 admins have the option to use elliptic curve cryptography for the
30+
majority of user, host, and certificate authority key material.
31+
32+
This includes Ed25519 SSH keys and ECDSA TLS keys, replacing the RSA keys used
33+
today.
34+
35+
New clusters will leverage [modern signature algorithms](https://goteleport.com/docs/ver/17.x/reference/signature-algorithms/)
36+
by default. Existing Teleport clusters will continue to use RSA2048 until a CA
37+
rotation is performed.
38+
39+
#### (Preview) AWS IAM Identity Center integration
40+
41+
Teleport 17 integrates with AWS IAM Identity Center to allow users to sync and
42+
manage AWS IC group members via Access Lists.
43+
44+
#### Hardware key support for Teleport Connect
45+
46+
We have extended Teleport 17’s support for
47+
[hardware-backed private keys](https://goteleport.com/docs/admin-guides/access-controls/guides/hardware-key-support/)
48+
to Teleport Connect.
49+
50+
#### Nested access lists
51+
52+
Teleport 17 admins and access list owners can add access lists as members in
53+
other access lists.
54+
55+
See details in the [documentation](https://goteleport.com/docs/ver/17.x/admin-guides/access-controls/access-lists/nested-access-lists/).
56+
57+
#### Access lists UI/UX improvements
58+
59+
Teleport 17 web UI has an updated access lists page that will include the new
60+
table view, improved search and filtering capabilities.
61+
62+
#### Signed and notarized macOS assets
63+
64+
Starting from Teleport 17 macOS `teleport.pkg` installer includes signed and
65+
notarized `tsh.app` and `tctl.app` so downloading a separate tsh.pkg to use
66+
Touch ID is no longer necessary.
67+
68+
In addition, Teleport 17 event handler and Terraform provider for macOS are also
69+
signed and notarized.
70+
71+
#### Datadog Incident Management plugin for access requests
72+
73+
Teleport 17 supports PagerDuty-like integration with Datadog's [on-call](https://docs.datadoghq.com/service_management/on-call/)
74+
and [incident management](https://docs.datadoghq.com/service_management/incident_management/)
75+
APIs for access request notifications.
76+
77+
See the [configuration guide](https://goteleport.com/docs/ver/17.x/admin-guides/access-controls/access-request-plugins/datadog-hosted/).
78+
79+
#### Hosted Microsoft Teams plugin for access requests
80+
81+
Teleport 17 adds support for Microsoft Teams integration for access request
82+
notifications using Teleport web UI without needing to self-host the plugin.
83+
84+
#### Dynamic registration for Windows desktops
85+
86+
Dynamic registration allows Teleport administrators to register new Windows
87+
desktops without having to update the static configuration files read by
88+
Teleport Windows Desktop Service instances.
89+
90+
#### Support for images in web SSH sessions
91+
92+
The SSH console in Teleport’s web UI includes support for rendering images via
93+
both the SIXEL and iTerm Inline Image Protocol (IIP).
94+
95+
#### tbot CLI updates
96+
97+
The `tbot` client now supports starting most outputs and services directly from
98+
the command line with no need for a configuration file using the new
99+
`tbot start <mode>` family of commands. If desired, a given command can be
100+
converted to a YAML configuration file with `tbot configure <mode>`.
101+
102+
Additionally, `tctl` now supports inspection and management of bot instances using
103+
the `tctl bots instances` family of commands. This allows onboarding of new
104+
instances for existing bots with `tctl bots instances add`, and inspection of
105+
existing instances with `tctl bots instances list`.
106+
107+
### Breaking changes and deprecations
108+
109+
#### macOS assets
110+
111+
Starting with version 17, Teleport no longer provides a separate `tsh.pkg` macOS
112+
package.
113+
114+
Instead, `teleport.pkg` and all macOS tarballs include signed and notarized
115+
`tsh.app` and `tctl.app`.
116+
117+
#### Enforced stricter requirements for SSH hostnames
118+
119+
Hostnames are only allowed if they are less than 257 characters and consist of
120+
only alphanumeric characters and the symbols `.` and `-`.
121+
122+
Any hostname that violates the new restrictions will be changed, the original
123+
hostname will be moved to the `teleport.internal/invalid-hostname` label for
124+
discoverability.
125+
126+
Any Teleport agents with an invalid hostname will be replaced with the host UUID.
127+
Any Agentless OpenSSH Servers with an invalid hostname will be replaced with
128+
the host of the address, if it is valid, or a randomly generated identifier.
129+
Any hosts with invalid hostnames should be updated to comply with the new
130+
requirements to avoid Teleport renaming them.
131+
132+
#### `TELEPORT_ALLOW_NO_SECOND_FACTOR` removed
133+
134+
As of Teleport 16, multi-factor authentication is required for local users. To
135+
assist with upgrades, Teleport 16 included a temporary opt-out mechanism via the
136+
`TELEPORT_ALLOW_NO_SECOND_FACTOR` environment variable. This opt-out mechanism
137+
has been removed.
138+
139+
#### TOTP for per-session MFA
140+
141+
Teleport 17 is the last release where `tsh` will allow for using TOTP with
142+
per-session MFA. Starting with Teleport 18, `tsh` will require a strong webauthn
143+
credential for per-session MFA.
6144

