Export endpoint config #42810
Export endpoint config #42810
Conversation
lib/service/service.go
Outdated
| @@ -1129,6 +1130,20 @@ func NewTeleport(cfg *servicecfg.Config) (*TeleportProcess, error) { | |||
| process.logger.WarnContext(process.ExitContext(), "Use of external upgraders on control-plane instances is not recommended.") | |||
| } | |||
|
|
|||
| if upgraderKind == "unit" { | |||
| process.RegisterFunc("autoupdates.endpoint.export", func() error { | |||
| if err := endpoint.Export(process.ExitContext(), resolverAddr); err != nil { | |||
There was a problem hiding this comment.
If we are joining via auth I think this will do weird things with the updater as it will set the endpoint override to auth.example.com:3025 which is not a valid version server.
This is not a possible case for Cloud, but this can and will happen in self-hosted setups. I'm not sure we can catch all cases where we connect through a proxy, but known cases are:
- when
cfg.ProxyServeris set - (ugly) when port is 443 or 3080
We can also make this logic cloud-specific by looking for the teleport.sh suffix in the resolver address.
There was a problem hiding this comment.
I've made changes in 57cf444 so that this export function will only be run for Cloud instances.
Additionally, the export function will attempt to verify the endpoint first before writing the config. So if the resolver address results in an invalid version server, the endpoint will not be written.
The updater is already dependent on Teleport to export an update schedule, so I think it has already been coupled in both directions. We can handle this in the teleport updater logic, but correctly parsing the different teleport.yaml config versions in bash doesn't sound like the simplest task. I can give it a shot if you're really against adding any updater logic into teleport. |
|
Hey @fheinecke, actually I think it would be preferred to implement this logic inside Teleport because it would also help address the issue with the global version endpoint https://github.com/gravitational/cloud/issues/8361. There are still a number of users that have not upgraded their teleport updater from the deprecated version, and they still query the target agent version from the global version endpoint. This change would allow agents to override that default without requiring the updater package itself to be updated. |
public-teleport-github-review-bot
bot
removed request for
greedy52,
strideynet and
fspmarshall
|
@bernardjkim See the table below for backport results.
|
Closes #41983
This PR registers an endpoint export function with the teleport process. On startup the proxy version endpoint will be exported to the
/etc/teleport-upgrade.d/endpointconfig. If an endpoint value is already configured, the value will not be overwritten.This will allow the teleport updater to be compatible with the previous versions of the teleport config.
changelog: Fixes automatic updates with previous versions of the
teleport.yamlconfig.