From e588ecd2cdb8ddf5213e8dd7db1b006a7b1a2092 Mon Sep 17 00:00:00 2001 From: Cam Hutchison Date: Tue, 29 Oct 2024 10:06:51 +1100 Subject: [PATCH] Release 17.0.0-alpha.1 (#47989) * [v17] sync changelog to v16 The master CHANGELOG.md which has become the changelog for v17 has no entries for the releases since 14.0.0. However, some links in the master changelog have been updated to point to new docs locations on master/v17 so we cannot just wholesale replace the changelog. Add the entries from 14.0.0 onwards from the v16 changelog and update docs/cspell.json to add entries for new words from that part of the changelog. * Release 17.0.0-alpha.1 --- CHANGELOG.md | 2443 ++++++++++++++++- Makefile | 2 +- api/version.go | 2 +- docs/cspell.json | 43 +- examples/chart/access/datadog/Chart.yaml | 2 +- .../__snapshot__/configmap_test.yaml.snap | 4 +- .../__snapshot__/deployment_test.yaml.snap | 8 +- examples/chart/access/discord/Chart.yaml | 2 +- .../__snapshot__/configmap_test.yaml.snap | 4 +- .../__snapshot__/deployment_test.yaml.snap | 8 +- examples/chart/access/email/Chart.yaml | 2 +- .../__snapshot__/configmap_test.yaml.snap | 24 +- .../__snapshot__/deployment_test.yaml.snap | 58 +- examples/chart/access/jira/Chart.yaml | 2 +- .../__snapshot__/configmap_test.yaml.snap | 4 +- .../__snapshot__/deployment_test.yaml.snap | 8 +- examples/chart/access/mattermost/Chart.yaml | 2 +- .../__snapshot__/configmap_test.yaml.snap | 4 +- .../__snapshot__/deployment_test.yaml.snap | 28 +- examples/chart/access/msteams/Chart.yaml | 2 +- .../__snapshot__/configmap_test.yaml.snap | 4 +- .../__snapshot__/deployment_test.yaml.snap | 8 +- examples/chart/access/pagerduty/Chart.yaml | 2 +- .../__snapshot__/configmap_test.yaml.snap | 4 +- .../__snapshot__/deployment_test.yaml.snap | 8 +- examples/chart/access/slack/Chart.yaml | 2 +- .../__snapshot__/configmap_test.yaml.snap | 4 +- .../__snapshot__/deployment_test.yaml.snap | 8 +- examples/chart/event-handler/Chart.yaml | 2 +- .../__snapshot__/configmap_test.yaml.snap | 4 +- .../__snapshot__/deployment_test.yaml.snap | 6 +- examples/chart/tbot/Chart.yaml | 2 +- .../__snapshot__/deployment_test.yaml.snap | 8 +- examples/chart/teleport-cluster/Chart.yaml | 2 +- .../charts/teleport-operator/Chart.yaml | 2 +- .../auth_clusterrole_test.yaml.snap | 4 +- .../__snapshot__/auth_config_test.yaml.snap | 4 +- .../auth_deployment_test.yaml.snap | 8 +- .../__snapshot__/proxy_config_test.yaml.snap | 4 +- .../proxy_deployment_test.yaml.snap | 36 +- examples/chart/teleport-kube-agent/Chart.yaml | 2 +- .../__snapshot__/deployment_test.yaml.snap | 60 +- .../tests/__snapshot__/job_test.yaml.snap | 10 +- .../__snapshot__/statefulset_test.yaml.snap | 66 +- .../updater_deployment_test.yaml.snap | 4 +- 45 files changed, 2594 insertions(+), 322 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0107d7720e978..ea8dfcafa8f8c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,16 +1,699 @@ # Changelog -## 16.0.0 (xx/xx/xx) +## 17.0.0 (11/xx/2024) -### Breaking changes +### ** Not yet released ** + + +## 16.4.6 (10/22/2024) + +### Security Fixes + +#### [High] Privilege persistence in Okta SCIM-only integration + +When Okta SCIM-only integration is enabled, in certain cases Teleport could +calculate the effective set of permission based on SSO user's stale traits. This +could allow a user who was unassigned from an Okta group to log into a Teleport +cluster once with a role granted by the unassigned group being present in their +effective role set. + +Note: This issue only affects Teleport clusters that have installed a SCIM-only +Okta integration as described in this guide. If you have an Okta integration +with user sync enabled or only using Okta SSO auth connector to log into your +Teleport cluster without SCIM integration configured, you're unaffected. To +verify your configuration: + +- Use `tctl get plugins/okta --format=json | jq ".[].spec.Settings.okta.sync_settings.sync_users"` + command to check if you have Okta integration with user sync enabled. If it + outputs null or false, you may be affected and should upgrade. +- Check SCIM provisioning settings for the Okta application you created or + updated while following the SCIM-only setup guide. If SCIM provisioning is + enabled, you may be affected and should upgrade. + +We strongly recommend customers who use Okta SCIM integration to upgrade their +auth servers to version 16.3.0 or later. Teleport services other than auth +(proxy, SSH, Kubernetes, desktop, application, database and discovery) are not +impacted and do not need to be updated. + +### Other improvements and fixes + +* Added a new teleport_roles_total metric that exposes the number of roles which exist in a cluster. [#47812](https://github.com/gravitational/teleport/pull/47812) +* Teleport's Windows Desktop Service now filters domain-joined Linux hosts out during LDAP discovery. [#47773](https://github.com/gravitational/teleport/pull/47773) +* The `join_token.create` audit event has been enriched with additional metadata. [#47765](https://github.com/gravitational/teleport/pull/47765) +* Propagate resources configured in teleport-kube-agent chart values to post-install and post-delete hooks. [#47743](https://github.com/gravitational/teleport/pull/47743) +* Add support for the Datadog Incident Management plugin helm chart. [#47727](https://github.com/gravitational/teleport/pull/47727) +* Automatic device enrollment may be locally disabled using the TELEPORT_DEVICE_AUTO_ENROLL_DISABLED=1 environment variable. [#47720](https://github.com/gravitational/teleport/pull/47720) +* Fixed the Machine ID and GitHub Actions wizard. [#47708](https://github.com/gravitational/teleport/pull/47708) +* Added migration to update the old import_all_objects database object import rule to the new preset. [#47707](https://github.com/gravitational/teleport/pull/47707) +* Alter ServiceAccounts in the teleport-cluster Helm chart to automatically disable mounting of service account tokens on newer Kubernetes distributions, helping satisfy security linters. [#47703](https://github.com/gravitational/teleport/pull/47703) +* Avoid tsh auto-enroll escalation in machines without a TPM. [#47695](https://github.com/gravitational/teleport/pull/47695) +* Fixed a bug that prevented users from canceling `tsh scan keys` executions. [#47658](https://github.com/gravitational/teleport/pull/47658) +* Postgres database session start events now include the Postgres backend PID for the session. [#47643](https://github.com/gravitational/teleport/pull/47643) +* Reworked the `teleport-event-handler` integration to significantly improve performance, especially when running with larger `--concurrency` values. [#47633](https://github.com/gravitational/teleport/pull/47633) +* Fixes a bug where Let's Encrypt certificate renewal failed in AMI and HA deployments due to insufficient disk space caused by syncing audit logs. [#47622](https://github.com/gravitational/teleport/pull/47622) +* Adds support for custom SQS consumer lock name and disabling a consumer. [#47614](https://github.com/gravitational/teleport/pull/47614) +* Fixed an issue that prevented RDS Aurora discovery configuration in the AWS OIDC enrollment wizard when any cluster existed without member instances. [#47605](https://github.com/gravitational/teleport/pull/47605) +* Extend the Datadog plugin to support automatic approvals. [#47602](https://github.com/gravitational/teleport/pull/47602) +* Allow using a custom database for Firestore backends. [#47583](https://github.com/gravitational/teleport/pull/47583) +* Include host name instead of host uuid in error messages when SSH connections are prevented due to an invalid login. [#47578](https://github.com/gravitational/teleport/pull/47578) +* Fix the example Terraform code to support the new larger Teleport Enterprise licenses and updates output of web address to use fqdn when ACM is disabled. [#47512](https://github.com/gravitational/teleport/pull/47512) +* Add new `tctl` subcommands to manage bot instances. [#47225](https://github.com/gravitational/teleport/pull/47225) + +Enterprise: +* Device auto-enroll failures are now recorded in the audit log. +* Fixed possible panic when processing Okta assignments. + +## 16.4.3 (10/16/2024) + +* Extended Teleport Discovery Service to support resource discovery across all projects accessible by the service account. [#47568](https://github.com/gravitational/teleport/pull/47568) +* Fixed a bug that could allow users to list active sessions even when prohibited by RBAC. [#47564](https://github.com/gravitational/teleport/pull/47564) +* The `tctl tokens ls` command redacts secret join tokens by default. To include the token values, provide the new `--with-secrets flag`. [#47545](https://github.com/gravitational/teleport/pull/47545) +* Added missing field-level documentation to the terraform provider reference. [#47469](https://github.com/gravitational/teleport/pull/47469) +* Fixed a bug where `tsh logout` failed to parse flags passed with spaces. [#47460](https://github.com/gravitational/teleport/pull/47460) +* Fixed the resource-based labels handler crashing without restarting. [#47452](https://github.com/gravitational/teleport/pull/47452) +* Install teleport FIPS binary in FIPS environments during Server Auto Discover. [#47437](https://github.com/gravitational/teleport/pull/47437) +* Fix possibly missing rules when using large amount of Access Monitoring Rules. [#47430](https://github.com/gravitational/teleport/pull/47430) +* Added ability to list/get AccessMonitoringRule resources with `tctl`. [#47401](https://github.com/gravitational/teleport/pull/47401) +* Include JWK header in JWTs issued by Teleport Application Access. [#47393](https://github.com/gravitational/teleport/pull/47393) +* Teleport Workload ID now supports issuing JWT SVIDs via the Workload API. [#47389](https://github.com/gravitational/teleport/pull/47389) +* Added kubeconfig context name to the output table of `tsh proxy kube` command for enhanced clarity. [#47383](https://github.com/gravitational/teleport/pull/47383) +* Improve error messaging when connections to offline agents are attempted. [#47361](https://github.com/gravitational/teleport/pull/47361) +* Allow specifying the instance type of AWS HA Terraform bastion instance. [#47338](https://github.com/gravitational/teleport/pull/47338) +* Added a config option to Teleport Connect to control how it interacts with the local SSH agent (`sshAgent.addKeysToAgent`). [#47324](https://github.com/gravitational/teleport/pull/47324) +* Teleport Workload ID issued JWT SVIDs are now compatible with OIDC federation with a number of platforms. [#47317](https://github.com/gravitational/teleport/pull/47317) +* The "ha-autoscale-cluster" terraform module now support default AWS resource tags and ASG instance refresh on configuration or launch template changes. [#47299](https://github.com/gravitational/teleport/pull/47299) +* Fixed error in Workload ID in cases where the process ID cannot be resolved. [#47274](https://github.com/gravitational/teleport/pull/47274) +* Teleport Connect for Linux now requires glibc 2.31 or later. [#47262](https://github.com/gravitational/teleport/pull/47262) +* Fixed a bug where security group rules that refer to another security group by ID were not displayed in web UI enrollment wizards when viewing security group rules. [#47246](https://github.com/gravitational/teleport/pull/47246) +* Improve the msteams access plugin debug logging. [#47158](https://github.com/gravitational/teleport/pull/47158) +* Fix missing tsh MFA prompt in certain OTP+WebAuthn scenarios. [#47154](https://github.com/gravitational/teleport/pull/47154) +* Updates self-hosted db discover flow to generate 2190h TTL certs, not 12h. [#47125](https://github.com/gravitational/teleport/pull/47125) +* Fixes an issue preventing access requests from displaying user friendly resource names. [#47112](https://github.com/gravitational/teleport/pull/47112) +* Fixed a bug where only one IP CIDR block security group rule for a port range was displayed in the web UI RDS enrollment wizard when viewing a security group. [#47077](https://github.com/gravitational/teleport/pull/47077) +* The `tsh play` command now supports a text output format. [#47073](https://github.com/gravitational/teleport/pull/47073) +* Updated Go to 1.22.8. [#47050](https://github.com/gravitational/teleport/pull/47050) +* Fixed the "source path is empty" error when attempting to upload a file in Teleport Connect. [#47011](https://github.com/gravitational/teleport/pull/47011) +* Added static host users to Terraform provider. [#46974](https://github.com/gravitational/teleport/pull/46974) +* Enforce a global `device_trust.mode=required` on OSS processes paired with an Enterprise Auth. [#46947](https://github.com/gravitational/teleport/pull/46947) +* Added a new config option in Teleport Connect to control SSH agent forwarding (`ssh.forwardAgent`); starting in Teleport Connect v17, this option will be disabled by default. [#46895](https://github.com/gravitational/teleport/pull/46895) +* Correctly display available allowed logins of leaf AWS Console Apps on `tsh app login`. [#46806](https://github.com/gravitational/teleport/pull/46806) +* Allow all audit events to be trimmed if necessary. [#46499](https://github.com/gravitational/teleport/pull/46499) + +Enterprise: +* Fixed possible panic when processing Okta assignments. +* Fixed bug where an unknown device aborts device web authentication. +* Add the Datadog Incident Management Plugin as a hosted plugin. +* Permit bootstrapping enterprise clusters with state from an open source cluster. + +## 16.4.2 (09/25/2024) + +* Fixed a panic when using the self-hosted PagerDuty plugin. [#46925](https://github.com/gravitational/teleport/pull/46925) +* A user joining a session will now see available controls for terminating & leaving the session. [#46901](https://github.com/gravitational/teleport/pull/46901) +* Fixed a regression in the SAML IdP service which prevented cache from initializing in a cluster that may have a service provider configured with unsupported `acs_url` and `relay_state` values. [#46845](https://github.com/gravitational/teleport/pull/46845) + +Enterprise: +* Fixed a possible crash when using Teleport Policy's GitLab integration. + +## 16.4.1 (09/25/2024) + +### Secrets support for Kubernetes Operator + +Kubernetes Operator is now able to lookup values from Kubernetes secrets for `GithubConnector.ClientSecret` and `OIDCConnector.ClientSecret`. + +### Other improvements and fixes + +* Fixed a regression that made it impossible to read the Teleport Audit Log after creating a plugin if the audit event is present. [#46831](https://github.com/gravitational/teleport/pull/46831) +* Added a new flag to static host users spec that allows teleport to automatically take ownership across matching hosts of any users with the same name as the static host user. [#46828](https://github.com/gravitational/teleport/pull/46828) +* Added support for Kubernetes SPDY over Websocket Protocols for PortForward. [#46815](https://github.com/gravitational/teleport/pull/46815) +* Fixed a regression where Teleport swallowed Kubernetes API errors when using kubectl exec with a Kubernetes cluster newer than v1.30.0. [#46811](https://github.com/gravitational/teleport/pull/46811) +* Added support for Access Request Datadog plugin. [#46740](https://github.com/gravitational/teleport/pull/46740) + +## 16.4.0 (09/18/2024) + +### Machine ID for HCP Terraform and Terraform Enterprise + +Teleport now supports secure joining via Terraform Cloud, allowing Machine ID +workflows to run on Terraform Cloud without shared secrets. + +### SPIFFE Federation for Workload Identity + +Teleport Workload Identity now supports SPIFFE Federation, allowing trust +relationships to be established between a Teleport cluster's trust domain and +trust domains managed by other SPIFFE compatible platforms. Establishing a +relationship between the trust domains enables workloads belonging to one trust +domain to validate the identity of workloads in the other trust domain, and vice +versa. + +### Multi-domain support for web applications + +Teleport now supports web application access where one application depends on +another. For example, you may have a web application that depends on a backend +API service, both of which are separate apps protected by Teleport. + +### Okta integration status dashboard + +Cluster admins are now able to get a detailed overview of the Okta integration +status in the Teleport web UI. + +### Other improvements and fixes + +* Fixed the web favicon not displaying on specific builds. [#46736](https://github.com/gravitational/teleport/pull/46736) +* Fixed regression in private key parser to handle mismatched PEM headers. [#46727](https://github.com/gravitational/teleport/pull/46727) +* Removed TXT record validation from custom DNS zones in VNet; VNet now supports any custom DNS zone, as long as it's included in `vnet_config`. [#46722](https://github.com/gravitational/teleport/pull/46722) +* Fixed audit log not recognizing static host user events. [#46697](https://github.com/gravitational/teleport/pull/46697) +* Fixes a bug in Kubernetes access that causes the error `expected *metav1.PartialObjectMetadata object` when trying to list resources. [#46694](https://github.com/gravitational/teleport/pull/46694) +* Added a new `default_shell` configuration for the static host users resource that works exactly the same as the `create_host_user_default_shell` configuration added for roles. [#46688](https://github.com/gravitational/teleport/pull/46688) +* Machine ID now generates cluster-specific `ssh_config` and `known_hosts` files which will always direct SSH connections made using them via Teleport. [#46684](https://github.com/gravitational/teleport/pull/46684) +* Fixed a regression that prevented the `fish` shell from starting in Teleport Connect. [#46662](https://github.com/gravitational/teleport/pull/46662) +* Added a new `create_host_user_default_shell` configuration under role options that changes the default shell of auto provisioned host users. [#46648](https://github.com/gravitational/teleport/pull/46648) +* Fixed an issue that prevented host user creation when the username was also listed in `host_groups`. [#46635](https://github.com/gravitational/teleport/pull/46635) +* Fixed `tsh scp` showing a login prompt when attempting to transfer a folder without the recursive option. [#46603](https://github.com/gravitational/teleport/pull/46603) +* The Teleport Terraform provider now supports AccessMonitoringRule resources. [#46582](https://github.com/gravitational/teleport/pull/46582) +* The `teleport-plugin-slack` chart can now deploy `tbot` to obtain and renew the Slack plugin credentials automatically. This setup is easier and more secure than signing long-lived credentials. [#46581](https://github.com/gravitational/teleport/pull/46581) +* Always show the device trust green shield for authenticated devices. [#46565](https://github.com/gravitational/teleport/pull/46565) +* Add new `terraform_cloud` joining method to enable secretless authentication on HCP Terraform jobs for the Teleport Terraform provider. [#46049](https://github.com/gravitational/teleport/pull/46049) +* Emit audit logs when creating, updating or deleting Teleport Plugins. [#4939](https://github.com/gravitational/teleport.e/pull/4939) + +## 16.3.0 (09/11/2024) + +### Out-of-band user creation + +Cluster administrators are now able to configure Teleport's `ssh_service` to +ensure that certain host users exist on the machine without the need to start +an SSH session. [#46498](https://github.com/gravitational/teleport/pull/46498) + +### Other improvements and fixes + +* Allow the cluster wide ssh dial timeout to be set via `auth_service.ssh_dial_timeout` in the Teleport config file. [#46507](https://github.com/gravitational/teleport/pull/46507) +* Fixed an issue preventing session joining while host user creation was in use. [#46501](https://github.com/gravitational/teleport/pull/46501) +* Added tbot Helm chart for deploying a Machine ID Bot into a Teleport cluster. [#46373](https://github.com/gravitational/teleport/pull/46373) + +## 16.2.2 (09/10/24) + +* Fixed an issue that prevented the Firestore backend from reading existing data. [#46433](https://github.com/gravitational/teleport/issues/46433) +* The `teleport-kube-agent` chart now correctly propagates configured annotations when deploying a StatefulSet. [#46421](https://github.com/gravitational/teleport/issues/46421) +* Fixed regression with Slack notification rules matching on plugin name instead of type. [#46391](https://github.com/gravitational/teleport/issues/46391) +* Update `tsh puttyconfig` to respect any defined proxy templates. [#46384](https://github.com/gravitational/teleport/issues/46384) +* Ensure that additional pod labels are carried over to post-upgrade and post-delete hook job pods when using the `teleport-kube-agent` Helm chart. [#46232](https://github.com/gravitational/teleport/issues/46232) +* Fix bug that renders WebUI unusable if a role is deleted while it is still being in use by the logged in user. [#45774](https://github.com/gravitational/teleport/issues/45774) + +## 16.2.1 (09/05/24) + +* Fixed debug service not being turned off by configuration; Connect My Computer in Teleport Connect should no longer fail with "bind: invalid argument". [#46293](https://github.com/gravitational/teleport/issues/46293) +* Fixed an issue that could result in duplicate session recordings being created. [#46265](https://github.com/gravitational/teleport/issues/46265) +* Connect now supports bulk selection of resources to create an access request in the unified resources view. [#46238](https://github.com/gravitational/teleport/issues/46238) +* Added support for the `teleport_installer` resource to the Teleport Terraform provider. [#46200](https://github.com/gravitational/teleport/issues/46200) +* Fixed an issue that would cause reissue of certificates to fail in some scenarios where a local auth service was present. [#46184](https://github.com/gravitational/teleport/issues/46184) +* Updated OpenSSL to 3.0.15. [#46180](https://github.com/gravitational/teleport/issues/46180) +* Extend Teleport ability to use non-default cluster domains in Kubernetes, avoiding the assumption of `cluster.local`. [#46150](https://github.com/gravitational/teleport/issues/46150) +* Fixed retention period handling in the CockroachDB audit log storage backend. [#46147](https://github.com/gravitational/teleport/issues/46147) +* Prevented Teleport Kubernetes access from resending resize events to the party that triggered the terminal resize, avoiding potential resize loops. [#46066](https://github.com/gravitational/teleport/issues/46066) +* Fixed an issue where attempts to play/export certain session recordings would fail with `gzip: invalid header`. [#46035](https://github.com/gravitational/teleport/issues/46035) +* Fixed a bug where Teleport services could not join the cluster using iam, azure, or tpm methods when the proxy service certificate did not contain IP SANs. [#46010](https://github.com/gravitational/teleport/issues/46010) +* Prevent connections from being randomly terminated by Teleport proxies when `proxy_protocol` is enabled and TLS is terminated before Teleport Proxy. [#45992](https://github.com/gravitational/teleport/issues/45992) +* Updated the icons for server, application, and desktop resources. [#45990](https://github.com/gravitational/teleport/issues/45990) +* Added `eks:UpdateAccessEntry` to IAM permissions generated by the teleport integration IAM setup command and to the documentation reference for auto-discovery IAM permissions. [#45983](https://github.com/gravitational/teleport/issues/45983) +* Added ServiceNow support to access request notification routing rules. [#45965](https://github.com/gravitational/teleport/issues/45965) +* Added PagerDuty support to access request notification routing rules. [#45913](https://github.com/gravitational/teleport/issues/45913) +* Fixed an issue where `host_sudoers` could be written to Teleport proxy server sudoer lists in Teleport v14 and v15. [#45958](https://github.com/gravitational/teleport/issues/45958) +* Prevent interactive sessions from hanging on exit. [#45952](https://github.com/gravitational/teleport/issues/45952) +* Fixed kernel version check of Enhanced Session Recording for distributions with backported BPF. [#45941](https://github.com/gravitational/teleport/issues/45941) +* Added a flag to skip a relogin attempt when using `tsh ssh` and `tsh proxy ssh`. [#45929](https://github.com/gravitational/teleport/issues/45929) +* The hostname where the process is running is returned when running `tctl get db_services`. [#45909](https://github.com/gravitational/teleport/issues/45909) +* Add buttons to clear all selected Roles/Reviewers in new Access Requests. [#45904](https://github.com/gravitational/teleport/issues/45904) +* Fixed an issue WebSocket upgrade fails with MiTM proxies that can remask payloads. [#45899](https://github.com/gravitational/teleport/issues/45899) +* When a database is created manually (without auto-discovery) the `teleport.dev/db-admin` and `teleport.dev/db-admin-default-database` labels are no longer ignored and can be used to configure database auto-user provisioning. [#45891](https://github.com/gravitational/teleport/issues/45891) +* Add support for non-RSA SSH signatures with imported CA keys. [#45890](https://github.com/gravitational/teleport/issues/45890) +* Update `tsh login` and `tsh status` output to truncate a list of roles. [#45581](https://github.com/gravitational/teleport/issues/45581) + +## 16.2.0 (08/26/24) + +### NLA Support for Windows desktops + +Teleport now supports Network Level Authentication (NLA) when connecting to +Windows hosts that are part of an Active Directory domain. NLA support is +currently opt-in. It will be enabled by default in a future release. + +To enable NLA, set the `TELEPORT_ENABLE_RDP_NLA` environment variable to `yes` +on your `windows_desktop_service` instances. It is not necessary to configure +the Windows hosts to require NLA - Teleport's client will perform NLA when +configured to do so, even if the server does not require it. + +More information is available in the +[Active Directory docs](./docs/pages/enroll-resources/desktop-access/active-directory.mdx#network-level-authentication-nla) + +### DocumentDB IAM authentication support + +Teleport now supports authenticating to DocumentDB with IAM users and roles +[recently released](https://aws.amazon.com/about-aws/whats-new/2024/06/amazon-documentdb-iam-database-authentication/) +by AWS. + +### Join Tokens in the Web UI + +Teleport now allows users to manage join tokens in the web UI as an alternative +to the tctl tokens commands. + +### Database Access Controls in Access Graph + +Database Access users are now able to see database objects and their access +paths in Access Graph. + +### Logrotate support + +Teleport now integrates with logrotate by automatically reopening log files when +detecting that they were renamed. + +### Other improvements and fixes + +* Failure to share a local directory in a Windows desktop session is no longer considered a fatal error. [#45852](https://github.com/gravitational/teleport/pull/45852) +* Add `teleport.dev/project-id` label for auto-enrolled instances in GCP. [#45820](https://github.com/gravitational/teleport/pull/45820) +* Fix an issue that prevented the creation of AWS App Access for an Integration that used digits only (eg, AWS Account ID). [#45819](https://github.com/gravitational/teleport/pull/45819) +* Slack plugin now lists logins permitted by requested roles. [#45759](https://github.com/gravitational/teleport/pull/45759) +* For new EKS Cluster auto-enroll configurations, the temporary Access Entry is tagged with `teleport.dev/` namespaced tags. For existing set ups, please add the `eks:TagResource` action to the Integration IAM Role to get the same behavior. [#45725](https://github.com/gravitational/teleport/pull/45725) +* Added support for importing S3 Bucket Tags into Teleport Policy's Access Graph. For existing configurations, ensure that the `s3:GetBucketTagging` permission is manually included in the Teleport Access Graph integration role. [#45551](https://github.com/gravitational/teleport/pull/45551) +* Add a `tctl terraform env` command to simplify running the Teleport Terraform provider locally. [#44690](https://github.com/gravitational/teleport/pull/44690) +* Add native MachineID support to the Terraform provider. Environments with delegated joining methods such as GitHub Actions, GitLab CI, CircleCI, GCP, or AWS can run the Terraform provider without having to setup `tbot`. [#44690](https://github.com/gravitational/teleport/pull/44690) +* The Terraform Provider now sequentially tries every credential source and provide more actionable error messages if it cannot connect. [#44690](https://github.com/gravitational/teleport/pull/44690) +* When the Terraform provider finds expired credentials it will now fail fast with a clear error instead of hanging for 30 seconds and sending potentially misleading error about certificates being untrusted. [#44690](https://github.com/gravitational/teleport/pull/44690) +* Fix a bug that caused some enterprise clusters to incorrectly display a message that the cluster had a monthly allocation of 0 access requests. [#4923](https://github.com/gravitational/teleport.e/pull/4923) + +## 16.1.8 (08/23/24) + +### Security fix + +#### [High] Stored XSS in SAML IdP + +When registering a service provider with SAML IdP, Teleport did not sufficiently +validate the ACS endpoint. This could allow a Teleport administrator with +permissions to write saml_idp_service_provider resources to configure a +malicious service provider with an XSS payload and compromise session of users +who would access that service provider. + +Note: This vulnerability is only applicable when Teleport itself is acting as +the identity provider. If you only use SAML to connect to an upstream identity +provider you are not impacted. You can use the tctl get +saml_idp_service_provider command to verify if you have any Service Provider +applications registered and Teleport acts as an IdP. + +For self-hosted Teleport customers that use Teleport as SAML Identity Provider, +we recommend upgrading auth and proxy servers. Teleport agents (SSH, Kubernetes, +desktop, application, database and discovery) are not impacted and do not need +to be updated. + +### Other fixes and improvements + +* Fixed an issue where Teleport could modify group assignments for users not managed by Teleport. This will require a migration of host users created with create_host_user_mode: keep in order to maintain Teleport management. [#45791](https://github.com/gravitational/teleport/pull/45791) +* The terminal shell can now be changed in Teleport Connect by right-clicking on a terminal tab. This allows using WSL (`wsl.exe`) if it is installed. Also, the default shell on Windows has been changed to `pwsh.exe` (instead of `powershell.exe`). [#45734](https://github.com/gravitational/teleport/pull/45734) +* Improve web UI enroll RDS flow where VPC, subnets, and security groups are now selectable. [#45688](https://github.com/gravitational/teleport/pull/45688) +* Allow to limit duration of local tsh proxy certificates with a new MFAVerificationInterval option. [#45686](https://github.com/gravitational/teleport/pull/45686) +* Fixed host user creation for tsh scp. [#45680](https://github.com/gravitational/teleport/pull/45680) +* Fixed an issue AWS access fails when the username is longer than 64 characters. [#45658](https://github.com/gravitational/teleport/pull/45658) +* Permit setting a cluster wide SSH connection dial timeout. [#45650](https://github.com/gravitational/teleport/pull/45650) +* Improve performance of host resolution performed via tsh ssh when connecting via labels or proxy templates. [#45644](https://github.com/gravitational/teleport/pull/45644) +* Remove empty tcp app session recordings. [#45643](https://github.com/gravitational/teleport/pull/45643) +* Fixed bug causing FeatureHiding flag to not hide the "Access Management" section in the UI as intended. [#45608](https://github.com/gravitational/teleport/pull/45608) +* Fixed an issue where users created in `keep` mode could effectively become `insecure_drop` and get cleaned up as a result. [#45594](https://github.com/gravitational/teleport/pull/45594) +* Prevent RBAC bypass for new Postgres connections. [#45554](https://github.com/gravitational/teleport/pull/45554) +* tctl allows cluster administrators to create custom notifications targeting Teleport users. [#45503](https://github.com/gravitational/teleport/pull/45503) +* Fixed debug service not enabled by default when not using a configuration file. [#45480](https://github.com/gravitational/teleport/pull/45480) +* Introduce support for Envoy SDS into the Machine ID spiffe-workload-api service. [#45460](https://github.com/gravitational/teleport/pull/45460) +* Improve the output of `tsh sessions ls`. [#45452](https://github.com/gravitational/teleport/pull/45452) +* Fix access entry handling permission error when EKS auto-discovery was set up in the Discover UI. [#45442](https://github.com/gravitational/teleport/pull/45442) +* Fix showing error message when enrolling EKS clusters in the Discover UI. [#45415](https://github.com/gravitational/teleport/pull/45415) +* Fixed the "Create A Bot" flow for GitHub Actions and SSH. It now correctly grants the bot the role created during the flow, and the example YAML is now correctly formatted. [#45409](https://github.com/gravitational/teleport/pull/45409) +* Mark authenticators used for passwordless as a passkey, if not previously marked as such. [#45395](https://github.com/gravitational/teleport/pull/45395) +* Prevents a panic caused by AWS STS client not being initialized when assuming an AWS Role. [#45382](https://github.com/gravitational/teleport/pull/45382) +* Update teleport debug commands to handle data dir not set. [#45341](https://github.com/gravitational/teleport/pull/45341) +* Fix `tctl get all` not returning SAML or OIDC auth connectors. [#45319](https://github.com/gravitational/teleport/pull/45319) +* The Opsgenie plugin recipients can now be dynamically configured by creating Access Monitoring Rules resources with the required Opsgenie notify schedules. [#45307](https://github.com/gravitational/teleport/pull/45307) +* Improve discoverability of the source or rejected connections due to unsupported versions. [#45278](https://github.com/gravitational/teleport/pull/45278) +* Improved copy and paste behavior in the terminal in Teleport Connect. On Windows and Linux, Ctrl+Shift+C/V now copies and pastes text (these shortcuts can be changed with `keymap.terminalCopy`/`keymap.terminalPaste`). A mouse right click (`terminal.rightClick`) can copy/paste text too (enabled by default on Windows). [#45265](https://github.com/gravitational/teleport/pull/45265) +* Fixed an issue that could cause auth servers to panic when their backend connectivity was interrupted. [#45225](https://github.com/gravitational/teleport/pull/45225) +* Adds SPIFFE compatible federation bundle endpoint to the Proxy API, allowing other workload identity platforms to federate with the Teleport cluster. [#44998](https://github.com/gravitational/teleport/pull/44998) +* Add 'Download CSV' button to Access Monitoring Query results. [#4899](https://github.com/gravitational/teleport.e/pull/4899) +* Fixed issue in Okta Sync that spuriously deletes Okta Applications due to connectivity errors. [#4885](https://github.com/gravitational/teleport.e/pull/4885) +* Fixed bug in Okta Sync that mistakenly removes Apps and Groups on connectivity