Merge branch 'master' into tcsc/ic-role-conditions

.github/ISSUE_TEMPLATE/test-plan-docs.md

@@ -36,11 +36,15 @@ to determine the rollout date.
     git submodule add https://github.com/gravitational/teleport content/<VERSION>.x
     ```
 
-## Is the docs site up to date with the new release?
+## Is the docs site content up to date with the new release?
 
 - [ ] Verify that Teleport version variables are correct and reflect the upcoming
   release. Check `docs/config.json` for this.
 
+- [ ] Ensure that redirects (as configured in `docs/config.json`) only exist for
+  the default version of the docs site, and have been removed from other
+  versions.
+
 - [ ] Remove version warnings in the docs that mention a version we no longer
   support _except_ for the last EOL version. E.g., if we no longer support
   version 10, remove messages saying "You need at least version n to use this

.github/ISSUE_TEMPLATE/webtestplan.md

@@ -175,11 +175,14 @@ All actions should require re-authn with a webauthn device.
 
 Use Discover Wizard to enroll new resources and access them:
 
-- [ ] SSH Server (teleport service, singular EC2, SSM agent)
+- [ ] SSH Server using Teleport Service
 - [ ] Self-Hosted PostgreSQL and Mongo
-- [ ] AWS RDS (singular RDS, auto discover with ECS)
 - [ ] Kubernetes
-- [ ] AWS EKS cluster
+- [ ] Using an AWS OIDC Integration
+  - [ ] EC2 Auto Enrollment (SSM)
+  - [ ] RDS flow: single database
+  - [ ] RDS flow: Auto Enrollment (by VPC)
+  - [ ] EKS Clusters
 - [ ] Non-guided cards link out to correct docs
 
 #### Access Lists

api/client/dynamicwindows/dynamicwindows.go

@@ -46,7 +46,7 @@ func (c *Client) GetDynamicWindowsDesktop(ctx context.Context, name string) (typ
 	return desktop, trace.Wrap(err)
 }
 
-func (c *Client) ListDynamicWindowsDesktop(ctx context.Context, pageSize int, pageToken string) ([]types.DynamicWindowsDesktop, string, error) {
+func (c *Client) ListDynamicWindowsDesktops(ctx context.Context, pageSize int, pageToken string) ([]types.DynamicWindowsDesktop, string, error) {
 	resp, err := c.grpcClient.ListDynamicWindowsDesktops(ctx, &dynamicwindows.ListDynamicWindowsDesktopsRequest{
 		PageSize:  int32(pageSize),
 		PageToken: pageToken,

api/types/autoupdate/config.go

@@ -1,38 +1,31 @@
 /*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
+Copyright 2024 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
 
 package autoupdate
 
 import (
+	"time"
+
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/gen/proto/go/teleport/autoupdate/v1"
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	"github.com/gravitational/teleport/api/types"
 )
 
-const (
-	// ToolsUpdateModeEnabled enables client tools automatic updates.
-	ToolsUpdateModeEnabled = "enabled"
-	// ToolsUpdateModeDisabled disables client tools automatic updates.
-	ToolsUpdateModeDisabled = "disabled"
-)
-
 // NewAutoUpdateConfig creates a new auto update configuration resource.
 func NewAutoUpdateConfig(spec *autoupdate.AutoUpdateConfigSpec) (*autoupdate.AutoUpdateConfig, error) {
 	config := &autoupdate.AutoUpdateConfig{
@@ -66,10 +59,41 @@ func ValidateAutoUpdateConfig(c *autoupdate.AutoUpdateConfig) error {
 		return trace.BadParameter("Spec is nil")
 	}
 	if c.Spec.Tools != nil {
-		if c.Spec.Tools.Mode != ToolsUpdateModeDisabled && c.Spec.Tools.Mode != ToolsUpdateModeEnabled {
-			return trace.BadParameter("ToolsMode is not valid")
+		if err := checkToolsMode(c.Spec.Tools.Mode); err != nil {
+			return trace.Wrap(err, "validating spec.tools.mode")
+		}
+	}
+	if c.Spec.Agents != nil {
+		if err := checkAgentsMode(c.Spec.Agents.Mode); err != nil {
+			return trace.Wrap(err, "validating spec.agents.mode")
+		}
+		if err := checkAgentsStrategy(c.Spec.Agents.Strategy); err != nil {
+			return trace.Wrap(err, "validating spec.agents.strategy")
 		}
+
+		windowDuration := c.Spec.Agents.MaintenanceWindowDuration.AsDuration()
+		if c.Spec.Agents.Strategy == AgentsStrategyHaltOnError && windowDuration != 0 {
+			return trace.BadParameter("spec.agents.maintenance_window_duration must be zero when the strategy is %q", c.Spec.Agents.Strategy)
+		}
+		if c.Spec.Agents.Strategy == AgentsStrategyTimeBased && windowDuration < 10*time.Minute {
+			return trace.BadParameter("spec.agents.maintenance_window_duration must be greater than 10 minutes when the strategy is %q", c.Spec.Agents.Strategy)
+		}
+
+		if err := checkAgentSchedules(c.Spec.Agents.Schedules); err != nil {
+			return trace.Wrap(err, "validating spec.agents.schedules")
+		}
+
 	}
 