7-
* Refreshed the Web UI and Teleport Connect UI design [#46812](https://github.com/gravitational/teleport/pull/46812)
145+
TOTP will continue to be accepted for the initial login.
8146

9147
## 16.4.6 (10/22/2024)
10148

‎Makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
# Stable releases: "1.0.0"
1414
# Pre-releases: "1.0.0-alpha.1", "1.0.0-beta.2", "1.0.0-rc.3"
1515
# Master/dev branch: "1.0.0-dev"
16-
VERSION=17.0.0-rc.3
16+
VERSION=17.0.0
1717

1818
DOCKER_IMAGE ?= teleport
1919

‎api/version.go

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎build.assets/macos/tsh/tsh.app/Contents/Info.plist

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,13 +19,13 @@
1919
<key>CFBundlePackageType</key>
2020
<string>APPL</string>
2121
<key>CFBundleShortVersionString</key>
22-
<string>1.0</string>
22+
<string>17.0.0</string>
2323
<key>CFBundleSupportedPlatforms</key>
2424
<array>
2525
<string>MacOSX</string>
2626
</array>
2727
<key>CFBundleVersion</key>
28-
<string>1.0</string>
28+
<string>17.0.0</string>
2929
<key>DTCompiler</key>
3030
<string>com.apple.compilers.llvm.clang.1_0</string>
3131
<key>DTPlatformBuild</key>

‎build.assets/macos/tshdev/tsh.app/Contents/Info.plist

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,13 +17,13 @@
1717
<key>CFBundlePackageType</key>
1818
<string>APPL</string>
1919
<key>CFBundleShortVersionString</key>
20-
<string>1.0</string>
20+
<string>17.0.0</string>
2121
<key>CFBundleSupportedPlatforms</key>
2222
<array>
2323
<string>MacOSX</string>
2424
</array>
2525
<key>CFBundleVersion</key>
26-
<string>1.0</string>
26+
<string>17.0.0</string>
2727
<key>DTCompiler</key>
2828
<string>com.apple.compilers.llvm.clang.1_0</string>
2929
<key>DTPlatformBuild</key>

‎docs/cspell.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -193,6 +193,7 @@
193193
"SIEM",
194194
"SIGINT",
195195
"SIGUSR",
196+
"SIXEL",
196197
"SLAVEOF",
197198
"SLES",
198199
"SLOWLOG",
@@ -1030,4 +1031,4 @@
10301031
"**/reference/terraform-provider/**",
10311032
"**/reference/operator-resources/**"
10321033
]
1033-
}
1034+
}

‎examples/chart/access/datadog/Chart.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
.version: &version "17.0.0-rc.3"
1+
.version: &version "17.0.0"
22

33
apiVersion: v2
44
name: teleport-plugin-datadog

‎examples/chart/access/datadog/tests/__snapshot__/configmap_test.yaml.snap

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,6 @@ should match the snapshot:
2626
app.kubernetes.io/instance: RELEASE-NAME
2727
app.kubernetes.io/managed-by: Helm
2828
app.kubernetes.io/name: teleport-plugin-datadog
29-
app.kubernetes.io/version: 17.0.0-rc.3
30-
helm.sh/chart: teleport-plugin-datadog-17.0.0-rc.3
29+
app.kubernetes.io/version: 17.0.0
30+
helm.sh/chart: teleport-plugin-datadog-17.0.0
3131
name: RELEASE-NAME-teleport-plugin-datadog

‎examples/chart/access/datadog/tests/__snapshot__/deployment_test.yaml.snap

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@ should match the snapshot:
77
app.kubernetes.io/instance: RELEASE-NAME
88
app.kubernetes.io/managed-by: Helm
99
app.kubernetes.io/name: teleport-plugin-datadog
10-
app.kubernetes.io/version: 17.0.0-rc.3
11-
helm.sh/chart: teleport-plugin-datadog-17.0.0-rc.3
10+
app.kubernetes.io/version: 17.0.0
11+
helm.sh/chart: teleport-plugin-datadog-17.0.0
1212
name: RELEASE-NAME-teleport-plugin-datadog
1313
spec:
1414
replicas: 1
@@ -22,8 +22,8 @@ should match the snapshot:
2222
app.kubernetes.io/instance: RELEASE-NAME
2323
app.kubernetes.io/managed-by: Helm
2424
app.kubernetes.io/name: teleport-plugin-datadog
25-
app.kubernetes.io/version: 17.0.0-rc.3
26-
helm.sh/chart: teleport-plugin-datadog-17.0.0-rc.3
25+
app.kubernetes.io/version: 17.0.0
26+
helm.sh/chart: teleport-plugin-datadog-17.0.0
2727
spec:
2828
containers:
2929
- command:

‎examples/chart/access/discord/Chart.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
.version: &version "17.0.0-rc.3"
1+
.version: &version "17.0.0"
22

33
apiVersion: v2
44
name: teleport-plugin-discord

‎examples/chart/access/discord/tests/__snapshot__/configmap_test.yaml.snap

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,6 @@ should match the snapshot:
2424
app.kubernetes.io/instance: RELEASE-NAME
2525
app.kubernetes.io/managed-by: Helm
2626
app.kubernetes.io/name: teleport-plugin-discord
27-
app.kubernetes.io/version: 17.0.0-rc.3
28-
helm.sh/chart: teleport-plugin-discord-17.0.0-rc.3
27+
app.kubernetes.io/version: 17.0.0
28+
helm.sh/chart: teleport-plugin-discord-17.0.0
2929
name: RELEASE-NAME-teleport-plugin-discord

‎examples/chart/access/discord/tests/__snapshot__/deployment_test.yaml.snap

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@ should match the snapshot:
77
app.kubernetes.io/instance: RELEASE-NAME
88
app.kubernetes.io/managed-by: Helm
99
app.kubernetes.io/name: teleport-plugin-discord
10-
app.kubernetes.io/version: 17.0.0-rc.3
11-
helm.sh/chart: teleport-plugin-discord-17.0.0-rc.3
10+
app.kubernetes.io/version: 17.0.0
11+
helm.sh/chart: teleport-plugin-discord-17.0.0
1212
name: RELEASE-NAME-teleport-plugin-discord
1313
spec:
1414
replicas: 1
@@ -22,8 +22,8 @@ should match the snapshot:
2222
app.kubernetes.io/instance: RELEASE-NAME
2323
app.kubernetes.io/managed-by: Helm
2424
app.kubernetes.io/name: teleport-plugin-discord
25-
app.kubernetes.io/version: 17.0.0-rc.3
26-
helm.sh/chart: teleport-plugin-discord-17.0.0-rc.3
25+
app.kubernetes.io/version: 17.0.0
26+
helm.sh/chart: teleport-plugin-discord-17.0.0
2727
spec:
2828
containers:
2929
- command:

‎examples/chart/access/email/Chart.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
.version: &version "17.0.0-rc.3"
1+
.version: &version "17.0.0"
22

