-
Notifications
You must be signed in to change notification settings - Fork 1.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Teleport 6.2 Test Plan #6651
Comments
When adding an OTP device with
|
@quinqu could you please file a bug for this and assign to me? |
Updating a user with |
@webvictim - I've added a test matrix for the
|
Encountered #6938 while testing: Panic when using tctl with remote auth server |
mfa related bug, where scp upload/download does not work in the web ui: #6939 |
Changes introduced in #6731 break compatibility with older Teleport should fallback to using old event API if new one is not available. |
@fspmarshall So this is a bit of an issue. The old events API does not support pagination but the |
@xacrimon Followed up in PR. Basically, I think we should pretend it doesn't exist when dealing with the first call (since that means we're getting the "first page", which is what the old API did), but we should return an error if |
@xacrimon @webvictim @fspmarshall @quinqu let me know if you're overloaded. |
@awly i could use some help on the U2F second factor tests as i do not have a U2F device. |
@quinqu will do 👍 |
FYI everyone, if you find an issue while testing, please file a bug and put it into 6.2 milestone. |
I have previously assumed DynamoDB tests were running but they have not been. I still need to hook these up and run them before I can say everything is correct. I will make another comment but please do not cut before I confirm that everything is indeed working @awly. @russjones I've also merged the API compat PR. #6990 will need to be merged as well, I will ping for reviews when it is ready. |
Ran into some weird Not sure if this is a blocker but I can't log out of all my clusters for some reason. |
Okay. I have pinged reviews on #6990 and I sign off on everything working when it is merged. I’ve manually done some testing to make sure it works. |
Most Kubernetes tests are finished, just waiting on #6990 merge/backport (and rc.2 cut?) to verify the audit log entries: |
All issues are either resolved or not caused by 6.2. |
From @fspmarshall 6.2 - etcd - IoT
6.2 - etcd - non-IoT
|
Manual Testing Plan
Below are the items that should be manually tested with each release of Teleport.
These tests should be run on both a fresh install of the version to be released
as well as an upgrade of the previous version of Teleport.
Adding nodes to a cluster @webvictim @tcsc
Trusted Clusters @nklaassen @awly
RBAC @Joerger @andrejtokarcik
Make sure that invalid and valid attempts are reflected in audit log.
Users @fspmarshall @quinqu
With every user combination, try to login and signup with invalid second factor, invalid password to see how the system reacts.
tsh mfa add
tsh mfa add
tsh mfa ls
tsh mfa rm
tsh mfa rm
second_factor: on
inauth_service
, should failsecond_factor: optional
inauth_service
, should succeedtsh mfa add
Audit Log @r0mant @xacrimon
scp
commands are recordedInteract with a cluster using
tsh
@webvictim @tcscThese commands should ideally be tested for recording and non-recording modes as they are implemented in a different ways.
Interact with a cluster using
ssh
@nklaassen @awlyMake sure to test both recording and regular proxy modes.
Interact with a cluster using the Web UI @Joerger @andrejtokarcik
Combinations @fspmarshall @quinqu
For some manual testing, many combinations need to be tested. For example, for
interactive sessions the 12 combinations are below.
Teleport with multiple Kubernetes clusters @xacrimon @webvictim
Note: you can use GKE or EKS or minikube to run Kubernetes clusters.
Minikube is the only caveat - it's not reachable publicly so don't run a proxy there.
tsh login
, check thattsh kube ls
has your clusterkubectl get nodes
,kubectl exec -it $SOME_POD -- sh
tsh login
, check thattsh kube ls
has your clusterkubectl get nodes
,kubectl exec -it $SOME_POD -- sh
tsh login
, check thattsh kube ls
has your clusterkubectl get nodes
,kubectl exec -it $SOME_POD -- sh
tsh login
, check thattsh kube ls
has both clusterstsh kube login
kubectl get nodes
,kubectl exec -it $SOME_POD -- sh
on the new clustertsh login
, check thattsh kube ls
has all clustersname
andlabels
Step 2
login value matching the rowsname
columnname
orlabels
in the search bar worksname
columHelm charts
teleport-cluster
Helm chart to an EKS cluster in HA mode by following the AWS guidetctl users add
tsh login
tsh kube ls
, log in withtsh kube login
kubectl get nodes
andkubectl -n kube-system get pods
teleport-cluster
Helm chart to a GKE cluster in HA mode by following the GKE guidetctl users add
tsh login
tsh kube ls
, log in withtsh kube login
kubectl get nodes
andkubectl -n kube-system get pods
teleport-kube-agent
Helm chart to an EKS cluster following instructions in the READMEtsh kube ls
, log in withtsh kube login
kubectl get nodes
andkubectl get pods
, verify no errorsteleport-kube-agent
Helm chart to a GKE cluster following instructions in the READMEtsh kube ls
, log in withtsh kube login
kubectl get nodes
andkubectl get pods
, verify no errorsMigrations @tcsc @nklaassen
SSH should work for both main and old clusters
SSH should work
Command Templates
When interacting with a cluster, the following command templates are useful:
OpenSSH
Teleport
Teleport Plugins @awly @Joerger
WEB UI @kimlisa @alex-kovoy
Main
For main, test with admin role that has access to all resources.
