Merge branch 'master' into probakowski/register-resources-discovery

.github/ISSUE_TEMPLATE/webtestplan.md

@@ -175,11 +175,14 @@ All actions should require re-authn with a webauthn device.
 
 Use Discover Wizard to enroll new resources and access them:
 
-- [ ] SSH Server (teleport service, singular EC2, SSM agent)
+- [ ] SSH Server using Teleport Service
 - [ ] Self-Hosted PostgreSQL and Mongo
-- [ ] AWS RDS (singular RDS, auto discover with ECS)
 - [ ] Kubernetes
-- [ ] AWS EKS cluster
+- [ ] Using an AWS OIDC Integration
+  - [ ] EC2 Auto Enrollment (SSM)
+  - [ ] RDS flow: single database
+  - [ ] RDS flow: Auto Enrollment (by VPC)
+  - [ ] EKS Clusters
 - [ ] Non-guided cards link out to correct docs
 
 #### Access Lists

api/proto/teleport/autoupdate/v1/autoupdate.proto

@@ -38,6 +38,7 @@ message AutoUpdateConfigSpec {
   reserved 1;
   reserved "tools_autoupdate"; // ToolsAutoupdate is replaced by tools.mode.
   AutoUpdateConfigSpecTools tools = 2;
+  AutoUpdateConfigSpecAgents agents = 3;
 }
 
 // AutoUpdateConfigSpecTools encodes the parameters for client tools auto updates.
@@ -48,6 +49,8 @@ message AutoUpdateConfigSpecTools {
 
 // AutoUpdateConfigSpecAgents encodes the parameters of automatic agent updates.
 message AutoUpdateConfigSpecAgents {
+  reserved 5;
+  reserved "agent_schedules";
   // mode specifies whether agent autoupdates are enabled, disabled, or paused.
   string mode = 1;
   // strategy to use for updating the agents.
@@ -56,8 +59,8 @@ message AutoUpdateConfigSpecAgents {
   // Once the window is over, the group transitions to the done state. Existing agents won't be updated until the next
   // maintenance window.
   google.protobuf.Duration maintenance_window_duration = 3;
-  // agent_schedules specifies schedules for updates of grouped agents.
-  AgentAutoUpdateSchedules agent_schedules = 5;
+  // schedules specifies schedules for updates of grouped agents.
+  AgentAutoUpdateSchedules schedules = 6;
 }
 
 // AgentAutoUpdateSchedules specifies update scheduled for grouped agents.

api/proto/teleport/provisioning/v1/provisioning.proto

@@ -104,4 +104,16 @@ message PrincipalStateStatus {
 
   // Error holds a description of the last provisioing error, if any.
   string error = 4;
+
+  // Revision holds the revision of the principal record provisioned into the
+  // downstream system. Used to assert that the latest revision of the principal
+  // is provisioned downstream and detect changes in the principal that require
+  // re-provisoning.
+  string provisioned_principal_revision = 6;
+
+  // ActiveLocks holds the list of known active locks on the principal. Used to
+  // store the lock state across restarts of Teleport in order to detect state
+  // changes that may happen while Teleport is not running (e.g. a storage
+  // backend deleting an expired lock record while Teleport is offline)
+  repeated string active_locks = 7;
 }

api/types/autoupdate/config.go

@@ -1,38 +1,31 @@
 /*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
+Copyright 2024 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
 
 package autoupdate
 
 import (
+	"time"
+
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/gen/proto/go/teleport/autoupdate/v1"
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	"github.com/gravitational/teleport/api/types"
 )
 
-const (
-	// ToolsUpdateModeEnabled enables client tools automatic updates.
-	ToolsUpdateModeEnabled = "enabled"
-	// ToolsUpdateModeDisabled disables client tools automatic updates.
-	ToolsUpdateModeDisabled = "disabled"
-)
-
 // NewAutoUpdateConfig creates a new auto update configuration resource.
 func NewAutoUpdateConfig(spec *autoupdate.AutoUpdateConfigSpec) (*autoupdate.AutoUpdateConfig, error) {
 	config := &autoupdate.AutoUpdateConfig{
@@ -66,10 +59,41 @@ func ValidateAutoUpdateConfig(c *autoupdate.AutoUpdateConfig) error {
 		return trace.BadParameter("Spec is nil")
 	}
 	if c.Spec.Tools != nil {
-		if c.Spec.Tools.Mode != ToolsUpdateModeDisabled && c.Spec.Tools.Mode != ToolsUpdateModeEnabled {
-			return trace.BadParameter("ToolsMode is not valid")
+		if err := checkToolsMode(c.Spec.Tools.Mode); err != nil {
+			return trace.Wrap(err, "validating spec.tools.mode")
+		}
+	}
+	if c.Spec.Agents != nil {
+		if err := checkAgentsMode(c.Spec.Agents.Mode); err != nil {
+			return trace.Wrap(err, "validating spec.agents.mode")
+		}
+		if err := checkAgentsStrategy(c.Spec.Agents.Strategy); err != nil {
+			return trace.Wrap(err, "validating spec.agents.strategy")
 		}
+
+		windowDuration := c.Spec.Agents.MaintenanceWindowDuration.AsDuration()
+		if c.Spec.Agents.Strategy == AgentsStrategyHaltOnError && windowDuration != 0 {
+			return trace.BadParameter("spec.agents.maintenance_window_duration must be zero when the strategy is %q", c.Spec.Agents.Strategy)
+		}
+		if c.Spec.Agents.Strategy == AgentsStrategyTimeBased && windowDuration < 10*time.Minute {
+			return trace.BadParameter("spec.agents.maintenance_window_duration must be greater than 10 minutes when the strategy is %q", c.Spec.Agents.Strategy)
+		}
+
+		if err := checkAgentSchedules(c.Spec.Agents.Schedules); err != nil {
+			return trace.Wrap(err, "validating spec.agents.schedules")
+		}
+
 	}
 
 	return nil
 }
+
+func checkAgentSchedules(schedules *autoupdate.AgentAutoUpdateSchedules) error {
+	// TODO: change this logic when we implement group support.
+	// Currently we reject any non-nil schedule
+	// When we'll implement schedule support, we'll treat an empty schedule as the default schedule.
+	if schedules == nil {
+		return nil
+	}
+	return trace.NotImplemented("agent schedules are not implemented yet")
+}