Add User Tasks resource - protos #46059

marcoandredinis · 2024-08-30T09:49:53Z

This PR creates a new resource: User Task

This resource will help the user fix issues with their other resources.

As the first use case for these, we are going to create Tasks when an EC2 auto-enrollment fails.
A User Task is going to be created letting the user know which Instance failed, why and how to fix it.
A single Task is created per Integration/Failure Type, and then multiple instances can be part of that Task.

Context: #41909

api/proto/teleport/userintegrationtasks/v1/user_integration_tasks.proto

r0mant · 2024-09-03T16:14:13Z

api/proto/teleport/userintegrationtasks/v1/user_integration_tasks.proto

+  string task_type = 2;
+  // IssueType is an identifier for the type of issue that happened.
+  // Example for discover-ec2: SSM_AGENT_NOT_AVAILABLE
+  string issue_type = 3;


Should this be an enum or is this a free-form field?

I prefer to keep it as a string instead with well-known values. It's easier for evolving and to keep IaC tools happy.

r0mant · 2024-09-03T16:18:30Z

api/proto/teleport/userintegrationtasks/v1/user_integration_tasks.proto

+  // DiscoverEC2 contains the AWS EC2 instances that failed to auto enroll into the cluster.
+  // Present when TaskType is discover-ec2.
+  DiscoverEC2 discover_ec2 = 4;
+}


Should this also contain a field with a detailed error message?

We'll use the issue_type to indicate the type of error.
We'll them map the issue_type with a specific UI element which has a detailed error message (which might contain lists, links and so on).

Aside from this field, I was thinking of adding add another one which indicates a more raw message in case there's no mapped error.
Are you referring to this one? I was trying to avoid it for now, but we might need it.

api/proto/teleport/userintegrationtasks/v1/user_integration_tasks.proto

marcoandredinis · 2024-09-18T06:39:19Z

@r0mant @espadolini Can you please take another look?

espadolini

You left an unintended e change in there.

r0mant

lgtm with 1 comment

api/proto/teleport/usertasks/v1/user_tasks.proto

public-teleport-github-review-bot · 2024-09-18T16:06:26Z

@marcoandredinis See the table below for backport results.

Branch	Result
branch/v16	Failed

* Add User Integration Tasks resource - protos * add account id * move state to task instead of instance * rename from user integration task to user task * add instance id

