Various changes to load testing machinery to support v17

assets/loadtest/Makefile

@@ -117,13 +117,14 @@ deploy-tc:
 .PHONY: join-tc
 join-tc:
 	kubectl get pod -n tc -o name --no-headers \
-    	| xargs -P 20 -n 1 -I {} kubectl -n tc exec {} -- tctl create -f /etc/teleport/tc.yaml
+    	| xargs -P 10 -n 1 -I {} kubectl -n tc exec {} -- tctl create -f /etc/teleport/tc.yaml
 
 # deletes trusted clusters
 .PHONY: delete-tc
 delete-tc:
 	helm delete -n tc trusted-cluster
-	tctl get rc | grep ' name:' | cut -d ':' -f2- | xargs -P 20 -n 1 -I {} tctl rm rc/{}
+	kubectl --namespace teleport exec deploy/teleport-auth \
+		-- /busybox/sh -c "tctl get rc | grep ' name:' | cut -d ':' -f2- | xargs -P 20 -n 1 -I {} tctl rm rc/{}"
 
 # creates a bot used by the soak tests to authenticate with the cluster
 .PHONY: create-soaktest-bot

assets/loadtest/azure/main.tf

@@ -2,7 +2,7 @@ terraform {
   required_providers {
     azurerm = {
       source  = "hashicorp/azurerm"
-      version = ">= 3.87.0"
+      version = ">= 4.8.0"
     }
 
     random = {
@@ -52,6 +52,7 @@ provider "kubectl" {
 }
 
 provider "azurerm" {
+  subscription_id = var.subscription_id
   features {}
 }
 

assets/loadtest/azure/teleport_kube.tf

@@ -13,7 +13,7 @@ resource "helm_release" "teleport" {
   name = local.teleport_release
 
   chart      = "teleport-cluster"
-  repository = "https://charts.releases.teleport.dev"
+  repository = "https://charts.releases.development.teleport.dev"
   version    = var.teleport_version
 
   namespace = kubernetes_namespace_v1.teleport.metadata.0.name
@@ -27,16 +27,16 @@ resource "helm_release" "teleport" {
       "databaseUser"                   = azurerm_postgresql_flexible_server_active_directory_administrator.pgbk_teleport.principal_name
       "sessionRecordingStorageAccount" = azurerm_storage_account.azsessions.primary_blob_host
       "clientID"                       = azurerm_user_assigned_identity.teleport_identity.client_id
-      "databasePoolMaxConnections"     = 50
+      "databasePoolMaxConnections"     = 100
     }
 
     "log" = {
       "format" = "json"
       "level"  = "DEBUG"
     }
     "extraArgs"       = ["--debug"]
-    "image"           = "public.ecr.aws/gravitational/teleport-distroless-debug"
-    "enterpriseImage" = "public.ecr.aws/gravitational/teleport-ent-distroless-debug"
+    "image"           = "public.ecr.aws/gravitational-staging/teleport-distroless-debug"
+    "enterpriseImage" = "public.ecr.aws/gravitational-staging/teleport-ent-distroless-debug"
 
     "proxyListenerMode" = "multiplex"
 
@@ -73,7 +73,7 @@ resource "helm_release" "teleport" {
     }
 
     "authentication" = {
-      "secondFactor" = "off"
+      "secondFactor" = "webauthn"
     }
 
     "highAvailability" = {

assets/loadtest/azure/terraform.tfvars

@@ -13,5 +13,5 @@ cluster_prefix = "loadtest"
 dns_zone    = "az.teleportdemo.net"
 dns_zone_rg = "teleportdemo-dns"
 
-teleport_version = "15.0.0"
+teleport_version = "17.0.0-alpha.2"
 deploy_teleport  = true

assets/loadtest/azure/variables.tf

@@ -27,8 +27,15 @@ variable "deploy_teleport" {
   nullable    = false
   description = "Install the Teleport helm release"
 }
+
 variable "teleport_version" {
   type        = string
   nullable    = false
   description = "Version of Teleport"
 }
+
+variable "subscription_id" {
+  type        = string
+  nullable    = false
+  description = "The Azure subscription_id"
+}

assets/loadtest/cluster/aws/cluster.yaml

@@ -4,6 +4,8 @@ metadata:
   name:
   region:
   version: "1.29"
+  tags:
+    teleport.dev/creator:
 
 iam:
   withOIDC: true
@@ -16,5 +18,7 @@ addons:
 managedNodeGroups:
   - name:
     instanceType: m5.4xlarge
-    minSize: 2
+    minSize: 3
     maxSize: 10
+    tags:
+      teleport.dev/creator:

assets/loadtest/cluster/gcp/Makefile

@@ -1,12 +1,12 @@
 # preview cluster configuration
 .PHONY: plan
 plan:
-	terraform plan
+	tofu plan
 
