Skip to content

Support for joining Actions in un-reachable GitHub Enterprise Servers via Static JWKS #48973

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 8 commits into from
Nov 15, 2024

Conversation

strideynet
Copy link
Contributor

@strideynet strideynet commented Nov 14, 2024

Closes #30831

changelog: Added support for directly configuring JWKS for GitHub joining for circumstances where the GHES is not reachable by the Teleport Auth Service.

Copy link

🤖 Vercel preview here: https://docs-4gtklpkkt-goteleport.vercel.app/docs/ver/preview

Copy link
Contributor

@hugoShaka hugoShaka left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's interesting how we are adding static JWK for unreachable github enterprise, and dynamic fetching JWKS for EKS clusters with short-lived key-sets 😅

I suppose we'll need to do both each time now.

Do we know how often GHE rotates its JWKS?

Copy link

🤖 Vercel preview here: https://docs-5yx8ks8v7-goteleport.vercel.app/docs/ver/preview

Copy link
Contributor

@tigrato tigrato left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would like to see static_jwks being marshaled as structpb because json in strings doesn't marshal well

Copy link

🤖 Vercel preview here: https://docs-4pq2hkhtp-goteleport.vercel.app/docs/ver/preview

@strideynet strideynet added this pull request to the merge queue Nov 15, 2024
Merged via the queue into master with commit c72a4f2 Nov 15, 2024
43 checks passed
@strideynet strideynet deleted the strideynet/ghes-static-jwks branch November 15, 2024 12:52
@public-teleport-github-review-bot

@strideynet See the table below for backport results.

Branch Result
branch/v15 Failed
branch/v16 Failed
branch/v17 Create PR

strideynet added a commit that referenced this pull request Nov 15, 2024
… via Static JWKS (#48973)

* Add JWKS based validator for github tokens

* Extend proto

* Update auth srvr github join impl to support static jwks

* Ignore govet

* initialize with jwks validator

* Update docs

* Update terraform shizz

* Regenerate various things
ptgott pushed a commit that referenced this pull request Nov 15, 2024
… via Static JWKS (#48973)

* Add JWKS based validator for github tokens

* Extend proto

* Update auth srvr github join impl to support static jwks

* Ignore govet

* initialize with jwks validator

* Update docs

* Update terraform shizz

* Regenerate various things
github-merge-queue bot pushed a commit that referenced this pull request Nov 18, 2024
…ervers via Static JWKS (#48973) (#49052)

* Support for joining Actions in un-reachable GitHub Enterprise Servers via Static JWKS (#48973)

* Add JWKS based validator for github tokens

* Extend proto

* Update auth srvr github join impl to support static jwks

* Ignore govet

* initialize with jwks validator

* Update docs

* Update terraform shizz

* Regenerate various things

* Fix key generation
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Machine ID: GitLab/GitHub joining when the instance is not accessible to Auth Server
3 participants