Add a watcher for rotating agentless EC2 nodes#25477
Conversation
There was a problem hiding this comment.
We have a very similar logic in lib/service/connect.go:(*TeleportProcess).syncRotationStateCycle. Is there any way to reuse it or hook into it to avoid duplicating the same watcher? Maybe parameterize it with the types of CAs we want to watch and have it emit some hook/event we can subscribe to here in the discovery service?
@espadolini What do you think, would that make sense?
There was a problem hiding this comment.
This watcher is different enough that I don't think it would be worth it to unify them (here we only act on certain phase changes, for instance).
A bigger problem is that until we figure out how to do reloadless CA rotations, this nice watcher loop will just get closed whenever the host CA is rotated (other than theinit and rollback phases, at least) - as it is, it's kinda pointless to watch for host CA rotations of the local CA, since we're just going to be closing the TeleportProcess at some unspecified time in the future, so you don't really have guaranteed time to do anything.
lxea
force-pushed
the
lxea/adcr-client
branch
2 times, most recently
from
7288617 to
dc44f60
Compare
lxea
force-pushed
the
lxea/adcr-discovery
branch
6 times, most recently
from
9e21ccc to
fecd932
Compare
lxea
force-pushed
the
lxea/adcr-discovery
branch
2 times, most recently
from
32d6607 to
7fb8986
Compare
lxea
force-pushed
the
lxea/adcr-discovery
branch
2 times, most recently
from
09db2bf to
6a97f82
Compare
lxea
force-pushed
the
lxea/adcr-discovery
branch
2 times, most recently
from
0e712a3 to
324fa73
Compare
r0mant
left a comment
r0mant
left a comment
There was a problem hiding this comment.
Mostly a bunch of naming nitpicks.
Resolve comments Remove the agentless watcher and re-use the existing ec2 watcher Fix getMostRecentRotationForCAs logic use the clustername from conn.ClientIdentity get instances once initially and then only from channels After or Equal last rotation when fetching nodes resolve comments Remove the ca rotation watcher and rely on the timer Resolve comments resolve comments
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
3 participants
depends on #24194
Adds an watcher for agentless nodes that uses a node watcher to match appropriate EC2 nodes and re-run
teleport openssh joinon them.In the event that a rotation phase is missed, there is a timed watcher that will run on any nodes that havent updated their rotation status.