Add support for deploy service agent auto updates

lib/auth/integration/integrationv1/awsoidc.go

@@ -21,6 +21,7 @@ import (
 	"time"
 
 	"github.com/gravitational/trace"
+	"github.com/jonboulle/clockwork"
 
 	integrationpb "github.com/gravitational/teleport/api/gen/proto/go/teleport/integration/v1"
 	"github.com/gravitational/teleport/api/types"
@@ -29,6 +30,9 @@ import (
 	"github.com/gravitational/teleport/lib/services"
 )
 
+// defaultTokenTTL is the default TTL for AWS OIDC tokens
+const defaultTokenTTL = time.Minute
+
 // GenerateAWSOIDCToken generates a token to be used when executing an AWS OIDC Integration action.
 func (s *Service) GenerateAWSOIDCToken(ctx context.Context, req *integrationpb.GenerateAWSOIDCTokenRequest) (*integrationpb.GenerateAWSOIDCTokenResponse, error) {
 	_, err := authz.AuthorizeWithVerbs(ctx, s.logger, s.authorizer, true, types.KindIntegration, types.VerbUse)
@@ -41,42 +45,89 @@ func (s *Service) GenerateAWSOIDCToken(ctx context.Context, req *integrationpb.G
 		return nil, trace.Wrap(err)
 	}
 
-	clusterName, err := s.caGetter.GetDomainName()
+	token, err := GenerateAWSOIDCToken(ctx, AWSOIDCTokenConfig{
+		CAGetter: s.caGetter,
+		Clock:    s.clock,
+		Issuer:   req.Issuer,
+		Username: username,
+	})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	ca, err := s.caGetter.GetCertAuthority(ctx, types.CertAuthID{
+	return &integrationpb.GenerateAWSOIDCTokenResponse{
+		Token: token,
+	}, nil
+}
+
+// AWSOIDCTokenConfig contains configuration to be used when generating an AWS OIDC token.
+type AWSOIDCTokenConfig struct {
+	CAGetter CAGetter
+	Clock    clockwork.Clock
+	// TTL is the time to live for the token
+	TTL time.Duration
+	// Issuer is the issuer of the token.
+	Issuer string
+	// Username is the Teleport identity.
+	Username string
+}
+
+func (c *AWSOIDCTokenConfig) checkAndSetDefaults() error {
+	if c.CAGetter == nil {
+		return trace.BadParameter("ca getter is required")
+	}
+	if c.Clock == nil {
+		c.Clock = clockwork.NewRealClock()
+	}
+	if c.TTL == 0 {
+		c.TTL = defaultTokenTTL
+	}
+	if c.Issuer == "" {
+		return trace.BadParameter("issuer is required")
+	}
+	return nil
+}
+
+// GenerateToken generates a token to be used when executing an AWS OIDC Integration action.
+func GenerateAWSOIDCToken(ctx context.Context, config AWSOIDCTokenConfig) (string, error) {
+	if err := config.checkAndSetDefaults(); err != nil {
+		return "", trace.Wrap(err)
+	}
+
+	clusterName, err := config.CAGetter.GetDomainName()
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+
+	ca, err := config.CAGetter.GetCertAuthority(ctx, types.CertAuthID{
 		Type:       types.OIDCIdPCA,
 		DomainName: clusterName,
 	}, true)
 	if err != nil {
-		return nil, trace.Wrap(err)
+		return "", trace.Wrap(err)
 	}
 
 	// Extract the JWT signing key and sign the claims.
-	signer, err := s.caGetter.GetKeyStore().GetJWTSigner(ctx, ca)
+	signer, err := config.CAGetter.GetKeyStore().GetJWTSigner(ctx, ca)
 	if err != nil {
-		return nil, trace.Wrap(err)
+		return "", trace.Wrap(err)
 	}
 
-	privateKey, err := services.GetJWTSigner(signer, ca.GetClusterName(), s.clock)
+	privateKey, err := services.GetJWTSigner(signer, ca.GetClusterName(), config.Clock)
 	if err != nil {
-		return nil, trace.Wrap(err)
+		return "", trace.Wrap(err)
 	}
 
 	token, err := privateKey.SignAWSOIDC(jwt.SignParams{
-		Username: username,
+		Username: config.Username,
 		Audience: types.IntegrationAWSOIDCAudience,
 		Subject:  types.IntegrationAWSOIDCSubject,
-		Issuer:   req.Issuer,
-		Expires:  s.clock.Now().Add(time.Minute),
+		Issuer:   config.Issuer,
+		Expires:  config.Clock.Now().Add(config.TTL),
 	})
 	if err != nil {
-		return nil, trace.Wrap(err)
+		return "", trace.Wrap(err)
 	}
 
