Support running a version server in the proxy

.github/dependabot.yml

@@ -133,29 +133,6 @@ updates:
       - "go"
       - "no-changelog"
 
-  - package-ecosystem: gomod
-    directory: "/integrations/kube-agent-updater"
-    schedule:
-      interval: weekly
-      day: "sunday"
-      time: "09:00" # 9am UTC
-    open-pull-requests-limit: 10
-    groups:
-      go:
-        update-types:
-          - "minor"
-          - "patch"
-    reviewers:
-      - codingllama
-      - hugoShaka
-      - jentfoo
-      - rosstimothy
-      - zmb3
-    labels:
-      - "dependencies"
-      - "go"
-      - "no-changelog"
-
   - package-ecosystem: cargo
     directory: "/"
     schedule:

.github/workflows/flaky-tests.yaml

@@ -79,7 +79,7 @@ jobs:
       - name: Run base difftest
         uses: ./.github/actions/difftest
         with:
-          flags: --skip="${{ steps.find_excluded.outputs.FLAKE_SKIP }}" -e "integrations/operator/**/*" -e "tool/tsh/**/*" -e "integration/**/*" -e "build.assets/**/*" -e "lib/auth/webauthncli/**/*" -e "lib/auth/touchid/**/*" -e "api/**/*" -e "integrations/kube-agent-updater/**/*" -e "examples/teleport-usage/**/*" -e "integrations/access/**" -e "integrations/lib/**" -e "integrations/lib/backoff/backoff_test.go" -e "e2e/**/*"
+          flags: --skip="${{ steps.find_excluded.outputs.FLAKE_SKIP }}" -e "integrations/operator/**/*" -e "tool/tsh/**/*" -e "integration/**/*" -e "build.assets/**/*" -e "lib/auth/webauthncli/**/*" -e "lib/auth/touchid/**/*" -e "api/**/*" -e "examples/teleport-usage/**/*" -e "integrations/access/**" -e "integrations/lib/**" -e "integrations/lib/backoff/backoff_test.go" -e "e2e/**/*"
           target: test-go-unit
 
       - name: Run touch-id difftest
@@ -100,12 +100,6 @@ jobs:
           flags: --skip="${{ steps.find_excluded.outputs.FLAKE_SKIP }}" --include "api/**/*" --relative "api"
           target: test-api
 
-      - name: Run kube-agent-updater difftest
-        uses: ./.github/actions/difftest
-        with:
-          flags: --skip="${{ steps.find_excluded.outputs.FLAKE_SKIP }}" --include "integrations/kube-agent-updater/**/*" --relative "integrations/kube-agent-updater"
-          target: test-kube-agent-updater
-
       - name: Run teleport-usage difftest
         uses: ./.github/actions/difftest
         with:

.github/workflows/lint.yaml

@@ -51,12 +51,6 @@ jobs:
           version: ${{ env.GOLANGCI_LINT_VERSION }}
           args: --build-tags libfido2,piv
           skip-cache: true
-      - name: golangci-lint (kube-agent-updater)
-        uses: golangci/golangci-lint-action@3a919529898de77ec3da873e3063ca4b10e7f5cc # v3.7.0
-        with:
-          version: ${{ env.GOLANGCI_LINT_VERSION }}
-          working-directory: integrations/kube-agent-updater
-          skip-cache: true
       - name: golangci-lint (assets/backport)
         uses: golangci/golangci-lint-action@3a919529898de77ec3da873e3063ca4b10e7f5cc # v3.7.0
         with:

examples/chart/teleport-kube-agent/templates/updater/deployment.yaml

@@ -65,7 +65,7 @@ spec:
           - "--agent-name={{ .Release.Name }}"
           - "--agent-namespace={{ .Release.Namespace }}"
           - "--base-image={{ include "teleport-kube-agent.baseImage" . }}"
-          - "--version-server={{ $updater.versionServer }}"
+          - "--version-server={{ tpl $updater.versionServer . }}"
           - "--version-channel={{ $updater.releaseChannel }}"
 {{- if $updater.securityContext }}
         securityContext: {{- toYaml $updater.securityContext | nindent 10 }}

examples/chart/teleport-kube-agent/tests/updater_deployment_test.yaml

@@ -57,6 +57,16 @@ tests:
       - contains:
           path: spec.template.spec.containers[0].args
           content: "--agent-namespace=my-namespace"
+  - it: defaults the updater version server to the proxy address
+    set:
+      proxyAddr: proxy.teleport.example.com:443
+      roles: "custom"
+      updater:
+        enabled: true
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: "--version-server=https://proxy.teleport.example.com:443/v1/webapi/automaticupgrades/channel"
   - it: sets the updater version server
     values:
       - ../.lint/updater.yaml

examples/chart/teleport-kube-agent/values.yaml

@@ -160,7 +160,8 @@ updater:
   # `updater.versionServer` is the URL of the version server the agent fetches
   # the target version from. The complete version endpoint is built by
   # concatenating `versionServer` and `releaseChannel`.
-  versionServer: "https://updates.releases.teleport.dev/v1/"
+  # This field supports gotemplate.
+  versionServer: "https://{{ .Values.proxyAddr }}/v1/webapi/automaticupgrades/channel"
   # Release channel the agent subscribes to.
   releaseChannel: "stable/cloud"
   image: public.ecr.aws/gravitational/teleport-kube-agent-updater