 # apply cluster configuration
 .PHONY: create-cluster
 create-cluster:
-	terraform apply
+	tofu apply
 
 # authorize kubectl to manage the cluster
 .PHONY: get-creds
@@ -16,14 +16,14 @@ get-creds:
 # destroy the cluster
 .PHONY: destroy
 destroy:
-	terraform destroy
+	tofu destroy
 
 # print cluster name
 .PHONY: get-cluster-name
 get-cluster-name:
-	@terraform output -raw cluster_name
+	@tofu output -raw cluster_name
 
 # print project name
 .PHONY: get-project
 get-project:
-	@terraform output -raw project
+	@tofu output -raw project

assets/loadtest/control-plane/dns/update-record.sh

@@ -4,6 +4,10 @@ set -euo pipefail
 
 source vars.env
 
+if [[ "$TELEPORT_BACKEND" == "firestore" ]]; then
+  exit 0
+fi
+
 action="${1}"
 
 case "$action" in

assets/loadtest/control-plane/policies/delete-policies.sh

@@ -4,6 +4,10 @@ set -euo pipefail
 
 source vars.env
 
+if [[ "$TELEPORT_BACKEND" == "firestore" ]]; then
+  exit 0
+fi
+
 dynamo_policy_arn="arn:aws:iam::${ACCOUNT_ID}:policy/${CLUSTER_NAME}-dynamo"
 
 s3_policy_arn="arn:aws:iam::${ACCOUNT_ID}:policy/${CLUSTER_NAME}-s3"

assets/loadtest/control-plane/policies/gen-policies.sh

@@ -4,6 +4,11 @@ set -euo pipefail
 
 source vars.env
 
+if [[ "$TELEPORT_BACKEND" == "firestore" ]]; then
+  exit 0
+fi
+
+
 dynamo_policy="$STATE_DIR/dynamo-iam-policy"
 
 s3_policy="$STATE_DIR/s3-iam-policy"

assets/loadtest/control-plane/teleport/gen-dynamo-teleport.sh

@@ -13,6 +13,14 @@ chartMode: aws
 clusterName: ${CLUSTER_NAME}.${ROUTE53_ZONE}      # Name of your cluster. Use the FQDN you intend to configure in DNS below.
 teleportVersionOverride: ${TELEPORT_VERSION}
 proxyListenerMode: "multiplex"
+authentication:
+  type: local
+  secondFactor: "webauthn"
+  webauthn:
+    rp_id: ${CLUSTER_NAME}.${ROUTE53_ZONE}
+  connector_name: passwordless
+  device_trust:
+    mode: "off"
 aws:
   region: ${REGION}                           # AWS region
   backendTable: ${CLUSTER_NAME}-backend           # DynamoDB table to use for the Teleport backend

assets/loadtest/control-plane/teleport/gen-etcd-teleport.sh

@@ -14,8 +14,8 @@ clusterName: ${CLUSTER_NAME}.${ROUTE53_ZONE}      # Name of your cluster. Use th
 teleportVersionOverride: ${TELEPORT_VERSION}
 
 extraArgs: ['--debug']
-image: "public.ecr.aws/gravitational/teleport-distroless-debug"
-enterpriseImage: "public.ecr.aws/gravitational/teleport-ent-distroless-debug"
+image: "public.ecr.aws/gravitational-staging/teleport-distroless-debug"
+enterpriseImage: "public.ecr.aws/gravitational-staging/teleport-ent-distroless-debug"
 
 persistence:
     enabled: false
@@ -28,7 +28,7 @@ highAvailability:
 
 authentication:
   type: local
-  secondFactor: "optional"
+  secondFactor: "webauthn"
   webauthn:
     rp_id: ${CLUSTER_NAME}.${ROUTE53_ZONE}
   connector_name: passwordless