-	return &integrationpb.GenerateAWSOIDCTokenResponse{
-		Token: token,
-	}, nil
+	return token, nil
 }

lib/automaticupgrades/config.go

@@ -26,6 +26,9 @@ import (
 const (
 	// automaticUpgradesEnvar defines the env var to lookup when deciding whether to enable AutomaticUpgrades feature.
 	automaticUpgradesEnvar = "TELEPORT_AUTOMATIC_UPGRADES"
+
+	// automaticUpgradesChannelEnvar defines a customer automatic upgrades version release channel.
+	automaticUpgradesChannelEnvar = "TELEPORT_AUTOMATIC_UPGRADES_CHANNEL"
 )
 
 // IsEnabled reads the TELEPORT_AUTOMATIC_UPGRADES and returns whether Automatic Upgrades are enabled or disabled.
@@ -46,3 +49,8 @@ func IsEnabled() bool {
 
 	return automaticUpgrades
 }
+
+// GetChannel returns the TELEPORT_AUTOMATIC_UPGRADES_CHANNEL value.
+func GetChannel() string {
+	return os.Getenv(automaticUpgradesChannelEnvar)
+}

lib/automaticupgrades/version.go

@@ -34,22 +34,21 @@ const (
 
 	// stableCloudVersionPath is the URL path that returns the current stable/cloud version.
 	stableCloudVersionPath = "/v1/stable/cloud/version"
+
+	// stableCloudCriticalPath is the URL path that returns the stable/cloud critical flag.
+	stableCloudCriticalPath = "/v1/stable/cloud/critical"
 )
 
 // Version returns the version that should be used for installing Teleport Services
 // This is used when installing agents using scripts.
 // Even when Teleport Auth/Proxy is using vX, the agents must always respect this version.
-func Version(ctx context.Context, baseURL string) (string, error) {
-	if baseURL == "" {
-		baseURL = stableCloudVersionBaseURL
-	}
-
-	fullURL, err := url.JoinPath(baseURL, stableCloudVersionPath)
+func Version(ctx context.Context, versionURL string) (string, error) {
+	versionURL, err := getVersionURL(versionURL)
 	if err != nil {
 		return "", trace.Wrap(err)
 	}
 
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, fullURL, nil)
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, versionURL, nil)
 	if err != nil {
 		return "", trace.Wrap(err)
 	}
@@ -73,3 +72,60 @@ func Version(ctx context.Context, baseURL string) (string, error) {
 
 	return versionString, trace.Wrap(err)
 }
+
+// getVersionURL returns the versionURL or the default stable/cloud version url.
+func getVersionURL(versionURL string) (string, error) {
+	if versionURL != "" {
+		return versionURL, nil
+	}
+	cloudStableVersionURL, err := url.JoinPath(stableCloudVersionBaseURL, stableCloudVersionPath)
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+	return cloudStableVersionURL, nil
+}
+
+// Critical returns true if a critical upgrade is available.
+func Critical(ctx context.Context, criticalURL string) (bool, error) {
+	criticalURL, err := getCriticalURL(criticalURL)
+	if err != nil {
+		return false, trace.Wrap(err)
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, criticalURL, nil)
+	if err != nil {
+		return false, trace.Wrap(err)
+	}
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return false, trace.Wrap(err)
+	}
+	defer resp.Body.Close()
+
+	body, err := utils.ReadAtMost(resp.Body, teleport.MaxHTTPResponseSize)
+	if err != nil {
+		return false, trace.Wrap(err)
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return false, trace.BadParameter("invalid status code %d, body: %s", resp.StatusCode, string(body))
+	}
+
+	critical := strings.TrimSpace(string(body))
+
+	// The critical endpoint returns either the string "yes" or "no"
+	return critical == "yes", nil
+}
+
+// getCriticalURL returns the criticalURL or the default stable/cloud critical url.
+func getCriticalURL(criticalURL string) (string, error) {
+	if criticalURL != "" {
+		return criticalURL, nil
+	}
+	cloudStableCriticalURL, err := url.JoinPath(stableCloudVersionBaseURL, stableCloudCriticalPath)
+	if err != nil {
+		return "", trace.Wrap(err)
+	}
+	return cloudStableCriticalURL, nil
+}

lib/automaticupgrades/version_test.go

@@ -20,6 +20,7 @@ import (
 	"context"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
 	"testing"
 
 	"github.com/gravitational/trace"
@@ -68,19 +69,133 @@ func TestVersion(t *testing.T) {
 	} {
 		t.Run(tt.name, func(t *testing.T) {
 			httpTestServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				assert.Equal(t, r.URL.Path, "/v1/stable/cloud/version")
+				assert.Equal(t, "/v1/stable/cloud/version", r.URL.Path)
 				w.WriteHeader(tt.mockStatusCode)
 				w.Write([]byte(tt.mockResponseString))
 			}))
 			defer httpTestServer.Close()
 