* Displaying mode and controls to additional participants * Moving SessionControlsInfoBroadcast over to kube/proxy * Transitioning to consistent proxy-emitted mode+controls * Moving message broadcast so new participant wont see it * Possible unit test fix (cant seem to test locally) * Fixed unit test * Adding a line break before messaging the participant * Linter errors * Emitting audit event and controls message for additional parties, i.e. not the session initiator * Revert "Emitting audit event and controls message for additional parties, i.e. not the session initiator" This reverts commit b66ad27. * Add User Tasks resource - protos (#46059) * Add User Integration Tasks resource - protos * add account id * move state to task instead of instance * rename from user integration task to user task * add instance id * Add notice to web UI that users arent equal to MAU (#46686) This adds a dismissible notice to the Users page for usage based billing users that notifies them that the user count here isn't an accurate reflection of MAU * Clarify TLS requirements in the Jira guide (#46484) Closes #45654 - Indicate that certificates for the Jira web server cannot be self signed. - Remove references to Caddy and a `Certificate` resource, which were left over from an attempted change to this guide that was not fully completed. * Remove TXT record validation of custom DNS zones in VNet (#46709) * Remove TXT record validation from custom DNS zones * Remove mentions of TXT records from docs * Outline in the RFD why domain verification was dropped * Update rfd/0163-vnet.md Co-authored-by: Nic Klaassen <nic@goteleport.com> --------- Co-authored-by: Nic Klaassen <nic@goteleport.com> * docs: mention the --days flag when executing an audit log query (#45764) * Update access-monitoring.mdx Include the default date range in the CLI example. This range is otherwise unclear and is hidden in the tctl audit help menu. * Update access-monitoring.mdx * Update docs/pages/admin-guides/access-controls/access-monitoring.mdx Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com> --------- Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com> * Remove access-graph path resolution, proxy `/enterprise` requests (#46541) * Remove `access-graph` path from tsconfig * Proxy /enterprise requested in dev * update e ref (#46726) * fix: tolerate mismatched key PEM headers (#46725) * fix: tolerate mismatched key PEM headers Issue #43381 introduced a regression where we now fail to parse PKCS8 encoded RSA private keys within an "RSA PRIVATE KEY" PEM block in some cases. This format is somewhat non-standard, usually PKCS8 data should be in a "PRIVATE KEY" PEM block. However, certain versions of OpenSSL and possibly even Teleport in specific cases have generated private keys in this format. This commit updates ParsePrivateKey and ParsePublicKey to be more tolerant of PKCS8, PKCS1, or PKIX key data no matter which PEM header is used. Fixes #46710 changelog: fixed regression in private key parser to handle mismatched PEM headers * fix typo in comment Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com> --------- Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com> * Use dynamic base path for favicon images (#46719) * Add Datadog Incident Management plugin support (#46271) * Implement datadog plugin * Add unit tests * Add fallback recipient config * Rename to Datadog Incident Management * Update tests * Datadog Incident Management * Update tctl resource plugin command * Typos * Lint * Exclude api changes for now * Set channel size * Address feedback - Add PluginShutdownTimeout const - Support api endpoint configuration - Add additional godocs/comments * Comment about datadog client package * Document Datadog API types * Only post resolution message when the AR is resolved * Fix lint * Unused function --------- Co-authored-by: hugoShaka <hugo.hervieux@goteleport.com> * Add AutoUpdate Client/Cache implementation (#46661) * Add AutoUpdate Client/Cache implementation * CR changes * Add permission for proxy to access resources * Rename all occurrences auto update to camelcase * Remove auto update client wrapper * Drop