failure. [#4883](https://github.com/gravitational/teleport.e/pull/4883) +* Fixed bug that caused some enterprise clusters to incorrectly display a message that the cluster had a monthly allocation of 0 access requests. [#4923](https://github.com/gravitational/teleport.e/pull/4923) + +## 16.1.4 (08/07/24) + +* Improved `tsh ssh` performance for concurrent execs. [#45162](https://github.com/gravitational/teleport/pull/45162) +* Fixed issue with loading cluster features when agents are upgraded prior to auth. [#45226](https://github.com/gravitational/teleport/pull/45226) +* Updated Go to `1.22.6`. [#45194](https://github.com/gravitational/teleport/pull/45194) + +## 16.1.3 (08/06/24) + +* Fixed an issue where `tsh aws` may display extra text in addition to the original command output. [#45168](https://github.com/gravitational/teleport/pull/45168) +* Fixed regression that denied access to launch some Apps. [#45149](https://github.com/gravitational/teleport/pull/45149) +* Bot resources now honor their `metadata.expires` field. [#45130](https://github.com/gravitational/teleport/pull/45130) +* Teleport Connect now sets `TERM_PROGRAM: Teleport_Connect` and `TERM_PROGRAM_VERSION: ` environment variables in the integrated terminal. [#45063](https://github.com/gravitational/teleport/pull/45063) +* Fixed a panic in the Microsoft Teams plugin when it receives an error. [#45011](https://github.com/gravitational/teleport/pull/45011) +* Added a background item for VNet in Teleport Connect; VNet now prompts for a password only during the first launch. [#44994](https://github.com/gravitational/teleport/pull/44994) +* Added warning on `tbot` startup when the requested certificate TTL exceeds the maximum allowed value. [#44989](https://github.com/gravitational/teleport/pull/44989) +* Fixed a race condition between session recording uploads and session recording upload cleanup. [#44978](https://github.com/gravitational/teleport/pull/44978) +* Prevented Kubernetes per-Resource RBAC from blocking access to namespaces when denying access to a single resource kind in every namespace. [#44974](https://github.com/gravitational/teleport/pull/44974) +* SSO login flows can now authorize web sessions with Device Trust. [#44906](https://github.com/gravitational/teleport/pull/44906) +* Added support for Kubernetes Workload Attestation into Teleport Workload Identity to allow the authentication of pods running within Kubernetes without secrets. [#44883](https://github.com/gravitational/teleport/pull/44883) + +Enterprise: +* Fixed a redirection issue with the SAML IdP authentication middleware which prevented users from signing into the service provider when an SAML authentication request was made with an HTTP-POST binding protocol, and user's didn't already have an active session with Teleport. [#4806](https://github.com/gravitational/teleport.e/pull/4806) +* SAML applications can now be deleted from the Web UI. [#4778](https://github.com/gravitational/teleport.e/pull/4778) +* Fixed an issue introduced in v16.0.3 and v15.4.6 where `tbot` FIPS builds fail to start due to a missing boringcrypto dependency. [#4757](https://github.com/gravitational/teleport.e/pull/4757) + +## 16.1.1 (07/31/24) + +* Added option to allow client redirects from IPs in specified CIDR ranges in SSO client logins. [#44846](https://github.com/gravitational/teleport/pull/44846) +* Machine ID can now be configured to use Kubernetes Secret destinations from the command line using the `kubernetes-secret` schema. [#44801](https://github.com/gravitational/teleport/pull/44801) +* Prevent the Discovery Service from overwriting Teleport dynamic resources that have the same name as discovered resources. [#44785](https://github.com/gravitational/teleport/pull/44785) +* Reduced the probability that the event-handler deadlocks when encountering errors processing session recordings. [#44771](https://github.com/gravitational/teleport/pull/44771) +* Improved event-handler diagnostics by providing a way to capture profiles dynamically via `SIGUSR1`. [#44758](https://github.com/gravitational/teleport/pull/44758) +* Teleport Connect now uses ConPTY for better terminal resizing and accurate color rendering on Windows, with an option to disable it in the app config. [#44742](https://github.com/gravitational/teleport/pull/44742) +* Fixed event-handler Helm charts using the wrong command when starting the event-handler container. [#44697](https://github.com/gravitational/teleport/pull/44697) +* Improved stability of very large Teleport clusters during temporary backend disruption/degradation. [#44694](https://github.com/gravitational/teleport/pull/44694) +* Resolved compatibility issue with Paramiko and Machine ID's SSH multiplexer SSH agent. [#44673](https://github.com/gravitational/teleport/pull/44673) +* Teleport no longer creates invalid SAML Connectors when calling `tctl get saml/ | tctl create -f` without the `--with-secrets` flag. [#44666](https://github.com/gravitational/teleport/pull/44666) +* Fixed a fatal error in `tbot` when unable to lookup the user from a given UID in containerized environments for checking ACL configuration. [#44645](https://github.com/gravitational/teleport/pull/44645) +* Fixed application access regression where an HTTP header wasn't set in forwarded requests. [#44628](https://github.com/gravitational/teleport/pull/44628) +* Added Server auto-discovery support for Rocky and AlmaLinux distros. [#44612](https://github.com/gravitational/teleport/pull/44612) +* Use the registered port of the target host when `tsh puttyconfig` is invoked without `--port`. [#44572](https://github.com/gravitational/teleport/pull/44572) +* Added more icons for guessing application icon by name or by label `teleport.icon` in the web UI. [#44566](https://github.com/gravitational/teleport/pull/44566) +* Remove deprecated S3 bucket option when creating or editing AWS OIDC integration in the web UI. [#44485](https://github.com/gravitational/teleport/pull/44485) +* Fixed terminal sessions with a database CLI client in Teleport Connect hanging indefinitely if the client cannot be found. [#44465](https://github.com/gravitational/teleport/pull/44465) +* Added `application-tunnel` service to Machine ID for establishing a long-lived tunnel to a HTTP or TCP application for Machine to Machine access. [#44443](https://github.com/gravitational/teleport/pull/44443) +* Fixed a regression that caused Teleport Connect to fail to start on Intel Macs. [#44435](https://github.com/gravitational/teleport/pull/44435) +* Improved auto-discovery resiliency by recreating Teleport configuration when the node fails to join the cluster. [#44432](https://github.com/gravitational/teleport/pull/44432) +* Fixed a low-probability panic in audit event upload logic. [#44425](https://github.com/gravitational/teleport/pull/44425) +* Fixed Teleport Connect binaries not being signed correctly. [#44419](https://github.com/gravitational/teleport/pull/44419) +* Prevented DoSing the cluster during a mass failed join event by agents. [#44414](https://github.com/gravitational/teleport/pull/44414) +* The availability filter is now a toggle to show (or hide) requestable resources. [#44413](https://github.com/gravitational/teleport/pull/44413) +* Moved PostgreSQL auto provisioning users procedures to `pg_temp` schema. [#44409](https://github.com/gravitational/teleport/pull/44409) +* Added audit events for AWS and Azure integration resource actions. [#44403](https://github.com/gravitational/teleport/pull/44403) +* Fixed automatic updates with previous versions of the `teleport.yaml` config. [#44379](https://github.com/gravitational/teleport/pull/44379) +* Added support for Rocky and AlmaLinux when enrolling a new server from the UI. [#44332](https://github.com/gravitational/teleport/pull/44332) +* Fixed PostgreSQL session playback not rendering queries line breaks correctly. [#44315](https://github.com/gravitational/teleport/pull/44315) +* Fixed Teleport access plugin tarballs containing a `build` directory, which was accidentally added upon v16.0.0 release. [#44300](https://github.com/gravitational/teleport/pull/44300) +* Prevented an infinite loop in DynamoDB event querying by advancing the cursor to the next day when the limit is reached at the end of a day with an empty iterator. This ensures the cursor does not reset to the beginning of the day. [#44275](https://github.com/gravitational/teleport/pull/44275) +* The clipboard sharing tooltip for desktop sessions now indicates why clipboard sharing is disabled. [#44237](https://github.com/gravitational/teleport/pull/44237) +* Prevented redirects to arbitrary URLs when launching an app. [#44188](https://github.com/gravitational/teleport/pull/44188) +* Added a `--skip-idle-time` flag to `tsh play`. [#44013](https://github.com/gravitational/teleport/pull/44013) +* Added audit events for discovery config actions. [#43793](https://github.com/gravitational/teleport/pull/43793) +* Enabled Access Monitoring Rules routing with Mattermost plugin. [#43601](https://github.com/gravitational/teleport/pull/43601) +* SAML application can now be deleted from the Web UI. [#4778](https://github.com/gravitational/teleport.e/pull/4778) +* Fixed an Access List permission bug where an Access List owner, who is also a member, was not able to add/remove Access List member. [#4744](https://github.com/gravitational/teleport.e/pull/4744) +* Fixed a bug in Web UI where clicking SAML GCP Workforce Identity Federation discover tile would throw an error, preventing from using the guided enrollment feature. [#4720](https://github.com/gravitational/teleport.e/pull/4720) +* Fixed an issue with incorrect yum/zypper updater packages being installed. [#4684](https://github.com/gravitational/teleport.e/pull/4684) + +## 16.1.0 (07/15/24) + +### New logo + +We're excited to announce an update to the Teleport logo. This refresh aligns +with our evolving brand and will be reflected across the product, our marketing +site (goteleport.com), branded content, swag, and more. + +The new logo will appear in the web UI starting with this release and on the +marketing website starting from July 17th, 2024. + +### Database access session replay + +Database access users will be able to watch PostgreSQL query replays in the web +UI or with tsh. + +### Other improvements and fixes + +* Fixed "staircase" text output for non-interactive Kube exec sessions in Web UI. [#44249](https://github.com/gravitational/teleport/pull/44249) +* Fixed a leak in the admin process spawned by starting VNet through `tsh vnet` or Teleport Connect. [#44225](https://github.com/gravitational/teleport/pull/44225) +* Fixed a `kube-agent-updater` bug affecting resolutions of private images. [#44191](https://github.com/gravitational/teleport/pull/44191) +* The `show_resources` option is no longer required for statically configured proxy ui settings. [#44181](https://github.com/gravitational/teleport/pull/44181) +* The `teleport-cluster` chart can now use existing ingresses instead of creating its own. [#44146](https://github.com/gravitational/teleport/pull/44146) +* Ensure that `tsh login` outputs accurate status information for the new session. [#44143](https://github.com/gravitational/teleport/pull/44143) +* Fixes "device trust mode _x_ requires Teleport Enterprise" errors on `tctl`. [#44133](https://github.com/gravitational/teleport/pull/44133) +* Added the `tbot install systemd` command for installing tbot as a service on Linux systems. [#44083](https://github.com/gravitational/teleport/pull/44083) +* Added ability to list Access List members in json format in `tctl`. [#44071](https://github.com/gravitational/teleport/pull/44071) +* Update grpc to `v1.64.1` (patches `GO-2024-2978`). [#44067](https://github.com/gravitational/teleport/pull/44067) +* Batch access review reminders into 1 message and provide link out to the web UI. [#44034](https://github.com/gravitational/teleport/pull/44034) +* Fixed denying access despite access being configured for Notification Routing Rules in the web UI. [#44029](https://github.com/gravitational/teleport/pull/44029) +* Honor proxy templates in tsh ssh. [#44026](https://github.com/gravitational/teleport/pull/44026) +* Fixed eBPF error occurring during startup on Linux RHEL 9. [#44023](https://github.com/gravitational/teleport/pull/44023) +* Fixed Redshift auto-user deactivation/deletion failure that occurs when a user is created or deleted and another user is deactivated concurrently. [#43968](https://github.com/gravitational/teleport/pull/43968) +* Lower latency of detecting Kubernetes cluster becoming online. [#43967](https://github.com/gravitational/teleport/pull/43967) +* Teleport AMIs now optionally source environment variables from `/etc/default/teleport` as regular Teleport package installations do. [#43962](https://github.com/gravitational/teleport/pull/43962) +* Make `tbot` compilable on Windows. [#43959](https://github.com/gravitational/teleport/pull/43959) +* Add a new event to the database session recording with query/command result information. [#43955](https://github.com/gravitational/teleport/pull/43955) +* Enabled setting event types to forward, skip events, skip session types in event-handler helm chart. [#43938](https://github.com/gravitational/teleport/pull/43938) +* `extraLabels` configured in `teleport-kube-agent` chart values are now correctly propagated to post-delete hooks. A new `extraLabels.job` object has been added for labels which should only apply to the post-delete job. [#43932](https://github.com/gravitational/teleport/pull/43932) +* Add support for Teams to Opsgenie plugin alert creation. [#43916](https://github.com/gravitational/teleport/pull/43916) +* Machine ID outputs now execute individually and concurrently, meaning that one failing output does not disrupt other outputs, and that performance when generating a large number of outputs is improved. [#43876](https://github.com/gravitational/teleport/pull/43876) +* SAML IdP service provider resource can now be updated from the Web UI. [#4651](https://github.com/gravitational/teleport.e/pull/4651) +* Fixed empty condition from unquoted string with YAML editor for Notification Routing Rules in the Web UI. [#4636](https://github.com/gravitational/teleport.e/pull/4636) +* Teleport Enterprise now supports the `TELEPORT_REPORTING_HTTP(S)_PROXY` environment variable to specify the URL of the HTTP(S) proxy used for connections to our usage reporting ingest service. [#4568](https://github.com/gravitational/teleport.e/pull/4568) +* Fixed inaccurately notifying user that Access List reviews are due in the web UI. [#4521](https://github.com/gravitational/teleport.e/pull/4521) + +## 16.0.4 (07/03/24) + +* Omit control plane services from the inventory list output for Cloud-Hosted instances. [#43779](https://github.com/gravitational/teleport/pull/43779) +* Updated Go toolchain to v1.22.5. [#43768](https://github.com/gravitational/teleport/pull/43768) +* Reduced CPU usage in auth servers experiencing very high concurrent request load. [#43755](https://github.com/gravitational/teleport/pull/43755) +* Machine ID defaults to disabling the use of the Kubernetes exec plugin when writing a Kubeconfig to a directory destination. This removes the need to manually configure `disable_exec_plugin`. [#43655](https://github.com/gravitational/teleport/pull/43655) +* Fixed startup crash of Teleport Connect on Ubuntu 24.04 by adding an AppArmor profile. [#43653](https://github.com/gravitational/teleport/pull/43653) +* Added support for dialling leaf clusters to the tbot SSH multiplexer. [#43634](https://github.com/gravitational/teleport/pull/43634) +* Extend Teleport ability to use non-default cluster domains in Kubernetes, avoiding the assumption of `cluster.local`. [#43631](https://github.com/gravitational/teleport/pull/43631) +* Wait for user MFA input when reissuing expired certificates for a kube proxy. [#43612](https://github.com/gravitational/teleport/pull/43612) +* Improved error diagnostics when using Machine ID's SSH multiplexer. [#43586](https://github.com/gravitational/teleport/pull/43586) + +Enterprise: +* Teleport Enterprise now supports the `TELEPORT_REPORTING_HTTP(S)_PROXY` environment variable to specify the URL of the HTTP(S) proxy used for connections to our usage reporting ingest service. + +## 16.0.3 (06/27/24) + +This release of Teleport contains a fix for medium-level security issue impacting +Teleport Enterprise, as well as various other updates and improvements + +### Security Fixes + +* **[Medium]** Fixes issue where a SCIM client could potentially overwrite. + Teleport system Roles using specially crafted groups. This issue impacts + Teleport Enterprise deployments using the Okta integration with SCIM support + enabled. + +We strongly recommend all customers upgrade to the latest releases of Teleport. + +### Other updates and improvements + +* Update `go-retryablehttp` to v0.7.7 (fixes CVE-2024-6104). [#43474](https://github.com/gravitational/teleport/pull/43474) +* Fixed Discover setup access error when updating user. [#43560](https://github.com/gravitational/teleport/pull/43560) +* Added audit event field describing if the "MFA for admin actions" requirement changed. [#43541](https://github.com/gravitational/teleport/pull/43541) +* Fixed remote port forwarding validation error. [#43516](https://github.com/gravitational/teleport/pull/43516) +* Added support to trust system CAs for self-hosted databases. [#43493](https://github.com/gravitational/teleport/pull/43493) +* Added error display in the Web UI for SSH and Kubernetes sessions. [#43485](https://github.com/gravitational/teleport/pull/43485) +* Fixed accurate inventory reporting of the updater after it is removed. [#43454](https://github.com/gravitational/teleport/pull/43454) +* `tctl alerts ls` now displays remaining alert ttl. [#43436](https://github.com/gravitational/teleport/pull/43436) +* Fixed input search for Teleport Connect's Access Request listing. [#43429](https://github.com/gravitational/teleport/pull/43429) +* Added `Debug` setting for event-handler. [#43408](https://github.com/gravitational/teleport/pull/43408) +* Fixed Headless auth for sso users, including when local auth is disabled. [#43361](https://github.com/gravitational/teleport/pull/43361) +* Added configuration for custom CAs in the event-handler helm chart. [#43340](https://github.com/gravitational/teleport/pull/43340) +* Updated VNet panel in Teleport Connect to list custom DNS zones and DNS zones from leaf clusters. [#43312](https://github.com/gravitational/teleport/pull/43312) +* Fixed an issue with Database Access Controls preventing users from making additional database connections. [#43303](https://github.com/gravitational/teleport/pull/43303) +* Fixed bug that caused gRPC connections to be disconnected when their certificate expired even though DisconnectCertExpiry was false. [#43290](https://github.com/gravitational/teleport/pull/43290) +* Fixed Connect My Computer in Teleport Connect failing with "bind: invalid argument". [#43287](https://github.com/gravitational/teleport/pull/43287) +* Fix a bug where a Teleport instance running only Jamf or Discovery service would never have a healthy `/readyz` endpoint. [#43283](https://github.com/gravitational/teleport/pull/43283) +* Added a missing `[Install]` section to the `teleport-acm` systemd unit file as used by Teleport AMIs. [#43257](https://github.com/gravitational/teleport/pull/43257) +* Patched timing variability in curve25519-dalek. [#43246](https://github.com/gravitational/teleport/pull/43246) +* Fixed setting request reason for automatic ssh Access Requests. [#43178](https://github.com/gravitational/teleport/pull/43178) +* Improved log rotation logic in Teleport Connect; now the non-numbered files always contain recent logs. [#43161](https://github.com/gravitational/teleport/pull/43161) +* Added `tctl desktop bootstrap` for bootstrapping AD environments to work with desktop access. [#43150](https://github.com/gravitational/teleport/pull/43150) + +### Enterprise only changes and improvements + +* The teleport updater will no longer default to using the global version channel, avoiding incompatible updates. +* Fixed sync error in Okta SCIM integration. + +## 16.0.1 (06/17/24) + +* `tctl` now ignores any configuration file if the auth_service section is disabled, and prefer loading credentials from a given identity file or tsh profile instead. [#43115](https://github.com/gravitational/teleport/pull/43115) +* Skip `jamf_service` validation when the service is not enabled. [#43095](https://github.com/gravitational/teleport/pull/43095) +* Fix v16.0.0 amd64 Teleport plugin images using arm64 binaries. [#43084](https://github.com/gravitational/teleport/pull/43084) +* Add ability to edit user traits from the Web UI. [#43067](https://github.com/gravitational/teleport/pull/43067) +* Enforce limits when reading events from Firestore for large time windows to prevent OOM events. [#42966](https://github.com/gravitational/teleport/pull/42966) +* Allow all authenticated users to read the cluster `vnet_config`. [#42957](https://github.com/gravitational/teleport/pull/42957) +* Improve search and predicate/label based dialing performance in large clusters under very high load. [#42943](https://github.com/gravitational/teleport/pull/42943) + +## 16.0.0 (06/13/24) + +Teleport 16 brings the following new features and improvements: + +- Teleport VNet +- Device Trust for the Web UI +- Increased support for per-session MFA +- Web UI notification system +- Access requests from the resources view +- `tctl` for Windows +- Teleport plugins improvements + +### Description + +#### Teleport VNet + +Teleport 16 introduces Teleport VNet, a new feature that provides a virtual IP +subnet and DNS server which automatically proxies TCP connections to Teleport +apps over mutually authenticated tunnels. + +This allows scripts and software applications to connect to any +Teleport-protected application as if they were connected to a VPN, without the +need to manage local tunnels. + +Teleport VNet is powered by the Teleport Connect client and is available for +macOS. Support for other operating systems will come in a future release. + +#### Device Trust for the Web UI + +Teleport Device Trust can now be enforced for browser-based workflows like +remote desktop and web application access. The Teleport Connect client must be +installed in order to satisfy device locality checks. + +#### Increased support for per-session MFA + +Teleport 16 now supports per-session MFA checks when accessing both web and TCP +applications via all supported clients (Web UI, `tsh`, and Teleport Connect). + +Additionally, Teleport Connect now includes support for per-session MFA when +accessing database resources. + +#### Web UI notification system + +Teleport’s Web UI includes a new notifications system that notifies users of +items requiring attention (for example, Access Requests needing review). + +#### Access requests from the resources view + +The resources view in the web UI now shows both resources you currently have +access to and resources you can request access to. This allows users to request +access to resources without navigating to a separate page. + +Cluster administrators who prefer the previous behavior of hiding requestable +resources from the main view can set `show_resources: accessible_only` in their +UI config: + +For dynamic configuration, run `tctl edit ui_config`: + +```yaml +kind: ui_config +version: v1 +metadata: + name: ui-config +spec: + show_resources: accessible_only +``` + +Alternatively, self-hosted Teleport users can update the `ui` section of their +proxy configuration: + +```yaml +proxy_service: + enabled: yes + ui: + show_resources: accessible_only +``` + +#### `tctl` for Windows + +Teleport 16 includes Windows builds of the `tctl` administrative tool, allowing +Windows users to administer their cluster without the need for a macOS or Linux +workstation. + +Additionally, there are no longer enterprise-specific versions of `tctl`. All +Teleport clients (`tsh`, `tctl`, and Teleport Connect) are available in a single +distribution that works on both Enterprise and Community Edition clusters. + +#### Teleport plugins improvements + +Teleport 16 includes major improvements to the plugins. All plugins now have: + +- amd64 and arm64 binaries available +- amd64 and arm64 multi-arch images +- Major and minor version rolling tags (ie + `public.ecr.aws/gravitational/teleport-plugin-email:16`) +- Image signatures for all images +- Additional debug images with all of the above features + +In addition, we now support plugins for each supported major version, starting +with v15. This means that if we fix a bug or security issue in a v16 plugin +version, we will also apply and release the change for the v15 plugin version. + +#### Other + +The Jamf plugin now authenticates with Jamf API credentials instead of username +and password. + +### Breaking changes and deprecations + +#### Community Edition license + +Starting with this release, Teleport Community Edition restricts commercial +usage. + +https://goteleport.com/blog/teleport-community-license/ + +#### License file validation on startup + +Teleport 16 introduces license file validation on startup. This only applies to +customers running **Teleport Enterprise Self-Hosted**. No action is required for +customers running Teleport Enterprise (Cloud) or Teleport Community Edition. + +If, after updating to Teleport 16, you receive an error message regarding an +outdated license file, follow our step-by-step [guide](docs/pages/admin-guides/deploy-a-cluster/license.mdx) +to update your license file. + +#### Multi-factor authentication is now required for local users + +Support for disabling multi-factor authentication has been removed. Teleport +will refuse to start until the `second_factor` setting is set to `on`, `webauthn` +or `otp`. + +This change only affects _self-hosted_ Teleport users, as Teleport Enterprise (Cloud) has +always required multi-factor authentication. + +**Important:** To avoid locking users out, we recommend the following steps: + +1. Ensure that all cluster administrators have multi-factor devices registered + in Teleport so that they will be able to reset any other users. +2. Announce to the user base that all users must register an MFA device. + Consider creating a cluster alert with `tctl alerts create` to help spread + the word. +3. While you are still on Teleport 15, set `second_factor: on`. This will help + identify any users who have not registered MFA devices and allow you to + revert to `second_factor: optional` if necessary. +4. Upgrade to Teleport 16. + +Any users who do not register MFA devices prior to the Teleport 16 upgrade will +be unable to log in and must be reset by an administrator (`tctl users reset`). + +#### Incompatible clients are rejected + +In accordance with our [component compatibility](docs/pages/upgrading/overview.mdx#component-compatibility) +guidelines, Teleport 16 will start rejecting connections from clients and agents +running incompatible (ie too old) versions. + +If Teleport detects connection attempts from outdated clients, it will show an +alert to cluster administrators in both the web UI and `tsh`. + +To disable this behavior and run in an unsupported configuration that allows +incompatible agents to connect to your cluster, start your Auth Service +instances with the `TELEPORT_UNSTABLE_ALLOW_OLD_CLIENTS=yes` environment +variable. #### Opsgenie plugin annotations -Opsgenie plugin users, role annotations must now contain -`teleport.dev/notify-services` to receive notification on Opsgenie. -`teleport.dev/schedules` is now the label used to determine auto approval flow. -See [the Opsgenie plugin documentation](docs/pages/admin-guides/access-controls/access-request-plugins/opsgenie.mdx) -for setup instructions. +Prior to Teleport 16, when using an Opsgenie plugin, the `teleport.dev/schedules` +role annotation was used to specify both schedules for Access Request +notifications as well as schedules to check for the request auto-approval. + +Starting with Teleport 16, the annotations were split to provide behavior +consistent with other Access Request plugins: a role must now contain the +`teleport.dev/notify-services` to receive notifications on Opsgenie and the +`teleport.dev/schedules` to check for auto-approval. + +Detailed setup instructions are available in the [documentation](https://github.com/gravitational/teleport/blob/branch/v16/docs/pages/access-controls/access-request-plugins/opsgenie.mdx). #### Teleport Assist has been removed @@ -19,14 +702,24 @@ options have been removed from the configuration. Teleport will not start if the During the migration from v15 to v16, the options mentioned above should be removed from the configuration. -#### DynamoDB permission requirements have changed +#### New required permissions for DynamoDB + +Teleport clusters using the DynamoDB backend on AWS now require the +`dynamodb:ConditionCheckItem` permissions. For a full list of required +permissions, see the IAM policy [example](docs/pages/reference/backends.mdx#dynamodb). -Teleport clusters using the dynamodb backend must now have the `dynamodb:ConditionCheckItem` -permission. For a full list of all required permissions see the Teleport [Backend Reference](docs/pages/reference/backends.mdx#dynamodb). +#### Updated keyboard shortcuts in Teleport connect -#### Disabling multi-factor authentication_type +On Windows and Linux, some of Teleport Connect’s keyboard shortcuts conflicted +with the default bash or nano shortcuts (Ctrl+E, Ctrl+K, etc). On those +platforms, the default shortcuts have been changed to a combination of +Ctrl+Shift+*. -Support for disabling multi-factor authentication has been removed +On macOS, the default shortcut to open a new terminal has been changed to +Ctrl+Shift+`. + +See the [configuration guide](https://github.com/gravitational/teleport/blob/branch/v16/docs/pages/connect-your-client/teleport-connect.mdx#configuration) +for a list of updated keyboard shortcuts. #### Machine ID and OpenSSH client config changes @@ -35,29 +728,874 @@ more performant, `tbot ssh-proxy-command`. See the [v16 upgrade guide](docs/pages/reference/machine-id/v16-upgrade-guide.mdx) for more details. -#### Default keyboard shortcuts in Teleport Connect have been changed +#### Removal of Active Directory configuration flow -On Windows and Linux, some of the default shortcuts conflicted with the default bash or nano shortcuts -(e.g. Ctrl + E, Ctrl + K). -On those platforms, the default shortcuts have been changed to a combination of Ctrl + Shift + *. -We also updated the shortcut to open a new terminal on macOS to Control + Shift + \`. -See [configuration](docs/pages/connect-your-client/teleport-connect.mdx#configuration) -for the current list of shortcuts. +The Active Directory installation and configuration wizard has been removed. +Users who don’t already have Active Directory should leverage Teleport’s local +user support, and users with existing Active Directory environments should +follow the manual setup guide. -## 15.0.0 (xx/xx/24) +#### Teleport Assist is removed -### New features +All Teleport Assist functionality and OpenAI integration has been removed from +Teleport. -#### FIPS now supported on ARM64 +## 15.4.10 (07/29/24) + +* Fixed an issue that could cause auth servers to panic when their backend connectivity was interrupted. [#44787](https://github.com/gravitational/teleport/pull/44787) +* Reduced the probability that the event-handler deadlocks when encountering errors processing session recordings. [#44772](https://github.com/gravitational/teleport/pull/44772) +* Improved event-handler diagnostics by providing a way to capture profiles dynamically via `SIGUSR1`. [#44759](https://github.com/gravitational/teleport/pull/44759) +* Added support for Teams to Opsgenie plugin alert creation. [#44330](https://github.com/gravitational/teleport/pull/44330) +* Improved stability of very large teleport clusters during temporary backend disruption/degradation. [#44695](https://github.com/gravitational/teleport/pull/44695) +* Resolved compatibility issue with Paramiko and Machine ID's SSH multiplexer SSH agent. [#44672](https://github.com/gravitational/teleport/pull/44672) +* Fixed a fatal error in `tbot` when unable to lookup the user from a given UID in containerized environments for checking ACL configuration. [#44646](https://github.com/gravitational/teleport/pull/44646) +* Fixed application access regression where an HTTP header wasn't set in forwarded requests. [#44629](https://github.com/gravitational/teleport/pull/44629) +* Use the registered port of the target host when `tsh puttyconfig` is invoked without `--port`. [#44573](https://github.com/gravitational/teleport/pull/44573) +* Added more icons for guessing application icon by name or by label `teleport.icon` in the web UI. [#44568](https://github.com/gravitational/teleport/pull/44568) +* Removed deprecated S3 bucket option when creating or editing AWS OIDC integration in the web UI. [#44487](https://github.com/gravitational/teleport/pull/44487) +* Fixed terminal sessions with a database CLI client in Teleport Connect hanging indefinitely if the client cannot be found. [#44466](https://github.com/gravitational/teleport/pull/44466) +* Added application-tunnel service to Machine ID for establishing a long-lived tunnel to a HTTP or TCP application for Machine to Machine access. [#44446](https://github.com/gravitational/teleport/pull/44446) +* Fixed a low-probability panic in audit event upload logic. [#44424](https://github.com/gravitational/teleport/pull/44424) +* Fixed Teleport Connect binaries not being signed correctly. [#44420](https://github.com/gravitational/teleport/pull/44420) +* Prevented DoSing the cluster during a mass failed join event by agents. [#44415](https://github.com/gravitational/teleport/pull/44415) +* Added audit events for AWS and Azure integration resource actions. [#44404](https://github.com/gravitational/teleport/pull/44404) +* Fixed automatic updates with previous versions of the `teleport.yaml` config. [#44378](https://github.com/gravitational/teleport/pull/44378) +* Added support for Rocky and AlmaLinux when enrolling a new server from the UI. [#44331](https://github.com/gravitational/teleport/pull/44331) +* Fixed Teleport access plugin tarballs containing a `build` directory, which was accidentally added upon v15.4.5 release. [#44301](https://github.com/gravitational/teleport/pull/44301) +* Prevented an infinite loop in DynamoDB event querying by advancing the cursor to the next day when the limit is reached at the end of a day with an empty iterator. This ensures the cursor does not reset to the beginning of the day. [#44274](https://github.com/gravitational/teleport/pull/44274) +* The clipboard sharing tooltip for desktop sessions now indicates why clipboard sharing is disabled. [#44238](https://github.com/gravitational/teleport/pull/44238) +* Fixed a `kube-agent-updater` bug affecting resolutions of private images. [#44192](https://github.com/gravitational/teleport/pull/44192) +* Prevented redirects to arbitrary URLs when launching an app. [#44189](https://github.com/gravitational/teleport/pull/44189) +* Added audit event field describing if the "MFA for admin actions" requirement changed. [#44185](https://github.com/gravitational/teleport/pull/44185) +* The `teleport-cluster` chart can now use existing ingresses instead of creating its own. [#44147](https://github.com/gravitational/teleport/pull/44147) +* Ensured that `tsh login` outputs accurate status information for the new session. [#44144](https://github.com/gravitational/teleport/pull/44144) +* Fixed "device trust mode _x_ requires Teleport Enterprise" errors