 	return nil
 }
+
+func checkAgentSchedules(schedules *autoupdate.AgentAutoUpdateSchedules) error {
+	// TODO: change this logic when we implement group support.
+	// Currently we reject any non-nil schedule
+	// When we'll implement schedule support, we'll treat an empty schedule as the default schedule.
+	if schedules == nil {
+		return nil
+	}
+	return trace.NotImplemented("agent schedules are not implemented yet")
+}

api/types/autoupdate/config_test.go

@@ -1,29 +1,29 @@
 /*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
+Copyright 2024 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
 
 package autoupdate
 
 import (
 	"testing"
+	"time"
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/protobuf/testing/protocmp"
+	"google.golang.org/protobuf/types/known/durationpb"
 
 	"github.com/gravitational/teleport/api/gen/proto/go/teleport/autoupdate/v1"
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
@@ -99,7 +99,121 @@ func TestNewAutoUpdateConfig(t *testing.T) {
 				},
 			},
 			assertErr: func(t *testing.T, err error, a ...any) {
-				require.ErrorContains(t, err, "ToolsMode is not valid")
+				require.ErrorContains(t, err, "unsupported tools mode: \"invalid-mode\"")
+			},
+		},
+		{
+			name: "invalid agents mode",
+			spec: &autoupdate.AutoUpdateConfigSpec{
+				Agents: &autoupdate.AutoUpdateConfigSpecAgents{
+					Mode:     "invalid-mode",
+					Strategy: AgentsStrategyHaltOnError,
+				},
+			},
+			assertErr: func(t *testing.T, err error, a ...any) {
+				require.ErrorContains(t, err, "unsupported agents mode: \"invalid-mode\"")
+			},
+		},
+		{
+			name: "invalid agents strategy",
+			spec: &autoupdate.AutoUpdateConfigSpec{
+				Agents: &autoupdate.AutoUpdateConfigSpecAgents{
+					Mode:     AgentsUpdateModeEnabled,
+					Strategy: "invalid-strategy",
+				},
+			},
+			assertErr: func(t *testing.T, err error, a ...any) {
+				require.ErrorContains(t, err, "unsupported agents strategy: \"invalid-strategy\"")
+			},
+		},
+		{
+			name: "invalid agents non-nil maintenance window with halt-on-error",
+			spec: &autoupdate.AutoUpdateConfigSpec{
+				Agents: &autoupdate.AutoUpdateConfigSpecAgents{
+					Mode:                      AgentsUpdateModeEnabled,
+					Strategy:                  AgentsStrategyHaltOnError,
+					MaintenanceWindowDuration: durationpb.New(time.Hour),
+				},
+			},
+			assertErr: func(t *testing.T, err error, a ...any) {
+				require.ErrorContains(t, err, "maintenance_window_duration must be zero")
+			},
+		},
+		{
+			name: "invalid agents nil maintenance window with time-based strategy",
+			spec: &autoupdate.AutoUpdateConfigSpec{
+				Agents: &autoupdate.AutoUpdateConfigSpecAgents{
+					Mode:     AgentsUpdateModeEnabled,
+					Strategy: AgentsStrategyTimeBased,
+				},
+			},
+			assertErr: func(t *testing.T, err error, a ...any) {
+				require.ErrorContains(t, err, "maintenance_window_duration must be greater than 10 minutes")
+			},
+		},
+		{
+			name: "invalid agents short maintenance window",
+			spec: &autoupdate.AutoUpdateConfigSpec{
+				Agents: &autoupdate.AutoUpdateConfigSpecAgents{
+					Mode:                      AgentsUpdateModeEnabled,
+					Strategy:                  AgentsStrategyTimeBased,
+					MaintenanceWindowDuration: durationpb.New(time.Minute),
+				},
+			},
+			assertErr: func(t *testing.T, err error, a ...any) {
+				require.ErrorContains(t, err, "maintenance_window_duration must be greater than 10 minutes")
+			},
+		},
+		{
+			name: "success agents autoupdate halt-on-failure",
+			spec: &autoupdate.AutoUpdateConfigSpec{
+				Agents: &autoupdate.AutoUpdateConfigSpecAgents{
+					Mode:     AgentsUpdateModeEnabled,
+					Strategy: AgentsStrategyHaltOnError,
+				},
+			},
+			assertErr: func(t *testing.T, err error, a ...any) {
+				require.NoError(t, err)
+			},
+			want: &autoupdate.AutoUpdateConfig{
+				Kind:    types.KindAutoUpdateConfig,
+				Version: types.V1,
+				Metadata: &headerv1.Metadata{
+					Name: types.MetaNameAutoUpdateConfig,
+				},
+				Spec: &autoupdate.AutoUpdateConfigSpec{
+					Agents: &autoupdate.AutoUpdateConfigSpecAgents{
+						Mode:     AgentsUpdateModeEnabled,
+						Strategy: AgentsStrategyHaltOnError,
+					},
+				},
+			},
+		},
+		{
+			name: "success agents autoupdate time-based",
+			spec: &autoupdate.AutoUpdateConfigSpec{
+				Agents: &autoupdate.AutoUpdateConfigSpecAgents{
+					Mode:                      AgentsUpdateModeEnabled,
+					Strategy:                  AgentsStrategyTimeBased,
+					MaintenanceWindowDuration: durationpb.New(time.Hour),
+				},
+			},
+			assertErr: func(t *testing.T, err error, a ...any) {
+				require.NoError(t, err)
+			},
+			want: &autoupdate.AutoUpdateConfig{
+				Kind:    types.KindAutoUpdateConfig,
+				Version: types.V1,
+				Metadata: &headerv1.Metadata{
+					Name: types.MetaNameAutoUpdateConfig,
+				},
+				Spec: &autoupdate.AutoUpdateConfigSpec{
+					Agents: &autoupdate.AutoUpdateConfigSpecAgents{
+						Mode:                      AgentsUpdateModeEnabled,
+						Strategy:                  AgentsStrategyTimeBased,
+						MaintenanceWindowDuration: durationpb.New(time.Hour),
+					},
+				},
 			},
 		},
 	}