AutoUpdateServiceClient helper Rename comments for consistency * User Tasks: services and clients implementation (#46131) This PR adds the implementation for the User Tasks: - services (backend+cache) - clients (API + tctl) - light validation to set up the path for later PRs * expanding testplan for host user creation (#46729) * Fix operator docs reference generator bug (#46732) In the reference page for one Kubernetes operator resource, some Markdown links are malformed. The issue is that some fields of custom resource definitions used by the operator consist of arrays of anonymous objects with fields that are also objects. When creating docs based on these fields, the operator resource docs generator creates a malformed link reference. This change modifies the generator to replace any spaces with hyphens before outputting link references, causing the resulting internal links to work correctly. This change also does some light refactoring to remove an unnecessary `switch` statement. * [auto] Update AMI IDs for 16.4.0 (#46746) Co-authored-by: GitHub <noreply@github.com> * Remove deprecated HTTP RemoteCluster endpoints (#46756) * Remove deprecated HTTP RemoteCluster endpoints * Remove redundant test * Add `tbot` helm chart to `version.mk` (#46763) * Remove LockConfiguration.LockName (#46772) Cleans up the deprecated config option now that gravitational/teleport.e#5034 has been merged. * adding a reference to to the host user guide (#46765) * Replace more Logrus usage with Slog (#46757) * Remove logrus from lib/auth/machineid * Switch authclient.Config.Log and TunnelAuthDialerConfig.Log to Slog * Add *slog.Logger to auth.Server * Remove logrus usage in `lib/auth/access.go` * Replace logrus with slog in lib/auth/accountrecovery.go * Replace logrus with slog in `lib/auth/apiserver.go` * Add missing logger to auth.Server * Fix test * Update AWS roles ARNs displayed on `tsh app login` for AWS console apps (#44983) * feat(tsh): list aws console logins from server * chore(services): remove unified resources change This is being covered on another PR. * test(tsh): solve TestAzure flakiness by waiting using app servers are ready * fix(tsh): apps with logins were fallingback into using aws arns * refactor(client): use GetEnrichedResources * chore(client): rename function * refactor(tsh): directly resource lisiting for apps and reuse cluster client * chore(client): reset client changes * refactor(tsh): reuse cluster client for fetching allowed logins * chore(tsh): remove unused function param * refactor(tsh): update getApp retry with login * refactor(tsh): use a single function to grab profile and cluste client * refactor(tsh): perform retry with login at caller site * fix(tsh): close auth client * test(tsh): fix test failing due to login misconfiguration * test(tsh): fix lint errors * test(tsh): remove unused imports * bulk audit event export api (#46399) * Reverting back to using the emitSessionJoin boolean * Nits and removing a debug log --------- Co-authored-by: Marco Dinis <marco.dinis@goteleport.com> Co-authored-by: Michael <michael.myers@goteleport.com> Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com> Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com> Co-authored-by: Nic Klaassen <nic@goteleport.com> Co-authored-by: Dan Johns <117299936+djohns7@users.noreply.github.com> Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com> Co-authored-by: Ryan Clark <ryan.clark@goteleport.com> Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com> Co-authored-by: Bernard Kim <bernard@goteleport.com> Co-authored-by: hugoShaka <hugo.hervieux@goteleport.com> Co-authored-by: Vadym Popov <vadym.popov@goteleport.com> Co-authored-by: Erik Tate <erik.tate@goteleport.com> Co-authored-by: teleport-post-release-automation[bot] <128860004+teleport-post-release-automation[bot]@users.noreply.github.com> Co-authored-by: GitHub <noreply@github.com> Co-authored-by: Noah Stride <noah.stride@goteleport.com> Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com> Co-authored-by: Gabriel Corado <gabriel.oliveira@goteleport.com> Co-authored-by: Forrest <30576607+fspmarshall@users.noreply.github.com>

) * Displaying mode and controls to additional participants * Moving SessionControlsInfoBroadcast over to kube/proxy * Transitioning to consistent proxy-emitted mode+controls * Moving message broadcast so new participant wont see it * Possible unit test fix (cant seem to test locally) * Fixed unit test * Adding a line break before messaging the participant * Linter errors * Emitting audit event and controls message for additional parties, i.e. not the session initiator * Revert "Emitting audit event and controls message for additional parties, i.e. not the session initiator" This reverts commit b66ad27. * Add User Tasks resource - protos (#46059) * Add User Integration Tasks resource - protos * add account id * move state to task instead of instance * rename from user integration task to user task * add instance id * Add notice to web UI that users arent equal to MAU (#46686) This adds a dismissible notice to the Users page for usage based billing users that notifies them that the user count here isn't an accurate reflection of MAU * Clarify TLS requirements in the Jira guide (#46484) Closes #45654 - Indicate that certificates for the Jira web server cannot be self signed. - Remove references to Caddy and a `Certificate` resource, which were left over from an attempted change to this guide that was not fully completed. * Remove TXT record validation of custom DNS zones in VNet (#46709) * Remove TXT record validation from custom DNS zones * Remove mentions of TXT records from docs * Outline in the RFD why domain verification was dropped * Update rfd/0163-vnet.md --------- * docs: mention the --days flag when executing an audit log query (#45764) * Update access-monitoring.mdx Include the default date range in the CLI example. This range is otherwise unclear and is hidden in the tctl audit help menu. * Update access-monitoring.mdx * Update docs/pages/admin-guides/access-controls/access-monitoring.mdx --------- * Remove access-graph path resolution, proxy `/enterprise` requests (#46541) * Remove `access-graph` path from tsconfig * Proxy /enterprise requested in dev * update e ref (#46726) * fix: tolerate mismatched key PEM headers (#46725) * fix: tolerate mismatched key PEM headers Issue #43381 introduced a regression where we now fail to parse PKCS8 encoded RSA private keys within an "RSA PRIVATE KEY" PEM block in some cases. This format is somewhat non-standard, usually PKCS8 data should be in a "PRIVATE KEY" PEM block. However, certain versions of OpenSSL and possibly even Teleport in specific cases have generated private keys in this format. This commit updates ParsePrivateKey and ParsePublicKey to be more tolerant of PKCS8, PKCS1, or PKIX key data no matter which PEM header is used. Fixes #46710 changelog: fixed regression in private key parser to handle mismatched PEM headers * fix typo in comment --------- * Use dynamic base path for favicon images (#46719) * Add Datadog Incident Management plugin support (#46271) * Implement datadog plugin * Add unit tests * Add fallback recipient config * Rename to Datadog Incident Management * Update tests * Datadog Incident Management * Update tctl resource plugin command * Typos * Lint * Exclude api changes for now * Set channel size * Address feedback - Add PluginShutdownTimeout const - Support api endpoint configuration - Add additional godocs/comments * Comment about datadog client package * Document Datadog API types * Only post resolution message when the AR is resolved * Fix lint * Unused function --------- * Add AutoUpdate Client/Cache implementation (#46661) * Add AutoUpdate Client/Cache implementation * CR changes * Add permission for proxy to access resources * Rename all occurrences auto update to camelcase * Remove auto update client wrapper * Drop AutoUpdateServiceClient helper Rename comments for consistency * User Tasks: services and clients implementation (#46131) This PR adds the implementation for the User Tasks: - services (backend+cache) - clients (API + tctl) - light validation to set up the path for later PRs * expanding testplan for host user creation (#46729) * Fix operator docs reference generator bug (#46732) In the reference page for one Kubernetes operator resource, some Markdown links are malformed. The issue is that some fields of custom resource definitions used by the operator consist of arrays of anonymous objects with fields that are also objects. When creating docs based on these fields, the operator resource docs generator creates a malformed link reference. This change modifies the generator to replace any spaces with hyphens before outputting link references, causing the resulting internal links to work correctly. This change also does some light refactoring to remove an unnecessary `switch` statement. * [auto] Update AMI IDs for 16.4.0 (#46746) * Remove deprecated HTTP RemoteCluster endpoints (#46756) * Remove deprecated HTTP RemoteCluster endpoints * Remove redundant test * Add `tbot` helm chart to `version.mk` (#46763) * Remove LockConfiguration.LockName (#46772) Cleans up the deprecated config option now that gravitational/teleport.e#5034 has been merged. * adding a reference to to the host user guide (#46765) * Replace more Logrus usage with Slog (#46757) * Remove logrus from lib/auth/machineid * Switch authclient.Config.Log and TunnelAuthDialerConfig.Log to Slog * Add *slog.Logger to auth.Server * Remove logrus usage in `lib/auth/access.go` * Replace logrus with slog in lib/auth/accountrecovery.go * Replace logrus with slog in `lib/auth/apiserver.go` * Add missing logger to auth.Server * Fix test * Update AWS roles ARNs displayed on `tsh app login` for AWS console apps (#44983) * feat(tsh): list aws console logins from server * chore(services): remove unified resources change This is being covered on another PR. * test(tsh): solve TestAzure flakiness by waiting using app servers are ready * fix(tsh): apps with logins were fallingback into using aws arns * refactor(client): use GetEnrichedResources * chore(client): rename function * refactor(tsh): directly resource lisiting for apps and reuse cluster client * chore(client): reset client changes * refactor(tsh): reuse cluster client for fetching allowed logins * chore(tsh): remove unused function param * refactor(tsh): update getApp retry with login * refactor(tsh): use a single function to grab profile and cluste client * refactor(tsh): perform retry with login at caller site * fix(tsh): close auth client * test(tsh): fix test failing due to login misconfiguration * test(tsh): fix lint errors * test(tsh): remove unused imports * bulk audit event export api (#46399) * Reverting back to using the emitSessionJoin boolean * Nits and removing a debug log --------- Co-authored-by: Marco Dinis <marco.dinis@goteleport.com> Co-authored-by: Michael <michael.myers@goteleport.com> Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com> Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com> Co-authored-by: Nic Klaassen <nic@goteleport.com> Co-authored-by: Dan Johns <117299936+djohns7@users.noreply.github.com> Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com> Co-authored-by: Ryan Clark <ryan.clark@goteleport.com> Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com> Co-authored-by: Bernard Kim <bernard@goteleport.com> Co-authored-by: hugoShaka <hugo.hervieux@goteleport.com> Co-authored-by: Vadym Popov <vadym.popov@goteleport.com> Co-authored-by: Erik Tate <erik.tate@goteleport.com> Co-authored-by: teleport-post-release-automation[bot] <128860004+teleport-post-release-automation[bot]@users.noreply.github.com> Co-authored-by: GitHub <noreply@github.com> Co-authored-by: Noah Stride <noah.stride@goteleport.com> Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com> Co-authored-by: Gabriel Corado <gabriel.oliveira@goteleport.com> Co-authored-by: Forrest <30576607+fspmarshall@users.noreply.github.com>