on `tctl`. [#44134](https://github.com/gravitational/teleport/pull/44134) +* Added a `--skip-idle-time` flag to `tsh play`. [#44095](https://github.com/gravitational/teleport/pull/44095) +* Added the `tbot install systemd` command for installing tbot as a service on Linux systems. [#44082](https://github.com/gravitational/teleport/pull/44082) +* Added ability to list Access List members in json format in `tctl` cli tool. [#44072](https://github.com/gravitational/teleport/pull/44072) +* Made `tbot` compilable on Windows. [#44070](https://github.com/gravitational/teleport/pull/44070) +* For slack integration, Access List reminders are batched into 1 message and provides link out to the web UI. [#44035](https://github.com/gravitational/teleport/pull/44035) +* Fixed denying access despite access being configured for Notification Routing Rules in the web UI. [#44028](https://github.com/gravitational/teleport/pull/44028) +* Fixed eBPF error occurring during startup on Linux RHEL 9. [#44024](https://github.com/gravitational/teleport/pull/44024) +* Lowered latency of detecting Kubernetes cluster becoming online. [#43971](https://github.com/gravitational/teleport/pull/43971) +* Enabled Access Monitoring Rules routing with Mattermost plugin. [#43600](https://github.com/gravitational/teleport/pull/43600) + +Enterprise: +* Fixed an Access List permission bug where an Access List owner, who is also a member, was not able to add/rm Access List member. +* Fixed an issue with incorrect yum/zypper updater packages being installed. +* Fixed empty condition from unquoted string with yaml editor for Notification Routing Rules in the Web UI. + +## 15.4.9 (07/11/24) + +* Honor proxy templates in tsh ssh. [#44027](https://github.com/gravitational/teleport/pull/44027) +* Fixed Redshift auto-user deactivation/deletion failure that occurs when a user is created or deleted and another user is deactivated concurrently. [#43975](https://github.com/gravitational/teleport/pull/43975) +* Teleport AMIs now optionally source environment variables from `/etc/default/teleport` as regular Teleport package installations do. [#43961](https://github.com/gravitational/teleport/pull/43961) +* Enabled setting event types to forward, skip events, skip session types in event-handler helm chart. [#43939](https://github.com/gravitational/teleport/pull/43939) +* Correctly propagate `extraLabels` configured in teleport-kube-agent chart values to post-delete hooks. A new `extraLabels.job` object has been added for labels which should only apply to the post-delete job. [#43931](https://github.com/gravitational/teleport/pull/43931) +* Machine ID outputs now execute individually and concurrently, meaning that one failing output does not disrupt other outputs, and that performance when generating a large number of outputs is improved. [#43883](https://github.com/gravitational/teleport/pull/43883) +* Omit control plane services from the inventory list output for Cloud-Hosted instances. [#43778](https://github.com/gravitational/teleport/pull/43778) +* Fixed session recordings getting overwritten or not uploaded. [#42164](https://github.com/gravitational/teleport/pull/42164) + +Enterprise: +* Fixed inaccurately notifying user that Access List reviews are due in the web UI. + +## 15.4.7 (07/03/24) + +* Added audit events for discovery config actions. [#43794](https://github.com/gravitational/teleport/pull/43794) +* Updated Go toolchain to v1.22.5. [#43769](https://github.com/gravitational/teleport/pull/43769) +* Reduced CPU usage in auth servers experiencing very high concurrent request load. [#43760](https://github.com/gravitational/teleport/pull/43760) +* Machine ID defaults to disabling the use of the Kubernetes exec plugin when writing a Kubeconfig to a directory destination. This removes the need to manually configure `disable_exec_plugin`. [#43656](https://github.com/gravitational/teleport/pull/43656) +* Fixed startup crash of Teleport Connect on Ubuntu 24.04 by adding an AppArmor profile. [#43652](https://github.com/gravitational/teleport/pull/43652) +* Added support for dialling leaf clusters to the tbot SSH multiplexer. [#43635](https://github.com/gravitational/teleport/pull/43635) +* Extend Teleport ability to use non-default cluster domains in Kubernetes, avoiding the assumption of `cluster.local`. [#43632](https://github.com/gravitational/teleport/pull/43632) +* Wait for user MFA input when reissuing expired certificates for a kube proxy. [#43613](https://github.com/gravitational/teleport/pull/43613) +* Improved error diagnostics when using Machine ID's SSH multiplexer. [#43587](https://github.com/gravitational/teleport/pull/43587) + +Enterprise: +* Increased Access Monitoring refresh interval to 24h. +* Teleport Enterprise now supports the `TELEPORT_REPORTING_HTTP(S)_PROXY` environment variable to specify the URL of the HTTP(S) proxy used for connections to our usage reporting ingest service. + +## 15.4.6 (06/27/24) + +This release of Teleport contains a fix for medium-level security issue impacting +Teleport Enterprise, as well as various other updates and improvements + +### Security Fixes + +* **[Medium]** Fixes issue where a SCIM client could potentially overwrite. + Teleport system Roles using specially crafted groups. This issue impacts + Teleport Enterprise deployments using the Okta integration with SCIM support + enabled. + +We strongly recommend all customers upgrade to the latest releases of Teleport. + +### Other updates and improvements + +* Fixed Discover setup access error when updating user. [#43561](https://github.com/gravitational/teleport/pull/43561) +* Updated Go toolchain to 1.22. [#43550](https://github.com/gravitational/teleport/pull/43550) +* Fixed remote port forwarding validation error. [#43517](https://github.com/gravitational/teleport/pull/43517) +* Added support to trust system CAs for self-hosted databases. [#43500](https://github.com/gravitational/teleport/pull/43500) +* Added error display in the Web UI for SSH and Kubernetes sessions. [#43491](https://github.com/gravitational/teleport/pull/43491) +* Update `go-retryablehttp` to v0.7.7 (fixes CVE-2024-6104). [#43475](https://github.com/gravitational/teleport/pull/43475) +* Fixed accurate inventory reporting of the updater after it is removed.. [#43453](https://github.com/gravitational/teleport/pull/43453) +* `tctl alerts ls` now displays remaining alert ttl. [#43435](https://github.com/gravitational/teleport/pull/43435) +* Fixed input search for Teleport Connect's Access Request listing. [#43430](https://github.com/gravitational/teleport/pull/43430) +* Added `Debug` setting for event-handler. [#43409](https://github.com/gravitational/teleport/pull/43409) +* Fixed Headless auth for sso users, including when local auth is disabled. [#43362](https://github.com/gravitational/teleport/pull/43362) +* Added configuration for custom CAs in the event-handler helm chart. [#43341](https://github.com/gravitational/teleport/pull/43341) +* Fixed an issue with Database Access Controls preventing users from making additional database connections depending on their permissions. [#43302](https://github.com/gravitational/teleport/pull/43302) +* Fixed Connect My Computer in Teleport Connect failing with "bind: invalid argument". [#43288](https://github.com/gravitational/teleport/pull/43288) + +### Enterprise only updates and improvements + +* The teleport updater will no longer default to using the global version channel, avoiding incompatible updates. [#4476](https://github.com/gravitational/teleport.e/pull/4476) + +## 15.4.5 (06/20/24) + +* Added a missing `[Install]` section to the `teleport-acm` systemd unit file as used by Teleport AMIs. [#43256](https://github.com/gravitational/teleport/pull/43256) +* Patched timing variability in curve25519-dalek. [#43249](https://github.com/gravitational/teleport/pull/43249) +* Updated `tctl` to ignore a configuration file if the `auth_service` section is disabled, and prefer loading credentials from a given identity file or tsh profile instead. [#43203](https://github.com/gravitational/teleport/pull/43203) +* Fixed setting request reason for automatic ssh Access Requests. [#43180](https://github.com/gravitational/teleport/pull/43180) +* Updated `teleport` to skip `jamf_service` validation when the Jamf service is not enabled. [#43169](https://github.com/gravitational/teleport/pull/43169) +* Improved log rotation logic in Teleport Connect; now the non-numbered files always contain recent logs. [#43162](https://github.com/gravitational/teleport/pull/43162) +* Made `tsh` and Teleport Connect return early during login if ping to Proxy Service was not successful. [#43086](https://github.com/gravitational/teleport/pull/43086) +* Added ability to edit user traits from the Web UI. [#43068](https://github.com/gravitational/teleport/pull/43068) +* Enforce limits when reading events from Firestore to prevent OOM events. [#42967](https://github.com/gravitational/teleport/pull/42967) +* Fixed updating groups for Teleport-created host users. [#42884](https://github.com/gravitational/teleport/pull/42884) +* Added support for `crown_jewel` resource. [#42866](https://github.com/gravitational/teleport/pull/42866) +* Added ability to edit user traits from the Web UI. [#43068](https://github.com/gravitational/teleport/pull/43068) +* Fixed gRPC disconnection on certificate expiry even though DisconnectCertExpiry was false. [#43291](https://github.com/gravitational/teleport/pull/43291) +* Fixed issue where a Teleport instance running only Jamf or Discovery service would never have a healthy `/readyz` endpoint. [#43284](https://github.com/gravitational/teleport/pull/43284) + +### Enterprise-only changes + +* Fixed sync error in Okta SCIM integration. + +## 15.4.4 (06/13/24) + +* Improve search and predicate/label based dialing performance in large clusters under very high load. [#42941](https://github.com/gravitational/teleport/pull/42941) +* Fix an issue Oracle access failed through trusted cluster. [#42928](https://github.com/gravitational/teleport/pull/42928) +* Fix errors caused by `dynamoevents` query `StartKey` not being within the [From, To] window. [#42915](https://github.com/gravitational/teleport/pull/42915) +* Fix Jira Issue creation when Summary exceeds the max allowed size. [#42862](https://github.com/gravitational/teleport/pull/42862) +* Fix editing reviewers from being ignored/overwritten when creating an Access Request from the web UI. [#4397](https://github.com/gravitational/teleport.e/pull/4397) + +## 15.4.3 (06/12/24) + +**Note:** This release includes a new binary, `fdpass-teleport`, that can be +optionally used by Machine ID to significantly reduce resource consumption in +use-cases that create large numbers of SSH connections (e.g. Ansible). Refer to +the [documentation](docs/pages/reference/machine-id/configuration.mdx#ssh-multiplexer) +for more details. -Teleport 15 now provides FIPS-compliant Linux builds on ARM64. Users will now -be able to run Teleport in FedRAMP/FIPS mode on ARM64. +* Update `azidentity` to `v1.6.0` (patches `CVE-2024-35255`). [#42859](https://github.com/gravitational/teleport/pull/42859) +* Remote rate limits on endpoints used extensively to connect to the cluster. [#42835](https://github.com/gravitational/teleport/pull/42835) +* Machine ID SSH multiplexer now only writes artifacts if they have not changed, resolving a potential race condition with the OpenSSH client. [#42830](https://github.com/gravitational/teleport/pull/42830) +* Use more efficient API when querying SSH nodes to resolve Proxy Templates in `tbot`. [#42829](https://github.com/gravitational/teleport/pull/42829) +* Improve the performance of the Athena audit log and S3 session storage backends. [#42795](https://github.com/gravitational/teleport/pull/42795) +* Prevent a panic in the Proxy when accessing an offline application. [#42786](https://github.com/gravitational/teleport/pull/42786) +* Improve backoff of session recording uploads by teleport agents. [#42776](https://github.com/gravitational/teleport/pull/42776) +* Introduce the new Machine ID `ssh-multiplexer` service for significant improvements in SSH performance. [#42761](https://github.com/gravitational/teleport/pull/42761) +* Reduce backend writes incurred by tracking status of non-recorded sessions. [#42694](https://github.com/gravitational/teleport/pull/42694) +* Fix not being able to logout from the web UI when session invalidation errors. [#42648](https://github.com/gravitational/teleport/pull/42648) +* Fix Access List listing not updating when creating or deleting an Access List in the web UI. [#4383](https://github.com/gravitational/teleport.e/pull/4383) +* Fix crashes related to importing GCP labels. [#42871](https://github.com/gravitational/teleport/pull/42871) + +## 15.4.2 (06/11/24) + +* Fixed a desktop access resize bug which occurs when window was resized during MFA. [#42705](https://github.com/gravitational/teleport/pull/42705) +* Fixed listing available db users in Teleport Connect for databases from leaf clusters obtained through Access Requests. [#42679](https://github.com/gravitational/teleport/pull/42679) +* Fixed file upload/download for Teleport-created users in `insecure-drop` mode. [#42660](https://github.com/gravitational/teleport/pull/42660) +* Updated OpenSSL to 3.0.14. [#42642](https://github.com/gravitational/teleport/pull/42642) +* Fixed fetching resources with tons of metadata (such as labels or description) in Teleport Connect. [#42627](https://github.com/gravitational/teleport/pull/42627) +* Added support for Microsoft Entra ID directory synchronization (Teleport Enterprise only, preview). [#42555](https://github.com/gravitational/teleport/pull/42555) +* Added experimental support for storing audit events in cockroach. [#42549](https://github.com/gravitational/teleport/pull/42549) +* Teleport Connect binaries for Windows are now signed. [#42472](https://github.com/gravitational/teleport/pull/42472) +* Updated Go to 1.21.11. [#42404](https://github.com/gravitational/teleport/pull/42404) +* Added GCP Cloud SQL for PostgreSQL backend support. [#42399](https://github.com/gravitational/teleport/pull/42399) +* Added Prometheus metrics for the Postgres event backend. [#42384](https://github.com/gravitational/teleport/pull/42384) +* Fixed the event-handler Helm chart causing stuck rollouts when using a PVC. [#42363](https://github.com/gravitational/teleport/pull/42363) +* Fixed web UI notification dropdown menu height from growing too long from many notifications. [#42336](https://github.com/gravitational/teleport/pull/42336) +* Disabled session recordings for non-interactive sessions when enhanced recording is disabled. There is no loss of auditing or impact on data fidelity because these recordings only contained session.start, session.end, and session.leave events which were already captured in the audit log. This will cause all teleport components to consume less resources and reduce storage costs. [#42320](https://github.com/gravitational/teleport/pull/42320) +* Fixed an issue where removing an app could make teleport app agents incorrectly report as unhealthy for a short time. [#42270](https://github.com/gravitational/teleport/pull/42270) +* Fixed a panic in the DynamoDB audit log backend when the cursor fell outside of the [From,To] interval. [#42267](https://github.com/gravitational/teleport/pull/42267) +* The `teleport configure` command now supports a `--node-name` flag for overriding the node's hostname. [#42250](https://github.com/gravitational/teleport/pull/42250) +* Added support plugin resource in `tctl` tool. [#42224](https://github.com/gravitational/teleport/pull/42224) + +## 15.4.0 (05/31/24) + +### Access requests notification routing rules + +Hosted Slack plugin users can now configure notification routing rules for +role-based Access Requests. + +### Database access for Spanner + +Database access users can now connect to GCP Spanner. + +### Unix Workload Attestation + +*Delayed from Teleport 15.3.0* + +Teleport Workload ID now supports basic workload attestation on Unix systems, +allowing cluster administrators to restrict the issuance of SVIDs to specific +workloads based on UID/PID/GID. -#### Hardened AMIs now produced for ARM64 +### Other improvements and fixes + +* Fixed an issue where mix-and-match of join tokens could interfere with some services appearing correctly in heartbeats. [#42189](https://github.com/gravitational/teleport/pull/42189) +* Added an alternate EC2 auto discover flow using AWS Systems Manager as a more scalable method than Endpoint Instance Connect in the "Enroll New Resource" view in the web UI. [#42205](https://github.com/gravitational/teleport/pull/42205) +* Fixed `kubectl exec` functionality when Teleport is running behind L7 load balancer. [#42192](https://github.com/gravitational/teleport/pull/42192) +* Fixed the plugins AMR cache to be updated when Access requests are removed from the subject of an existing rule. [#42186](https://github.com/gravitational/teleport/pull/42186) +* Improved temporary disk space usage for session recording processing. [#42174](https://github.com/gravitational/teleport/pull/42174) +* Fixed a regression where Kubernetes Exec audit events were not properly populated and lacked error details. [#42145](https://github.com/gravitational/teleport/pull/42145) +* Fixed Azure join method when using Resource Groups in the allow section. [#42141](https://github.com/gravitational/teleport/pull/42141) +* Added new `teleport debug set-log-level / profile` commands changing instance log level without a restart and collecting pprof profiles. [#42122](https://github.com/gravitational/teleport/pull/42122) +* Added ability to manage access monitoring rules via `tctl`. [#42092](https://github.com/gravitational/teleport/pull/42092) +* Added access monitoring rule routing for slack access plugin. [#42087](https://github.com/gravitational/teleport/pull/42087) +* Extended Discovery Service to self-bootstrap necessary permissions for Kubernetes Service to interact with the Kubernetes API on behalf of users. [#42075](https://github.com/gravitational/teleport/pull/42075) +* Fixed resource leak in session recording cleanup. [#42066](https://github.com/gravitational/teleport/pull/42066) +* Reduced memory and CPU usage after control plane restarts in clusters with a high number of roles. [#42062](https://github.com/gravitational/teleport/pull/42062) +* Added an option to send a `Ctrl+Alt+Del` sequence to remote desktops. [#41720](https://github.com/gravitational/teleport/pull/41720) +* Added support for GCP Spanner to Teleport Database Service. [#41349](https://github.com/gravitational/teleport/pull/41349) + +## 15.3.7 (05/23/24) + +* Fixed creating Access Requests for servers in Teleport Connect that were blocked due to a "no roles configured" error. [#41959](https://github.com/gravitational/teleport/pull/41959) +* Fixed regression issue with event-handler Linux artifacts not being available. [#4237](https://github.com/gravitational/teleport.e/pull/4237) +* Fixed failed startup on GCP if missing permissions. [#41985](https://github.com/gravitational/teleport/pull/41985) + +## 15.3.6 (05/22/24) + +This release contains fixes for several high-severity security issues, as well +as numerous other bug fixes and improvements. + +### Security Fixes + +* **[High]** Fixed unrestricted redirect in SSO Authentication. Teleport didn’t + sufficiently validate the client redirect URL. This could allow an attacker to + trick Teleport users into performing an SSO authentication and redirect to an + attacker-controlled URL allowing them to steal the credentials. [#41834](https://github.com/gravitational/teleport/pull/41834). + +* **[High]** Fixed CockroachDB authorization bypass. When connecting to + CockroachDB using database access, Teleport did not properly consider the + username case when running RBAC checks. As such, it was possible to establish + a connection using an explicitly denied username when using a different case. + [#41823](https://github.com/gravitational/teleport/pull/41823). + +* **[High]** Fixed Long-lived connection persistence issue with expired + certificates. Teleport did not terminate some long-running mTLS-authenticated + connections past the expiry of client certificates for users with the + `disconnect_expired_cert` option. This could allow such users to perform + some API actions after their certificate has expired. [#41827](https://github.com/gravitational/teleport/pull/41827). + +* **[High]** Fixed PagerDuty integration privilege escalation. When creating a + role Access Request, Teleport would include PagerDuty annotations from the + entire user’s role set rather than a specific role being requested. For users + who run multiple PagerDuty access plugins with auto-approval, this could + result in a request for a different role being inadvertently auto-approved + than the one which corresponds to the user’s active on-call schedule. [#41837](https://github.com/gravitational/teleport/pull/41837). + +* **[High]** Fixed SAML IdP session privilege escalation. When using Teleport as + SAML IdP, authorization wasn’t properly enforced on the SAML IdP session + creation. As such, authenticated users could use an internal API to escalate + their own privileges by crafting a malicious program. [#41846](https://github.com/gravitational/teleport/pull/41846). + +We strongly recommend all customers upgrade to the latest releases of Teleport. + +### Other fixes and improvements + +* Fixed Access Request annotations when annotations contain globs, regular + expressions, trait expansions, or `claims_to_roles` is used. [#41936](https://github.com/gravitational/teleport/pull/41936). +* Added AWS Management Console as a guided flow using AWS OIDC integration in + the "Enroll New Resource" view in the web UI. [#41864](https://github.com/gravitational/teleport/pull/41864). +* Fixed spurious Windows Desktop sessions screen resize during an MFA ceremony. [#41856](https://github.com/gravitational/teleport/pull/41856). +* Fixed session upload completion with large number of simultaneous session + uploads. [#41854](https://github.com/gravitational/teleport/pull/41854). +* Fixed MySQL databases version reporting on new connections. [#41819](https://github.com/gravitational/teleport/pull/41819). +* Added read-only permissions for cluster maintenance config. [#41790](https://github.com/gravitational/teleport/pull/41790). +* Stripped debug symbols from Windows builds, resulting in smaller `tsh` and + `tctl` binaries. [#41787](https://github.com/gravitational/teleport/pull/41787) +* Fixed passkey deletion so that a user may now delete their last passkey if + the have a password and another MFA configured. [#41771](https://github.com/gravitational/teleport/pull/41771). +* Changed the default permissions for the Workload Identity Unix socket to `0777` + rather than the default as applied by the umask. This will allow the socket to + be accessed by workloads running as users other than the user that owns the + `tbot` process. [#41754](https://github.com/gravitational/teleport/pull/41754) +* Added ability for `teleport-event-handler` to skip certain events type when + forwarding to an upstream server. [#41747](https://github.com/gravitational/teleport/pull/41747). +* Added automatic GCP label importing. [#41733](https://github.com/gravitational/teleport/pull/41733). +* Fixed missing variable and script options in Default Agentless Installer + script. [#41723](https://github.com/gravitational/teleport/pull/41723). +* Removed invalid AWS Roles from Web UI picker. [#41707](https://github.com/gravitational/teleport/pull/41707). +* Added remote address to audit log events emitted when a Bot or Instance join + completes, successfully or otherwise. [#41700](https://github.com/gravitational/teleport/pull/41700). +* Simplified how Bots are shown on the Users list page. [#41697](https://github.com/gravitational/teleport/pull/41697). +* Added improved-performance implementation of ProxyCommand for Machine ID and + SSH. This will become the default in v16. You can adopt this new mode early by + setting `TBOT_SSH_CONFIG_PROXY_COMMAND_MODE=new`. [#41694](https://github.com/gravitational/teleport/pull/41694). +* Improved EC2 Auto Discovery by adding the SSM script output and more explicit + error messages. [#41664](https://github.com/gravitational/teleport/pull/41664). +* Added webauthn diagnostics commands to `tctl`. [#41643](https://github.com/gravitational/teleport/pull/41643). +* Upgraded application heartbeat service to support 1000+ dynamic applications. [#41626](https://github.com/gravitational/teleport/pull/41626) +* Fixed issue where Kubernetes watch requests are written out of order. [#41624](https://github.com/gravitational/teleport/pull/41624). +* Fixed a race condition triggered by a reload during Teleport startup. [#41592](https://github.com/gravitational/teleport/pull/41592). +* Updated discover wizard Install Script to support Ubuntu 24.04. [#41589](https://github.com/gravitational/teleport/pull/41589). +* Fixed `systemd` unit to always restart Teleport on failure unless explicitly stopped. [#41581](https://github.com/gravitational/teleport/pull/41581). +* Updated Teleport package installers to reload Teleport service config after + upgrades. [#41547](https://github.com/gravitational/teleport/pull/41547). +* Fixed file truncation bug in Desktop Directory Sharing. [#41540](https://github.com/gravitational/teleport/pull/41540). +* Fixed WebUI SSH connection leak when browser tab closed during SSH connection + establishment. [#41518](https://github.com/gravitational/teleport/pull/41518). +* Fixed AccessList reconciler comparison causing audit events noise. [#41517](https://github.com/gravitational/teleport/pull/41517). +* Added tooling to create SCIM integrations in tctl. [#41514](https://github.com/gravitational/teleport/pull/41514). +* Fixed Windows Desktop error preventing rendering of the remote session. [#41498](https://github.com/gravitational/teleport/pull/41498). +* Fixed issue in the PagerDuty, Opsgenie and ServiceNow access plugins that + causing duplicate calls on Access Requests containing duplicate service names. + Also increases the timeout so slow external API requests are less likely to + fail. [#41488](https://github.com/gravitational/teleport/pull/41488). +* Added basic Unix workload attestation to the `tbot` SPIFFE workload API. You + can now restrict the issuance of certain SVIDs to processes running with a + certain UID, GID or PID. [#41450](https://github.com/gravitational/teleport/pull/41450). +* Added "login failed" audit events for invalid passwords on password+webauthn + local authentication. [#41432](https://github.com/gravitational/teleport/pull/41432). + Fixed Terraform provider issue causing the Provision Token options to default + to `false` instead of empty. [#41429](https://github.com/gravitational/teleport/pull/41429). +* Added support to automatically download CA for MongoDB Atlas databases. [#41338](https://github.com/gravitational/teleport/pull/41338). +* Fixed broken "finish" web page for SSO Users on auto discover. [#41335](https://github.com/gravitational/teleport/pull/41335). +* Allow setting Kubernetes Cluster name when using non-default addresses. [#41331](https://github.com/gravitational/teleport/pull/41331). +* Added fallback on GetAccessList cache miss call. [#41326](https://github.com/gravitational/teleport/pull/41326). +* Fixed DiscoveryService panic when auto-enrolling EKS clusters. [#41320](https://github.com/gravitational/teleport/pull/41320). +* Added validation for application URL extracted from the web application launcher request route. [#41304](https://github.com/gravitational/teleport/pull/41304). +* Allow defining custom database names and users when selecting wildcard during test connection when enrolling a database through the web UI. [#41301](https://github.com/gravitational/teleport/pull/41301). +* Fixed broken link for alternative EC2 installation during EC2 discover flow. [#41292](https://github.com/gravitational/teleport/pull/41292) +* Updated Go to v1.21.10. [#41281](https://github.com/gravitational/teleport/pull/41281). +* Updated user management to explicitly deny password resets and local logins to + SSO users. [#41270](https://github.com/gravitational/teleport/pull/41270). +* Fixed fetching suggested Access Lists with large IDs in Teleport Connect. [#41269](https://github.com/gravitational/teleport/pull/41269). +* Prevents cloud tenants from updating `cluster_networking_config` fields `keep_alive_count_max`, `keep_alive_interval`, `tunnel_strategy`, or `proxy_listener_mode`. [#41247](https://github.com/gravitational/teleport/pull/41247). +* Added support for creating Okta integrations with `tctl` [#41888](https://github.com/gravitational/teleport/pull/41888). + +## 15.3.1 (05/07/24) + +* Fixed `screen_size` behavior for Windows Desktops, which was being overridden by the new resize feature. [#41241](https://github.com/gravitational/teleport/pull/41241) +* Ensure that the active sessions page shows up in the web UI for users with permissions to join sessions. [#41221](https://github.com/gravitational/teleport/pull/41221) +* Added indicators on the account settings page that tell which authentication methods are active. [#41169](https://github.com/gravitational/teleport/pull/41169) +* Fix a bug that was preventing tsh proxy kube certificate renewal from working when accessing a leaf kubernetes cluster via the root. [#41158](https://github.com/gravitational/teleport/pull/41158) +* Fixed `AccessDeniedException` for `dynamodb:ConditionCheckItem` operations when using Amazon DynamoDB for cluster state storage. [#41133](https://github.com/gravitational/teleport/pull/41133) +* Added lock target to lock deletion audit events. [#41112](https://github.com/gravitational/teleport/pull/41112) +* Fixed a permissions issue that prevented the teleport-cluster helm chart operator from registering agentless ssh servers. [#41108](https://github.com/gravitational/teleport/pull/41108) +* Improve the reliability of the upload completer. [#41103](https://github.com/gravitational/teleport/pull/41103) +* Allows the listener for the `tbot` `database-tunnel` service to be set to a unix socket. [#41008](https://github.com/gravitational/teleport/pull/41008) + +## 15.3.0 (04/30/24) + +### Improved Roles UI + +The Roles page of the web UI is now backed by a paginated API, improving +load times even on clusters with large numbers of roles. + +### Resizing for Windows desktop sessions + +Windows desktop sessions now automatically resize as the size of the browser +window changes. + +### Hardware key support for agentless nodes + +Teleport now supports connecting to agentless OpenSSH nodes even when Teleport +is configured to require hardware key MFA checks. + +### TPM joining + +The new TPM join method enables secure joining for agents and Machine ID bots +that run on-premise. Based on the secure properties of the host's hardware +trusted platform module, this join method removes the need to create and +distribute secret tokens, significantly reducing the risk of exfiltration. + +### Other improvements and fixes -Teleport 15 now provides hardened AWS AMIs on ARM64. +* Fixed user SSO bypass by performing a local passwordless login. [#41067](https://github.com/gravitational/teleport/pull/41067) +* Enforce allow_passwordless server-side. [#41057](https://github.com/gravitational/teleport/pull/41057) +* Fixed a memory leak caused by incorrectly passing the offset when paginating all Access Lists' members when there are more than the default pagesize (200) Access Lists. [#41045](https://github.com/gravitational/teleport/pull/41045) +* Added resize capability to windows desktop sessions. [#41025](https://github.com/gravitational/teleport/pull/41025) +* Fixed a regression causing roles filtering to not work. [#40999](https://github.com/gravitational/teleport/pull/40999) +* Allow AWS integration to be used for global services without specifying a valid region. [#40991](https://github.com/gravitational/teleport/pull/40991) +* Made account id visible when selecting IAM Role for accessing the AWS Console. [#40987](https://github.com/gravitational/teleport/pull/40987) + +## 15.2.5 (04/26/24) + +* Extend proxy templates to allow the target host to be resolved via a predicate expression or fuzzy matching. [#40966](https://github.com/gravitational/teleport/pull/40966) +* Fix an issue where Access Requests would linger in UI and tctl after expiry. [#40964](https://github.com/gravitational/teleport/pull/40964) +* The `teleport-cluster` Helm chart can configure AccessMonitoring when running in `aws` mode. [#40957](https://github.com/gravitational/teleport/pull/40957) +* Make `podSecurityContext` configurable in the `teleport-cluster` Helm chart. [#40951](https://github.com/gravitational/teleport/pull/40951) +* Allow to mount extra volumes in the updater pod deployed by the `teleport-kube-agent`chart. [#40946](https://github.com/gravitational/teleport/pull/40946) +* Improve error message when performing an SSO login with a hardware key. [#40923](https://github.com/gravitational/teleport/pull/40923) +* Fix a bug in the `teleport-cluster` Helm chart that happened when `sessionRecording` was `off`. [#40919](https://github.com/gravitational/teleport/pull/40919) +* Fix audit event failures when using DynamoDB event storage. [#40913](https://github.com/gravitational/teleport/pull/40913) +* Allow setting additional Kubernetes labels on resources created by the `teleport-cluster` Helm chart. [#40909](https://github.com/gravitational/teleport/pull/40909) +* Fix Windows cursor getting stuck. [#40890](https://github.com/gravitational/teleport/pull/40890) +* Issue `cert.create` events during device authentication. [#40872](https://github.com/gravitational/teleport/pull/40872) +* Add the ability to control `ssh_config` generation in Machine ID's Identity Outputs. This allows the generation of the `ssh_config` to be disabled if unnecessary, improving performance and removing the dependency on the Proxy being online. [#40861](https://github.com/gravitational/teleport/pull/40861) +* Prevent deleting AWS OIDC integration used by External Audit Storage. [#40851](https://github.com/gravitational/teleport/pull/40851) +* Introduce the `tpm` join method, which allows for secure joining in on-prem environments without the need for a shared secret. [#40823](https://github.com/gravitational/teleport/pull/40823) +* Reduce parallelism when polling AWS resources to prevent API throttling when exporting them to Teleport Access Graph. [#40811](https://github.com/gravitational/teleport/pull/40811) +* Fix spurious deletion of Access List Membership metadata during SCIM push or sync. [#40544](https://github.com/gravitational/teleport/pull/40544) +* Properly enforce session moderation requirements when starting Kubernetes ephemeral containers. [#40906](https://github.com/gravitational/teleport/pull/40906) + +## 15.2.4 (04/23/24) + +* Fixed a deprecation warning being shown when `tbot` is used with OpenSSH. [#40837](https://github.com/gravitational/teleport/pull/40837) +* Added a new Audit log event that is emitted when an Agent or Bot request to join the cluster is denied. [#40814](https://github.com/gravitational/teleport/pull/40814) +* Fixed regenerating cloud account recovery codes. [#40786](https://github.com/gravitational/teleport/pull/40786) +* Changed UI for the sign-up and authentication reset flows. [#40773](https://github.com/gravitational/teleport/pull/40773) +* Added a new Prometheus metric to track requests initiated by Teleport against the control plane API. [#40754](https://github.com/gravitational/teleport/pull/40754) +* Fixed an issue that prevented uploading