Skip to content

Introduce config version v3, allow proxy_addresses to be given in the config #14054

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
ryanclark wants to merge 10 commits into from
Closed

Introduce config version v3, allow proxy_addresses to be given in the config #14054

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
9f4504b
Introduce config version 3
ryanclark Jul 1, 2022
39fccf2
Add ProxyServer option to the config and CLI
ryanclark Jul 1, 2022
8cf3e7a
Refactor the config validation code, validate proxy_address with conf…
ryanclark Jul 1, 2022
706255c
Fix linting errors
ryanclark Jul 1, 2022
bf46c4f
Set default config version if it's empty
ryanclark Jul 1, 2022
774f93c
Allow version to be empty when validating the version number
ryanclark Jul 1, 2022
cee29a5
Use `utils.SliceContainsStr` instead of re-inventing the wheel
ryanclark Jul 4, 2022
f548d38
Remove unneeded TODO
ryanclark Jul 4, 2022
44da823
Update incorrect comments in the config
ryanclark Jul 4, 2022
e9e9984
Do not show an example address for proxy servers
ryanclark Jul 4, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 9 additions & 5 deletions docs/pages/setup/reference/config.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,8 +65,8 @@ By default, it is stored in `/etc/teleport.yaml`.
```yaml
# By default, this file should be stored in /etc/teleport.yaml

# Configuration file version. The current version is "v2".
version: v2
# Configuration file version. The current version is "v3".
version: v3

# This section of the configuration file applies to all teleport
# services.
Expand Down Expand Up @@ -131,12 +131,16 @@ teleport:
# Auth Server address and port to connect to. If you enable the Teleport
# Auth Server to run in High Availability configuration, the address should
# point to a Load Balancer.
# If adding a node located behind NAT, use the Proxy URL. e.g.
# auth_servers:
# - teleport-proxy.example.com:443
# If adding a node located behind NAT, specify `proxy_servers` instead
auth_servers:
- 10.1.0.5:3025

# Proxy Server address and port to connect to. If you enable the Teleport
# Proxy Server to run in High Availability configuration, the address should
# point to a Load Balancer.
proxy_servers:
- teleport-proxy.example.com:443

# cache:
# # The cache is enabled by default, it can be disabled with this flag
# enabled: true
Expand Down
2 changes: 1 addition & 1 deletion integration/ec2_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,7 @@ func newNodeConfig(t *testing.T, authAddr utils.NetAddr, tokenName string, joinM

func newProxyConfig(t *testing.T, authAddr utils.NetAddr, tokenName string, joinMethod types.JoinMethod) *service.Config {
config := service.MakeDefaultConfig()
config.Version = defaults.TeleportConfigVersionV2
config.Version = defaults.TeleportConfigVersionV3
config.SetToken(tokenName)
config.JoinMethod = joinMethod
config.SSH.Enabled = false
Expand Down
4 changes: 2 additions & 2 deletions integration/proxy_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -363,10 +363,10 @@ func TestALPNSNIProxyKubeV2Leaf(t *testing.T) {
suite := newProxySuite(t,
withRootClusterConfig(rootClusterStandardConfig(t), func(config *service.Config) {
config.Proxy.Kube.Enabled = true
config.Version = defaults.TeleportConfigVersionV2
config.Version = defaults.TeleportConfigVersionV3
}),
withLeafClusterConfig(leafClusterStandardConfig(t), func(config *service.Config) {
config.Version = defaults.TeleportConfigVersionV2
config.Version = defaults.TeleportConfigVersionV3
config.Proxy.Kube.Enabled = true

config.Kube.Enabled = true
Expand Down
26 changes: 22 additions & 4 deletions lib/config/configuration.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,8 @@ type CommandLineFlags struct {
NodeName string
// --auth-server flag
AuthServerAddr []string
// --proxy-server flag
ProxyServerAddr []string
// --token flag
AuthToken string
// CAPins are the SKPI hashes of the CAs used to verify the Auth Server.