* Add User Integration Tasks resource - protos * add account id * move state to task instead of instance * rename from user integration task to user task * add instance id

* Add User Tasks resource - protos (#46059) * Add User Integration Tasks resource - protos * add account id * move state to task instead of instance * rename from user integration task to user task * add instance id * User Tasks: services and clients implementation (#46131) This PR adds the implementation for the User Tasks: - services (backend+cache) - clients (API + tctl) - light validation to set up the path for later PRs

marcoandredinis added no-changelog Indicates that a PR does not require a changelog entry backport/branch/v16 labels Aug 30, 2024

github-actions bot added the size/md label Aug 30, 2024

github-actions bot requested review from gzdunek and timothyb89 August 30, 2024 09:50

marcoandredinis force-pushed the marco/tasks_proto branch 3 times, most recently from 21bd240 to a540a3e Compare August 30, 2024 10:13

marcoandredinis mentioned this pull request Aug 30, 2024

AWS OIDC Integration Dashboard #41909

Open

marcoandredinis force-pushed the marco/tasks_proto branch 2 times, most recently from 607d33f to e8303ce Compare September 2, 2024 15:30

r0mant reviewed Sep 3, 2024

View reviewed changes

r0mant mentioned this pull request Sep 3, 2024

User Tasks: services and clients implementation #46131

Merged

marcoandredinis force-pushed the marco/tasks_proto branch 2 times, most recently from c0fd9b0 to 19ef1d8 Compare September 13, 2024 17:48

marcoandredinis requested review from r0mant and espadolini September 13, 2024 18:50

marcoandredinis force-pushed the marco/tasks_proto branch 3 times, most recently from fa81f30 to 14a2317 Compare September 17, 2024 13:41

marcoandredinis changed the title ~~Add User Integration Tasks resource - protos~~ Add User Tasks resource - protos Sep 18, 2024

marcoandredinis force-pushed the marco/tasks_proto branch from 14a2317 to ffe5684 Compare September 18, 2024 06:38

espadolini approved these changes Sep 18, 2024

View reviewed changes

marcoandredinis force-pushed the marco/tasks_proto branch 3 times, most recently from 1108130 to 2f68a31 Compare September 18, 2024 13:01

r0mant approved these changes Sep 18, 2024

View reviewed changes

api/proto/teleport/usertasks/v1/user_tasks.proto Show resolved Hide resolved

public-teleport-github-review-bot bot removed request for timothyb89 and gzdunek September 18, 2024 15:21

marcoandredinis added 5 commits September 18, 2024 16:29

Add User Integration Tasks resource - protos

8cbf66d

add account id

4de61dc

move state to task instead of instance

c878a34

rename from user integration task to user task

fd2fc77

add instance id

6288682

marcoandredinis force-pushed the marco/tasks_proto branch from 2f68a31 to 6288682 Compare September 18, 2024 15:31

marcoandredinis added this pull request to the merge queue Sep 18, 2024

Merged via the queue into master with commit e885865 Sep 18, 2024
42 checks passed

marcoandredinis deleted the marco/tasks_proto branch September 18, 2024 16:05

marcoandredinis mentioned this pull request Sep 19, 2024

[v16] User Tasks resource #46754

Merged

mvbrock pushed a commit that referenced this pull request Sep 19, 2024

Add User Tasks resource - protos (#46059)

5fa8f70

* Add User Integration Tasks resource - protos * add account id * move state to task instead of instance * rename from user integration task to user task * add instance id

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add User Tasks resource - protos #46059

Add User Tasks resource - protos #46059

marcoandredinis commented Aug 30, 2024 •

edited

Loading

r0mant Sep 3, 2024

marcoandredinis Sep 13, 2024

r0mant Sep 3, 2024

marcoandredinis Sep 13, 2024

marcoandredinis commented Sep 18, 2024

espadolini left a comment

r0mant left a comment

public-teleport-github-review-bot bot commented Sep 18, 2024

Add User Tasks resource - protos #46059

Add User Tasks resource - protos #46059

Conversation

marcoandredinis commented Aug 30, 2024 • edited Loading

r0mant Sep 3, 2024

Choose a reason for hiding this comment

marcoandredinis Sep 13, 2024

Choose a reason for hiding this comment

r0mant Sep 3, 2024

Choose a reason for hiding this comment

marcoandredinis Sep 13, 2024

Choose a reason for hiding this comment

marcoandredinis commented Sep 18, 2024

espadolini left a comment

Choose a reason for hiding this comment

r0mant left a comment

Choose a reason for hiding this comment

public-teleport-github-review-bot bot commented Sep 18, 2024

marcoandredinis commented Aug 30, 2024 •

edited

Loading