a zip file larger than 10MiB when updating an AWS Lambda function via tsh app access. [#40737](https://github.com/gravitational/teleport/pull/40737) +* Patched CVE-2024-32650. [#40735](https://github.com/gravitational/teleport/pull/40735) +* Fixed possible data race that could lead to concurrent map read and map write while proxying Kubernetes requests. [#40720](https://github.com/gravitational/teleport/pull/40720) +* Fixed Access Request promotion of windows_desktop resources. [#40712](https://github.com/gravitational/teleport/pull/40712) +* Fixed spurious ambiguous host errors in ssh routing. [#40706](https://github.com/gravitational/teleport/pull/40706) +* Patched CVE-2023-45288 and CVE-2024-32473. [#40695](https://github.com/gravitational/teleport/pull/40695) +* generic "not found" errors are returned whether a remote cluster can't be found or access is denied. [#40681](https://github.com/gravitational/teleport/pull/40681) +* Fixed a resource leak in the Teleport proxy server when using proxy peering. [#40672](https://github.com/gravitational/teleport/pull/40672) +* Added Azure CLI access support on AKS with Entra Workload ID. [#40660](https://github.com/gravitational/teleport/pull/40660) +* Allow other issue types when configuring JIRA plugin. [#40644](https://github.com/gravitational/teleport/pull/40644) +* Added `regexp.match` to Access Request `filter` and `where` expressions. [#40642](https://github.com/gravitational/teleport/pull/40642) +* Notify the requester in slack review request messages. [#40624](https://github.com/gravitational/teleport/pull/40624) +* Handle passwordless in MFA audit events. [#40617](https://github.com/gravitational/teleport/pull/40617) +* Added auto discover capability to EC2 enrollment in the web UI. [#40605](https://github.com/gravitational/teleport/pull/40605) +* Fixes RDP licensing. [#40595](https://github.com/gravitational/teleport/pull/40595) +* Added support for the ascii variants of smartcard calls. [#40566](https://github.com/gravitational/teleport/pull/40566) +* Added the ability to configure labels that should be set on the Kubernetes secret when using the `kubernetes_secret` destination in `tbot`. [#40550](https://github.com/gravitational/teleport/pull/40550) +* Updated cosign to address CVE-2024-29902 and CVE-2024-29903. [#40497](https://github.com/gravitational/teleport/pull/40497) +* The Web UI now supports large number of roles by paginating them. [#40463](https://github.com/gravitational/teleport/pull/40463) +* Improved the responsiveness of the session player during long periods of idle time. [#40442](https://github.com/gravitational/teleport/pull/40442) +* Fixed incorrect format for database_object_import_rule resources with non-empty expiry. [#40203](https://github.com/gravitational/teleport/pull/40203) +* Updated Opsgenie annotations so approve-schedules is used for both alert creation and auto approval if notify schedules is not set. [#40121](https://github.com/gravitational/teleport/pull/40121) + +## 15.2.2 (04/11/24) + +* Updated the cluster selector in the UI to now only be visible when more than one cluster is available. [#40478](https://github.com/gravitational/teleport/pull/40478) +* Fixed accidental passkey "downgrades" to MFA. [#40409](https://github.com/gravitational/teleport/pull/40409) +* Added `tsh proxy kube --exec` mode that spawns kube proxy in the background, which re-executes the user shell with the appropriate kubeconfig. [#40395](https://github.com/gravitational/teleport/pull/40395) +* Made Amazon S3 fields optional when creating or editing AWS OIDC integration on the web UI. [#40368](https://github.com/gravitational/teleport/pull/40368) +* Fixed a bug that prevented the available logins from being displayed for Windows desktops in leaf clusters that were being accessed via the root cluster web ui. [#40367](https://github.com/gravitational/teleport/pull/40367) +* Changed Teleport Connect to hide cluster name in the connection list if there is only a single cluster available. [#40356](https://github.com/gravitational/teleport/pull/40356) +* Fixed `invalid session TTL` error when creating Access Request with `tsh`. [#40335](https://github.com/gravitational/teleport/pull/40335) +* Added missing discovery AWS matchers fields "Integration" and "KubeAppDiscovery" to the file configuration. [#40320](https://github.com/gravitational/teleport/pull/40320) +* Added automatic role Access Requests. [#40285](https://github.com/gravitational/teleport/pull/40285) +* Redesigned the login UI. [#40272](https://github.com/gravitational/teleport/pull/40272) +* Added friendly role names for Okta sourced roles. These will be displayed in Access List and Access Request pages in the UI. [#40260](https://github.com/gravitational/teleport/pull/40260) +* Added Teleport Machine ID Workload Identity support for legacy systems which are not able to parse DNS SANs, and which are not SPIFFE aware. [#40180](https://github.com/gravitational/teleport/pull/40180) + +## 15.2.1 (04/05/24) + +* Teleport Connect now shows all recent connections instead of capping them at 10. [#40250](https://github.com/gravitational/teleport/pull/40250) +* Limit max read size for the tsh device trust DMI cache file on Linux. [#40234](https://github.com/gravitational/teleport/pull/40234) +* Fix an issue that prevents the teleport service from restarting. [#40229](https://github.com/gravitational/teleport/pull/40229) +* Add new resource filtering predicates to allow exact matches on a single item of a delimited list stored in a label value. For example, if given the following label containing a string separated list of values `foo=bar,baz,bang`, it is now possible to match on any resources with a label `foo` that contains the element `bar` via `contains(split(labels[foo], ","), bar)`. [#40183](https://github.com/gravitational/teleport/pull/40183) +* Updated Go to 1.21.9. [#40176](https://github.com/gravitational/teleport/pull/40176) +* Adds `disable_exec_plugin` option to the Machine ID Kubernetes Output to remove the dependency on `tbot` existing in the target environment. [#40162](https://github.com/gravitational/teleport/pull/40162) +* Adds the `database-tunnel` service to `tbot` which allows an authenticated database tunnel to be opened by `tbot`. This is an improvement over the original technique of using `tbot proxy db`. [#40151](https://github.com/gravitational/teleport/pull/40151) +* Allow diagnostic endpoints to be accessed behind a PROXY protocol enabled loadbalancer/proxy. [#40138](https://github.com/gravitational/teleport/pull/40138) +* Include system annotations in audit event entries for Access Requests. [#40123](https://github.com/gravitational/teleport/pull/40123) +* Fixed GitHub Auth Connector update event to show in Audit Log with name and description. [#40116](https://github.com/gravitational/teleport/pull/40116) +* Re-enabled the `show_desktop_wallpaper` flag. [#40088](https://github.com/gravitational/teleport/pull/40088) +* Reduce default Jamf inventory page size, allow custom values to be provided. [#3817](https://github.com/gravitational/teleport.e/pull/3817) + +## 15.2.0 (03/29/24) + +### Improved Access Requests UI + +The Access Requests page of the web UI will be backed by a paginated API, +improving load times even on clusters with many Access Requests. + +Additionally, the UI allows you to search for Access Requests, sort them based +on various attributes, and includes several new filtering options. + +### Zero-downtime web asset rollout + +Teleport 15.2 changes the way that web assets are served and cached, which will +allow multiple compatible versions of the Teleport Proxy to run behind the same +load balancer. + +### Workload Identity MVP + +With Teleport 15.2, Machine ID can bootstrap and issue identity to services +across multiple computing environments and organizational boundaries. Workload +Identity issues SPIFFE-compatible x509 certificates that can be used for mTLS +between services. + +### Support for Kubernetes 1.29+ + +The Kubernetes project is deprecating the SPDY protocol for streaming commands +(kubectl exec, kubectl port-forward, etc) and replacing it with a new +websocket-based subprotocol. Teleport 15.2.0 will support the new protocol to +ensure compatibility with newer Kubernetes clusters. + +### Automatic database Access Requests + +Both tsh db connect and tsh proxy db will offer the option to submit an access +request if the user attempts to connect to a database that they don't already +have access to. + +### GCP console access via Workforce Identity Federation + +Teleport administrators will be able to setup access to GCP web console through +Workforce Identity Federation using Teleport as a SAML identity provider. + +### IaC support for OpenSSH nodes + +Users will be able to register OpenSSH nodes in the cluster using Terraform and +Kubernetes Operator. + +### Access requests start time + +Users submitting Access Requests via web UI will be able to request specific +access start time up to a week in advance. -#### Streaming session playback +### Terraform and Operator support for agentless SSH nodes + +The Teleport Terraform provider and Kubernetes operator now support declaring +agentless OpenSSH and OpenSSH EC2 ICE servers. You can follow [this +guide](docs/pages/admin-guides/infrastructure-as-code/managing-resources/agentless-ssh-servers.mdx) +to register OpenSSH agents with infrastructure as code. + +Setting up EC2 ICE automatic discovery with IaC will come in a future update. + +### Operator and CRDs can be deployed separately + +The `teleport-operator` and `teleport-cluster` charts now support deploying only +the CRD, the CRD and the operator, or only the operator. + +From the `teleport-cluster` Helm chart: + +```yaml +operator: + enabled: true|false + installCRDs: always|never|dynamic +``` + +From the `teleport-operator` Helm chart: + +```yaml +enabled: true|false +installCRDs: always|never|dynamic +``` + +In dynamic mode (by default), the chart will install CRDs if the operator is +enabled, but will not remove the CRDs if you temporarily disable the operator. + +### Operator now propagates labels + +Kubernetes CR labels are now copied to the Teleport resource when applicable. +This allows you to configure RBAC for operator-created resources, and to filter +Teleport resources using CR labels. + +### Terraform provider no longer forces resource re-creation on version change + +Teleport v15 introduced two Terraform provider changes: +- setting the resource version is now mandatory +- a resource version change triggers the resource re-creation to ensure defaults + were correctly set + +The second change was too disruptive, especially for roles, as they cannot be +deleted if a user or an Access List references them. Teleport 15.2 lifts this +restriction and allows version change without forcing the resource deletion. + +Another change to ensure resource defaults are correctly set during version +upgrades will happen in v16. + +### Other improvements and fixes + +* Fixed "Invalid URI" error in Teleport Connect when starting mongosh from database connection tab. [#40033](https://github.com/gravitational/teleport/pull/40033) +* Adds support for exporting the SPIFFE CA using `tls auth export --type tls-spiffe` and the `/webapi/auth/export` endpoint. [#40007](https://github.com/gravitational/teleport/pull/40007) +* Update Rust to 1.77.0, enable RDP font smoothing. [#39995](https://github.com/gravitational/teleport/pull/39995) +* The role, server and token Teleport operator CRs now display additional information when listed with `kubectl get`. [#39993](https://github.com/gravitational/teleport/pull/39993) +* Improve performance of filtering resources via predicate expressions. [#39972](https://github.com/gravitational/teleport/pull/39972) +* Fixes a bug that prevented CA import when a SPIFFE CA was present. [#39958](https://github.com/gravitational/teleport/pull/39958) +* Fix a verbosity issue that caused the `teleport-kube-agent-updater` to output debug logs by default. [#39953](https://github.com/gravitational/teleport/pull/39953) +* Reduce default Jamf inventory page size, allow custom values to be provided. [#39933](https://github.com/gravitational/teleport/pull/39933) +* AWS IAM Roles are now filterable in the web UI when launching a console app. [#39911](https://github.com/gravitational/teleport/pull/39911) +* The `teleport-cluster` Helm chart now supports using the Amazon Athena event backend. [#39907](https://github.com/gravitational/teleport/pull/39907) +* Correctly show the users allowed logins when accessing leaf resources via the root cluster web UI. [#39887](https://github.com/gravitational/teleport/pull/39887) +* Improve performance of resource filtering via labels and fuzzy search. [#39791](https://github.com/gravitational/teleport/pull/39791) +* Enforce optimistic locking for AuthPreferences, ClusterNetworkingConfig, SessionRecordingConfig. [#39785](https://github.com/gravitational/teleport/pull/39785) +* Fix potential issue with some resources expiry being set to 01/01/1970 instead of never. [#39773](https://github.com/gravitational/teleport/pull/39773) +* Update default Access Request TTLs to 1 week. [#39509](https://github.com/gravitational/teleport/pull/39509) +* Fixed an issue where creating or updating an Access List with Admin MFA would fail in the WebUI. [#3827](https://github.com/gravitational/teleport.e/pull/3827) + + +## 15.1.10 (03/27/24) + +* Fixed possible phishing links which could result in code execution with install and join scripts. [#39837](https://github.com/gravitational/teleport/pull/39837) +* Fixed MFA checks not being prompted when joining a session. [#39814](https://github.com/gravitational/teleport/pull/39814) +* Added support for Kubernetes websocket streaming subprotocol v5 connections. [#39770](https://github.com/gravitational/teleport/pull/39770) +* Fixed a regression causing MFA prompts to not show up in Teleport Connect. [#39739](https://github.com/gravitational/teleport/pull/39739) +* Fixed broken SSO login landing page on certain versions of Google Chrome. [#39723](https://github.com/gravitational/teleport/pull/39723) +* Teleport Connect now shows specific error messages instead of generic "access denied". [#39720](https://github.com/gravitational/teleport/pull/39720) +* Added audit events for database auto user provisioning. [#39665](https://github.com/gravitational/teleport/pull/39665) +* Updated Electron to v29 in Teleport Connect. [#39657](https://github.com/gravitational/teleport/pull/39657) +* Added automatic Access Request support for `tsh db login`, `tsh db connect` and `tsh proxy db`. [#39617](https://github.com/gravitational/teleport/pull/39617) +* Fixed a bug in Teleport Enterprise (Cloud) causing the hosted ServiceNow plugin to crash when setting up the integration. [#39603](https://github.com/gravitational/teleport/pull/39603) +* Fixed a bug of the discovery script failing when `jq` was not installed. [#39599](https://github.com/gravitational/teleport/pull/39599) +* Ensured that audit events are emitted whenever the authentication preferences, cluster networking config, or session recording config are modified. [#39522](https://github.com/gravitational/teleport/pull/39522) +* Database object labels will now support templates. [#39496](https://github.com/gravitational/teleport/pull/39496) + +## 15.1.9 (03/19/24) + +* Improved performance when listing nodes with tsh or tctl. [#39567](https://github.com/gravitational/teleport/pull/39567) +* Require AWS S3 bucket fields when creating/editing AWS OIDC integration in the web UII. [#39510](https://github.com/gravitational/teleport/pull/39510) +* Added remote port forwarding to tsh. [#39441](https://github.com/gravitational/teleport/pull/39441) +* Added support for setting default relay state for SAML IdP initiated logins via the web interface and `tctl`. For supported preset service provider types, a default value will be applied if the field is not configured. [#39401](https://github.com/gravitational/teleport/pull/39401) + +## 15.1.8 (03/18/24) + +* Fixed an issue with AWS IAM permissions that may prevent AWS database access when discovery_service is enabled in the same Teleport config as the db_service, namely AWS RDS, Redshift, Elasticache, and MemoryDB. [#39488](https://github.com/gravitational/teleport/pull/39488) + +## 15.1.7 (03/16/24) + +* Added remote port forwarding for Teleport nodes. [#39440](https://github.com/gravitational/teleport/pull/39440) +* Added remote port forwarding for OpenSSH nodes. [#39438](https://github.com/gravitational/teleport/pull/39438) + +## 15.1.5 (03/15/24) + +* Improve error messaging when creating resources fails because they already exist or updating resources fails because they were removed. [#39395](https://github.com/gravitational/teleport/pull/39395) +* The audit entry for `access_request.search` will now truncate the list of roles in the audit UI if it exceeds 80 characters. [#39372](https://github.com/gravitational/teleport/pull/39372) +* Re-enable AWS IMDSv1 fallback due to some EKS clusters having their IMDSv2 hop limit set to `1`, leading to IMDSv2 requests failing. Users who wish to keep IMDSv1 fallback disabled can set the `AWS_EC2_METADATA_V1_DISABLED` environmental variable. [#39366](https://github.com/gravitational/teleport/pull/39366) +* Only allow necessary operations during moderated file transfers and limit in-flight file transfer requests to one per session. [#39351](https://github.com/gravitational/teleport/pull/39351) +* Make the Jira access plugin log Jira errors properly. [#39346](https://github.com/gravitational/teleport/pull/39346) +* Fixed allowing invalid Access Request start time date to be set. [#39322](https://github.com/gravitational/teleport/pull/39322) +* Teleport Enterprise now attempts to load the license file from the configured data directory if not otherwise specified. [#39314](https://github.com/gravitational/teleport/pull/39314) +* Improve the security for MFA for Admin Actions when used alongside Hardware Key support. [#39306](https://github.com/gravitational/teleport/pull/39306) +* The `saml_idp_service_provider` spec adds a new `preset` field that can be used to specify predefined SAML service provider profile. [#39277](https://github.com/gravitational/teleport/pull/39277) +* Fixed a bug that caused some MFA for Admin Action flows to fail instead of retrying: ex: `tctl bots add --token=`. [#39269](https://github.com/gravitational/teleport/pull/39269) + +## 15.1.4 (03/12/24) + +* Raised concurrent connection limits between Teleport Enterprise (Cloud) regions and in clusters that use proxy peering. [#39233](https://github.com/gravitational/teleport/pull/39233) +* Improved cleanup of system resources during a shutdown of Teleport. [#39211](https://github.com/gravitational/teleport/pull/39211) +* Resolved sporadic errors caused by requests fail to comply with Kubernetes API spec by not specifying resource identifiers. [#39168](https://github.com/gravitational/teleport/pull/39168) +* Added a new password change wizard. [#39124](https://github.com/gravitational/teleport/pull/39124) +* Fixed the NumLock and Pause keys for desktop access sessions not working. [#39095](https://github.com/gravitational/teleport/pull/39095) + +## 15.1.3 (03/08/24) + +* Fix a bug when using automatic updates and the Discovery Service. The default install script now installs the correct teleport version by querying the version server. [#39099](https://github.com/gravitational/teleport/pull/39099) +* Fix a regression where `tsh kube credentials` fails to re-login when credentials expire. [#39075](https://github.com/gravitational/teleport/pull/39075) +* TBot now supports `--proxy-server` for explicitly configuring the Proxy address. We recommend switching to this if you currently specify the address of your Teleport proxy to `--auth-server`. [#39055](https://github.com/gravitational/teleport/pull/39055) +* Expand the EC2 joining process to include newly created AWS regions. [#39051](https://github.com/gravitational/teleport/pull/39051) +* Added GCP MySQL access IAM Authentication support. [#39040](https://github.com/gravitational/teleport/pull/39040) +* Fixed compatibility of the Teleport service file with older versions of systemd. [#39032](https://github.com/gravitational/teleport/pull/39032) +* Update WebUI database connection instructions. [#39027](https://github.com/gravitational/teleport/pull/39027) +* Teleport Proxy Service now runs a version server by default serving its own version. [#39017](https://github.com/gravitational/teleport/pull/39017) +* Significantly reduced latency of network calls in Teleport Connect. [#39012](https://github.com/gravitational/teleport/pull/39012) +* SPIFFE SVID generation introduced to tbot (experimental). [#39011](https://github.com/gravitational/teleport/pull/39011) +* Adds `tsh workload issue` command for issuing SVIDs using `tsh`. [#39115](https://github.com/gravitational/teleport/pull/39115) +* Fixed an issue in SAML IdP entity descriptor generator process, which would fail to generate entity descriptor if the configured Entity ID endpoint would return HTTP status code above `200` and below `400` . [#38987](https://github.com/gravitational/teleport/pull/38987) +* Updated Go to 1.21.8. [#38983](https://github.com/gravitational/teleport/pull/38983) +* Updated electron-builder dependency to address possible arbitrary code execution in the Windows installer of Teleport Connect (CVE-2024-27303). [#38964](https://github.com/gravitational/teleport/pull/38964) +* Fixed an issue where it was possible to skip providing old password when setting a new one. [#38962](https://github.com/gravitational/teleport/pull/38962) +* Added database permission management support for Postgres. [#38945](https://github.com/gravitational/teleport/pull/38945) +* Improved reliability and performance of `tbot`. [#38928](https://github.com/gravitational/teleport/pull/38928) +* Filter terminated sessions from the `tsh sessions ls` output. [#38887](https://github.com/gravitational/teleport/pull/38887) +* Make it easier to identify Teleport browser tabs by placing the session information before the cluster name. [#38737](https://github.com/gravitational/teleport/pull/38737) +* The `teleport-ent-upgrader` package now gracefully restarts the Teleport binary if possible, to avoid cutting off ongoing connections. [#3578](https://github.com/gravitational/teleport.e/pull/3578) +* Trusted device authentication failures may now include a brief explanation message in the corresponding audit event. [#3572](https://github.com/gravitational/teleport.e/pull/3572) +* Okta Access Lists sync will now sync groups without members. [#3636](https://github.com/gravitational/teleport.e/pull/3636) + +## 15.1.1 (03/01/24) + +* Fixed panic when an older `tsh` or proxy changes an Access List. [#38861](https://github.com/gravitational/teleport/pull/38861) +* SSH connection resumption now works during graceful upgrades of the Teleport agent. [#38842](https://github.com/gravitational/teleport/pull/38842) +* Fixed an issue with over counting of reported Teleport updater metrics. [#38831](https://github.com/gravitational/teleport/pull/38831) +* Fixed `tsh` returning "private key policy not met" errors instead of automatically initiating re-login to satisfy the private key policy. [#38819](https://github.com/gravitational/teleport/pull/38819) +* Made graceful shutdown and graceful restart terminate active sessions after 30 hours. [#38803](https://github.com/gravitational/teleport/pull/38803) + +## 15.1.0 (02/29/24) + +### New Features + +#### Standalone tbot Docker image +We now ship a new container image that contains tbot but omits other Teleport binaries, providing a light-weight option for Machine ID users. + +#### Custom mouse pointers for remote desktop sessions +Teleport remote desktop sessions now automatically change the mouse cursor depending on context (when hovering over a link, resizing a window, or editing text, for example). + +#### Synchronization of Okta groups and apps +Okta integration now support automatic synchronization of Okta groups and app assignments to Teleport as Access Lists giving users ability to request access to Okta apps without extra configuration. + +#### EKS auto-discovery in Access Management UI +Users going through EKS enrollment flow in Access Management web UI now have an option to enable auto-discovery for EKS clusters. + +### Other changes + +* Fixed application access events being overwritten when using DynamoDB as event storage. [#38815](https://github.com/gravitational/teleport/pull/38815) +* Fixed a regression that had reintroduced long freezes for certain actions like "Run as different user". [#38805](https://github.com/gravitational/teleport/pull/38805) +* When teleport is configured to require MFA for admin actions, MFA is required to get certificate authority secrets. Ex: `tctl auth export --keys` or `tctl get cert_authority/host/root.example.com --with-secrets`. [#38777](https://github.com/gravitational/teleport/pull/38777) +* Added auto-enrolling capabilities to EKS discover flow in the web UI. [#38773](https://github.com/gravitational/teleport/pull/38773) +* Heavily optimized the Access List page in the UI, speeding things up considerably. [#38764](https://github.com/gravitational/teleport/pull/38764) +* Align DynamoDB BatchWriteItem max items limit. [#38763](https://github.com/gravitational/teleport/pull/38763) +* tbot-distroless image is now published. This contains just the tbot binary and therefore has a smaller image size. [#38718](https://github.com/gravitational/teleport/pull/38718) +* Fixed a regression with Teleport Connect not showing the re-login reason and connection errors when accessing databases, Kube clusters, and apps with an expired cert. [#38716](https://github.com/gravitational/teleport/pull/38716) +* Re-enabled the Windows key and prevents it from sticking or otherwise causing problems when cmd+tab-ing or alt+tab-ing away from the browser during desktop sessions. [#38699](https://github.com/gravitational/teleport/pull/38699) +* Resource limits are now correctly applied to the `wait-auth-update` initContainer in the `teleport-cluster` Helm chart. [#38692](https://github.com/gravitational/teleport/pull/38692) +* When teleport is configured to require MFA for admin actions, MFA is required to create, update, or delete trusted clusters. [#38690](https://github.com/gravitational/teleport/pull/38690) +* Fixed error in `tctl get users --with-secrets` when using SSO. [#38663](https://github.com/gravitational/teleport/pull/38663) +* When device trust is required and MFA is optional, users will need to add their first MFA device from a trusted device. [#38657](https://github.com/gravitational/teleport/pull/38657) +* Temporary files are no longer created during Discover UI EKS cluster enrollment. [#38649](https://github.com/gravitational/teleport/pull/38649) +* When teleport is configured to require MFA for admin actions, MFA is required to get or list tokens with `tctl`. Ex: `tctl tokens ls` or `tctl get tokens/foo`. [#38645](https://github.com/gravitational/teleport/pull/38645) +* Implemented dynamic mouse pointer updates to reflect context-specific actions, e.g. window resizing. [#38614](https://github.com/gravitational/teleport/pull/38614) +* MFA approval is no longer required in the beginning of EKS Discover flow. [#38580](https://github.com/gravitational/teleport/pull/38580) +* Fixed Postgres v16.x compatibility issue preventing multiple connections for auto-provisioned users. [#38543](https://github.com/gravitational/teleport/pull/38543) +* Fixed incorrect color of resource cards after changing the theme in Web UI and Connect. [#38537](https://github.com/gravitational/teleport/pull/38537) +* Updated the dialog for adding new authentication methods in the account settings screen. [#38535](https://github.com/gravitational/teleport/pull/38535) +* Displays review dates for Access Lists in dates, not remaining hours in tsh. [#38525](https://github.com/gravitational/teleport/pull/38525) +* Ensure that tsh continues to function if one of its profiles is invalid. [#38514](https://github.com/gravitational/teleport/pull/38514) +* Fixed logging output for `teleport configure ...` commands. [#38508](https://github.com/gravitational/teleport/pull/38508) +* Fixed tsh/WebAuthn.dll panic on Windows Server 2019. [#38490](https://github.com/gravitational/teleport/pull/38490) +* Fixes an issue that prevented the Web UI from properly displaying the hostname of servers in leaf clusters. [#38469](https://github.com/gravitational/teleport/pull/38469) +* Added `ssh_service.enhanced_recording.root_path` configuration option to change the cgroup slice path used by the agent. [#38394](https://github.com/gravitational/teleport/pull/38394) +* Fixed a bug that could cause expired SSH servers from appearing in the Web UI until the Proxy is restarted. [#38310](https://github.com/gravitational/teleport/pull/38310) +* Desktops can now be configured to use the same screen resolution for all sessions. [#38307](https://github.com/gravitational/teleport/pull/38307) +* The maximum duration for an Access Request is now 14 days, the okta-requester role has been added which takes advantage of this. [#38224](https://github.com/gravitational/teleport/pull/38224) +* Added TLS routing native WebSocket connection upgrade support. [#38108](https://github.com/gravitational/teleport/pull/38108) +* Fixed a bug allowing the operator to delete resource it does not own. [#37750](https://github.com/gravitational/teleport/pull/37750) + +## 15.0.2 (02/15/24) + +* Fixed a potential panic in the `tsh status` command. [#38305](https://github.com/gravitational/teleport/pull/38305) +* Fixed SSO user locking in the setup access step of the RDS auto discover flow in the web UI. [#38283](https://github.com/gravitational/teleport/pull/38283) +* Optionally permit the Auth Service to terminate client connections from unsupported versions. [#38182](https://github.com/gravitational/teleport/pull/38182) +* Fixed Assist obstructing the user dropdown menu when in docked mode. [#38156](https://github.com/gravitational/teleport/pull/38156) +* Improved the stability of Teleport during graceful upgrades. [#38145](https://github.com/gravitational/teleport/pull/38145) +* Added the ability to view and manage Machine ID bots from the UI. [#38122](https://github.com/gravitational/teleport/pull/38122) +* Fixed a bug that prevented desktop clipboard sharing from working when large amounts of text are placed on the clipboard. [#38120](https://github.com/gravitational/teleport/pull/38120) +* Added option to validate hardware key serial numbers with hardware key support. [#38068](https://github.com/gravitational/teleport/pull/38068) +* Removed access tokens from URL parameters, preventing them from being leaked to intermediary systems that may log them in plaintext. [#38032](https://github.com/gravitational/teleport/pull/38032) +* Forced agents to terminate Auth connections if joining fails. [#38005](https://github.com/gravitational/teleport/pull/38005) +* Added a tsh sessions ls command to list active sessions. [#37969](https://github.com/gravitational/teleport/pull/37969) +* Improved error handling when idle desktop connections are terminated. [#37955](https://github.com/gravitational/teleport/pull/37955) +* Updated Go to 1.21.7. [#37846](https://github.com/gravitational/teleport/pull/37846) +* Discover flow now starts two instances of DatabaseServices when setting up access to Amazon RDS. [#37805](https://github.com/gravitational/teleport/pull/37805) + +## 15.0.1 (02/06/24) + +* Correctly handle non-registered U2F keys. [#37720](https://github.com/gravitational/teleport/pull/37720) +* Fixed memory leak in tbot caused by never closing reverse tunnel address resolvers. [#37718](https://github.com/gravitational/teleport/pull/37718) +* Fixed conditional user modifications (used by certain Teleport subsystems such as Device Trust) on users that have previously been locked out due to repeated recovery attempts. [#37703](https://github.com/gravitational/teleport/pull/37703) +* Added okta integration SCIM support for web UI. [#37697](https://github.com/gravitational/teleport/pull/37697) +* Added SCIM support in Okta integration (cloud only). [#3341](https://github.com/gravitational/teleport.e/pull/3341) +* Fixed usage data submission becoming stuck sending too many reports at once (Teleport Enterprise only). [#37687](https://github.com/gravitational/teleport/pull/37687) +* Fixed cache init issue with Access List members/reviews. [#37673](https://github.com/gravitational/teleport/pull/37673) +* Fixed "failed to close stream" log messages. [#37662](https://github.com/gravitational/teleport/pull/37662) +* Skip tsh AppID pre-flight check whenever possible. [#37642](https://github.com/gravitational/teleport/pull/37642) + +## 15.0.0 (01/31/24) + +Teleport 15 brings the following new major features and improvements: + +- Desktop access performance improvements +- Enhanced Device Trust support +- SSH connection resumption +- RDS auto-discovery in Access Management UI +- EKS Integration for Teleport +- MFA for Administrative Actions +- Improved SAML IdP configuration flow +- Improved provisioning for Okta +- Support for AWS KMS +- Teleport Connect improvements +- Session playback improvements +- Standalone Kubernetes Operator +- Roles v6 and v7 support for Kubernetes Operator +- Enhanced ARM64 builds + +In addition, this release includes several changes that affect existing +functionality listed in the “Breaking changes” section below. Users are advised +to review them before upgrading. + +### Description + +#### Desktop access performance improvements + +Teleport 15 leverages a new, more performant RDP engine, resulting in a smoother +desktop access experience. + +#### Device Trust for Linux support + +Teleport Device Trust now supports TPM joining on Linux devices. + +Additionally, `tsh proxy app` can now solve device challenges, allowing users to +enforce the use of a trusted device to access applications. + +#### SSH connection resumption + +Teleport v15 introduces automatic SSH connection resumption if the network path +between the client and the Teleport node is interrupted due to connectivity +issues, and transparent connection migration if the control plane is gracefully +upgraded. + +The feature is active by default when a v15 client (`tsh`, OpenSSH or PuTTY +configured by `tsh config`, or Teleport Connect) connects to a v15 Teleport +node. + +#### RDS auto-discovery in Access Management UI + +Users going through the Access Management UI flow to enroll RDS databases are +now able to set up auto-discovery. + +#### EKS Integration for Teleport + +Teleport now allows users to enroll EKS clusters via the Access Management UI. + +#### Improved SAML IdP configuration flow + +When adding a SAML application via Access Management UI, users are now able to +configure attribute mapping and have Teleport fetch service provider's entity +descriptor automatically. + +#### Improved provisioning for Okta + +Teleport 15 improves performance of receiving user/group updates from Okta by +leveraging System for Cross-domain Identity Management (SCIM). + +Note: This feature will come out in a later 15.0 patch release. + +#### Support for AWS KMS + +Teleport 15 supports the use of AWS Key Management Service (KMS) to store and +handle the CA private key material used to sign all Teleport-issued +certificates. When enabled, private key material never leaves AWS KMS. + +To migrate existing clusters to AWS KMS, you must perform a CA rotation. + +#### MFA for administrative actions + +When Teleport is configured to require webauthn (`second_factor: webauthn`), +administrative