api/types/autoupdate/constants.go

@@ -0,0 +1,46 @@
+/*
+Copyright 2024 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package autoupdate
+
+const (
+	// ToolsUpdateModeEnabled enables client tools automatic updates.
+	ToolsUpdateModeEnabled = "enabled"
+	// ToolsUpdateModeDisabled disables client tools automatic updates.
+	ToolsUpdateModeDisabled = "disabled"
+
+	// AgentsUpdateModeEnabled enabled agent automatic updates.
+	AgentsUpdateModeEnabled = "enabled"
+	// AgentsUpdateModeDisabled disables agent automatic updates.
+	AgentsUpdateModeDisabled = "disabled"
+	// AgentsUpdateModeSuspended temporarily suspends agent automatic updates.
+	AgentsUpdateModeSuspended = "suspended"
+
+	// AgentsScheduleRegular is the regular agent update schedule.
+	AgentsScheduleRegular = "regular"
+	// AgentsScheduleImmediate is the immediate agent update schedule.
+	// Every agent must update immediately if it's not already running the target version.
+	// This can be used to recover agents in case of major incident or actively exploited vulnerability.
+	AgentsScheduleImmediate = "immediate"
+
+	// AgentsStrategyHaltOnError is the agent update strategy that updates groups sequentially
+	// according to their order in the schedule. The previous groups must succeed.
+	AgentsStrategyHaltOnError = "halt-on-error"
+	// AgentsStrategyTimeBased is the agent update strategy that updates groups solely based on their
+	// maintenance window. There is no dependency between groups. Agents won't be instructed to update
+	// if the window is over.
+	AgentsStrategyTimeBased = "time-based"
+)