-			v, err := Version(ctx, httpTestServer.URL)
+			versionURL, err := url.JoinPath(httpTestServer.URL, "/v1/stable/cloud/version")
+			require.NoError(t, err)
+
+			v, err := Version(ctx, versionURL)
 			tt.errCheck(t, err)
 			if err != nil {
 				return
 			}
 
-			require.Equal(t, v, tt.expectedVersion)
+			require.Equal(t, tt.expectedVersion, v)
+		})
+	}
+}
+
+func TestCritical(t *testing.T) {
+	ctx := context.Background()
+
+	isBadParameterErr := func(tt require.TestingT, err error, i ...any) {
+		require.True(tt, trace.IsBadParameter(err), "expected bad parameter, got %v", err)
+	}
+
+	for _, tt := range []struct {
+		name               string
+		mockStatusCode     int
+		mockResponseString string
+		errCheck           require.ErrorAssertionFunc
+		expectedCritical   bool
+	}{
+		{
+			name:               "critical available",
+			mockStatusCode:     http.StatusOK,
+			mockResponseString: "yes\n",
+			errCheck:           require.NoError,
+			expectedCritical:   true,
+		},
+		{
+			name:               "critical is not available",
+			mockStatusCode:     http.StatusOK,
+			mockResponseString: "no\n",
+			errCheck:           require.NoError,
+			expectedCritical:   false,
+		},
+		{
+			name:           "invalid status code (500)",
+			mockStatusCode: http.StatusInternalServerError,
+			errCheck:       isBadParameterErr,
+		},
+		{
+			name:           "invalid status code (403)",
+			mockStatusCode: http.StatusForbidden,
+			errCheck:       isBadParameterErr,
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			httpTestServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				assert.Equal(t, "/v1/stable/cloud/critical", r.URL.Path)
+				w.WriteHeader(tt.mockStatusCode)
+				w.Write([]byte(tt.mockResponseString))
+			}))
+			defer httpTestServer.Close()
+
+			criticalURL, err := url.JoinPath(httpTestServer.URL, "/v1/stable/cloud/critical")
+			require.NoError(t, err)
+
+			v, err := Critical(ctx, criticalURL)
+			tt.errCheck(t, err)
+			if err != nil {
+				return
+			}
+
+			require.Equal(t, tt.expectedCritical, v)
+		})
+	}
+}
+
+func TestGetVersionURL(t *testing.T) {
+	for _, tt := range []struct {
+		name        string
+		versionURL  string
+		expectedURL string
+	}{
+		{
+			name:        "default stable/cloud version url",
+			versionURL:  "",
+			expectedURL: "https://updates.releases.teleport.dev/v1/stable/cloud/version",
+		},
+		{
+			name:        "custom version url",
+			versionURL:  "https://custom.dev/version",
+			expectedURL: "https://custom.dev/version",
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			v, err := getVersionURL(tt.versionURL)
+			require.NoError(t, err)
+			require.Equal(t, tt.expectedURL, v)
+		})
+	}
+}
+
+func TestGetCriticalURL(t *testing.T) {
+	for _, tt := range []struct {
+		name        string
+		criticalURL string
+		expectedURL string
+	}{
+		{
+			name:        "default stable/cloud critical url",
+			criticalURL: "",
+			expectedURL: "https://updates.releases.teleport.dev/v1/stable/cloud/critical",
+		},
+		{
+			name:        "custom critical url",
+			criticalURL: "https://custom.dev/critical",
+			expectedURL: "https://custom.dev/critical",
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			v, err := getCriticalURL(tt.criticalURL)
+			require.NoError(t, err)
+			require.Equal(t, tt.expectedURL, v)
 		})
 	}
 }

lib/cloud/aws/policy_statements.go

@@ -48,7 +48,8 @@ func StatementForECSManageService() *Statement {
 		Actions: []string{
 			"ecs:DescribeClusters", "ecs:CreateCluster", "ecs:PutClusterCapacityProviders",
 			"ecs:DescribeServices", "ecs:CreateService", "ecs:UpdateService",
-			"ecs:RegisterTaskDefinition",
+			"ecs:RegisterTaskDefinition", "ecs:ListClusters", "ecs:ListServices",
+			"ecs:DescribeTaskDefinition", "ecs:DeregisterTaskDefinition",
 
 			// EC2 DescribeSecurityGroups is required so that the user can list the SG and then pick which ones they want to apply to the ECS Service.
 			"ec2:DescribeSecurityGroups",