actions performed via `tctl` or the web UI will require an +additional MFA tap. + +Examples of administrative actions include, but are not limited to: + +- Resetting or recovering user accounts +- Inviting new users +- Updating cluster configuration resources +- Creating and approving Access Requests +- Generating new join tokens + +Note: when MFA for administrative actions is enabled, user certificates produced +with `tctl auth sign` will no longer be suitable for automation due to the additional +MFA checks, unless run directly on a local Auth Service (legacy setup). We +recommend using Machine ID to issue certificates for automated workflows, which +uses role impersonation that is not subject to MFA checks. + +#### Teleport Connect improvements + +Teleport Connect will now prompt for an MFA tap prior to accessing Kubernetes +clusters when per-session MFA is enabled. + +Additionally, Teleport Connect includes support for TCP and web applications, +and can also launch AWS and SAML apps in a web browser. + +#### Session playback improvements Prior to Teleport 15, `tsh play` and the web UI would download the entire session recording before starting playback. As a result, playback of large @@ -67,42 +1605,64 @@ In Teleport 15, session recordings are streamed from the Auth Service, allowing playback to start before the entire session is downloaded and unpacked. Additionally, `tsh play` now supports a `--speed` flag for adjusting the -playback speed. +playback speed, and desktop session playback now supports seeking to arbitrary +positions in the recording. + +#### Web UI improvements -#### Standalone Teleport Operator +Prior to Teleport 15, there was a dropdown in the sidebar between “Resources” +and “Management,” and in the Resources mode, there were tabs in the sidebar for +Access Requests and Active Sessions. In Teleport 15, all of the above have moved +to tabs in a top navbar, and the Resources view is fully responsive across +viewport widths. A side navbar still exists in the “Access Management” tab. + +Prior to Teleport 15, Passkeys and MFA devices were shown in a single list on +the “Account Settings” screen, without a clear distinction between them. In +Teleport 15, these have been split into distinct lists so it is clearer which +type of authentication you are adding to your account. + +#### Standalone Kubernetes Operator Prior to Teleport 15, the Teleport Kubernetes Operator had to run as a sidecar -of the Teleport auth. It was not possible to use the operator in Teleport -Enterprise (Cloud) or against a Teleport cluster not deployed with the -`teleport-cluster` Helm chart. +of the Teleport auth. It was not possible to use the operator in Teleport Enterprise (Cloud) +or against a Teleport cluster not deployed with the `teleport-cluster` Helm +chart. In Teleport 15, the Teleport Operator can reconcile resources in any Teleport -cluster. Teleport Enterprise (Cloud) users can now use the operator to manage -their resources. +cluster. Teleport Enterprise (Cloud) users can now use the operator to manage their +resources. When deployed with the `teleport-cluster` chart, the operator now runs in a -separate pod. This ensures that Teleport's availability won't be impacted if -the operator becomes unready. +separate pod. This ensures that Teleport's availability won't be impacted if the +operator becomes unready. See [the Standalone Operator guide](docs/pages/admin-guides/infrastructure-as-code/teleport-operator/teleport-operator-standalone.mdx) for installation instructions. -#### Teleport Operator now supports roles v6 and v7 +#### Roles v6 and v7 support for Kubernetes Operator -Starting with Teleport 15, newly supported kinds will contain the resource version. -For example: `TeleportRoleV6` and `TeleportRoleV7` kinds will allow users to -create Teleport Roles v6 and v7. +Starting with Teleport 15, newly supported kinds will contain the resource +version. For example: `TeleportRoleV6` and `TeleportRoleV7` kinds will allow +users to create Teleport Roles v6 and v7. Existing kinds will remain unchanged in Teleport 15, but will be renamed in Teleport 16 for consistency. -To migrate an existing Custom Resource (CR) `TeleportRole` to -a `TeleportRoleV7`, you must: +To migrate an existing Custom Resource (CR) `TeleportRole` to a +`TeleportRoleV7`, you must: - upgrade Teleport and the operator to v15 - annotate the exiting `TeleportRole` CR with `teleport.dev/keep: "true"` -- delete the `TeleportRole` CR (it won't delete the role in Teleport thanks to the annotation) +- delete the `TeleportRole` CR (it won't delete the role in Teleport thanks to + the annotation) - create a new `TeleportRoleV7` CR with the same name +#### Enhanced ARM64 builds + +Teleport 15 now provides FIPS-compliant Linux builds on ARM64. Users will now be +able to run Teleport in FedRAMP/FIPS mode on ARM64. + +Additionally, Teleport 15 includes hardened AWS AMIs for ARM64. + ### Breaking changes and deprecations #### RDP engine requires RemoteFX @@ -127,8 +1687,10 @@ Directory environment, you should enable RemoteFX via group policy. Under Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host, enable: -1. Remote Session Environment > RemoteFX for Windows Server 2008 R2 > Configure RemoteFX -1. Remote Session Environment > Enable RemoteFX encoding for RemoteFX clients designed for Windows Server 2008 R2 SP1 +1. Remote Session Environment > RemoteFX for Windows Server 2008 R2 > Configure + RemoteFX +1. Remote Session Environment > Enable RemoteFX encoding for RemoteFX clients + designed for Windows Server 2008 R2 SP1 1. Remote Session Environment > Limit maximum color depth Detailed instructions are available in the @@ -137,23 +1699,23 @@ A reboot may be required for these changes to take effect. #### `tsh ssh` -When running a command on multiple nodes with `tsh ssh`, each line of output -is now labeled with the hostname of the node it was written by. Users that -rely on parsing the output from multiple nodes should pass the `--log-dir` flag -to `tsh ssh`, which will create a directory where the separated output of each node -will be written. +When running a command on multiple nodes with `tsh ssh`, each line of output is +now labeled with the hostname of the node it was written by. Users that rely on +parsing the output from multiple nodes should pass the `--log-dir` flag to `tsh +ssh`, which will create a directory where the separated output of each node will +be written. #### `drop` host user creation mode -The `drop` host user creation mode has been removed in Teleport 15. It is replaced -by `insecure-drop`, which still creates temporary users but does not create a -home directory. Users who need home directory creation should either wrap `useradd`/`userdel` -or use PAM. +The `drop` host user creation mode has been removed in Teleport 15. It is +replaced by `insecure-drop`, which still creates temporary users but does not +create a home directory. Users who need home directory creation should either +wrap `useradd`/`userdel` or use PAM. #### Remove restricted sessions for SSH -The restricted session feature for SSH has been deprecated since Teleport 14 and -has been removed in Teleport 15. We recommend implementing network restrictions +The restricted session feature for SSH has been deprecated since Teleport 14 and +has been removed in Teleport 15. We recommend implementing network restrictions outside of Teleport (iptables, security groups, etc). #### Packages no longer published to legacy Debian and RPM repos @@ -167,8 +1729,8 @@ All users are recommended to switch to `apt.releases.teleport.dev` and `yum.releases.teleport.dev` repositories as described in installation [instructions](docs/pages/installation.mdx). -The legacy package repos will be shut off in mid 2025 after Teleport 14 -has been out of support for many months. +The legacy package repos will be shut off in mid 2025 after Teleport 14 has been +out of support for many months. #### Container images @@ -178,17 +1740,20 @@ and usability of Teleport-provided container images. ##### "Heavy" container images are discontinued In order to increase default security in 15+, Teleport will no longer publish -[container images containing a shell and command line environment](https://github.com/gravitational/teleport/blob/branch/v14/build.assets/charts/Dockerfile) -to Elastic Container Registry's [gravitational/teleport](https://gallery.ecr.aws/gravitational/teleport) -image repo. Instead, all users should use the [distroless images](https://github.com/gravitational/teleport/blob/branch/v15/build.assets/charts/Dockerfile-distroless) +[container images containing a shell and command line +environment](https://github.com/gravitational/teleport/blob/branch/v14/build.assets/charts/Dockerfile) +to Elastic Container Registry's +[gravitational/teleport](https://gallery.ecr.aws/gravitational/teleport) image +repo. Instead, all users should use the [distroless +images](https://github.com/gravitational/teleport/blob/branch/v15/build.assets/charts/Dockerfile-distroless) introduced in Teleport 12. These images can be found at: * https://gallery.ecr.aws/gravitational/teleport-distroless * https://gallery.ecr.aws/gravitational/teleport-ent-distroless -For users who need a shell in a Teleport container, a "debug" image is -available which contains BusyBox, including a shell and many CLI tools. Find -the debug images at: +For users who need a shell in a Teleport container, a "debug" image is available +which contains BusyBox, including a shell and many CLI tools. Find the debug +images at: * https://gallery.ecr.aws/gravitational/teleport-distroless-debug * https://gallery.ecr.aws/gravitational/teleport-ent-distroless-debug @@ -200,7 +1765,7 @@ throughout the remainder of these releases' lifecycle. ##### Helm cluster chart FIPS mode changes -The teleport-cluster chart no longer uses versionOverride and extraArgs to set FIPS mode. +The teleport-cluster chart no longer uses versionOverride and extraArgs to set FIPS mode. Instead, you should use the following values file configuration: ``` @@ -213,10 +1778,11 @@ authentication: Teleport Operator container images will no longer be published with architecture suffixes in their tags (for example: `14.2.1-amd64` and `14.2.1-arm`). Instead, -only a single tag will be published with multi-platform support (e.g., `15.0.0`). -If you use Teleport Operator images with an architecture suffix, remove the -suffix and your client should automatically pull the platform-appropriate image. -Individual architectures may be pulled with `docker pull --platform `. +only a single tag will be published with multi-platform support (e.g., +`15.0.0`). If you use Teleport Operator images with an architecture suffix, +remove the suffix and your client should automatically pull the +platform-appropriate image. Individual architectures may be pulled with `docker +pull --platform `. ##### Quay.io registry @@ -224,13 +1790,13 @@ The quay.io container registry was deprecated and Teleport 12 is the last version to publish images to quay.io. With Teleport 15's release, v12 is no longer supported and no new container images will be published to quay.io. -For Teleport 8+, replacement container images can be found in [Teleport's public ECR registry](https://gallery.ecr.aws/gravitational). +For Teleport 8+, replacement container images can be found in [Teleport's public +ECR registry](https://gallery.ecr.aws/gravitational). -Users who wish to continue to use unsupported container images prior to -Teleport 8 will need to download any quay.io images they depend on and mirror -them elsewhere before July 2024. Following brownouts in May and June, Teleport -will disable pulls from all Teleport quay.io repositories on Wednesday July 3, -2024. +Users who wish to continue to use unsupported container images prior to Teleport +8 will need to download any quay.io images they depend on and mirror them +elsewhere before July 2024. Following brownouts in May and June, Teleport will +disable pulls from all Teleport quay.io repositories on Wednesday July 3, 2024. #### Amazon AMIs @@ -249,8 +1815,8 @@ naming scheme for these AMIs has been changed to include the architecture. ##### Legacy Amazon Linux 2 AMIs Teleport-provided Amazon Linux 2 AMIs were deprecated, and Teleport 14 is the -last version to produce such legacy AMIs. With Teleport 15's release, only -the newer hardened Amazon Linux 2023 AMIs will be produced. +last version to produce such legacy AMIs. With Teleport 15's release, only the +newer hardened Amazon Linux 2023 AMIs will be produced. The legacy AMIs will continue to be published for Teleport 13 and 14 throughout the remainder of these releases' lifecycle. @@ -272,25 +1838,25 @@ and instance type has been changed to ARM64/Graviton. As a result of this modernization, the legacy monitoring stack configuration used with the legacy AMIs has been removed. -#### `teleport-cluster` Helm chart changes +##### `teleport-cluster` Helm chart changes -Due to the new separate operator deployment, the operator is deployed by a subchart. -This causes the following breaking changes: +Due to the new separate operator deployment, the operator is deployed by a +subchart. This causes the following breaking changes: - `installCRDs` has been replaced by `operator.installCRDs` -- `teleportVersionOverride` does not set the operator version anymore, you must +- `teleportVersionOverride` does not set the operator version anymore, you must use `operator.teleportVersionOverride` to override the operator version. -Note: version overrides are dangerous and not recommended. Each chart version -is designed to run a specific Teleport and operator version. If you want to -deploy a specific Teleport version, use Helm's `--version X.Y.Z` instead. +Note: version overrides are dangerous and not recommended. Each chart version is +designed to run a specific Teleport and operator version. If you want to deploy +a specific Teleport version, use Helm's `--version X.Y.Z` instead. The operator now joins using a Kubernetes ServiceAccount token. To validate the -token, the Teleport Auth Service must have access to the `TokenReview` API. -The chart configures this for you since v12, unless you disabled `rbac` creation. +token, the Teleport Auth Service must have access to the `TokenReview` API. The +chart configures this for you since v12, unless you disabled `rbac` creation. ##### Helm cluster chart FIPS mode changes -The teleport-cluster chart no longer uses versionOverride and extraArgs to set FIPS mode. +The teleport-cluster chart no longer uses versionOverride and extraArgs to set FIPS mode. Instead, you should use the following values file configuration: @@ -303,10 +1869,10 @@ authentication: #### Resource version is now mandatory and immutable in the Terraform provider -Starting with Teleport 15, each Terraform resource must have its version specified. -Before version 15, Terraform was picking the latest version available on resource creation. -This caused inconsistencies as new resources created with the same manifest as -old resources were not exhibiting the same behavior. +Starting with Teleport 15, each Terraform resource must have its version +specified. Before version 15, Terraform was picking the latest version available +on resource creation. This caused inconsistencies as new resources creates with +the same manifest as old resources were not exhibiting the same behavior. Resource version is now immutable. Changing a resource version will cause Terraform to delete and re-create the resource. This ensures the correct @@ -319,11 +1885,702 @@ version. However, new resources will require an explicit version. #### Increased password length -The minimum password length has been increased to 12 characters. +The minimum password length for local users has been increased from 6 to 12 +characters. #### Increased account lockout interval -The account lockout interval has been increased to 30 minutes. +The account lockout interval has been increased from 20 to 30 minutes. + +## 14.3.21 (06/20/24) + +* Fixed bug that caused gRPC connections to be disconnected when their certificate expired even though DisconnectCertExpiry was false. [#43292](https://github.com/gravitational/teleport/pull/43292) +* Fixed bug where a Teleport instance running only Jamf or Discovery service would never have a healthy `/readyz` endpoint. [#43285](https://github.com/gravitational/teleport/pull/43285) +* Added a missing `[Install]` section to the `teleport-acm` systemd unit file as used by Teleport AMIs. [#43258](https://github.com/gravitational/teleport/pull/43258) +* Updated `teleport` to skip `jamf_service` validation when the Jamf is not enabled. [#43170](https://github.com/gravitational/teleport/pull/43170) +* Improved log rotation logic in Teleport Connect; now the non-numbered files always contain recent logs. [#43163](https://github.com/gravitational/teleport/pull/43163) +* Made tsh and Teleport Connect return early during login if ping to Proxy Service was not successful. [#43087](https://github.com/gravitational/teleport/pull/43087) +* Added ability to edit user traits from the Web UI. [#43070](https://github.com/gravitational/teleport/pull/43070) +* Enforce limits when reading events from Firestore to prevent OOM events. [#42968](https://github.com/gravitational/teleport/pull/42968) +* Fixed an issue Oracle access failed through trusted cluster. [#42929](https://github.com/gravitational/teleport/pull/42929) +* Fixes errors caused by `dynamoevents` query `StartKey` not being within the [From, To] window. [#42914](https://github.com/gravitational/teleport/pull/42914) +* Fixed updating groups for Teleport-created host users. [#42883](https://github.com/gravitational/teleport/pull/42883) +* Update azidentity to v1.6.0 (patches CVE-2024-35255). [#42860](https://github.com/gravitational/teleport/pull/42860) +* Remote rate limits on endpoints used extensively to connect to the cluster. [#42836](https://github.com/gravitational/teleport/pull/42836) +* Improved the performance of the Athena audit log and S3 session storage backends. [#42796](https://github.com/gravitational/teleport/pull/42796) +* Prevented a panic in the Proxy when accessing an offline application. [#42787](https://github.com/gravitational/teleport/pull/42787) +* Improve backoff of session recording uploads by teleport agents. [#42775](https://github.com/gravitational/teleport/pull/42775) +* Reduced backend writes incurred by tracking status of non-recorded sessions. [#42695](https://github.com/gravitational/teleport/pull/42695) +* Fixed listing available DB users in Teleport Connect for databases from leaf clusters obtained through Access Requests. [#42681](https://github.com/gravitational/teleport/pull/42681) +* Fixed not being able to logout from the web UI when session invalidation errors. [#42654](https://github.com/gravitational/teleport/pull/42654) +* Updated OpenSSL to 3.0.14. [#42643](https://github.com/gravitational/teleport/pull/42643) +* Teleport Connect binaries for Windows are now signed. [#42473](https://github.com/gravitational/teleport/pull/42473) +* Updated Go to 1.21.11. [#42416](https://github.com/gravitational/teleport/pull/42416) +* Fix web UI notification dropdown menu height from growing too long from many notifications. [#42338](https://github.com/gravitational/teleport/pull/42338) +* Disabled session recordings for non-interactive sessions when enhanced recording is disabled. [#42321](https://github.com/gravitational/teleport/pull/42321) +* Fixed issue where removing an app could make teleport app agents incorrectly report as unhealthy for a short time. [#42269](https://github.com/gravitational/teleport/pull/42269) +* Fixed a panic in the DynamoDB audit log backend when the cursor fell outside of the [From,To] interval. [#42266](https://github.com/gravitational/teleport/pull/42266) +* The `teleport configure` command now supports a `--node-name` flag for overriding the node's hostname. [#42249](https://github.com/gravitational/teleport/pull/42249) +* Fixed an issue where mix-and-match of join tokens could interfere with some services appearing correctly in heartbeats. [#42188](https://github.com/gravitational/teleport/pull/42188) +* Improved temporary disk space usage for session recording processing. [#42175](https://github.com/gravitational/teleport/pull/42175) +* Fixed a regression where Kubernetes Exec audit events were not properly populated and lacked error details. [#42146](https://github.com/gravitational/teleport/pull/42146) +* Fix Azure join method when using Resource Groups in the allow section. [#42140](https://github.com/gravitational/teleport/pull/42140) +* Fixed resource leak in session recording cleanup. [#42069](https://github.com/gravitational/teleport/pull/42069) +* Reduced memory and cpu usage after control plane restarts in clusters with a high number of roles. [#42064](https://github.com/gravitational/teleport/pull/42064) +* Fixed the field `allowed_https_hostnames` in the Teleport Operator resources: SAML, OIDC, and GitHub Connector. [#42056](https://github.com/gravitational/teleport/pull/42056) +* Enhanced error messaging for clients using `kubectl exec` v1.30+ to include warnings about a breaking change in Kubernetes. [#41989](https://github.com/gravitational/teleport/pull/41989) + +### Enterprise-Only changes: +* Improved memory usage when reconciling Access Lists members to prevent Out of Memory events when reconciling a large number of Access Lists members. +* Prevented Access Monitoring reports from crashing when large datasets are returned. +* Ensured graceful restart of `teleport.service` after an upgrade. + +## 14.3.20 (05/23/24) + +This release contains fixes for several high-severity security issues, as well +as numerous other bug fixes and improvements. + +### Security Fixes + +#### **[High]** Unrestricted redirect in SSO Authentication + +Teleport didn’t sufficiently validate the client redirect URL. This could allow +an attacker to trick Teleport users into performing an SSO authentication and +redirect to an attacker-controlled URL allowing them to steal the credentials. +[#41834](https://github.com/gravitational/teleport/pull/41834). + +Warning: Teleport will now disallow non-localhost callback URLs for SSO logins +unless otherwise configured. Users of the `tsh login --callback` feature should +modify their auth connector configuration as follows: + +```yaml +version: vX +kind: (saml|oidc|github) +metadata: + name: ... +spec: + ... + client_redirect_settings: + allowed_https_hostnames: + - '*.app.github.dev' + - '^\d+-[a-zA-Z0-9]+\.foo.internal$' + ``` + +The `allowed_https_hostnames` field is an array containing allowed hostnames, +supporting glob matching and, if the string begins and ends with `^` and `$` +respectively, full regular expression syntax. Custom callback URLs are required +to be HTTPS on the standard port (443). + +#### **[High]** CockroachDB authorization bypass + +When connecting to CockroachDB using database access, Teleport did not properly +consider the username case when running RBAC checks. As such, it was possible to +establish a connection using an explicitly denied username when using a +different case. [#41823](https://github.com/gravitational/teleport/pull/41823). + +#### **[High]** Long-lived connection persistence issue with expired certificates + +Teleport did not terminate some long-running mTLS-authenticated connections past +the expiry of client certificates for users with the `disconnect_expired_cert` +option. This could allow such users to perform some API actions after their +certificate has expired. +[#41827](https://github.com/gravitational/teleport/pull/41827). + +#### **[High]** PagerDuty integration privilege escalation + +When creating a role Access Request, Teleport would include PagerDuty +annotations from the entire user’s role set rather than a specific role being +requested. For users who run multiple PagerDuty access plugins with +auto-approval, this could result in a request for a different role being +inadvertently auto-approved than the one which corresponds to the user’s active +on-call schedule. +[#41837](https://github.com/gravitational/teleport/pull/41837). + +#### **[High]** SAML IdP session privilege escalation + +When using Teleport as SAML IdP, authorization wasn’t properly enforced on the +SAML IdP session creation. As such, authenticated users could use an internal +API to escalate their own privileges by crafting a malicious program. +[#41846](https://github.com/gravitational/teleport/pull/41846). + +We strongly recommend all customers upgrade to the latest releases of Teleport. + +### Other fixes and improvements + +* Fixed session upload completion in situations where there's a large number of in-flight session uploads. [#41853](https://github.com/gravitational/teleport/pull/41853) +* Debug symbols are now stripped from Windows builds, resulting in smaller tsh and tctl binaries. [#41839](https://github.com/gravitational/teleport/pull/41839) +* Fixed an issue that the server version of the registered MySQL databases is not automatically updated upon new connections. [#41820](https://github.com/gravitational/teleport/pull/41820) +* Add read-only permissions for cluster maintenance config. [#41791](https://github.com/gravitational/teleport/pull/41791) +* Simplified how Bots are shown on the Users list page. [#41739](https://github.com/gravitational/teleport/pull/41739) +* Fix missing variable and script options in Default Agentless Installer script. [#41722](https://github.com/gravitational/teleport/pull/41722) +* Improved reliability of aggregated usage reporting with some cluster state storage backends (Teleport Enterprise only). [#41703](https://github.com/gravitational/teleport/pull/41703) +* Adds the remote address to audit log events emitted when a join for a Bot or Instance fails or succeeds. [#41699](https://github.com/gravitational/teleport/pull/41699) +* Allow the Application Service to heartbeat on behalf of more than 1000 dynamic applications. [#41627](https://github.com/gravitational/teleport/pull/41627) +* Ensure responses to Kubernetes watch requests are written sequentially. [#41625](https://github.com/gravitational/teleport/pull/41625) +* Install Script used in discover wizard now supports Ubuntu 24.04. [#41588](https://github.com/gravitational/teleport/pull/41588) +* Ensured that systemd always restarts Teleport on any failure unless explicitly stopped. [#41582](https://github.com/gravitational/teleport/pull/41582) +* Teleport service config is now reloaded on upgrades. [#41548](https://github.com/gravitational/teleport/pull/41548) +* Fix AccessList reconciler comparison causing audit events noise. [#41541](https://github.com/gravitational/teleport/pull/41541) +* Prevent SSH connections opened in the UI from leaking if the browser tab is closed while the SSH connection is being established. [#41519](https://github.com/gravitational/teleport/pull/41519) +* Emit login login failed audit events for invalid passwords on password+webauthn local authentication. [#41433](https://github.com/gravitational/teleport/pull/41433) +* Allow setting Kubernetes Cluster name when using non-default addresses. [#41355](https://github.com/gravitational/teleport/pull/41355) +* Added support to automatically download CA for MongoDB Atlas databases. [#41339](https://github.com/gravitational/teleport/pull/41339) +* Fix broken finish web page for SSO user's on auto discover. [#41336](https://github.com/gravitational/teleport/pull/41336) +* Add fallback on GetAccessList cache miss call. [#41327](https://github.com/gravitational/teleport/pull/41327) +* Validate application URL extracted from the web application launcher request route. [#41305](https://github.com/gravitational/teleport/pull/41305) +* Allow defining custom database names and users when selecting wildcard during test connection when enrolling a database through the web UI. [#41302](https://github.com/gravitational/teleport/pull/41302) +* Updated Go to v1.21.10. [#41282](https://github.com/gravitational/teleport/pull/41282) +* Forbid SSO users from local logins or password changes. [#41271](https://github.com/gravitational/teleport/pull/41271) +* Prevents Cloud tenants from updating `cluster_networking_config` fields `keep_alive_count_max`, `keep_alive_interval`, `tunnel_strategy`, or `proxy_listener_mode`. [#41248](https://github.com/gravitational/teleport/pull/41248) + +## 14.3.18 (05/07/24) + +* Ensure that the active sessions page shows up in the web UI for users with permissions to join sessions. [#41222](https://github.com/gravitational/teleport/pull/41222) +* Fix a bug that was preventing tsh proxy kube certificate renewal from working when accessing a leaf kubernetes cluster via the root. [#41157](https://github.com/gravitational/teleport/pull/41157) +* Add lock target to lock deletion audit events. [#41111](https://github.com/gravitational/teleport/pull/41111) +* Improve the reliability of the upload completer. [#41104](https://github.com/gravitational/teleport/pull/41104) +* Allows the listener for the tbot database-tunnel service to be set to a unix socket. [#41042](https://github.com/gravitational/teleport/pull/41042) + +## 14.3.17 (04/30/24) + +* Fixed user SSO bypass by performing a local passwordless login. [#41071](https://github.com/gravitational/teleport/pull/41071) +* Enforce allow_passwordless server-side. [#41058](https://github.com/gravitational/teleport/pull/41058) +* Fixed a memory leak caused by incorrectly passing the offset when paginating all Access Lists' members when there are more than the default pagesize (200) Access Lists. [#41044](https://github.com/gravitational/teleport/pull/41044) +* Fixed a regression causing roles filtering to not work. [#41000](https://github.com/gravitational/teleport/pull/41000) +* Allow AWS integration to be used for global services without specifying a valid region. [#40990](https://github.com/gravitational/teleport/pull/40990) +* Fixed Access Requests lingering in the UI and tctl after expiry. [#40965](https://github.com/gravitational/teleport/pull/40965) +* Made `podSecurityContext` configurable in the `teleport-cluster` Helm chart. [#40950](https://github.com/gravitational/teleport/pull/40950) +* Allow mounting extra volumes in the updater pod deployed by the `teleport-kube-agent`chart. [#40949](https://github.com/gravitational/teleport/pull/40949) +* Improved error message when performing an SSO login with a hardware key. [#40924](https://github.com/gravitational/teleport/pull/40924) +* Fixed a bug in the `teleport-cluster` Helm chart that happened when `sessionRecording` was `off`. [#40920](https://github.com/gravitational/teleport/pull/40920) +* Allows setting additional Kubernetes labels on resources created by the `teleport-cluster` Helm chart. [#40916](https://github.com/gravitational/teleport/pull/40916) +* Fixed audit event failures when using DynamoDB event storage. [#40912](https://github.com/gravitational/teleport/pull/40912) +* Properly enforce session moderation requirements when starting Kubernetes ephemeral containers. [#40907](https://github.com/gravitational/teleport/pull/40907) +* Introduced the tpm join method, which allows for secure joining in on-prem environments without the need for a shared secret. [#40875](https://github.com/gravitational/teleport/pull/40875) +* Issue cert.create events during device authentication. [#40873](https://github.com/gravitational/teleport/pull/40873) +* Add the ability to control `ssh_config` generation in Machine ID's Identity Outputs. This allows the generation of the `ssh_config` to be disabled if unnecessary, improving performance and removing the dependency on the Proxy being online. [#40862](https://github.com/gravitational/teleport/pull/40862) +* Prevented deleting AWS OIDC integration used by External Audit Storage. [#40853](https://github.com/gravitational/teleport/pull/40853) +* Reduced parallelism when polling AWS resources to prevent API throttling when exporting them to Teleport Access Graph. [#40812](https://github.com/gravitational/teleport/pull/40812) +* Added hardware key support for agentless connections [#40929](https://github.com/gravitational/teleport/pull/40929) + +## 14.3.16 (04/23/24) + +* Fixed a deprecation warning being shown when `tbot` is used with OpenSSH. [#40838](https://github.com/gravitational/teleport/pull/40838) +* Added a new Audit log event that is emitted when an Agent or Bot request to join the cluster is denied. [#40815](https://github.com/gravitational/teleport/pull/40815) +* Added a new Prometheus metric to track requests initiated by Teleport against the control plane API. [#40755](https://github.com/gravitational/teleport/pull/40755) +* Fixed uploading zip files larger than 10MiB when updating an AWS Lambda function via tsh app access. [#40738](https://github.com/gravitational/teleport/pull/40738) +* Fixed possible data race that could lead to concurrent map read and map write while proxying Kubernetes requests. [#40721](https://github.com/gravitational/teleport/pull/40721) +* Fixed Access Request promotion of windows_desktop resources. [#40711](https://github.com/gravitational/teleport/pull/40711) +* Fixed spurious ambiguous host errors in ssh routing. [#40709](https://github.com/gravitational/teleport/pull/40709) +* Patched CVE-2023-45288 and CVE-2024-32473. [#40696](https://github.com/gravitational/teleport/pull/40696) +* Generic "not found" errors are returned whether a remote cluster can't be found or access is denied. [#40682](https://github.com/gravitational/teleport/pull/40682) +* Fixed a resource leak in the Teleport proxy server when using proxy peering. [#40675](https://github.com/gravitational/teleport/pull/40675) +* Allow other issue types when configuring JIRA plugin. [#40645](https://github.com/gravitational/teleport/pull/40645) +* Added the ability to configure labels that should be set on the Kubernetes secret when using the `kubernetes_secret` destination in `tbot`. [#40551](https://github.com/gravitational/teleport/pull/40551) +* Updated cosign to address CVE-2024-29902 and CVE-2024-29903. [#40498](https://github.com/gravitational/teleport/pull/40498) +* The Web UI now supports large number of roles by paginating them. [#40464](https://github.com/gravitational/teleport/pull/40464) + +## 14.3.15 (04/12/24) + +* Fixed accidental passkey "downgrades" to MFA. [#40410](https://github.com/gravitational/teleport/pull/40410) +* Added `tsh proxy kube --exec` mode that spawns kube proxy in the background, which re-executes the user shell with the appropriate kubeconfig. [#40394](https://github.com/gravitational/teleport/pull/40394) +* Made Amazon S3 fields optional when creating or editing AWS OIDC integration on the web UI. [#40372](https://github.com/gravitational/teleport/pull/40372) +* Changed Teleport Connect to hide cluster name in the connection list if there is only a single cluster available. [#40357](https://github.com/gravitational/teleport/pull/40357) +* Changed Teleport Connect to now show all recent connections instead of capping them at 10. [#40251](https://github.com/gravitational/teleport/pull/40251) +* Fixed an issue that prevents the Teleport service from restarting. [#40230](https://github.com/gravitational/teleport/pull/40230) +* Added a new resource filtering predicates to allow exact matches on a single item of a delimited list stored in a label value. For example, if given the following label containing a string separated list of values `foo=bar,baz,bang`, it is now possible to match on any resources with a label `foo` that contains the element `bar` via `contains(split(labels[foo], ","), bar)`. [#40184](https://github.com/gravitational/teleport/pull/40184) +* Updated Go to 1.21.9. [#40177](https://github.com/gravitational/teleport/pull/40177) +* Added `disable_exec_plugin` option to the Machine ID Kubernetes Output to remove the dependency on `tbot` existing in the target environment. [#40163](https://github.com/gravitational/teleport/pull/40163) +* Added the database-tunnel service to `tbot` which allows an authenticated database tunnel to be opened by `tbot`. This is an improvement over the original technique of using `tbot proxy db`. [#40160](https://github.com/gravitational/teleport/pull/40160) +* Enabled diagnostic endpoints access behind a PROXY protocol enabled loadbalancer/proxy. [#40139](https://github.com/gravitational/teleport/pull/40139) +* Added system annotations to audit event entries for Access Requests. [#40122](https://github.com/gravitational/teleport/pull/40122) +* Fixed "Invalid URI" error in Teleport Connect when starting MongoDB `mongosh` from the database connection tab. [#40105](https://github.com/gravitational/teleport/pull/40105) +* Improved the performance of filtering resources via predicate expressions. [#39975](https://github.com/gravitational/teleport/pull/39975) +* Fixed a verbosity issue that caused the `teleport-kube-agent-updater` to output debug logs by default. [#39954](https://github.com/gravitational/teleport/pull/39954) +* Reduced default Jamf inventory page size, and added support for custom values. [#39934](https://github.com/gravitational/teleport/pull/39934) +* Added support to the `teleport-cluster` Helm chart for using an Amazon Athena event backend. [#39908](https://github.com/gravitational/teleport/pull/39908) +* Improved the performance of resource filtering via labels and fuzzy search. [#39792](https://github.com/gravitational/teleport/pull/39792) + +## 14.3.14 (03/27/24) + +* Fixed possible phishing links which could result in code execution with install and join scripts. [#39838](https://github.com/gravitational/teleport/pull/39838) +* Fixed MFA checks not being prompted when joining a session. [#39815](https://github.com/gravitational/teleport/pull/39815) +* Fixed potential issue with some resources expiry being set to 01/01/1970 instead of never. [#39774](https://github.com/gravitational/teleport/pull/39774) +* Added support for Kubernetes websocket streaming subprotocol v5 connections. [#39771](https://github.com/gravitational/teleport/pull/39771) +* Fixed broken SSO login landing page on certain versions of Google Chrome. [#39722](https://github.com/gravitational/teleport/pull/39722) +* Updated Electron to v29 in Teleport Connect. [#39658](https://github.com/gravitational/teleport/pull/39658) +* Fixed a bug in Teleport Enterprise (Cloud) causing the hosted ServiceNow plugin to crash when setting up the integration. [#39604](https://github.com/gravitational/teleport/pull/39604) +* Fixed Teleport updater metrics for AWS OIDC deployments. [#39531](https://github.com/gravitational/teleport/pull/39531) +* Fixed allowing invalid Access Request start time date to be set. [#39324](https://github.com/gravitational/teleport/pull/39324) + +## 14.3.13 (03/20/24) + +* Fixed the discovery script failing when `jq` was not installed. [#39600](https://github.com/gravitational/teleport/pull/39600) +* Improve performance when listing nodes with tsh or tctl. [#39568](https://github.com/gravitational/teleport/pull/39568) +* Require AWS S3 bucket fields when creating/editing AWS OIDC integration in the web UI. [#39513](https://github.com/gravitational/teleport/pull/39513) +* Removed implicit AccessList membership and ownership modes. All AccessList owners and members must be explicitly specified. [#39388](https://github.com/gravitational/teleport/pull/39388) + +## 14.3.11 (03/18/24) + +* Fixed an issue with AWS IAM permissions that may prevent AWS database access when discovery_service is enabled in the same Teleport config as the db_service, namely AWS RDS, Redshift, Elasticache, and MemoryDB. [#39487](https://github.com/gravitational/teleport/pull/39487) + +## 14.3.10 (03/16/24) + +* Fixed issue with Teleport Auth Service panicking when Access Graph is enabled in Discovery Service. [#39456](https://github.com/gravitational/teleport/pull/39456) + +## 14.3.8 (03/15/24) + +* Improve error messaging when creating resources fails because they already exist or updating resources fails because they were removed. [#39396](https://github.com/gravitational/teleport/pull/39396) +* Support logging in with an identity file with `tsh login -i identity.pem`. This allows running `tsh app login` in CI environments where MachineID is impossible. [#39374](https://github.com/gravitational/teleport/pull/39374) +* Only allow necessary operations during moderated file transfers and limit in-flight file transfer requests to one per session. [#39352](https://github.com/gravitational/teleport/pull/39352) +* Make the Jira access plugin log Jira errors properly. [#39347](https://github.com/gravitational/teleport/pull/39347) +* Teleport Enterprise now attempts to load the license file from the configured data directory if not otherwise specified. [#39313](https://github.com/gravitational/teleport/pull/39313) +* Patched CVE-2024-27304 (Postgres driver). [#39259](https://github.com/gravitational/teleport/pull/39259) +* Raised concurrent connection limits between Teleport Enterprise (Cloud) regions and in clusters that use proxy peering. [#39232](https://github.com/gravitational/teleport/pull/39232) +* Improved cleanup of system resources during a shutdown of Teleport. [#39213](https://github.com/gravitational/teleport/pull/39213) +* Fixed an issue where it was possible to skip providing old password when setting a new one. [#39126](https://github.com/gravitational/teleport/pull/39126) + +## 14.3.7 (03/11/24) + +* Resolved sporadic errors caused by requests fail to comply with Kubernetes API spec by not specifying resource identifiers. [#39167](https://github.com/gravitational/teleport/pull/39167) +* Fixed a bug when using automatic updates and the Discovery Service. The default install script now installs the correct Teleport version by querying the version server. [#39100](https://github.com/gravitational/teleport/pull/39100) +* Teleport Proxy Service now runs a version server by default serving its own version. [#39096](https://github.com/gravitational/teleport/pull/39096) +* Fixed a regression where `tsh kube credentials` fails to re-login when credentials expire. [#39074](https://github.com/gravitational/teleport/pull/39074) +* TBot now supports `--proxy-server` for explicitly configuring the Proxy address. We recommend switching to this if you currently specify the address of your Teleport proxy to `--auth-server`. [#39056](https://github.com/gravitational/teleport/pull/39056) +* Expanded the EC2 joining process to include newly created AWS regions. [#39052](https://github.com/gravitational/teleport/pull/39052) +* Added GCP MySQL access IAM Authentication support. [#39041](https://github.com/gravitational/teleport/pull/39041) +* Fixed an issue in SAML IdP entity descriptor generator process, which would fail to generate entity descriptor if the configured Entity ID endpoint would return HTTP status code above `200` and below `400`. [#38988](https://github.com/gravitational/teleport/pull/38988) +* Updated Go to 1.21.8. [#38985](https://github.com/gravitational/teleport/pull/38985) +* Updated electron-builder dependency to address possible arbitrary code execution in the Windows installer of Teleport Connect (CVE-2024-27303). [#38966](https://github.com/gravitational/teleport/pull/38966) +* Improved reliability and performance of `tbot`. [#38929](https://github.com/gravitational/teleport/pull/38929) +* Filtered terminated sessions from the `tsh sessions ls` output. [#38886](https://github.com/gravitational/teleport/pull/38886) +* Prevented panic when AccessList's status field is not set. [#38862](https://github.com/gravitational/teleport/pull/38862) +* Fixed an issue with over counting of reported Teleport updater metrics. [#38832](https://github.com/gravitational/teleport/pull/38832) +* Fixed a bug that caused `tsh` to return "private key policy not met" errors instead of automatically initiating re-login to satisfy the private key policy. [#38818](https://github.com/gravitational/teleport/pull/38818) +* Fixed application access events being overwritten when using DynamoDB as event storage. [#38816](https://github.com/gravitational/teleport/pull/38816) +* Fixed issue where DynamoDB writes could fail when recording too many records. [#38762](https://github.com/gravitational/teleport/pull/38762) +* Added a tbot-only `tbot-distroless` container image, bringing an 80% size reduction over the Teleport `teleport` image. [#38719](https://github.com/gravitational/teleport/pull/38719) +* Fixed a Postgres v16.x compatibility issue preventing multiple connections for auto-provisioned users. [#38542](https://github.com/gravitational/teleport/pull/38542) +* Tsh will now show Access List review deadlines in dates rather than remaining hours.. [#38526](https://github.com/gravitational/teleport/pull/38526) +* Fixed an issue where tsh would not function if one of its profiles is invalid. [#38513](https://github.com/gravitational/teleport/pull/38513) +* Fixed an issue where `teleport configure` command logs would not use the configured logger. [#38509](https://github.com/gravitational/teleport/pull/38509) +* Removed `telnet` from legacy Ubuntu images due to CVE-2021-40491. Netcat `nc` can be used instead. [#38506](https://github.com/gravitational/teleport/pull/38506) +* Fixed a tsh WebAuthn.dll panic on Windows Server 2019. [#38489](https://github.com/gravitational/teleport/pull/38489) +* Added `ssh_service.enhanced_recording.root_path` configuration option to change the cgroup slice path used by the agent. [#38395](https://github.com/gravitational/teleport/pull/38395) +* Fixed a bug which allowed the operator to delete resources it does not own. [#37751](https://github.com/gravitational/teleport/pull/37751) + +## 14.3.6 (02/16/24) + +* Fixed a potential panic in the `tsh status` command. [#38304](https://github.com/gravitational/teleport/pull/38304) +* Fixed locking SSO user in the setup access step of the RDS auto discover flow in the web UI. [#38284](https://github.com/gravitational/teleport/pull/38284) +* Optionally permit the Auth Service to terminate client connections from unsupported versions. [#38186](https://github.com/gravitational/teleport/pull/38186) +* Removed access tokens from URL parameters, preventing them from being leaked to intermediary systems that may log them in plaintext. [#38070](https://github.com/gravitational/teleport/pull/38070) +* Added option to validate hardware key serial numbers with hardware key support. [#38069](https://github.com/gravitational/teleport/pull/38069) +* Forced agents to terminate Auth connections if joining fails. [#38004](https://github.com/gravitational/teleport/pull/38004) +* Added a tsh sessions ls command to list active sessions. [#37970](https://github.com/gravitational/teleport/pull/37970) +* Improved error handling when idle desktop connections are terminated. [#37956](https://github.com/gravitational/teleport/pull/37956) +* Updated Go to 1.21.7. [#37848](https://github.com/gravitational/teleport/pull/37848) +* Discover flow now starts two instances of DatabaseServices when setting up access to Amazon RDS. [#37804](https://github.com/gravitational/teleport/pull/37804) +* Fixed incorrect resizing of CLI apps in Teleport Connect on Windows. [#37799](https://github.com/gravitational/teleport/pull/37799) +* Fixed handling of non-registered U2F keys. [#37722](https://github.com/gravitational/teleport/pull/37722) +* Fixed memory leak in tbot caused by never closing reverse tunnel address resolvers. [#37719](https://github.com/gravitational/teleport/pull/37719) +* Fixed app redirection loop on browser's incognito mode and 3rd party cookie block. [#37692](https://github.com/gravitational/teleport/pull/37692) + +## 14.3.4 (02/01/24) + +* Skip `tsh` AppID pre-flight check whenever possible. [#37643](https://github.com/gravitational/teleport/pull/37643) +* Update OpenSSL to `3.0.13`. [#37552](https://github.com/gravitational/teleport/pull/37552) +* `tsh` FIDO2 backend re-written for improved responsiveness and reliability. [#37538](https://github.com/gravitational/teleport/pull/37538) +* Do not add alphabetically first Kube cluster's name to a user certificate on login. [#37501](https://github.com/gravitational/teleport/pull/37501) +* Allow to replicate proxy pods when using an ingress in the `teleport-cluster` Helm chart. [#37480](https://github.com/gravitational/teleport/pull/37480) +* Fix an issue `tsh` uses wrong default username for auto-user provisioning enabled databases in remote clusters [#37418](https://github.com/gravitational/teleport/pull/37418) +* Prevent backend throttling caused by a large number of app sessions. [#37391](https://github.com/gravitational/teleport/pull/37391) +* Emit audit events when SFTP or SCP commands are blocked. [#37385](https://github.com/gravitational/teleport/pull/37385) +* Fix goroutine leak on PostgreSQL access. [#37342](https://github.com/gravitational/teleport/pull/37342) +* Fixed incompatibility between leaf clusters and ProxyJump. [#37319](https://github.com/gravitational/teleport/pull/37319) +* Fixed a potential crash when setting up the Connect My Computer role in Teleport Connect. [#37314](https://github.com/gravitational/teleport/pull/37314) +* Fixed CA key generation when two auth servers share a single YubiHSM2. [#37296](https://github.com/gravitational/teleport/pull/37296) +* Add support for cancelling CockroachDB requests. [#37282](https://github.com/gravitational/teleport/pull/37282) +* Fix Terraform provider creating AccessLists with next audit date set to Epoch. [#37262](https://github.com/gravitational/teleport/pull/37262) +* Fix an issue selecting MySQL database is not reflected in the audit logs. [#37257](https://github.com/gravitational/teleport/pull/37257) +* The login screen will no longer be rendered for authenticated users. [#37230](https://github.com/gravitational/teleport/pull/37230) +* Fixed missing proxy address in GCP and Azure VM auto-discovery. [#37215](https://github.com/gravitational/teleport/pull/37215) +* Teleport namespace label prefixes are now sorted toward the end of the labels list in the web UI. [#37191](https://github.com/gravitational/teleport/pull/37191) +* Adds `tbot proxy kube` to support connecting to Kubernetes clusters using Machine ID when the Proxy is behind a L7 LB. [#37157](https://github.com/gravitational/teleport/pull/37157) +* Fix a bug that was breaking web UI if automatic upgrades are misconfigured. [#37130](https://github.com/gravitational/teleport/pull/37130) +* Fix an issue Amazon Redshift auto-provisioned user not deleted in drop mode. [#37036](https://github.com/gravitational/teleport/pull/37036) +* Fix an issue database auto-user provisioning fails to connect a second session on MariaDB older than 10.7. [#37028](https://github.com/gravitational/teleport/pull/37028) +* Improved styling of the login form in Connect and Web UI. [#37003](https://github.com/gravitational/teleport/pull/37003) +* Ensure that moderated sessions do not get stuck in the event of an unexpected drop in the moderator's connection. [#36917](https://github.com/gravitational/teleport/pull/36917) +* The web terminal now properly displays underscores on Linux. [#36890](https://github.com/gravitational/teleport/pull/36890) +* Fix `tsh` panic on Windows if `WebAuthn.dll` is missing. [#36868](https://github.com/gravitational/teleport/pull/36868) +* Increased timeout when waiting for response from Jira API and webhook to reconcile. [#36818](https://github.com/gravitational/teleport/pull/36818) +* Ensure `connect_to_node_attempts_total` is always incremented when dialing hosts. [#36739](https://github.com/gravitational/teleport/pull/36739) +* Fixed a potential crash in Teleport Connect after downgrading the app from v15+. [#36730](https://github.com/gravitational/teleport/pull/36730) +* Prevent a goroutine leak caused by app sessions not cleaning up resources properly. [#36668](https://github.com/gravitational/teleport/pull/36668) +* Added `tctl idp saml test-attribute-mapping` command to test SAML IdP attribute mapping. [#36662](https://github.com/gravitational/teleport/pull/36662) +* Fixed an issue where valid SAML entity descriptors could be rejected. [#36485](https://github.com/gravitational/teleport/pull/36485) +* Updated SAML IdP UI to display entity ID, SSO URL and X.509 certificate. [#3322](https://github.com/gravitational/teleport.e/pull/3322) +* Updated Access Request creation dialog to pre-select suggested reviewers. [#3325](https://github.com/gravitational/teleport.e/pull/3325) + +## 14.3.3 (01/12/24) + +* Fixed routing to nodes by their public addresses. [#36624](https://github.com/gravitational/teleport/pull/36624) +* Enhanced Kubernetes app discovery functionality to provide the ability to disable specific Service imports and configure the TLS Skip Verify option using an annotation. [#36611](https://github.com/gravitational/teleport/pull/36611) +* Added client remote IP address to some administrative audit events. [#36567](https://github.com/gravitational/teleport/pull/36567) + +## 14.3.2 (01/11/24) + +* Fixed routing to nodes by their public address. [#36591](https://github.com/gravitational/teleport/pull/36591) +* Verify MFA device locks during user authentication. [#36589](https://github.com/gravitational/teleport/pull/36589) +* Fixed `tctl get access_list` and support creating Access Lists without a next audit date. [#36572](https://github.com/gravitational/teleport/pull/36572) + +## 14.3.1 (01/10/24) + +* Added support to select database roles from `tsh`. [#36528](https://github.com/gravitational/teleport/pull/36528) +* Fixed goroutine leak per ssh session. [#36511](https://github.com/gravitational/teleport/pull/36511) +* Fixed user invites preventing listing tokens. [#36492](https://github.com/gravitational/teleport/pull/36492) +* Updated Go to v1.21.6. [#36478](https://github.com/gravitational/teleport/pull/36478) +* Fixed `refresh_identity = true` preventing Access Plugins connecting to Teleport using TLS routing with a L7 LB. [#36469](https://github.com/gravitational/teleport/pull/36469) +* Added --callback flag to tsh login. [#36468](https://github.com/gravitational/teleport/pull/36468) +* Added auto-enrolling capabilities to RDS discover flow in the web UI. [#36434](https://github.com/gravitational/teleport/pull/36434) +* Fixed an issue where bad cache state could cause spurious access denied errors during app access. [#36432](https://github.com/gravitational/teleport/pull/36432) +* Resources named `.` and `..` are no longer allowed. Please review the resources in your Teleport instance and rename any resources with these names before upgrading. [#36404](https://github.com/gravitational/teleport/pull/36404) +* Ensured that the login time is populated for app sessions. [#36373](https://github.com/gravitational/teleport/pull/36373) +* Fixed incorrect report of user's IP address in Kubernetes Audit Logs. [#36346](https://github.com/gravitational/teleport/pull/36346) +* Access lists and associated resources are now cached, which should significantly reduce the impact of Access List calculation. [#36331](https://github.com/gravitational/teleport/pull/36331) +* Added new certificate extensions and usage reporting flags to explicitly identify Machine ID bots and their cluster activity. [#36313](https://github.com/gravitational/teleport/pull/36313) +* Fixed potential panic after backend watcher failure. [#36301](https://github.com/gravitational/teleport/pull/36301) +* Prevent deleted users from using account reset links created prior to the user being deleted. [#36271](https://github.com/gravitational/teleport/pull/36271) +* Make Unified Resources page in Web UI responsive. [#36265](https://github.com/gravitational/teleport/pull/36265) +* Added "Database Roles" column to `tsh db ls -v`. [#36246](https://github.com/gravitational/teleport/pull/36246) +* Safeguard against the disruption of cluster access caused by incorrect Kubernetes APIService configurations. [#36227](https://github.com/gravitational/teleport/pull/36227) +* Support running a version server in the proxy for automatic agent upgrades. [#36220](https://github.com/gravitational/teleport/pull/36220) +* The user login state generator now uses the cache, which should reduce the number of calls to the backend. [#36196](https://github.com/gravitational/teleport/pull/36196) +* Added the `--insecure-no-resolve-image` flag to the `teleport-kube-agent-updater` to disable image tag resolution if it cannot pull the image. [#36097](https://github.com/gravitational/teleport/pull/36097) +* Added future assume time to Access Requests. [#35726](https://github.com/gravitational/teleport/pull/35726) + +## 14.3.0 + +This release of Teleport contains multiple security fixes, improvements and bug fixes. + +### Security fixes + +* Teleport Proxy now restricts SFTP for normal users as described under Advisory + https://github.com/gravitational/teleport/security/advisories/GHSA-c9v7-wmwj-vf6x + [#36139](https://github.com/gravitational/teleport/pull/36139) +* Fixed an issue that would allow for SSRF via Teleport's reverse tunnel + subsystem. Documented under the advisory + https://github.com/gravitational/teleport/security/advisories/GHSA-hw4x-mcx5-9q36 + [#36131](https://github.com/gravitational/teleport/pull/36131) +* On macOS, Teleport filters the environment to prevent code execution via + `DYLD_` variables. Documented under + https://github.com/gravitational/teleport/security/advisories/GHSA-vfxf-76hv-v4w4 + [#36135](https://github.com/gravitational/teleport/pull/36135) +* A fix was applied to Access Lists to prevent possible privilege escalation of + list owners. Documented under + https://github.com/gravitational/teleport/security/advisories/GHSA-76cc-p55w-63g3 + +### Other Fixes & Improvements + +* Added the ability to promote an Access Request to an Access List in Teleport Connect +* Fixed an issue that would prevent websocket upgrades from completing. [#36088](https://github.com/gravitational/teleport/pull/36088) +* Enhanced the audit events related to Teleport's SAML IdP [#36087](https://github.com/gravitational/teleport/pull/36087) +* Added support for STS session tags in the database configuration for granular DynamoDB access. [#36064](https://github.com/gravitational/teleport/pull/36064) +* Added support for the IAM join method in ca-west-1. [#36049](https://github.com/gravitational/teleport/pull/36049) +* Improved the formatting of Access List notifications in tsh. [#36046](https://github.com/gravitational/teleport/pull/36046) +* Fixed downgrade logic of KubernetesResources to Role v6 [#36009](https://github.com/gravitational/teleport/pull/36009) +* Fixed potential panic during early phases of SSH service lifetime [#35923](https://github.com/gravitational/teleport/pull/35923) +* Added a `tsh latency` command to monitor ssh connection latency in realtime [#35916](https://github.com/gravitational/teleport/pull/35916) +* Support GitHub joining from Enterprise accounts with `include_enterprise_slug` enabled. [#35900](https://github.com/gravitational/teleport/pull/35900) +* Added vpc-id as a label to auto-discovered RDS databases [#35890](https://github.com/gravitational/teleport/pull/35890) +* Improved teleport agent performance when handling a large number of TCP forwarding requests. [#35887](https://github.com/gravitational/teleport/pull/35887) +* Bump golang.org/x/crypto to v0.17.0, which addresses the Terrapin vulnerability (CVE-2023-48795) [#35879](https://github.com/gravitational/teleport/pull/35879) +* Include the lock expiration time in `lock.create` audit events [#35874](https://github.com/gravitational/teleport/pull/35874) +* Add custom attribute mapping to the `saml_idp_service_provider` spec. [#35873](https://github.com/gravitational/teleport/pull/35873) +* Fixed PIV not being available on Windows tsh binaries [#35866](https://github.com/gravitational/teleport/pull/35866) +* Restored direct dial SSH server compatibility with certain SSH tools such as `ssh-keyscan` (#35647) [#35859](https://github.com/gravitational/teleport/pull/35859) +* Prevent users from deleting their last passwordless device [#35855](https://github.com/gravitational/teleport/pull/35855) +* the `teleport-kube-agent` chart now supports passing extra arguments to the updater. [#35831](https://github.com/gravitational/teleport/pull/35831) +* New Access Lists with an unspecified NextAuditDate now pick a new date instead of being rejected [#35830](https://github.com/gravitational/teleport/pull/35830) +* Changed the minimal supported macOS version of Teleport Connect to 10.15 (Catalina) [#35819](https://github.com/gravitational/teleport/pull/35819) +* Add non-AD desktops to Enroll New Resource [#35797](https://github.com/gravitational/teleport/pull/35797) +* Fixed a bug in `teleport-kube-agent` chart when using both `appResources` and the `discovery` role. [#35783](https://github.com/gravitational/teleport/pull/35783) +* Fixed session upload audit events sometimes containing an incorrect URL for the session recording. [#35777](https://github.com/gravitational/teleport/pull/35777) +* Prevent tsh from re-authenticating if the MFA ceremony fails during `tsh ssh` [#35750](https://github.com/gravitational/teleport/pull/35750) +* Prevent attempts to join a nonexistent SSH session from hanging forever [#35743](https://github.com/gravitational/teleport/pull/35743) +* Improved Windows hosts registration with a new `static_hosts` configuration field [#35742](https://github.com/gravitational/teleport/pull/35742) +* Fixed the sorting of name and description columns for user groups when creating an Access Request [#35729](https://github.com/gravitational/teleport/pull/35729) + +## 14.2.3 (12/14/23) + +* Prevent Cloud tenants from being a leaf cluster. [#35687](https://github.com/gravitational/teleport/pull/35687) +* Added "Show All Labels" button in the unified resources list view. [#35666](https://github.com/gravitational/teleport/pull/35666) +* Added auto approval flow to servicenow plugin. [#35658](https://github.com/gravitational/teleport/pull/35658) +* Added guided SAML entity descriptor creation when entity descriptor XML is not yet available. [#35657](https://github.com/gravitational/teleport/pull/35657) +* Added a connection test when enrolling a new Connect My Computer resource in Web UI. [#35649](https://github.com/gravitational/teleport/pull/35649) +* Fixed regression of Kubernetes Server Address when Teleport runs in multiplex mode. [#35633](https://github.com/gravitational/teleport/pull/35633) +* When using the Slack plugin, users will now be notified directly of Access Requests and their approvals or denials. [#35577](https://github.com/gravitational/teleport/pull/35577) +* Fixed bug where configuration errors with an individual SSO connector impacted other connectors. [#35576](https://github.com/gravitational/teleport/pull/35576) +* Fixed client IP propagation from the Proxy to the Auth during IdP initiated SSO. [#35545](https://github.com/gravitational/teleport/pull/35545) + +## 14.2.2 (12/07/23) + +**Note**: `tsh` v14.2.2 has a known issue where `tsh kube login` uses an +incorrect port for clusters with multiplex mode enabled. If you use Kubernetes +access with multiplex mode, we recommend downgrading `tsh` to 14.2.1 until a fix +is available. + +* Prevent panic when dialing a deleted Application Server. [#35525](https://github.com/gravitational/teleport/pull/35525) +* Fixed regression issue with arm32 binaries in 14.2.1 having higher glibc requirements. [#35539](https://github.com/gravitational/teleport/pull/35539) +* Fixed GCP VM auto-discovery not using instances' internal IP address. [#35521](https://github.com/gravitational/teleport/pull/35521) +* Calculate latency of Web SSH sessions and report it to users. [#35516](https://github.com/gravitational/teleport/pull/35516) +* Fix bot's unable to view or approve Access Requests issue. [#35512](https://github.com/gravitational/teleport/pull/35512) +* Fix querying of large audit events with Athena backend. [#35483](https://github.com/gravitational/teleport/pull/35483) +* Fix panic on potential nil value when requesting `/webapi/presetroles`. [#35463](https://github.com/gravitational/teleport/pull/35463) +* Add `insecure-drop` host user creation mode. [#35403](https://github.com/gravitational/teleport/pull/35403) +* IAM permissions for `rds:DescribeDBProxyTargets` are no longer required for RDS Proxy discovery. [#35389](https://github.com/gravitational/teleport/pull/35389) +* Update Go to `1.21.5`. [#35371](https://github.com/gravitational/teleport/pull/35371) +* Desktop connections default to RDP port 3389 if not otherwise specified. [#35343](https://github.com/gravitational/teleport/pull/35343) +* Add `cluster_auth_preferences` to the shortcuts for `cluster_auth_preference`. [#35329](https://github.com/gravitational/teleport/pull/35329) +* Make the `podSecurityPolicy` configurable in the `teleport-kube-agent` chart. [#35320](https://github.com/gravitational/teleport/pull/35320) +* Prevent EKS fetcher not having correct IAM permissions from stopping whole Discovery service start up. [#35319](https://github.com/gravitational/teleport/pull/35319) +* Add database automatic user provisioning support for self-hosted MongoDB. [#35317](https://github.com/gravitational/teleport/pull/35317) +* Improve the resilience of `tbot` to misconfiguration of auth connectors when generating a Kubernetes output. [#35309](https://github.com/gravitational/teleport/pull/35309) +* Fix crash when writing kubeconfig with `tctl auth sign --tar`. [#34874](https://github.com/gravitational/teleport/pull/34874) + +## 14.2.1 (11/30/23) + +* Fixed issue that could cause app and desktop session recording events to be written to the audit log. [#35183](https://github.com/gravitational/teleport/pull/35183) +* Fixed a possible panic when downgrading Teleport roles to older versions. [#35236](https://github.com/gravitational/teleport/pull/35236) +* Fixed a regression issue where tsh db connect to Redis 7 fails with an error on REDIS_REPLY_STATUS. [#35162](https://github.com/gravitational/teleport/pull/35162) +* Allow Teleport to complete abandoned uploads faster in HA deployments. [#35102](https://github.com/gravitational/teleport/pull/35102) +* Fixed error when installing a v13 node with the default installer from a v14 cluster. [#35058](https://github.com/gravitational/teleport/pull/35058) +* Fixed issue with the absence of membership expiry circumventing membership requirements check. [#35057](https://github.com/gravitational/teleport/pull/35057) +* Added read verb to suggested role spec when enrolling new resources. [#35053](https://github.com/gravitational/teleport/pull/35053) +* Added more new "Enroll Integration" tiles for Machine ID guides. [#35050](https://github.com/gravitational/teleport/pull/35050) +* Fixed default installer yum error on RHEL and Amazon Linux. [#35021](https://github.com/gravitational/teleport/pull/35021) +* External Audit Storage enables Cloud customers to store Audit Logs and Session Recordings in their own AWS account. [#35008](https://github.com/gravitational/teleport/pull/35008) +* Fixed IP propagation for nodes/bots joining the cluster and add LoginIP to bot certificates. [#34958](https://github.com/gravitational/teleport/pull/34958) +* Fixed an issue `tsh db connect ` does not give reason on connection errors. [#34910](https://github.com/gravitational/teleport/pull/34910) +* Updated distroless images to use Debian 12. [#34878](https://github.com/gravitational/teleport/pull/34878) +* Added new email-based UI for inviting new local users on Teleport Enterprise (Cloud) clusters. [#34869](https://github.com/gravitational/teleport/pull/34869) +* Fix an issue "Allowed Users" in "tsh db ls" shows wrong user for databases with Automatic User Provisioning enabled. [#34850](https://github.com/gravitational/teleport/pull/34850) +* Fixed issue with application Access Requests and web UI large file downloads timing out after 30 seconds. [#34849](https://github.com/gravitational/teleport/pull/34849) +* Added default database support for PostgreSQL auto-user provisioning. [#34840](https://github.com/gravitational/teleport/pull/34840) +* Machine ID: handle kernel version check failing more gracefully. [#34828](https://github.com/gravitational/teleport/pull/34828) + +## 14.2.0 (11/20/23) + +### New Features +#### Advanced Okta Integration (Enterprise Edition only) +Teleport will be able to automatically create SSO connector and sync users when configuring Okta integration. + +#### Connect my Computer support in Web UI +The Teleport web UI will provide a guided flow for joining your computer to the Teleport cluster using Teleport Connect. + +#### Dynamic credential reloading for plugins +Teleport plugins will support dynamic credential reloading, allowing them to take advantage of short-lived (and frequently rotated) credentials generated by Machine ID. + +### Fixes and Improvements +* Access list review reminders will now be sent via Slack [#34663](https://github.com/gravitational/teleport/pull/34663) +* Improve the error message when attempting to enroll a hardware key that cannot support passwordless [#34589](https://github.com/gravitational/teleport/pull/34589) +* Allow selecting multiple resource filters in the search bar in Connect [#34543](https://github.com/gravitational/teleport/pull/34543) +* Added a guided flow for joining your computer to the Teleport cluster using Teleport Connect; find it in the Web UI under Enroll New Resource -> Connect My Computer (available only for local users, with prerequisites) [#33688](https://github.com/gravitational/teleport/pull/33688) + +## 14.1.5 (11/16/2023) + +* Increased the maximum width of the console tabs in the web UI. [#34648](https://github.com/gravitational/teleport/pull/34648) +* Fixed accessing dedicated Proxy Kubernetes port when TLS routing is enabled. [#34645](https://github.com/gravitational/teleport/pull/34645) +* Fixed `tsh --piv-slot` custom PIV slot setting for Hardware Key Support. [#34592](https://github.com/gravitational/teleport/pull/34592) +* Disabled AWS IMDSv1 fallback and enforced use of FIPS endpoints in FIPS mode. [#34433](https://github.com/gravitational/teleport/pull/34433) +* Fixed incorrect permissions when opening X11 listener. [#34617](https://github.com/gravitational/teleport/pull/34617) +* Prevented `.tsh/environment` values from overriding prior set values. [#34626](https://github.com/gravitational/teleport/pull/34626) +* Changed Access Lists to respect user locking. [#34620](https://github.com/gravitational/teleport/pull/34620) +* Fixed Access Requests to respect explicit deny rules. [#34600](https://github.com/gravitational/teleport/pull/34600) +* Added Teleport Access Graph integration. [#34569](https://github.com/gravitational/teleport/pull/34569) +* Fixed cleanup of unused GCP KMS keys. [#34468](https://github.com/gravitational/teleport/pull/34468) +* Added list view option to the unified resources page. [#34466](https://github.com/gravitational/teleport/pull/34466) +* Fixed duplicate entries in resources view when updating nodename [#34236](https://github.com/gravitational/teleport/issues/34236) [#34453](https://github.com/gravitational/teleport/pull/34453) +* Allow configuring `cluster_networking_config` and `cluster_auth_preference` via `--bootstrap`. [#34445](https://github.com/gravitational/teleport/pull/34445) +* Fixed `tsh logout` with broken key directory. [#34435](https://github.com/gravitational/teleport/pull/34435) +* Added binary formatted parameters