Add WebSocket handler for WebUI database sessions

lib/auth/authclient/clt.go

@@ -1897,4 +1897,8 @@ type ClientI interface {
 
 	// GitServerClient returns git server client.
 	GitServerClient() gitserverv1.GitServerServiceClient
+
+	// SignDatabaseCSR generates client certificate used by proxy to
+	// authenticate with a remote database service.
+	SignDatabaseCSR(ctx context.Context, req *proto.DatabaseCSRRequest) (*proto.DatabaseCSRResponse, error)
 }

lib/defaults/defaults.go

@@ -721,6 +721,10 @@ const (
 
 	// WebsocketKubeExec provides latency information for a session.
 	WebsocketKubeExec = "k"
+
+	// WebsocketDatabaseSessionRequest is received when a new database session
+	// is requested.
+	WebsocketDatabaseSessionRequest = "d"
 )
 
 // The following are cryptographic primitives Teleport does not support in

lib/service/service.go

@@ -4641,6 +4641,14 @@ func (process *TeleportProcess) initProxyEndpoint(conn *Connector) error {
 			AutomaticUpgradesChannels: cfg.Proxy.AutomaticUpgradesChannels,
 			IntegrationAppHandler:     connectionsHandler,
 			FeatureWatchInterval:      retryutils.HalfJitter(web.DefaultFeatureWatchInterval * 2),
+			DatabasesAddrs: map[string]utils.NetAddr{
+				defaults.ProtocolPostgres: cfg.Proxy.PostgresAddr,
+				defaults.ProtocolMySQL:    cfg.Proxy.MySQLAddr,
+				defaults.ProtocolMongoDB:  cfg.Proxy.MongoAddr,
+			},
+			// TODO(gabrielcorado): place the database REPL getter from
+			//                      lib/client/db package once it gets merged.
+			// DatabaseREPLGetter: ,
 		}
 		webHandler, err := web.NewHandler(webConfig)
 		if err != nil {

lib/web/apiserver.go

@@ -331,6 +331,13 @@ type Config struct {
 	// FeatureWatchInterval is the interval between pings to the auth server
 	// to fetch new cluster features
 	FeatureWatchInterval time.Duration
+
+	// DatabasesAddrs is the list of separate listeners addresses per database
+	// protocol.
+	DatabasesAddrs map[string]utils.NetAddr
+
+	// DatabaseREPLGetter is used for retrieving database REPL.
+	DatabaseREPLGetter DatabaseREPLGetter
 }
 
 // SetDefaults ensures proper default values are set if
@@ -839,6 +846,7 @@ func (h *Handler) bindDefaultEndpoints() {
 	h.GET("/webapi/sites/:site/sessions", h.WithClusterAuth(h.clusterActiveAndPendingSessionsGet)) // get list of active and pending sessions
 
 	h.GET("/webapi/sites/:site/kube/exec/ws", h.WithClusterAuthWebSocket(h.podConnect)) // connect to a pod with exec (via websocket, with auth over websocket)
+	h.GET("/webapi/sites/:site/db/exec/ws", h.WithClusterAuthWebSocket(h.dbConnect))
 
 	// Audit events handlers.
 	h.GET("/webapi/sites/:site/events/search", h.WithClusterAuth(h.clusterSearchEvents))                 // search site events
@@ -3581,6 +3589,7 @@ func (h *Handler) siteNodeConnect(
 	}
 
 	term, err := NewTerminal(ctx, TerminalHandlerConfig{
+		Logger:             h.logger,
 		Term:               req.Term,
 		SessionCtx:         sessionCtx,
 		UserAuthClient:     clt,
@@ -3733,6 +3742,7 @@ func (h *Handler) podConnect(
 		ws:                  ws,
 		keepAliveInterval:   keepAliveInterval,
 		log:                 h.log.WithField(teleport.ComponentKey, "pod"),
+		logger:              h.logger.With(teleport.ComponentKey, "pod"),
 		userClient:          clt,
 		localCA:             hostCA,
 		configServerAddr:    serverAddr,

lib/web/apiserver_test.go

@@ -210,6 +210,12 @@ type webSuiteConfig struct {
 
 	// clock to use for all server components
 	clock clockwork.FakeClock
+
+	// databaseREPLGetter allows setting custom database REPLs.
+	databaseREPLGetter DatabaseREPLGetter
+
+	// databasesAddrs allows setting custom database proxy addresses.
+	databasesAddrs map[string]utils.NetAddr
 }
 
 func newWebSuiteWithConfig(t *testing.T, cfg webSuiteConfig) *WebSuite {
@@ -509,6 +515,8 @@ func newWebSuiteWithConfig(t *testing.T, cfg webSuiteConfig) *WebSuite {
 			return &proxyClientCert, nil
 		},
 		IntegrationAppHandler: &mockIntegrationAppHandler{},
+		DatabaseREPLGetter:    cfg.databaseREPLGetter,
+		DatabasesAddrs:        cfg.databasesAddrs,
 	}
 
 	if handlerConfig.HealthCheckAppServer == nil {