33
apiVersion: v2
44
name: teleport-plugin-email

‎examples/chart/access/email/tests/__snapshot__/configmap_test.yaml.snap

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -26,8 +26,8 @@ should match the snapshot (mailgun on):
2626
app.kubernetes.io/instance: RELEASE-NAME
2727
app.kubernetes.io/managed-by: Helm
2828
app.kubernetes.io/name: teleport-plugin-email
29-
app.kubernetes.io/version: 17.0.0-rc.3
30-
helm.sh/chart: teleport-plugin-email-17.0.0-rc.3
29+
app.kubernetes.io/version: 17.0.0
30+
helm.sh/chart: teleport-plugin-email-17.0.0
3131
name: RELEASE-NAME-teleport-plugin-email
3232
should match the snapshot (smtp on):
3333
1: |
@@ -59,8 +59,8 @@ should match the snapshot (smtp on):
5959
app.kubernetes.io/instance: RELEASE-NAME
6060
app.kubernetes.io/managed-by: Helm
6161
app.kubernetes.io/name: teleport-plugin-email
62-
app.kubernetes.io/version: 17.0.0-rc.3
63-
helm.sh/chart: teleport-plugin-email-17.0.0-rc.3
62+
app.kubernetes.io/version: 17.0.0
63+
helm.sh/chart: teleport-plugin-email-17.0.0
6464
name: RELEASE-NAME-teleport-plugin-email
6565
should match the snapshot (smtp on, no starttls):
6666
1: |
@@ -92,8 +92,8 @@ should match the snapshot (smtp on, no starttls):
9292
app.kubernetes.io/instance: RELEASE-NAME
9393
app.kubernetes.io/managed-by: Helm
9494
app.kubernetes.io/name: teleport-plugin-email
95-
app.kubernetes.io/version: 17.0.0-rc.3
96-
helm.sh/chart: teleport-plugin-email-17.0.0-rc.3
95+
app.kubernetes.io/version: 17.0.0
96+
helm.sh/chart: teleport-plugin-email-17.0.0
9797
name: RELEASE-NAME-teleport-plugin-email
9898
should match the snapshot (smtp on, password file):
9999
1: |
@@ -125,8 +125,8 @@ should match the snapshot (smtp on, password file):
125125
app.kubernetes.io/instance: RELEASE-NAME
126126
app.kubernetes.io/managed-by: Helm
127127
app.kubernetes.io/name: teleport-plugin-email
128-
app.kubernetes.io/version: 17.0.0-rc.3
129-
helm.sh/chart: teleport-plugin-email-17.0.0-rc.3
128+
app.kubernetes.io/version: 17.0.0
129+
helm.sh/chart: teleport-plugin-email-17.0.0
130130
name: RELEASE-NAME-teleport-plugin-email
131131
should match the snapshot (smtp on, roleToRecipients set):
132132
1: |
@@ -161,8 +161,8 @@ should match the snapshot (smtp on, roleToRecipients set):
161161
app.kubernetes.io/instance: RELEASE-NAME
162162
app.kubernetes.io/managed-by: Helm
163163
app.kubernetes.io/name: teleport-plugin-email
164-
app.kubernetes.io/version: 17.0.0-rc.3
165-
helm.sh/chart: teleport-plugin-email-17.0.0-rc.3
164+
app.kubernetes.io/version: 17.0.0
165+
helm.sh/chart: teleport-plugin-email-17.0.0
166166
name: RELEASE-NAME-teleport-plugin-email
167167
should match the snapshot (smtp on, starttls disabled):
168168
1: |
@@ -194,6 +194,6 @@ should match the snapshot (smtp on, starttls disabled):
194194
app.kubernetes.io/instance: RELEASE-NAME
195195
app.kubernetes.io/managed-by: Helm
196196
app.kubernetes.io/name: teleport-plugin-email
197-
app.kubernetes.io/version: 17.0.0-rc.3
198-
helm.sh/chart: teleport-plugin-email-17.0.0-rc.3
197+
app.kubernetes.io/version: 17.0.0
198+
helm.sh/chart: teleport-plugin-email-17.0.0
199199
name: RELEASE-NAME-teleport-plugin-email

0 commit comments

Comments
 (0)