as base64 encoded strings to PostgreSQL Statement Bind audit log events. [#34432](https://github.com/gravitational/teleport/pull/34432) +* Reduced CPU & memory usage, and logging in the operator, by reusing connections to Teleport. [#34425](https://github.com/gravitational/teleport/pull/34425) +* Updated the code signing certificate for Windows artifacts. [#34377](https://github.com/gravitational/teleport/pull/34377) +* Added IAM Authentication support for Amazon MemoryDB Access. [#34348](https://github.com/gravitational/teleport/pull/34348) +* Split large desktop recordings into multiple files during export. [#34319](https://github.com/gravitational/teleport/pull/34319) +* Allow setting server labels from tctl. [#34137](https://github.com/gravitational/teleport/pull/34137) + +## 14.1.3 (11/8/23) + +### Security Fixes + +#### [Medium] Arbitrary code execution with `LD_PRELOAD` and `SFTP` + +Teleport implements SFTP using a subcommand. Prior to this release it was +possible to inject environment variables into the execution of this +subcommand, via shell init scripts or via the SSH environment request. + +This is addressed by preventing `LD_PRELOAD` and other dangerous environment +variables from being forwarded during re-exec. + +[#3274](https://github.com/gravitational/teleport/pull/34274) + +#### [Medium] Outbound SSH from Proxy can lead to IP spoofing + +If the Teleport auth or proxy services are configured to accept `PROXY` +protocol headers, a malicious actor can use this to spoof their IP address. + +This is addressed by requiring that the first bytes of any SSH connection are +the SSH protocol prefix, denying a malicious actor the opportunity to send their +own proxy headers. + +[#33729](https://github.com/gravitational/teleport/pull/33729) + +### Other Fixes & Improvements + +* Fixed issue where tbot would select the wrong address for Kubernetes access when in ports separate mode [#34283](https://github.com/gravitational/teleport/pull/34283) +* Added post-review state of Access Request in audit log description [#34213](https://github.com/gravitational/teleport/pull/34213) +* Updated Operator Reconciliation to skip Teleport Operator on status updates [#34194](https://github.com/gravitational/teleport/pull/34194) +* Updated Kube Agent Auto-Discovery to install the Teleport version provided by Automatic Upgrades [#34157](https://github.com/gravitational/teleport/pull/34157) +* Updated Server Auto-Discovery installer script to use `bash` instead of `sh` [#34144](https://github.com/gravitational/teleport/pull/34144) +* When a promotable Access Request targets a resource that belongs to an Access List, owners of that list will now automatically be added as reviewers. [#34131](https://github.com/gravitational/teleport/pull/34131) +* Added Database Automatic User Provisioning support for Redshift [#34126](https://github.com/gravitational/teleport/pull/34126) +* Added `teleport_auth_type` config parameter to the AWS Terraform examples [#34124](https://github.com/gravitational/teleport/pull/34124) +* Fixed issue where an auto-provisioned PostgreSQL user may keep old roles indefinitely [#34121](https://github.com/gravitational/teleport/pull/34121) +* Fixed incorrectly set file mode for Windows TPM files [#34113](https://github.com/gravitational/teleport/pull/34113) +* Added dynamic credential reloading for access plugins [#34079](https://github.com/gravitational/teleport/pull/34079) +* Fixed Azure Identity federated Application ID [#33960](https://github.com/gravitational/teleport/pull/33960) +* Fixed issue where Kubernetes Audit Events reported incorrect information in the exec audit [#33950](https://github.com/gravitational/teleport/pull/33950) +* Added support for formatting hostname as `host:port` to `tsh puttyconfig` [#33883](https://github.com/gravitational/teleport/pull/33883) +* Added support for `--set-context-name` to `tsh proxy kube` +* Fixed various Access List bookkeeping issues [#33834](https://github.com/gravitational/teleport/pull/33834) +* Fixed issue where `tsh aws ecs execute-command` would always fail [#33833](https://github.com/gravitational/teleport/pull/33833) +* Updated UI to automatically redirect to login page on missing session cookie [#33806](https://github.com/gravitational/teleport/pull/33806) +* Added Dynamic Discovery matching for Databases [#33693](https://github.com/gravitational/teleport/pull/33693) +* Fixed formatting errors on empty result sets in `tsh` [#33633](https://github.com/gravitational/teleport/pull/33633) +* Added Database Automatic User Provisioning support for MariaDB [#34256](https://github.com/gravitational/teleport/pull/34256) +* Fixed issue where MySQL auto-user deletion fails on usernames with quotes [#34304](https://github.com/gravitational/teleport/pull/34304) + +## 14.1.1 (10/23/23) + +* Fixed the top bar breaking layout when the window is narrow in Connect [#33821](https://github.com/gravitational/teleport/pull/33821) +* Limited Snowflake decompressed request to 10MB [#33764](https://github.com/gravitational/teleport/pull/33764) +* Added MySQL auto-user deletion [#33710](https://github.com/gravitational/teleport/pull/33710) +* Configured Connect to intercept deep link clicks [#33684](https://github.com/gravitational/teleport/pull/33684) +* Added URL and SAML connector name in entity descriptor URL errors [#33667](https://github.com/gravitational/teleport/pull/33667) +* Added the ability to run a specific tool to Assist. [#33640](https://github.com/gravitational/teleport/pull/33640) +* Added PostgreSQL auto-user deletion [#33570](https://github.com/gravitational/teleport/pull/33570) +* Added DiscoveryConfig CRUD operations [#33380](https://github.com/gravitational/teleport/pull/33380) + +## 14.1.0 (10/18/23) + +### New features + +* Teleport Connect 14.1 introduces Connect My Computer which makes it possible to add your personal machine to a Teleport cluster in just a couple of clicks. Whether you're exploring capabilities of Teleport or want to make your computer available in your private cluster, Connect My Computer lets you do that without having to use the terminal to get the job done. +* Resource pinning allows you to pin your most frequently accessed resources to a separate page. +* Access Monitoring provides a view of risky accounts access and access anti-patterns in clusters using Athena as the audit log backend. +* Users can connect to EC2 instances via Amazon EC2 Instance Connect endpoints without needing to install Teleport Agents. +* Access list owners will be able to perform regular periodic reviews of the Access List members. + +### Security fixes +* Updated golang.org/x/net dependency. [#33420](https://github.com/gravitational/teleport/pull/33420) + * swift-nio-http2 vulnerable to HTTP/2 Stream Cancellation Attack: [CVE-2023-44487](https://github.com/advisories/GHSA-qppj-fm5r-hxr3) +* Updated `google.golang.org/grpc` to v1.57.1. [#33487](https://github.com/gravitational/teleport/pull/33487) + * swift-nio-http2 vulnerable to HTTP/2 Stream Cancellation Attack: [CVE-2023-44487](https://github.com/advisories/GHSA-qppj-fm5r-hxr3) +* Updated OpenTelemetry dependency. [#33523](https://github.com/gravitational/teleport/pull/33523) [#33550](https://github.com/gravitational/teleport/pull/33550) + * OpenTelemetry-Go Contrib vulnerable to denial of service in `otelhttp` due to unbound cardinality metrics: [CVE-2023-45142](https://github.com/advisories/GHSA-rcjv-mgp8-qvmr) +* Updated babel/core to 7.3.2. [#33441](https://github.com/gravitational/teleport/pull/33441) + * Arbitrary code execution when compiling specifically crafted malicious code: [CVE-2023-45133](https://github.com/babel/babel/security/advisories/GHSA-67hx-6x53-jw92) + +### Other fixes and improvements + +* Web SSH sessions are terminated right away when a user closes the tab. [#33529](https://github.com/gravitational/teleport/pull/33529) +* Added the ability for bots to submit Access Request reviews. [#33509](https://github.com/gravitational/teleport/pull/33509) +* Added access review notifications when logging in via `tsh` or running `tsh status`. [#33468](https://github.com/gravitational/teleport/pull/33468) +* Added database automatic user provisioning support for MySQL. [#33379](https://github.com/gravitational/teleport/pull/33379) +* Added job to update the Teleport version for deployments in Amazon ECS used during RDS Enrollment. [#33313](https://github.com/gravitational/teleport/pull/33313) +* Fixed Teleport Assist SQL view names. [#33581](https://github.com/gravitational/teleport/pull/33581) +* Fixed hardware key support for sso web login. [#33548](https://github.com/gravitational/teleport/pull/33548) +* Fixed Access Lists to allow them to affect Access Request permissions. [#33350](https://github.com/gravitational/teleport/pull/33350) +* Prevented remote proxies from impersonating users from different clusters. [#33539](https://github.com/gravitational/teleport/pull/33539) +* Added link to Access Request in ServiceNow incidents. [#33593](https://github.com/gravitational/teleport/pull/33593) +* Added new "Identity Governance & Security" navigation section in web UI. [#33423](https://github.com/gravitational/teleport/pull/33423) +* Fixed `tsh` connection issue when Proxy is in separate mode and Web port is TLS-terminated by a load balancer. [#32531](https://github.com/gravitational/teleport/issues/32531) [#33406](https://github.com/gravitational/teleport/pull/33406) +* Fixed panic when trying to register resources from older Kubernetes clusters with `extensions/v1beta1` group/version. [#33402](https://github.com/gravitational/teleport/pull/33402) +* Fixed Access List audit log messages to properly include user names. [#33383](https://github.com/gravitational/teleport/pull/33383) +* Added notification icon to Web UI to show Access List review notifications. [#33381](https://github.com/gravitational/teleport/pull/33381) +* Fixed creation of `@teleport-access-approver` role to `v6` to support downgrades to Teleport 13. [#33354](https://github.com/gravitational/teleport/pull/33354) +* Added ability to specify PIV slot for hardware key support. [#33352](https://github.com/gravitational/teleport/pull/33352) [#33353](https://github.com/gravitational/teleport/pull/33353) +* Extended timeout when waiting for hardware key touch/PIN. [#33348](https://github.com/gravitational/teleport/pull/33348) +* Added support for Windows AD root domain for PKI operations. [#33275](https://github.com/gravitational/teleport/pull/33275) +* Added resources to Slack notification of Access Requests. [#33264](https://github.com/gravitational/teleport/pull/33264) +* Fixed provision tokens to make system roles case-insensitive. [#33260](https://github.com/gravitational/teleport/pull/33260) + +## 14.0.3 (10/11/23) + +### Security Fixes + +#### [Critical] Privilege escalation through `RecursiveChown` + +When using automatic Linux user creation, an attacker could exploit a race +condition in the user creation functionality to `chown` arbitrary files on the +system. + +Users who aren't using automatic Linux host user creation aren’t affected by +this vulnerability. + +[#33248](https://github.com/gravitational/teleport/pull/33248) + +### Other Fixes + + * Fixed spurious timeouts in database access sessions [#32720](https://github.com/gravitational/teleport/pull/32720) + * Azure VM auto-discovery can now find VMs with multiple managed identities [#32800](https://github.com/gravitational/teleport/pull/32800) + * Fixed improperly set Kubernetes impersonation headers [#32848](https://github.com/gravitational/teleport/pull/32848) + * `tsh puttyconfig` now uses `Validity` format for WinSCP compatibility [#32856](https://github.com/gravitational/teleport/pull/32856) + * Teleport client now uses gRPC when connecting to the root cluster [#32662](https://github.com/gravitational/teleport/pull/32662) + * Teleport client now uses gRPC when creating tracing client [#32663](https://github.com/gravitational/teleport/pull/32663) + * Fixed panic on `tsh device enroll --current-device` [#32756](https://github.com/gravitational/teleport/pull/32756) + * The Teleport `etcd` backend will now start if some nodes are unreachable [#32779](https://github.com/gravitational/teleport/pull/32779) + * Fixed certificate verification issues when using `kubectl exec` [#32768](https://github.com/gravitational/teleport/pull/32768) + * Added Discover flow for enrolling EC2 Instances with Endpoint Instance Connect [#32760](https://github.com/gravitational/teleport/pull/32760) + * Added connection information to multiplexer logs [#32738](https://github.com/gravitational/teleport/pull/32738) + * Fixed issue causing keys to be incorrectly removed in tsh and Teleport Connect on Windows [#32963](https://github.com/gravitational/teleport/pull/32963) + * Improved Unified Resource Cache performance [#33027](https://github.com/gravitational/teleport/pull/33027) + * Adds Audit Review recurrence presets [#32960](https://github.com/gravitational/teleport/pull/32960) + * Fixed multiple discovery install attempts on Azure & GCP VMs [#32569](https://github.com/gravitational/teleport/pull/32569) + * Fixed a corner case of privilege tokens where MFA devices disabled by cluster settings were still counted against the user [#32430](https://github.com/gravitational/teleport/pull/32430) + * Fixed Access List caching & eventing issues [#32649](https://github.com/gravitational/teleport/pull/32649) + * Fixed user session tracking across trusted clusters [#32967](https://github.com/gravitational/teleport/pull/32967) + * Added cost optimized pagination search for athena [#33007](https://github.com/gravitational/teleport/pull/33007) + * Teleport now reports initial command to session moderators [#33112](https://github.com/gravitational/teleport/pull/33112) + * OneOff install script now installs enterprise Teleport when generated by an enterprise cluster [#33148](https://github.com/gravitational/teleport/pull/33148) + * Fixed issue when playing back a session recorded on a leaf cluster [#33102](https://github.com/gravitational/teleport/pull/33102) + * Fixed self-signed certificate issue on macOS [#33156](https://github.com/gravitational/teleport/pull/33156) + * Discovery EC2 instance listing now shows instance name [#33179](https://github.com/gravitational/teleport/pull/33179) + * Fixed HTTP connection hijack issue when using `tsh proxy kube` [#33172](https://github.com/gravitational/teleport/pull/33172) + * Improved error messaging in `tsh kube credentials` when root cluster roles don't allow Kube access [#33210](https://github.com/gravitational/teleport/pull/33210) + +## 14.0.1 (09/26/23) + +* Fixed issue where Teleport Connect Kube terminal throws an internal server error [#32612](https://github.com/gravitational/teleport/pull/32612) +* Fixed `create_host_user_mode` issue with TeleportRole in the Teleport Operator CRDs [#32557](https://github.com/gravitational/teleport/pull/32557) +* Fixed issue that allowed for duplicate Access List owners [#32481](https://github.com/gravitational/teleport/pull/32481) +* Removed unnecessary permission requirement from PostgreSQL backend [#32474](https://github.com/gravitational/teleport/pull/32474) +* Added feature allowing for managing host sudoers without also creating users [#32400](https://github.com/gravitational/teleport/pull/32400) +* Fixed dynamic labels not being present on server access audit events [#32382](https://github.com/gravitational/teleport/pull/32382) +* Added PostHog events for discovered Kubernetes Apps [#32379](https://github.com/gravitational/teleport/pull/32379) +* Fixed issue where changing the cluster name leads to cluster being unaccessible [#32352](https://github.com/gravitational/teleport/pull/32352) +* Added additional logging for when the Teleport process file is not accessible due to a permission issue upon startup [#32348](https://github.com/gravitational/teleport/pull/32348) +* Fixed issue where the `teleport-kube-agent` Helm chart would created the same `ServiceAccount` multiple times [#32338](https://github.com/gravitational/teleport/pull/32338) +* Fixed GCP VM auto-discovery bugs [#32316](https://github.com/gravitational/teleport/pull/32316) +* Added Access List usage events [#32297](https://github.com/gravitational/teleport/pull/32297) +* Allowed for including only traits when doing a JWT rewrite for web application access [#32291](https://github.com/gravitational/teleport/pull/32291) +* Added `IneligibleStatus` fields for Access List members and owners [#32278](https://github.com/gravitational/teleport/pull/32278) +* Fixed issue where the Auth Service was listed twice in the inventory of connected resources [#32270](https://github.com/gravitational/teleport/pull/32270) +* Added three second shutdown delay on on `SIGINT`/`SIGTERM` [#32189](https://github.com/gravitational/teleport/pull/32189) +* Add initial ServiceNow plugin [#32131](https://github.com/gravitational/teleport/pull/32131) + ## 14.0.0 (09/20/23) diff --git a/Makefile b/Makefile index a6cf23c23e277..19a7c68f6cdac 100644 --- a/Makefile +++ b/Makefile @@ -13,7 +13,7 @@ # Stable releases: "1.0.0" # Pre-releases: "1.0.0-alpha.1", "1.0.0-beta.2", "1.0.0-rc.3" # Master/dev branch: "1.0.0-dev" -VERSION=17.0.0-dev +VERSION=17.0.0-alpha.1 DOCKER_IMAGE ?= teleport diff --git a/api/version.go b/api/version.go index 17bbdd36f118c..0e4a1c51e5821 100644 --- a/api/version.go +++ b/api/version.go @@ -3,6 +3,6 @@ package api import "github.com/coreos/go-semver/semver" -const Version = "17.0.0-dev" +const Version = "17.0.0-alpha.1" var SemVersion = semver.New(Version) diff --git a/docs/cspell.json b/docs/cspell.json index 6628e917a3909..12aa4c2e340ab 100644 --- a/docs/cspell.json +++ b/docs/cspell.json @@ -45,6 +45,7 @@ "DQMB", "DSID", "DWORD", + "DYLD", "Decisiv", "Deeplink", "Dfnnpu", @@ -54,12 +55,12 @@ "EBSCSI", "ECCP", "ECMWF", + "EICE", "EKCert", "ERRO", "Elastcsearch", "Elasticvue", "Entra", - "Exadata", "Exfiltrate", "Exrch", "FGHIJ", @@ -67,6 +68,7 @@ "FLUSHALL", "FLUSHDB", "FMPFM", + "Fargate", "Fatalf", "Fintech", "Firestore", @@ -130,7 +132,6 @@ "MODIFYCLUSTERSETTING", "MYDNS", "MYELB", - "MYHOSTNAME", "MYIP", "MYPROJ", "MYTOKEN", @@ -141,6 +142,7 @@ "Mqgcq", "Multifactor", "Multihost", + "MYHOSTNAME", "Mzgz", "NOFILE", "NOKEY", @@ -156,6 +158,19 @@ "OpenAI", "Opsgenie", "Orapki", + "Exadata", + "exadata", + "demodb", + "exadatadomain", + "oraclevcn", + "cprops", + "mkstore", + "dbaas", + "acfs", + "sqlplus", + "sysdba", + "paas", + "nologo", "PFDEBUG", "PFSELFTEST", "PGCLIENTENCODING", @@ -189,6 +204,7 @@ "SECURITYADMIN", "SIEM", "SIGINT", + "SIGUSR", "SLAVEOF", "SLES", "SLOWLOG", @@ -196,6 +212,7 @@ "SPIFFE", "SQLSTATE", "SSHEICE", + "SSRF", "SSUBSCRIBE", "SSWS", "STIG", @@ -258,7 +275,6 @@ "Zrpsaln", "abcdefghijklm", "accesslist", - "acfs", "aclfile", "acmecorp", "acpi", @@ -289,6 +305,7 @@ "armv", "atburke", "attested", + "attobj", "attrname", "auditctl", "auditd", @@ -383,9 +400,9 @@ "compu", "cond", "configmap", + "configurator", "connectionupgrade", "connectorname", - "cprops", "cqlsh", "createkey", "createnongalleryapp", @@ -396,12 +413,12 @@ "cryptoprocessor", "customizability", "daemonset", + "dalek", "databaseresources", "datacenter", "datadoghq", "datagrip", "datareader", - "dbaas", "dbaccessdemo", "dbadir", "dbadmin", @@ -412,7 +429,6 @@ "dbuser", "deanonymize", "deletecollection", - "demodb", "deregisters", "devel", "develnode", @@ -421,6 +437,7 @@ "disableexcludes", "disablerepo", "disablesse", + "discoverability", "distros", "docdb", "dockerhost", @@ -457,8 +474,6 @@ "enzos", "errcode", "etcdctl", - "exadata", - "exadatadomain", "exampledb", "exampletoken", "exampleuser", @@ -524,6 +539,7 @@ "hostdb", "hostedzone", "hostip", + "hostnames", "hostssl", "hsm-ppzzfxbleki", "httpout", @@ -625,7 +641,6 @@ "microk", "minikube", "minikube's", - "mkstore", "mlock", "mlockall", "mongodbatlas", @@ -692,7 +707,6 @@ "nodename", "nohup", "nologin", - "nologo", "nonprod", "noout", "noprompt", @@ -716,12 +730,11 @@ "opensearchsql", "operatorenabled", "opsexample", - "oraclevcn", "organisation", "osconfig", + "otelhttp", "oustanding", "oxrq", - "paas", "packagekit", "pagerduty", "pagerdutyapikey", @@ -745,6 +758,7 @@ "pprof", "preconfigured", "prereqs", + "presetroles", "prioritise", "privateca", "privkey", @@ -786,6 +800,7 @@ "rediss", "regexes", "relogged", + "remask", "remotefx", "removelock", "replaceall", @@ -794,6 +809,7 @@ "requestable", "requestsclaims", "requirepass", + "retryablehttp", "reversetunnel", "reviewee", "rffx", @@ -822,6 +838,7 @@ "scrollback", "seccomp", "secretname", + "secretless", "selectnongalleryapp", "selectsaml", "selfhosted", @@ -856,7 +873,6 @@ "sqlcl", "sqlcmd", "sqlnet", - "sqlplus", "sqlserver", "sshcacerts", "sshcert", @@ -878,7 +894,6 @@ "supervillain", "svid", "syscalls", - "sysdba", "sysvinit", "tadmin", "tbot", diff --git a/examples/chart/access/datadog/Chart.yaml b/examples/chart/access/datadog/Chart.yaml index cd2ee76d02052..2054f3dd2c7d8 100644 --- a/examples/chart/access/datadog/Chart.yaml +++ b/examples/chart/access/datadog/Chart.yaml @@ -1,4 +1,4 @@ -.version: &version "17.0.0-dev" +.version: &version "17.0.0-alpha.1" apiVersion: v2 name: teleport-plugin-datadog diff --git a/examples/chart/access/datadog/tests/__snapshot__/configmap_test.yaml.snap b/examples/chart/access/datadog/tests/__snapshot__/configmap_test.yaml.snap index 501c844054d76..3a7d58ade03f7 100644 --- a/examples/chart/access/datadog/tests/__snapshot__/configmap_test.yaml.snap +++ b/examples/chart/access/datadog/tests/__snapshot__/configmap_test.yaml.snap @@ -26,6 +26,6 @@ should match the snapshot: app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-datadog - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-datadog-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-datadog-17.0.0-alpha.1 name: RELEASE-NAME-teleport-plugin-datadog diff --git a/examples/chart/access/datadog/tests/__snapshot__/deployment_test.yaml.snap b/examples/chart/access/datadog/tests/__snapshot__/deployment_test.yaml.snap index 2059ce41c0b04..83e1ef19e34e5 100644 --- a/examples/chart/access/datadog/tests/__snapshot__/deployment_test.yaml.snap +++ b/examples/chart/access/datadog/tests/__snapshot__/deployment_test.yaml.snap @@ -7,8 +7,8 @@ should match the snapshot: app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-datadog - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-datadog-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-datadog-17.0.0-alpha.1 name: RELEASE-NAME-teleport-plugin-datadog spec: replicas: 1 @@ -22,8 +22,8 @@ should match the snapshot: app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-datadog - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-datadog-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-datadog-17.0.0-alpha.1 spec: containers: - command: diff --git a/examples/chart/access/discord/Chart.yaml b/examples/chart/access/discord/Chart.yaml index 345bb8c893c0b..2304443b68db8 100644 --- a/examples/chart/access/discord/Chart.yaml +++ b/examples/chart/access/discord/Chart.yaml @@ -1,4 +1,4 @@ -.version: &version "17.0.0-dev" +.version: &version "17.0.0-alpha.1" apiVersion: v2 name: teleport-plugin-discord diff --git a/examples/chart/access/discord/tests/__snapshot__/configmap_test.yaml.snap b/examples/chart/access/discord/tests/__snapshot__/configmap_test.yaml.snap index d2ca5c3a439b3..b026016c0fbb4 100644 --- a/examples/chart/access/discord/tests/__snapshot__/configmap_test.yaml.snap +++ b/examples/chart/access/discord/tests/__snapshot__/configmap_test.yaml.snap @@ -24,6 +24,6 @@ should match the snapshot: app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-discord - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-discord-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-discord-17.0.0-alpha.1 name: RELEASE-NAME-teleport-plugin-discord diff --git a/examples/chart/access/discord/tests/__snapshot__/deployment_test.yaml.snap b/examples/chart/access/discord/tests/__snapshot__/deployment_test.yaml.snap index 208c6936060fc..63aace0aaf7a7 100644 --- a/examples/chart/access/discord/tests/__snapshot__/deployment_test.yaml.snap +++ b/examples/chart/access/discord/tests/__snapshot__/deployment_test.yaml.snap @@ -7,8 +7,8 @@ should match the snapshot: app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-discord - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-discord-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-discord-17.0.0-alpha.1 name: RELEASE-NAME-teleport-plugin-discord spec: replicas: 1 @@ -22,8 +22,8 @@ should match the snapshot: app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-discord - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-discord-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-discord-17.0.0-alpha.1 spec: containers: - command: diff --git a/examples/chart/access/email/Chart.yaml b/examples/chart/access/email/Chart.yaml index f589b552357d2..155f46ebe4493 100644 --- a/examples/chart/access/email/Chart.yaml +++ b/examples/chart/access/email/Chart.yaml @@ -1,4 +1,4 @@ -.version: &version "17.0.0-dev" +.version: &version "17.0.0-alpha.1" apiVersion: v2 name: teleport-plugin-email diff --git a/examples/chart/access/email/tests/__snapshot__/configmap_test.yaml.snap b/examples/chart/access/email/tests/__snapshot__/configmap_test.yaml.snap index 07109f0b0b1f9..fdfc8351cd052 100644 --- a/examples/chart/access/email/tests/__snapshot__/configmap_test.yaml.snap +++ b/examples/chart/access/email/tests/__snapshot__/configmap_test.yaml.snap @@ -26,8 +26,8 @@ should match the snapshot (mailgun on): app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-email - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-email-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-email-17.0.0-alpha.1 name: RELEASE-NAME-teleport-plugin-email should match the snapshot (smtp on): 1: | @@ -59,8 +59,8 @@ should match the snapshot (smtp on): app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-email - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-email-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-email-17.0.0-alpha.1 name: RELEASE-NAME-teleport-plugin-email should match the snapshot (smtp on, no starttls): 1: | @@ -92,8 +92,8 @@ should match the snapshot (smtp on, no starttls): app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-email - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-email-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-email-17.0.0-alpha.1 name: RELEASE-NAME-teleport-plugin-email should match the snapshot (smtp on, password file): 1: | @@ -125,8 +125,8 @@ should match the snapshot (smtp on, password file): app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-email - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-email-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-email-17.0.0-alpha.1 name: RELEASE-NAME-teleport-plugin-email should match the snapshot (smtp on, roleToRecipients set): 1: | @@ -161,8 +161,8 @@ should match the snapshot (smtp on, roleToRecipients set): app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-email - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-email-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-email-17.0.0-alpha.1 name: RELEASE-NAME-teleport-plugin-email should match the snapshot (smtp on, starttls disabled): 1: | @@ -194,6 +194,6 @@ should match the snapshot (smtp on, starttls disabled): app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-email - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-email-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-email-17.0.0-alpha.1 name: RELEASE-NAME-teleport-plugin-email diff --git a/examples/chart/access/email/tests/__snapshot__/deployment_test.yaml.snap b/examples/chart/access/email/tests/__snapshot__/deployment_test.yaml.snap index b7e81f481eedb..9058d57db7d26 100644 --- a/examples/chart/access/email/tests/__snapshot__/deployment_test.yaml.snap +++ b/examples/chart/access/email/tests/__snapshot__/deployment_test.yaml.snap @@ -7,8 +7,8 @@ should be possible to override volume name (smtp on): app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-email - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-email-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-email-17.0.0-alpha.1 name: RELEASE-NAME-teleport-plugin-email spec: replicas: 1 @@ -22,8 +22,8 @@ should be possible to override volume name (smtp on): app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-email - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-email-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-email-17.0.0-alpha.1 spec: containers: - command: @@ -34,7 +34,7 @@ should be possible to override volume name (smtp on): env: - name: TELEPORT_PLUGIN_FAIL_FAST value: "true" - image: public.ecr.aws/gravitational/teleport-plugin-email:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-plugin-email:17.0.0-alpha.1 imagePullPolicy: IfNotPresent name: teleport-plugin-email ports: @@ -75,8 +75,8 @@ should match the snapshot: app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-email - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-email-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-email-17.0.0-alpha.1 name: RELEASE-NAME-teleport-plugin-email spec: replicas: 1 @@ -90,8 +90,8 @@ should match the snapshot: app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-email - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-email-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-email-17.0.0-alpha.1 spec: containers: - command: @@ -136,8 +136,8 @@ should match the snapshot (mailgun on): app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-email - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-email-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-email-17.0.0-alpha.1 name: RELEASE-NAME-teleport-plugin-email spec: replicas: 1 @@ -151,8 +151,8 @@ should match the snapshot (mailgun on): app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-email - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-email-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-email-17.0.0-alpha.1 spec: containers: - command: @@ -163,7 +163,7 @@ should match the snapshot (mailgun on): env: - name: TELEPORT_PLUGIN_FAIL_FAST value: "true" - image: public.ecr.aws/gravitational/teleport-plugin-email:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-plugin-email:17.0.0-alpha.1 imagePullPolicy: IfNotPresent name: teleport-plugin-email ports: @@ -204,8 +204,8 @@ should match the snapshot (smtp on): app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-email - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-email-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-email-17.0.0-alpha.1 name: RELEASE-NAME-teleport-plugin-email spec: replicas: 1 @@ -219,8 +219,8 @@ should match the snapshot (smtp on): app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-email - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-email-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-email-17.0.0-alpha.1 spec: containers: - command: @@ -231,7 +231,7 @@ should match the snapshot (smtp on): env: - name: TELEPORT_PLUGIN_FAIL_FAST value: "true" - image: public.ecr.aws/gravitational/teleport-plugin-email:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-plugin-email:17.0.0-alpha.1 imagePullPolicy: IfNotPresent name: teleport-plugin-email ports: @@ -272,8 +272,8 @@ should mount external secret (mailgun on): app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-email - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-email-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-email-17.0.0-alpha.1 name: RELEASE-NAME-teleport-plugin-email spec: replicas: 1 @@ -287,8 +287,8 @@ should mount external secret (mailgun on): app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-email - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-email-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-email-17.0.0-alpha.1 spec: containers: - command: @@ -299,7 +299,7 @@ should mount external secret (mailgun on): env: - name: TELEPORT_PLUGIN_FAIL_FAST value: "true" - image: public.ecr.aws/gravitational/teleport-plugin-email:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-plugin-email:17.0.0-alpha.1 imagePullPolicy: IfNotPresent name: teleport-plugin-email ports: @@ -340,8 +340,8 @@ should mount external secret (smtp on): app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-email - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-email-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-email-17.0.0-alpha.1 name: RELEASE-NAME-teleport-plugin-email spec: replicas: 1 @@ -355,8 +355,8 @@ should mount external secret (smtp on): app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-email - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-email-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-email-17.0.0-alpha.1 spec: containers: - command: @@ -367,7 +367,7 @@ should mount external secret (smtp on): env: - name: TELEPORT_PLUGIN_FAIL_FAST value: "true" - image: public.ecr.aws/gravitational/teleport-plugin-email:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-plugin-email:17.0.0-alpha.1 imagePullPolicy: IfNotPresent name: teleport-plugin-email ports: diff --git a/examples/chart/access/jira/Chart.yaml b/examples/chart/access/jira/Chart.yaml index bda1cd653e046..9872445db9ff8 100644 --- a/examples/chart/access/jira/Chart.yaml +++ b/examples/chart/access/jira/Chart.yaml @@ -1,4 +1,4 @@ -.version: &version "17.0.0-dev" +.version: &version "17.0.0-alpha.1" apiVersion: v2 name: teleport-plugin-jira diff --git a/examples/chart/access/jira/tests/__snapshot__/configmap_test.yaml.snap b/examples/chart/access/jira/tests/__snapshot__/configmap_test.yaml.snap index d1a5b3b3d5390..083a987e074b3 100644 --- a/examples/chart/access/jira/tests/__snapshot__/configmap_test.yaml.snap +++ b/examples/chart/access/jira/tests/__snapshot__/configmap_test.yaml.snap @@ -32,6 +32,6 @@ should match the snapshot (smtp on): app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-jira - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-jira-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-jira-17.0.0-alpha.1 name: RELEASE-NAME-teleport-plugin-jira diff --git a/examples/chart/access/jira/tests/__snapshot__/deployment_test.yaml.snap b/examples/chart/access/jira/tests/__snapshot__/deployment_test.yaml.snap index 6911e6e41ed78..ee5857584ccde 100644 --- a/examples/chart/access/jira/tests/__snapshot__/deployment_test.yaml.snap +++ b/examples/chart/access/jira/tests/__snapshot__/deployment_test.yaml.snap @@ -7,8 +7,8 @@ should match the snapshot: app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-jira - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-jira-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-jira-17.0.0-alpha.1 name: RELEASE-NAME-teleport-plugin-jira spec: replicas: 1 @@ -22,8 +22,8 @@ should match the snapshot: app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-jira - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-jira-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-jira-17.0.0-alpha.1 spec: containers: - command: diff --git a/examples/chart/access/mattermost/Chart.yaml b/examples/chart/access/mattermost/Chart.yaml index 2f171d58f08da..319063ae2c6ed 100644 --- a/examples/chart/access/mattermost/Chart.yaml +++ b/examples/chart/access/mattermost/Chart.yaml @@ -1,4 +1,4 @@ -.version: &version "17.0.0-dev" +.version: &version "17.0.0-alpha.1" apiVersion: v2 name: teleport-plugin-mattermost diff --git a/examples/chart/access/mattermost/tests/__snapshot__/configmap_test.yaml.snap b/examples/chart/access/mattermost/tests/__snapshot__/configmap_test.yaml.snap index 0b130d51c7218..4e81fe6711f6f 100644 --- a/examples/chart/access/mattermost/tests/__snapshot__/configmap_test.yaml.snap +++ b/examples/chart/access/mattermost/tests/__snapshot__/configmap_test.yaml.snap @@ -22,6 +22,6 @@ should match the snapshot: app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-mattermost - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-mattermost-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-mattermost-17.0.0-alpha.1 name: RELEASE-NAME-teleport-plugin-mattermost diff --git a/examples/chart/access/mattermost/tests/__snapshot__/deployment_test.yaml.snap b/examples/chart/access/mattermost/tests/__snapshot__/deployment_test.yaml.snap index 723e8279c09d3..6dfe3a14b1f03 100644 --- a/examples/chart/access/mattermost/tests/__snapshot__/deployment_test.yaml.snap +++ b/examples/chart/access/mattermost/tests/__snapshot__/deployment_test.yaml.snap @@ -7,8 +7,8 @@ should match the snapshot: app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-mattermost - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-mattermost-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-mattermost-17.0.0-alpha.1 name: RELEASE-NAME-teleport-plugin-mattermost spec: replicas: 1 @@ -22,8 +22,8 @@ should match the snapshot: app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-mattermost - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-mattermost-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-mattermost-17.0.0-alpha.1 spec: containers: - command: @@ -75,8 +75,8 @@ should mount external secret: app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-mattermost - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-mattermost-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-mattermost-17.0.0-alpha.1 name: RELEASE-NAME-teleport-plugin-mattermost spec: replicas: 1 @@ -90,8 +90,8 @@ should mount external secret: app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-mattermost - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-mattermost-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-mattermost-17.0.0-alpha.1 spec: containers: - command: @@ -102,7 +102,7 @@ should mount external secret: env: - name: TELEPORT_PLUGIN_FAIL_FAST value: "true" - image: public.ecr.aws/gravitational/teleport-plugin-mattermost:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-plugin-mattermost:17.0.0-alpha.1 imagePullPolicy: IfNotPresent name: teleport-plugin-mattermost ports: @@ -143,8 +143,8 @@ should override volume name: app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-mattermost - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-mattermost-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-mattermost-17.0.0-alpha.1 name: RELEASE-NAME-teleport-plugin-mattermost spec: replicas: 1 @@ -158,8 +158,8 @@ should override volume name: app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-mattermost - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-mattermost-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-mattermost-17.0.0-alpha.1 spec: containers: - command: @@ -170,7 +170,7 @@ should override volume name: env: - name: TELEPORT_PLUGIN_FAIL_FAST value: "true" - image: public.ecr.aws/gravitational/teleport-plugin-mattermost:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-plugin-mattermost:17.0.0-alpha.1 imagePullPolicy: IfNotPresent name: teleport-plugin-mattermost ports: diff --git a/examples/chart/access/msteams/Chart.yaml b/examples/chart/access/msteams/Chart.yaml index 9ba10864dc698..418af84a2739c 100644 --- a/examples/chart/access/msteams/Chart.yaml +++ b/examples/chart/access/msteams/Chart.yaml @@ -1,4 +1,4 @@ -.version: &version "17.0.0-dev" +.version: &version "17.0.0-alpha.1" apiVersion: v2 name: teleport-plugin-msteams diff --git a/examples/chart/access/msteams/tests/__snapshot__/configmap_test.yaml.snap b/examples/chart/access/msteams/tests/__snapshot__/configmap_test.yaml.snap index 553e036515e21..298ba6e986358 100644 --- a/examples/chart/access/msteams/tests/__snapshot__/configmap_test.yaml.snap +++ b/examples/chart/access/msteams/tests/__snapshot__/configmap_test.yaml.snap @@ -29,6 +29,6 @@ should match the snapshot: app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-msteams - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-msteams-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-msteams-17.0.0-alpha.1 name: RELEASE-NAME-teleport-plugin-msteams diff --git a/examples/chart/access/msteams/tests/__snapshot__/deployment_test.yaml.snap b/examples/chart/access/msteams/tests/__snapshot__/deployment_test.yaml.snap index 0c95e9d24e3ff..b97948014a684 100644 --- a/examples/chart/access/msteams/tests/__snapshot__/deployment_test.yaml.snap +++ b/examples/chart/access/msteams/tests/__snapshot__/deployment_test.yaml.snap @@ -7,8 +7,8 @@ should match the snapshot: app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-msteams - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-msteams-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-msteams-17.0.0-alpha.1 name: RELEASE-NAME-teleport-plugin-msteams spec: replicas: 1 @@ -22,8 +22,8 @@ should match the snapshot: app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-msteams - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-msteams-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-msteams-17.0.0-alpha.1 spec: containers: - command: diff --git a/examples/chart/access/pagerduty/Chart.yaml b/examples/chart/access/pagerduty/Chart.yaml index 711acf2fa83e8..1071c1d60e095 100644 --- a/examples/chart/access/pagerduty/Chart.yaml +++ b/examples/chart/access/pagerduty/Chart.yaml @@ -1,4 +1,4 @@ -.version: &version "17.0.0-dev" +.version: &version "17.0.0-alpha.1" apiVersion: v2 name: teleport-plugin-pagerduty diff --git a/examples/chart/access/pagerduty/tests/__snapshot__/configmap_test.yaml.snap b/examples/chart/access/pagerduty/tests/__snapshot__/configmap_test.yaml.snap index 64083c3642b5c..af85c7ab89a25 100644 --- a/examples/chart/access/pagerduty/tests/__snapshot__/configmap_test.yaml.snap +++ b/examples/chart/access/pagerduty/tests/__snapshot__/configmap_test.yaml.snap @@ -21,6 +21,6 @@ should match the snapshot (smtp on): app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-pagerduty - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-pagerduty-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-pagerduty-17.0.0-alpha.1 name: RELEASE-NAME-teleport-plugin-pagerduty diff --git a/examples/chart/access/pagerduty/tests/__snapshot__/deployment_test.yaml.snap b/examples/chart/access/pagerduty/tests/__snapshot__/deployment_test.yaml.snap index c44a3284ccc85..238f63d349545 100644 --- a/examples/chart/access/pagerduty/tests/__snapshot__/deployment_test.yaml.snap +++ b/examples/chart/access/pagerduty/tests/__snapshot__/deployment_test.yaml.snap @@ -7,8 +7,8 @@ should match the snapshot: app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-pagerduty - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-pagerduty-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-pagerduty-17.0.0-alpha.1 name: RELEASE-NAME-teleport-plugin-pagerduty spec: replicas: 1 @@ -22,8 +22,8 @@ should match the snapshot: app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-pagerduty - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-pagerduty-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-pagerduty-17.0.0-alpha.1 spec: containers: - command: diff --git a/examples/chart/access/slack/Chart.yaml b/examples/chart/access/slack/Chart.yaml index d295bc30b3f90..fa78dc97ca546 100644 --- a/examples/chart/access/slack/Chart.yaml +++ b/examples/chart/access/slack/Chart.yaml @@ -1,4 +1,4 @@ -.version: &version "17.0.0-dev" +.version: &version "17.0.0-alpha.1" apiVersion: v2 name: teleport-plugin-slack diff --git a/examples/chart/access/slack/tests/__snapshot__/configmap_test.yaml.snap b/examples/chart/access/slack/tests/__snapshot__/configmap_test.yaml.snap index 78e6b06bb439a..ad53a6103a04b 100644 --- a/examples/chart/access/slack/tests/__snapshot__/configmap_test.yaml.snap +++ b/examples/chart/access/slack/tests/__snapshot__/configmap_test.yaml.snap @@ -24,6 +24,6 @@ should match the snapshot: app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-slack - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-slack-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-slack-17.0.0-alpha.1 name: RELEASE-NAME-teleport-plugin-slack diff --git a/examples/chart/access/slack/tests/__snapshot__/deployment_test.yaml.snap b/examples/chart/access/slack/tests/__snapshot__/deployment_test.yaml.snap index d19f3c2783750..965ad8367f3ed 100644 --- a/examples/chart/access/slack/tests/__snapshot__/deployment_test.yaml.snap +++ b/examples/chart/access/slack/tests/__snapshot__/deployment_test.yaml.snap @@ -7,8 +7,8 @@ should match the snapshot: app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-slack - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-slack-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-slack-17.0.0-alpha.1 name: RELEASE-NAME-teleport-plugin-slack spec: replicas: 1 @@ -22,8 +22,8 @@ should match the snapshot: app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-slack - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-slack-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-slack-17.0.0-alpha.1 spec: containers: - command: diff --git a/examples/chart/event-handler/Chart.yaml b/examples/chart/event-handler/Chart.yaml index 7eaacdb7f530b..02c39562276a0 100644 --- a/examples/chart/event-handler/Chart.yaml +++ b/examples/chart/event-handler/Chart.yaml @@ -1,4 +1,4 @@ -.version: &version "17.0.0-dev" +.version: &version "17.0.0-alpha.1" apiVersion: v2 name: teleport-plugin-event-handler diff --git a/examples/chart/event-handler/tests/__snapshot__/configmap_test.yaml.snap b/examples/chart/event-handler/tests/__snapshot__/configmap_test.yaml.snap index 4d0b7a15e3ad0..19c0d6850e499 100644 --- a/examples/chart/event-handler/tests/__snapshot__/configmap_test.yaml.snap +++ b/examples/chart/event-handler/tests/__snapshot__/configmap_test.yaml.snap @@ -26,6 +26,6 @@ should match the snapshot: app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-event-handler - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-event-handler-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-event-handler-17.0.0-alpha.1 name: RELEASE-NAME-teleport-plugin-event-handler diff --git a/examples/chart/event-handler/tests/__snapshot__/deployment_test.yaml.snap b/examples/chart/event-handler/tests/__snapshot__/deployment_test.yaml.snap index d7a6dc7a36b7a..9f869e6e7ed39 100644 --- a/examples/chart/event-handler/tests/__snapshot__/deployment_test.yaml.snap +++ b/examples/chart/event-handler/tests/__snapshot__/deployment_test.yaml.snap @@ -7,8 +7,8 @@ should match the snapshot: app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-plugin-event-handler - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-plugin-event-handler-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-plugin-event-handler-17.0.0-alpha.1 name: RELEASE-NAME-teleport-plugin-event-handler spec: replicas: 1 @@ -82,7 +82,7 @@ should mount tls.existingCASecretName and set environment when set in values: value: "true" - name: SSL_CERT_FILE value: /etc/teleport-tls-ca/ca.pem - image: public.ecr.aws/gravitational/teleport-plugin-event-handler:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-plugin-event-handler:17.0.0-alpha.1 imagePullPolicy: IfNotPresent name: teleport-plugin-event-handler ports: diff --git a/examples/chart/tbot/Chart.yaml b/examples/chart/tbot/Chart.yaml index 5371135557a01..ed8bc1c6e9f44 100644 --- a/examples/chart/tbot/Chart.yaml +++ b/examples/chart/tbot/Chart.yaml @@ -1,4 +1,4 @@ -.version: &version "17.0.0-dev" +.version: &version "17.0.0-alpha.1" name: tbot apiVersion: v2 diff --git a/examples/chart/tbot/tests/__snapshot__/deployment_test.yaml.snap b/examples/chart/tbot/tests/__snapshot__/deployment_test.yaml.snap index d615816877e63..7b794dc01e902 100644 --- a/examples/chart/tbot/tests/__snapshot__/deployment_test.yaml.snap +++ b/examples/chart/tbot/tests/__snapshot__/deployment_test.yaml.snap @@ -29,7 +29,7 @@ should match the snapshot (full): app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: tbot - helm.sh/chart: tbot-17.0.0-dev + helm.sh/chart: tbot-17.0.0-alpha.1 test-key: test-label-pod spec: affinity: @@ -68,7 +68,7 @@ should match the snapshot (full): value: "1" - name: TEST_ENV value: test-value - image: public.ecr.aws/gravitational/tbot-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/tbot-distroless:17.0.0-alpha.1 imagePullPolicy: Always livenessProbe: failureThreshold: 6 @@ -154,7 +154,7 @@ should match the snapshot (simple): app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: tbot - helm.sh/chart: tbot-17.0.0-dev + helm.sh/chart: tbot-17.0.0-alpha.1 spec: containers: - args: @@ -176,7 +176,7 @@ should match the snapshot (simple): fieldPath: spec.nodeName - name: KUBERNETES_TOKEN_PATH value: /var/run/secrets/tokens/join-sa-token - image: public.ecr.aws/gravitational/tbot-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/tbot-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 diff --git a/examples/chart/teleport-cluster/Chart.yaml b/examples/chart/teleport-cluster/Chart.yaml index ea212b038a5d4..030eacf17ca67 100644 --- a/examples/chart/teleport-cluster/Chart.yaml +++ b/examples/chart/teleport-cluster/Chart.yaml @@ -1,4 +1,4 @@ -.version: &version "17.0.0-dev" +.version: &version "17.0.0-alpha.1" name: teleport-cluster apiVersion: v2 diff --git a/examples/chart/teleport-cluster/charts/teleport-operator/Chart.yaml b/examples/chart/teleport-cluster/charts/teleport-operator/Chart.yaml index 36e7fe2312354..1f4498fa75be8 100644 --- a/examples/chart/teleport-cluster/charts/teleport-operator/Chart.yaml +++ b/examples/chart/teleport-cluster/charts/teleport-operator/Chart.yaml @@ -1,4 +1,4 @@ -.version: &version "17.0.0-dev" +.version: &version "17.0.0-alpha.1" name: teleport-operator apiVersion: v2 diff --git a/examples/chart/teleport-cluster/tests/__snapshot__/auth_clusterrole_test.yaml.snap b/examples/chart/teleport-cluster/tests/__snapshot__/auth_clusterrole_test.yaml.snap index 81a2e28b7c823..bce441a4a8db3 100644 --- a/examples/chart/teleport-cluster/tests/__snapshot__/auth_clusterrole_test.yaml.snap +++ b/examples/chart/teleport-cluster/tests/__snapshot__/auth_clusterrole_test.yaml.snap @@ -8,8 +8,8 @@ adds operator permissions to ClusterRole: app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-cluster - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-cluster-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-cluster-17.0.0-alpha.1 teleport.dev/majorVersion: "17" name: RELEASE-NAME rules: diff --git a/examples/chart/teleport-cluster/tests/__snapshot__/auth_config_test.yaml.snap b/examples/chart/teleport-cluster/tests/__snapshot__/auth_config_test.yaml.snap index bff9e2a397a73..08e5d4ecb1fed 100644 --- a/examples/chart/teleport-cluster/tests/__snapshot__/auth_config_test.yaml.snap +++ b/examples/chart/teleport-cluster/tests/__snapshot__/auth_config_test.yaml.snap @@ -1848,8 +1848,8 @@ sets clusterDomain on Configmap: app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-cluster - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-cluster-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-cluster-17.0.0-alpha.1 teleport.dev/majorVersion: "17" name: RELEASE-NAME-auth namespace: NAMESPACE diff --git a/examples/chart/teleport-cluster/tests/__snapshot__/auth_deployment_test.yaml.snap b/examples/chart/teleport-cluster/tests/__snapshot__/auth_deployment_test.yaml.snap index 4fef4cd91bf80..e0c5534defb4b 100644 --- a/examples/chart/teleport-cluster/tests/__snapshot__/auth_deployment_test.yaml.snap +++ b/examples/chart/teleport-cluster/tests/__snapshot__/auth_deployment_test.yaml.snap @@ -8,7 +8,7 @@ - args: - --diag-addr=0.0.0.0:3000 - --apply-on-startup=/etc/teleport/apply-on-startup.yaml - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -141,7 +141,7 @@ should set nodeSelector when set in values: - args: - --diag-addr=0.0.0.0:3000 - --apply-on-startup=/etc/teleport/apply-on-startup.yaml - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -238,7 +238,7 @@ should set resources when set in values: - args: - --diag-addr=0.0.0.0:3000 - --apply-on-startup=/etc/teleport/apply-on-startup.yaml - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -324,7 +324,7 @@ should set securityContext when set in values: - args: - --diag-addr=0.0.0.0:3000 - --apply-on-startup=/etc/teleport/apply-on-startup.yaml - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent lifecycle: preStop: diff --git a/examples/chart/teleport-cluster/tests/__snapshot__/proxy_config_test.yaml.snap b/examples/chart/teleport-cluster/tests/__snapshot__/proxy_config_test.yaml.snap index 32830dc1a9d48..38d51dffc5b0a 100644 --- a/examples/chart/teleport-cluster/tests/__snapshot__/proxy_config_test.yaml.snap +++ b/examples/chart/teleport-cluster/tests/__snapshot__/proxy_config_test.yaml.snap @@ -567,8 +567,8 @@ sets clusterDomain on Configmap: app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-cluster - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-cluster-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-cluster-17.0.0-alpha.1 teleport.dev/majorVersion: "17" name: RELEASE-NAME-proxy namespace: NAMESPACE diff --git a/examples/chart/teleport-cluster/tests/__snapshot__/proxy_deployment_test.yaml.snap b/examples/chart/teleport-cluster/tests/__snapshot__/proxy_deployment_test.yaml.snap index 4e3f20a977377..0558a637e6f8e 100644 --- a/examples/chart/teleport-cluster/tests/__snapshot__/proxy_deployment_test.yaml.snap +++ b/examples/chart/teleport-cluster/tests/__snapshot__/proxy_deployment_test.yaml.snap @@ -11,8 +11,8 @@ sets clusterDomain on Deployment Pods: app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-cluster - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-cluster-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-cluster-17.0.0-alpha.1 teleport.dev/majorVersion: "17" name: RELEASE-NAME-proxy namespace: NAMESPACE @@ -26,7 +26,7 @@ sets clusterDomain on Deployment Pods: template: metadata: annotations: - checksum/config: 9ba7ee951511bedbbb6ab297c0b044322b0a39391e801ed8fc3bf44a58f112b9 + checksum/config: 6a020d48133e79edb932ef2d29410a085473593f7951681ea1abdad1630378aa kubernetes.io/pod: test-annotation kubernetes.io/pod-different: 4 labels: @@ -34,8 +34,8 @@ sets clusterDomain on Deployment Pods: app.kubernetes.io/instance: RELEASE-NAME app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: teleport-cluster - app.kubernetes.io/version: 17.0.0-dev - helm.sh/chart: teleport-cluster-17.0.0-dev + app.kubernetes.io/version: 17.0.0-alpha.1 + helm.sh/chart: teleport-cluster-17.0.0-alpha.1 teleport.dev/majorVersion: "17" spec: affinity: @@ -44,7 +44,7 @@ sets clusterDomain on Deployment Pods: containers: - args: - --diag-addr=0.0.0.0:3000 - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -105,7 +105,7 @@ sets clusterDomain on Deployment Pods: - wait - no-resolve - RELEASE-NAME-auth-v16.NAMESPACE.svc.test.com - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 name: wait-auth-update serviceAccountName: RELEASE-NAME-proxy terminationGracePeriodSeconds: 60 @@ -137,7 +137,7 @@ should provision initContainer correctly when set in values: - wait - no-resolve - RELEASE-NAME-auth-v16.NAMESPACE.svc.cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 name: wait-auth-update resources: limits: @@ -201,7 +201,7 @@ should set nodeSelector when set in values: containers: - args: - --diag-addr=0.0.0.0:3000 - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -262,7 +262,7 @@ should set nodeSelector when set in values: - wait - no-resolve - RELEASE-NAME-auth-v16.NAMESPACE.svc.cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 name: wait-auth-update nodeSelector: environment: security @@ -313,7 +313,7 @@ should set resources for wait-auth-update initContainer when set in values: containers: - args: - --diag-addr=0.0.0.0:3000 - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -381,7 +381,7 @@ should set resources for wait-auth-update initContainer when set in values: - wait - no-resolve - RELEASE-NAME-auth-v16.NAMESPACE.svc.cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 name: wait-auth-update resources: limits: @@ -421,7 +421,7 @@ should set resources when set in values: containers: - args: - --diag-addr=0.0.0.0:3000 - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -489,7 +489,7 @@ should set resources when set in values: - wait - no-resolve - RELEASE-NAME-auth-v16.NAMESPACE.svc.cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 name: wait-auth-update resources: limits: @@ -529,7 +529,7 @@ should set securityContext for initContainers when set in values: containers: - args: - --diag-addr=0.0.0.0:3000 - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -597,7 +597,7 @@ should set securityContext for initContainers when set in values: - wait - no-resolve - RELEASE-NAME-auth-v16.NAMESPACE.svc.cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 name: wait-auth-update securityContext: allowPrivilegeEscalation: false @@ -637,7 +637,7 @@ should set securityContext when set in values: containers: - args: - --diag-addr=0.0.0.0:3000 - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -705,7 +705,7 @@ should set securityContext when set in values: - wait - no-resolve - RELEASE-NAME-auth-v16.NAMESPACE.svc.cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 name: wait-auth-update securityContext: allowPrivilegeEscalation: false diff --git a/examples/chart/teleport-kube-agent/Chart.yaml b/examples/chart/teleport-kube-agent/Chart.yaml index a8b88bcc772fb..b233aeb36c8ae 100644 --- a/examples/chart/teleport-kube-agent/Chart.yaml +++ b/examples/chart/teleport-kube-agent/Chart.yaml @@ -1,4 +1,4 @@ -.version: &version "17.0.0-dev" +.version: &version "17.0.0-alpha.1" name: teleport-kube-agent apiVersion: v2 diff --git a/examples/chart/teleport-kube-agent/tests/__snapshot__/deployment_test.yaml.snap b/examples/chart/teleport-kube-agent/tests/__snapshot__/deployment_test.yaml.snap index bee6bf8282eac..65797ad7249ca 100644 --- a/examples/chart/teleport-kube-agent/tests/__snapshot__/deployment_test.yaml.snap +++ b/examples/chart/teleport-kube-agent/tests/__snapshot__/deployment_test.yaml.snap @@ -32,7 +32,7 @@ sets Deployment annotations when specified if action is Upgrade: value: "true" - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -109,7 +109,7 @@ sets Deployment labels when specified if action is Upgrade: value: "true" - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -173,7 +173,7 @@ sets Pod annotations when specified if action is Upgrade: value: "true" - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -237,7 +237,7 @@ sets Pod labels when specified if action is Upgrade: value: "true" - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -322,7 +322,7 @@ should add emptyDir for data when existingDataVolume is not set if action is Upg value: "true" - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -387,7 +387,7 @@ should add insecureSkipProxyTLSVerify to args when set in values if action is Up value: "true" - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -451,7 +451,7 @@ should correctly configure existingDataVolume when set if action is Upgrade: value: "true" - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -513,7 +513,7 @@ should expose diag port if action is Upgrade: value: "true" - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -589,7 +589,7 @@ should have multiple replicas when replicaCount is set (using .replicaCount, dep value: "true" - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -665,7 +665,7 @@ should have multiple replicas when replicaCount is set (using highAvailability.r value: "true" - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -729,7 +729,7 @@ should have one replica when replicaCount is not set if action is Upgrade: value: "true" - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -793,7 +793,7 @@ should mount extraVolumes and extraVolumeMounts if action is Upgrade: value: "true" - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -862,7 +862,7 @@ should mount jamfCredentialsSecret if it already exists and when role is jamf an value: "true" - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -932,7 +932,7 @@ should mount jamfCredentialsSecret.name when role is jamf and action is Upgrade: value: "true" - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -1004,7 +1004,7 @@ should mount tls.existingCASecretName and set environment when set in values if value: cluster.local - name: SSL_CERT_FILE value: /etc/teleport-tls-ca/ca.pem - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -1078,7 +1078,7 @@ should mount tls.existingCASecretName and set extra environment when set in valu value: http://username:password@my.proxy.host:3128 - name: SSL_CERT_FILE value: /etc/teleport-tls-ca/ca.pem - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -1148,7 +1148,7 @@ should provision initContainer correctly when set in values if action is Upgrade value: "true" - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -1270,7 +1270,7 @@ should set affinity when set in values if action is Upgrade: value: "true" - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -1334,7 +1334,7 @@ should set default serviceAccountName when not set in values if action is Upgrad value: "true" - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -1411,7 +1411,7 @@ should set environment when extraEnv set in values if action is Upgrade: value: cluster.local - name: HTTPS_PROXY value: http://username:password@my.proxy.host:3128 - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -1539,7 +1539,7 @@ should set imagePullPolicy when set in values if action is Upgrade: value: "true" - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: Always livenessProbe: failureThreshold: 6 @@ -1603,7 +1603,7 @@ should set nodeSelector if set in values if action is Upgrade: value: "true" - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -1669,7 +1669,7 @@ should set not set priorityClassName when not set in values if action is Upgrade value: "true" - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -1745,7 +1745,7 @@ should set preferred affinity when more than one replica is used if action is Up value: "true" - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -1809,7 +1809,7 @@ should set priorityClassName when set in values if action is Upgrade: value: "true" - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -1874,7 +1874,7 @@ should set probeTimeoutSeconds when set in values if action is Upgrade: value: "true" - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -1948,7 +1948,7 @@ should set required affinity when highAvailability.requireAntiAffinity is set if value: "true" - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -2012,7 +2012,7 @@ should set resources when set in values if action is Upgrade: value: "true" - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -2083,7 +2083,7 @@ should set serviceAccountName when set in values if action is Upgrade: value: "true" - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -2147,7 +2147,7 @@ should set tolerations when set in values if action is Upgrade: value: "true" - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 diff --git a/examples/chart/teleport-kube-agent/tests/__snapshot__/job_test.yaml.snap b/examples/chart/teleport-kube-agent/tests/__snapshot__/job_test.yaml.snap index 5778a68644853..9306cbd62a187 100644 --- a/examples/chart/teleport-kube-agent/tests/__snapshot__/job_test.yaml.snap +++ b/examples/chart/teleport-kube-agent/tests/__snapshot__/job_test.yaml.snap @@ -25,7 +25,7 @@ should create ServiceAccount for post-delete hook by default: fieldPath: metadata.namespace - name: RELEASE_NAME value: RELEASE-NAME - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent name: post-delete-job securityContext: @@ -108,7 +108,7 @@ should not create ServiceAccount for post-delete hook if serviceAccount.create i fieldPath: metadata.namespace - name: RELEASE_NAME value: RELEASE-NAME - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent name: post-delete-job securityContext: @@ -138,7 +138,7 @@ should not create ServiceAccount, Role or RoleBinding for post-delete hook if se fieldPath: metadata.namespace - name: RELEASE_NAME value: RELEASE-NAME - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent name: post-delete-job securityContext: @@ -168,7 +168,7 @@ should set nodeSelector in post-delete hook: fieldPath: metadata.namespace - name: RELEASE_NAME value: RELEASE-NAME - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent name: post-delete-job securityContext: @@ -200,7 +200,7 @@ should set resources in the Job's pod spec if resources is set in values: fieldPath: metadata.namespace - name: RELEASE_NAME value: RELEASE-NAME - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent name: post-delete-job resources: diff --git a/examples/chart/teleport-kube-agent/tests/__snapshot__/statefulset_test.yaml.snap b/examples/chart/teleport-kube-agent/tests/__snapshot__/statefulset_test.yaml.snap index 3a7ced7542085..73ba39c6e61f0 100644 --- a/examples/chart/teleport-kube-agent/tests/__snapshot__/statefulset_test.yaml.snap +++ b/examples/chart/teleport-kube-agent/tests/__snapshot__/statefulset_test.yaml.snap @@ -18,7 +18,7 @@ sets Pod annotations when specified: value: RELEASE-NAME - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -90,7 +90,7 @@ sets Pod labels when specified: value: RELEASE-NAME - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -186,7 +186,7 @@ sets StatefulSet labels when specified: value: RELEASE-NAME - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -290,7 +290,7 @@ should add insecureSkipProxyTLSVerify to args when set in values: value: RELEASE-NAME - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -362,7 +362,7 @@ should add volumeClaimTemplate for data volume when using StatefulSet and action value: RELEASE-NAME - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -454,7 +454,7 @@ should add volumeClaimTemplate for data volume when using StatefulSet and is Fre value: RELEASE-NAME - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -536,7 +536,7 @@ should add volumeMount for data volume when using StatefulSet: value: RELEASE-NAME - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -608,7 +608,7 @@ should expose diag port: value: RELEASE-NAME - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -680,7 +680,7 @@ should generate Statefulset when storage is disabled and mode is a Upgrade: value: RELEASE-NAME - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -766,7 +766,7 @@ should have multiple replicas when replicaCount is set (using .replicaCount, dep value: RELEASE-NAME - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -850,7 +850,7 @@ should have multiple replicas when replicaCount is set (using highAvailability.r value: RELEASE-NAME - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -922,7 +922,7 @@ should have one replica when replicaCount is not set: value: RELEASE-NAME - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -994,7 +994,7 @@ should install Statefulset when storage is disabled and mode is a Fresh Install: value: RELEASE-NAME - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -1068,7 +1068,7 @@ should mount extraVolumes and extraVolumeMounts: value: RELEASE-NAME - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -1145,7 +1145,7 @@ should mount jamfCredentialsSecret if it already exists and when role is jamf: value: RELEASE-NAME - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -1225,7 +1225,7 @@ should mount jamfCredentialsSecret.name when role is jamf: value: RELEASE-NAME - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -1307,7 +1307,7 @@ should mount tls.existingCASecretName and set environment when set in values: value: cluster.local - name: SSL_CERT_FILE value: /etc/teleport-tls-ca/ca.pem - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -1391,7 +1391,7 @@ should mount tls.existingCASecretName and set extra environment when set in valu value: /etc/teleport-tls-ca/ca.pem - name: HTTPS_PROXY value: http://username:password@my.proxy.host:3128 - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -1471,7 +1471,7 @@ should not add emptyDir for data when using StatefulSet: value: RELEASE-NAME - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -1543,7 +1543,7 @@ should provision initContainer correctly when set in values: value: RELEASE-NAME - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -1673,7 +1673,7 @@ should set affinity when set in values: value: RELEASE-NAME - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -1745,7 +1745,7 @@ should set default serviceAccountName when not set in values: value: RELEASE-NAME - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -1830,7 +1830,7 @@ should set environment when extraEnv set in values: value: cluster.local - name: HTTPS_PROXY value: http://username:password@my.proxy.host:3128 - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -1974,7 +1974,7 @@ should set imagePullPolicy when set in values: value: RELEASE-NAME - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: Always livenessProbe: failureThreshold: 6 @@ -2046,7 +2046,7 @@ should set nodeSelector if set in values: value: RELEASE-NAME - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -2132,7 +2132,7 @@ should set preferred affinity when more than one replica is used: value: RELEASE-NAME - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -2204,7 +2204,7 @@ should set probeTimeoutSeconds when set in values: value: RELEASE-NAME - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -2286,7 +2286,7 @@ should set required affinity when highAvailability.requireAntiAffinity is set: value: RELEASE-NAME - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -2358,7 +2358,7 @@ should set resources when set in values: value: RELEASE-NAME - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -2437,7 +2437,7 @@ should set serviceAccountName when set in values: value: RELEASE-NAME - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -2509,7 +2509,7 @@ should set storage.requests when set in values and action is an Upgrade: value: RELEASE-NAME - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -2581,7 +2581,7 @@ should set storage.storageClassName when set in values and action is an Upgrade: value: RELEASE-NAME - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -2653,7 +2653,7 @@ should set tolerations when set in values: value: RELEASE-NAME - name: TELEPORT_KUBE_CLUSTER_DOMAIN value: cluster.local - image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-distroless:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 diff --git a/examples/chart/teleport-kube-agent/tests/__snapshot__/updater_deployment_test.yaml.snap b/examples/chart/teleport-kube-agent/tests/__snapshot__/updater_deployment_test.yaml.snap index a0ad90efdf202..ddb4085148e3c 100644 --- a/examples/chart/teleport-kube-agent/tests/__snapshot__/updater_deployment_test.yaml.snap +++ b/examples/chart/teleport-kube-agent/tests/__snapshot__/updater_deployment_test.yaml.snap @@ -27,7 +27,7 @@ sets the affinity: - --base-image=public.ecr.aws/gravitational/teleport-distroless - --version-server=https://my-custom-version-server/v1 - --version-channel=custom/preview - image: public.ecr.aws/gravitational/teleport-kube-agent-updater:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-kube-agent-updater:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6 @@ -73,7 +73,7 @@ sets the tolerations: - --base-image=public.ecr.aws/gravitational/teleport-distroless - --version-server=https://my-custom-version-server/v1 - --version-channel=custom/preview - image: public.ecr.aws/gravitational/teleport-kube-agent-updater:17.0.0-dev + image: public.ecr.aws/gravitational/teleport-kube-agent-updater:17.0.0-alpha.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 6