Expand Down Expand Up @@ -268,6 +270,22 @@ func ApplyFileConfig(fc *FileConfig, cfg *service.Config) error {
}
}

// config file has auth servers in there?
if len(fc.ProxyServers) > 0 {
cfg.ProxyServers = make([]utils.NetAddr, 0, len(fc.ProxyServers))
for _, as := range fc.ProxyServers {
addr, err := utils.ParseHostPortAddr(as, defaults.AuthListenPort)
if err != nil {
return trace.Wrap(err)
}

if err != nil {
return trace.Errorf("cannot parse proxy server address: '%v'", as)
}
cfg.ProxyServers = append(cfg.ProxyServers, *addr)
}
}

if err := applyTokenConfig(fc, cfg); err != nil {
return trace.Wrap(err)
}
Expand Down Expand Up @@ -855,8 +873,8 @@ func applyProxyConfig(fc *FileConfig, cfg *service.Config) error {
case legacyKube && newKube:
return trace.BadParameter("proxy_service should either set kube_listen_addr/kube_public_addr or kubernetes.enabled, not both; keep kubernetes.enabled if you don't enable kubernetes_service, or keep kube_listen_addr otherwise")
case !legacyKube && !newKube:
if fc.Version == defaults.TeleportConfigVersionV2 {
// Always enable kube service if using config V2 (TLS routing is supported)
if fc.Version != defaults.TeleportConfigVersionV1 {
Copy link
Copy Markdown
Collaborator

@zmb3 zmb3 Jul 2, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: for all these checks, instead of a == or !=, I would find a switch easier to reason about.

switch fs.Version {
case defaults.TeleportConfigVersionV1:
    // v1 logic
case defaults.TeleportConfigVersionV2, defaults.TeleportConfigVersionV3:
    // v2/v3 logic
}

Copy link
Copy Markdown
Member Author

@ryanclark ryanclark Jul 3, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I had chose to do it this way so we have less places to update every time we do a new config version, happy to change it to a switch statement though

// Always enable kube service if using config version 2 onwards (TLS routing is supported)
cfg.Proxy.Kube.Enabled = true
}
}
Expand Down Expand Up @@ -953,8 +971,8 @@ func getPostgresDefaultPort(cfg *service.Config) int {
}

func applyDefaultProxyListenerAddresses(cfg *service.Config) {
if cfg.Version == defaults.TeleportConfigVersionV2 {
// For v2 configuration if an address is not provided don't fallback to the default values.
if cfg.Version != defaults.TeleportConfigVersionV1 {
// From v2 onwards, if an address is not provided don't fallback to the default values.
return
}

Expand Down
38 changes: 36 additions & 2 deletions lib/config/configuration_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1753,6 +1753,15 @@ func TestProxyKube(t *testing.T) {
},
checkErr: require.NoError,
},
{
desc: "v3 kube service should be enabled by default",
version: defaults.TeleportConfigVersionV3,
cfg: Proxy{},
want: service.KubeProxyConfig{
Enabled: true,
},
checkErr: require.NoError,
},
{
desc: "v2 kube service should be enabled by default",
version: defaults.TeleportConfigVersionV2,
Expand Down Expand Up @@ -1788,9 +1797,9 @@ func TestProxyConfigurationVersion(t *testing.T) {
checkErr require.ErrorAssertionFunc
}{
{
desc: "v2 config with default web address",
desc: "v3 config with default web address",
fc: FileConfig{
Version: defaults.TeleportConfigVersionV2,
Version: defaults.TeleportConfigVersionV3,
Proxy: Proxy{
Service: Service{
defaultEnabled: true,
Expand All @@ -1811,6 +1820,31 @@ func TestProxyConfigurationVersion(t *testing.T) {
},
checkErr: require.NoError,
},
{
desc: "v3 config with custom web address",
fc: FileConfig{
Version: defaults.TeleportConfigVersionV3,
Proxy: Proxy{
Service: Service{
defaultEnabled: true,
},
WebAddr: "0.0.0.0:9999",
},
},
want: service.ProxyConfig{
Enabled: true,
EnableProxyProtocol: true,
WebAddr: *utils.MustParseAddr("0.0.0.0:9999"),
Kube: service.KubeProxyConfig{
Enabled: true,
},
Limiter: limiter.Config{
MaxConnections: defaults.LimiterMaxConnections,
MaxNumberOfUsers: 250,
},
},
checkErr: require.NoError,
},
{
desc: "v2 config with custom web address",
fc: FileConfig{
Expand Down
27 changes: 17 additions & 10 deletions lib/config/fileconf.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -155,6 +155,8 @@ type SampleFlags struct {
Roles string
// AuthServer is the address of the auth server
AuthServer string
// ProxyServer is the address of the proxy server
ProxyServer string
// AppName is the name of the application to start
AppName string
// AppURI is the internal address of the application to proxy
Expand Down Expand Up @@ -217,6 +219,10 @@ func MakeSampleFileConfig(flags SampleFlags) (fc *FileConfig, err error) {
g.AuthServers = []string{flags.AuthServer}
}

if flags.ProxyServer != "" {
g.ProxyServers = []string{flags.ProxyServer}
}

g.CAPin = strings.Split(flags.CAPin, ",")

roles := roleMapFromFlags(flags)
Expand Down Expand Up @@ -306,7 +312,7 @@ func makeSampleAuthConfig(conf *service.Config, flags SampleFlags, enabled bool)
a.LicenseFile = flags.LicensePath
}

if flags.Version == defaults.TeleportConfigVersionV2 {
if flags.Version != defaults.TeleportConfigVersionV1 {
a.ProxyListenerMode = types.ProxyListenerMode_Multiplex
}
} else {
Expand Down Expand Up @@ -559,15 +565,16 @@ type Global struct {
// AuthToken is the old way of configuring the token to be used by the
// node to join the Teleport cluster. `JoinParams.TokenName` should be
// used instead with `JoinParams.JoinMethod = types.JoinMethodToken`.