Top Nav
Side Nav
>
, and expand has iconv
Servers aka Nodes
Add Server
button renders dialogue set toAutomatically
viewRegenerate Script
regenerates token value in the bash commandManually
tab renders manual stepsAutomatically
tab renders bash commandApplications
Add Application
button renders dialogueGenerate Script
, bash command is renderedRegenerate
button regenerates token value in bash commandDatabases
Add Database
button renders dialogue for manual instructions:Active Sessions
Audit log
Session Ended
event icon, takes user to session playerdetails
buttonUsers
Auth Connectors
Auth Connectors Card Icons
Roles
Managed Clusters
Help & Support
Access Requests
Creating Access Rquests
allow-roles
). This role allows you to see the Role screen and ssh into all nodes.allow-users
). This role session expires in 4 minutes, allows you to see Users screen, and denies access to all nodes.default
)default
assignedallow-roles
andallow-users
are listedViewing & Approving/Denying Requests
Create a user with the role
reviewer
that allows you to review all requests, and delete them.default
if thresholds weren't defined in role, or blank if not named)Assuming Approved Requests
allow-roles
allows you to see roles screen and ssh into nodesallow-roles
, verify that assumingallow-users
allows you to see users screen, and denies access to nodesswitching back
goes back to your default static roledefault
, and requests that are not expired and are approved are assumable againAccess Request Waiting Room
Strategy Reason
Create the following role:
request_prompt
settingsend request
, pending dialogue rendersStrategy Always
With the previous role you created from
Strategy Reason
, changerequest_access
toalways
:Strategy Optional
With the previous role you created from
Strategy Reason
, changerequest_access
tooptional
:Switch Back
and clicking goes back to the login screenAccount
Terminal
Node List Tab
Session Tab
$ sudo apt-get install mc
$ mc
Session Player
Invite Form
Login Form
Multi-factor Authentication (mfa)
Create/modify
teleport.yaml
and set the following authentication settings underauth_service
MFA create, login, password reset
totp
(TODO: temporary hack, ideally want to allow user to select)otp
otp
MFA require auth
Through the CLI,
tsh login
and register a u2f key withtsh mfa add
(not supported in UI yet).Using the same user as above:
RBAC
Create a role, with no
allow.rules
defined:Add Server
button in Server viewAdd Application
button in Applications viewNodes
andApps
are listed underoptions
button inManage Clusters
Note: User has read/create access_request access to their own requests, despite resource settings
Add the following under
spec.allow.rules
to enable read access to the audit log:Audit Log
andSession Recordings
is accessibleAdd the following to enable read access to recorded sessions
Add the following to enable read access to the roles
Add the following to enable read access to the auth connectors
Add the following to enable read access to users
Add the following to enable read access to trusted clusters
Performance/Soak Test @xacrimon @fspmarshall
Using
tsh bench
tool, perform the soak tests and benchmark tests on the following configurations:Cluster with 10K nodes in normal (non-IOT) node mode with ETCD
Cluster with 10K nodes in normal (non-IOT) mode with DynamoDB
Cluster with 1K IOT nodes with ETCD
Cluster with 1K IOT nodes with DynamoDB
Cluster with 500 trusted clusters with ETCD
Cluster with 500 trusted clusters with DynamoDB
Soak Tests
Run 4hour soak test with a mix of interactive/non-interactive sessions:
Observe prometheus metrics for goroutines, open files, RAM, CPU, Timers and make sure there are no leaks
Breaking load tests
Load system with tsh bench to the capacity and publish maximum numbers of concurrent sessions with interactive
and non interactive tsh bench loads.
Application Access @r0mant @smallinsky
debug_app: true
works.name.rootProxyPublicAddr
and well aspublicAddr
.name.rootProxyPublicAddr
.app.session.start
andapp.session.chunk
events are created in the Audit Log.app.session.chunk
points to a 5 minute session archive with multipleapp.session.request
events inside.tsh play <chunk-id>
can fetch and print a session chunk archive.tsh app login
.Add Application
dialogue works (refresh app screen to see it registered)Database Access @r0mant @smallinsky
db.session.start
is emitted when you connect.db.session.end
is emitted when you disconnect.db.session.query
is emitted when you execute a SQL query.tsh db ls
shows only databases matching role'sdb_labels
.db_users
.db_names
.db.session.start
is emitted when connection attempt is denied.name
,description
,type
, andlabels
Step 2
login value matching the rowsname
columnlabels
The text was updated successfully, but these errors were encountered: