Add webapi v2 endpoints for creating discovery token and enrolling eks with labels #50472

kimlisa · 2024-12-20T07:17:19Z

The endpoint for creating a token for discovery flow now allows user defined labels to be set as part of suggested_labels (this PR)
The endpoint for enrolling eks clusters recently added ability to add user defined labels as extraLabels (Discover EKS: allow custom labels for Kube Server #49420)

Both scenarios if a user tries to create token/resource and provides labels, if requests goes to an older proxy, it'll look like the request succeeded but the labels will not have been set. So this PR defines v2 endpoints, so that if request goes to an older proxy, a 404 error will return, which we will assume it's because of version mismatch.

This PR also returns the version number of proxy when a route wasn't matched.

Rendered example of route not matched 404 error:

if proxyVersion is returned:

if proxyVersion is not returned:

kimlisa · 2024-12-20T07:24:51Z

~~we do set version with app hash as a etag on the response headers for app.js, but I wasn't sure how to actually extract that, so I opted for a simpler meta tag that just stores the version instead~~

lib/web/apiserver.go

web/packages/teleport/src/services/webUiVersion/webUiVersion.ts

zmb3 · 2024-12-23T16:37:09Z

I'm not sure pulling the version from the HTML document makes sense here.

If a user runs into this error, it's because they have a newer web UI that knows how to use the new V2 endpoint with labels, but they ended up hitting an older proxy that doesn't know how to handle the request.

If you show them the version from the HTML document, you're going to show them the newer web UI version, which is actually new enough.

If we want this error message to make sense, we need to show the version of the proxy that is too old. (This means we probably need the backend to surface this information)

lib/web/apiserver.go

kimlisa · 2025-01-02T18:50:37Z

lib/client/https_client.go

@@ -62,7 +61,7 @@ func httpTransport(insecure bool, pool *x509.CertPool) *http.Transport {

 func NewWebClient(url string, opts ...roundtrip.ClientParam) (*WebClient, error) {
 	opts = append(opts, roundtrip.SanitizerEnabled(true))
-	clt, err := roundtrip.NewClient(url, teleport.WebAPIVersion, opts...)
+	clt, err := roundtrip.NewClient(url, "", opts...)


The version parameter refers to this field, and from what i can tell, its only purpose is to just append the version prefix when calling this function (which we use a lot in our tests, and in auth here)

I didn't think it was necessary to define the version, since we are just going to strip it off anyways, and it wouldn't work with v2 endpoints

If we are sure that we wont be using the version anymore, I think creating a v2 roundtrip.NewClientV2 function and then deprecating current one would be better here.

hrm, i could, but I am not sure I see a benefit of keeping the deprecated one?

The benefit of introducing v2 is that you wont have to refactor existing usage of roundtrip.NewClient in this PR.

Edit: I am not aware about current usage of roundtrip.NewClient so you might actually get away with that change without introducing v2 in this PR if that will be minimal, up to you.

lib/client/https_client.go

flyinghermit · 2025-01-06T15:17:04Z

lib/client/https_client.go

@@ -62,7 +61,7 @@ func httpTransport(insecure bool, pool *x509.CertPool) *http.Transport {

 func NewWebClient(url string, opts ...roundtrip.ClientParam) (*WebClient, error) {
 	opts = append(opts, roundtrip.SanitizerEnabled(true))
-	clt, err := roundtrip.NewClient(url, teleport.WebAPIVersion, opts...)
+	clt, err := roundtrip.NewClient(url, "", opts...)


If we are sure that we wont be using the version anymore, I think creating a v2 roundtrip.NewClientV2 function and then deprecating current one would be better here.

lib/httplib/httplib.go

flyinghermit · 2025-01-06T15:29:50Z

lib/web/apiserver.go

 	h.POST("/webapi/sites/:site/integrations/aws-oidc/:name/enrolleksclusters", h.WithClusterAuth(h.awsOIDCEnrollEKSClusters))
+	h.POST("/v2/webapi/sites/:site/integrations/aws-oidc/:name/enrolleksclusters", h.WithClusterAuth(h.awsOIDCEnrollEKSClusters))


nit: from endpoint organization perspective - Instead of mixing v1 and v2 endpoints here, what do you think of creating v2 endpoint method func (h *Handler) bindV2Endpoints() {}? See https://github.com/gravitational/teleport/blob/master/lib/web/apiserver.go#L758 for current bindDefaultEndpoints method for reference.

I do not have a strong preference either way but feel like separation will make it more cleaner as number of v2 grows.

i'll leave it as is, b/c we tend to group similar endpoints together and i think the binding method will separate them

lib/web/apiserver.go

lib/httplib/httplib.go

flyinghermit · 2025-01-07T14:49:34Z

lib/auth/trustedcluster.go

@@ -679,7 +679,7 @@ func (a *Server) sendValidateRequestToProxy(ctx context.Context, host string, va
 		opts = append(opts, roundtrip.HTTPClient(insecureWebClient))
 	}

-	clt, err := roundtrip.NewClient(proxyAddr.String(), teleport.WebAPIVersion, opts...)
+	clt, err := roundtrip.NewClient(proxyAddr.String(), "", opts...)


Umm based on discussion here #50472 (comment), I thought we are going to either add a roundtrip.NewClientV2 or update its current signature since we no longer use version field?

recording slack discussion: agreed to not change signature since using client.go/NewWebClient introduced cyclic imports in tests, instead put comment explaining why version is empty

lib/httplib/httplib.go

lib/web/apiserver.go

flyinghermit · 2025-01-07T15:07:58Z

lib/web/apiserver_test.go

+				require.True(t, trace.IsNotFound(err))
+
+				var rawObjMap map[string]*json.RawMessage
+				require.NoError(t, json.Unmarshal(re.Bytes(), &rawObjMap))


nit: unmarshal it once, check for error and then reuse the unmarshalled object in test below in line 3519, 3523.

i think this is what you meant below, and then access the fields?

var traceErr trace.TraceError require.NoError(t, json.Unmarshal(re.Bytes(), &traceErr))

if so, I couldn't do it this way because the returned JSON error didn't conform exactly to TraceError type (I ran into errors unmarshaling), so I had to manually unmarshal per field I wanted to test

lib/web/apiserver_test.go

lib/web/apiserver.go

flyinghermit · 2025-01-07T20:38:15Z

lib/web/apiserver_test_utils.go

@@ -29,10 +29,14 @@ import (
 )

 // NewDebugFileSystem returns the HTTP file system implementation
-func newDebugFileSystem() (http.FileSystem, error) {
+func NewDebugFileSystem(isEnterprise bool) (http.FileSystem, error) {


Does it need to be exported?

i forgot to push the branch that required this change in enterprise: https://github.com/gravitational/teleport.e/pull/5818, i added a enterprise not found handler test there (just in case...)

flyinghermit · 2025-01-07T20:51:19Z

lib/web/apiserver_test.go

+		Allow: types.RoleConditions{
+			Rules: []types.Rule{
+				types.NewRule(types.KindToken,
+					[]string{types.VerbCreate, types.VerbRead}),


is types.VerbRead needed? comment above only says "Allow user to create tokens."

public-teleport-github-review-bot · 2025-01-09T20:20:49Z

@kimlisa See the table below for backport results.

Branch	Result
branch/v16	Failed
branch/v17	Create PR

github-actions bot added size/md ui labels Dec 20, 2024

github-actions bot requested review from avatus and gzdunek December 20, 2024 07:17

kimlisa requested review from flyinghermit and removed request for avatus December 20, 2024 07:17

kimlisa changed the title ~~Lisa/add v2 endpoint~~ Add webapi v2 endpoints for creating discovery token and enrolling eks with labels Dec 20, 2024

kimlisa added the backport/branch/v17 label Dec 20, 2024

kimlisa force-pushed the lisa/add-v2-endpoint branch from b51dded to 0a6aebc Compare December 20, 2024 07:21

kimlisa requested a review from marcoandredinis December 20, 2024 07:26

tigrato reviewed Dec 20, 2024

View reviewed changes

lib/web/apiserver.go Show resolved Hide resolved

gzdunek reviewed Dec 23, 2024

View reviewed changes

zmb3 reviewed Dec 23, 2024

View reviewed changes

web/packages/teleport/src/services/webUiVersion/webUiVersion.ts Outdated Show resolved Hide resolved

kimlisa force-pushed the lisa/add-v2-endpoint branch from 4db33f1 to 15a7e75 Compare December 30, 2024 07:57

kimlisa mentioned this pull request Dec 30, 2024

WebDiscover: allow custom labels for single resource enroll (server, kube, eks, rds) #50606

Merged

5 tasks

kimlisa force-pushed the lisa/add-v2-endpoint branch from 15a7e75 to 0729ad9 Compare December 31, 2024 22:57

kimlisa added backport/branch/v16 no-changelog Indicates that a PR does not require a changelog entry labels Dec 31, 2024

kimlisa marked this pull request as draft December 31, 2024 23:33

kimlisa force-pushed the lisa/add-v2-endpoint branch 4 times, most recently from 410b710 to 538b042 Compare January 2, 2025 18:41

kimlisa commented Jan 2, 2025

View reviewed changes

lib/web/apiserver.go Outdated Show resolved Hide resolved

kimlisa commented Jan 2, 2025

View reviewed changes

kimlisa force-pushed the lisa/add-v2-endpoint branch from 538b042 to c6d7694 Compare January 2, 2025 18:58

kimlisa marked this pull request as ready for review January 2, 2025 19:20

github-actions bot requested a review from ryanclark January 2, 2025 19:21

avatus self-requested a review January 3, 2025 21:06

kimlisa requested a review from gzdunek January 3, 2025 22:12

kimlisa force-pushed the lisa/add-v2-endpoint branch from 67c5614 to fb39fee Compare January 3, 2025 22:44

avatus approved these changes Jan 6, 2025

View reviewed changes

marcoandredinis removed their request for review January 6, 2025 15:53

flyinghermit reviewed Jan 6, 2025

View reviewed changes

kimlisa force-pushed the lisa/add-v2-endpoint branch from fb39fee to bc43b78 Compare January 7, 2025 09:08

kimlisa requested a review from flyinghermit January 7, 2025 09:11

flyinghermit reviewed Jan 7, 2025

View reviewed changes

kimlisa force-pushed the lisa/add-v2-endpoint branch from 98edc7c to 9ec4fbd Compare January 7, 2025 20:07

kimlisa requested a review from flyinghermit January 7, 2025 20:07

kimlisa force-pushed the lisa/add-v2-endpoint branch from 9ec4fbd to 3f04271 Compare January 7, 2025 20:36

flyinghermit approved these changes Jan 7, 2025

View reviewed changes

public-teleport-github-review-bot bot removed the request for review from ryanclark January 7, 2025 20:58

kimlisa force-pushed the lisa/add-v2-endpoint branch 2 times, most recently from 852387b to 7518029 Compare January 9, 2025 18:34

kimlisa enabled auto-merge January 9, 2025 18:34

kimlisa disabled auto-merge January 9, 2025 18:36

Create v2 web api endpoints and required related changes

ef0eb7c

kimlisa force-pushed the lisa/add-v2-endpoint branch from 7518029 to ef0eb7c Compare January 9, 2025 19:16

kimlisa enabled auto-merge January 9, 2025 19:17

kimlisa added this pull request to the merge queue Jan 9, 2025

github-merge-queue bot removed this pull request from the merge queue due to failed status checks Jan 9, 2025

kimlisa added this pull request to the merge queue Jan 9, 2025

Merged via the queue into master with commit d5409cb Jan 9, 2025
45 checks passed

kimlisa deleted the lisa/add-v2-endpoint branch January 9, 2025 20:19

kimlisa mentioned this pull request Jan 9, 2025

Fix enterprise webassets path for testing #50927

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add webapi v2 endpoints for creating discovery token and enrolling eks with labels #50472

Add webapi v2 endpoints for creating discovery token and enrolling eks with labels #50472

kimlisa commented Dec 20, 2024 •

edited

Loading

kimlisa commented Dec 20, 2024 •

edited

Loading

zmb3 commented Dec 23, 2024 •

edited

Loading

kimlisa Jan 2, 2025 •

edited

Loading

flyinghermit Jan 6, 2025

kimlisa Jan 6, 2025

flyinghermit Jan 7, 2025 •

edited

Loading

flyinghermit Jan 6, 2025

flyinghermit Jan 6, 2025

kimlisa Jan 7, 2025

flyinghermit Jan 7, 2025

kimlisa Jan 7, 2025

flyinghermit Jan 7, 2025

kimlisa Jan 7, 2025

flyinghermit Jan 7, 2025

kimlisa Jan 9, 2025

flyinghermit Jan 7, 2025

public-teleport-github-review-bot bot commented Jan 9, 2025

		h.POST("/webapi/sites/:site/integrations/aws-oidc/:name/enrolleksclusters", h.WithClusterAuth(h.awsOIDCEnrollEKSClusters))
		h.POST("/v2/webapi/sites/:site/integrations/aws-oidc/:name/enrolleksclusters", h.WithClusterAuth(h.awsOIDCEnrollEKSClusters))

Add webapi v2 endpoints for creating discovery token and enrolling eks with labels #50472

Add webapi v2 endpoints for creating discovery token and enrolling eks with labels #50472

Conversation

kimlisa commented Dec 20, 2024 • edited Loading

kimlisa commented Dec 20, 2024 • edited Loading

zmb3 commented Dec 23, 2024 • edited Loading

kimlisa Jan 2, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

flyinghermit Jan 7, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

public-teleport-github-review-bot bot commented Jan 9, 2025

kimlisa commented Dec 20, 2024 •

edited

Loading

kimlisa commented Dec 20, 2024 •

edited

Loading

zmb3 commented Dec 23, 2024 •

edited

Loading

kimlisa Jan 2, 2025 •

edited

Loading

flyinghermit Jan 7, 2025 •

edited

Loading