AuthToken string `yaml:"auth_token,omitempty"`
JoinParams JoinParams `yaml:"join_params,omitempty"`
AuthServers []string `yaml:"auth_servers,omitempty"`
Limits ConnectionLimits `yaml:"connection_limits,omitempty"`
Logger Log `yaml:"log,omitempty"`
Storage backend.Config `yaml:"storage,omitempty"`
AdvertiseIP string `yaml:"advertise_ip,omitempty"`
CachePolicy CachePolicy `yaml:"cache,omitempty"`
SeedConfig *bool `yaml:"seed_config,omitempty"`
AuthToken string `yaml:"auth_token,omitempty"`
JoinParams JoinParams `yaml:"join_params,omitempty"`
AuthServers []string `yaml:"auth_servers,omitempty"`
ProxyServers []string `yaml:"proxy_servers,omitempty"`
Limits ConnectionLimits `yaml:"connection_limits,omitempty"`
Logger Log `yaml:"log,omitempty"`
Storage backend.Config `yaml:"storage,omitempty"`
AdvertiseIP string `yaml:"advertise_ip,omitempty"`
CachePolicy CachePolicy `yaml:"cache,omitempty"`
SeedConfig *bool `yaml:"seed_config,omitempty"`

// CipherSuites is a list of TLS ciphersuites that Teleport supports. If
// omitted, a Teleport selected list of defaults will be used.
Expand Down
11 changes: 11 additions & 0 deletions lib/defaults/defaults.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -764,13 +764,24 @@ func Transport() (*http.Transport, error) {
return tr, nil
}

// When adding a new version, please add it to TeleportVersions below
const (
// TeleportConfigVersionV1 is the teleport proxy configuration v1 version.
TeleportConfigVersionV1 string = "v1"
// TeleportConfigVersionV2 is the teleport proxy configuration v2 version.
TeleportConfigVersionV2 string = "v2"
// TeleportConfigVersionV3 is the teleport proxy configuration v3 version.
TeleportConfigVersionV3 string = "v3"
)

// TeleportVersions is an exported slice of the allowed versions in the config file,
//for convenience (looping through, etc)
var TeleportVersions = []string{
TeleportConfigVersionV1,
TeleportConfigVersionV2,
TeleportConfigVersionV3,
}

// Default values for tsh and tctl commands.
const (
TshTctlSessionListLimit = "50"
Expand Down
10 changes: 7 additions & 3 deletions lib/service/cfg.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,11 +90,15 @@ type Config struct {
// JoinMethod is the method the instance will use to join the auth server
JoinMethod types.JoinMethod

// AuthServers is a list of auth servers, proxies and peer auth servers to
// connect to. Yes, this is not just auth servers, the field name is
// misleading.
// AuthServers is a list of auth servers and peer auth servers to
// connect to.
// Previously, proxy servers could be passed here, but going foward this
//should only be auth servers
AuthServers []utils.NetAddr

// ProxyServers is a list of proxies to tunnel to
ProxyServers []utils.NetAddr

// Identities is an optional list of pre-generated key pairs
// for teleport roles, this is helpful when server is preconfigured
Identities []*auth.Identity
Expand Down
Loading