gravitational · camscale · Dec 14, 2023 · Dec 13, 2023
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,33 @@
 # Changelog
 
+## 13.4.11 (12/13/23)
+
+* Prevent Cloud tenants from being a leaf cluster. [#35688](https://github.com/gravitational/teleport/pull/35688)
+* Fixed regression of Kubernetes Server Address when Teleport runs in multiplex mode. [#35634](https://github.com/gravitational/teleport/pull/35634)
+* Fixed bug where configuration errors with an individual SSO connector impacted other connectors. [#35575](https://github.com/gravitational/teleport/pull/35575)
+* Fixed GCP VM auto-discovery not using instances' internal IP address. [#35522](https://github.com/gravitational/teleport/pull/35522)
+* Fixed bot being unable to view or approve access requests issue. [#35511](https://github.com/gravitational/teleport/pull/35511)
+* Fixed panic on potential nil value when requesting `/webapi/presetroles`. [#35462](https://github.com/gravitational/teleport/pull/35462)
+* Properly identify the Teleport user responsible for modifying user resources. [#35450](https://github.com/gravitational/teleport/pull/35450)
+* Added insecure-drop host user creation mode. [#35404](https://github.com/gravitational/teleport/pull/35404)
+* Updated Go to 1.20.12. [#35372](https://github.com/gravitational/teleport/pull/35372)
+* Desktop connections default to RDP port 3389 if not otherwise specified. [#35344](https://github.com/gravitational/teleport/pull/35344)
+* Added cluster_auth_preferences to the shortcuts for cluster_auth_preference. [#35328](https://github.com/gravitational/teleport/pull/35328)
+* Prevent EKS fetcher not having correct IAM permissions from stopping whole Discovery service start up. [#35323](https://github.com/gravitational/teleport/pull/35323)
+* Added email-based credential reset UI for Cloud users. [#35239](https://github.com/gravitational/teleport/pull/35239)
+* Fixed a possible panic when downgrading Teleport Roles to older versions. [#35237](https://github.com/gravitational/teleport/pull/35237)
+* OSS Teleport packages will now be published to OS package repos when private releases are cut. [#35224](https://github.com/gravitational/teleport/pull/35224)
+* Improved streaming event handling for Kubernetes API by flushing response after each event, ensuring complete, well-formed chunks. [#35196](https://github.com/gravitational/teleport/pull/35196)
+* Updated Teleport distroless OCI images to Debian 12. [#35111](https://github.com/gravitational/teleport/pull/35111)
+* Fixed FIPS distroless OCI image to run with the `--fips` flag. [#35111](https://github.com/gravitational/teleport/pull/35111)
+* Allow Teleport to complete abandoned uploads faster in HA deployments. [#35103](https://github.com/gravitational/teleport/pull/35103)
+* Added new email-based UI for inviting new local users on Teleport Cloud clusters. [#35076](https://github.com/gravitational/teleport/pull/35076)
+* Fixed issue with the absence of membership expiry circumventing membership requirements check. [#35056](https://github.com/gravitational/teleport/pull/35056)
+* Added read verb to suggested role spec when enrolling new resources. [#35052](https://github.com/gravitational/teleport/pull/35052)
+* Fixed `tsh db connect <mongodb>` to give reason on connection errors. [#34909](https://github.com/gravitational/teleport/pull/34909)
+* Fixed an issue "Allowed Users" in "tsh db ls" shows wrong user for databases with Automatic User Provisioning enabled. [#34851](https://github.com/gravitational/teleport/pull/34851)
+* Override the version of tsh kubectl with the upstream kubectl version used. [#34826](https://github.com/gravitational/teleport/pull/34826)
+
 ## 13.4.10 (11/22/23)
 
 * Device trust data is now collected concurrently on Windows [#34838](https://github.com/gravitational/teleport/pull/34838)

diff --git a/Makefile b/Makefile
@@ -11,7 +11,7 @@
 #   Stable releases:   "1.0.0"
 #   Pre-releases:      "1.0.0-alpha.1", "1.0.0-beta.2", "1.0.0-rc.3"
 #   Master/dev branch: "1.0.0-dev"
-VERSION=13.4.10
+VERSION=13.4.11
 
 DOCKER_IMAGE ?= teleport
 

diff --git a/api/version.go b/api/version.go
diff --git a/build.assets/macos/tsh/tsh.app/Contents/Info.plist b/build.assets/macos/tsh/tsh.app/Contents/Info.plist
@@ -19,13 +19,13 @@
 		<key>CFBundlePackageType</key>
 		<string>APPL</string>
 		<key>CFBundleShortVersionString</key>
-		<string>13.4.10</string>
+		<string>13.4.11</string>
 		<key>CFBundleSupportedPlatforms</key>
 		<array>
 			<string>MacOSX</string>
 		</array>
 		<key>CFBundleVersion</key>
-		<string>13.4.10</string>
+		<string>13.4.11</string>
 		<key>DTCompiler</key>
 		<string>com.apple.compilers.llvm.clang.1_0</string>
 		<key>DTPlatformBuild</key>

diff --git a/build.assets/macos/tshdev/tsh.app/Contents/Info.plist b/build.assets/macos/tshdev/tsh.app/Contents/Info.plist
@@ -17,13 +17,13 @@
 		<key>CFBundlePackageType</key>
 		<string>APPL</string>
 		<key>CFBundleShortVersionString</key>
-		<string>13.4.10</string>
+		<string>13.4.11</string>
 		<key>CFBundleSupportedPlatforms</key>
 		<array>
 			<string>MacOSX</string>
 		</array>
 		<key>CFBundleVersion</key>
-		<string>13.4.10</string>
+		<string>13.4.11</string>
 		<key>DTCompiler</key>
 		<string>com.apple.compilers.llvm.clang.1_0</string>
 		<key>DTPlatformBuild</key>

diff --git a/docs/cspell.json b/docs/cspell.json
@@ -640,6 +640,7 @@
     "pprof",
     "preconfigured",
     "prereqs",
+    "presetroles",
     "prioritise",
     "privateca",
     "privkey",

diff --git a/e b/e
diff --git a/examples/chart/teleport-cluster/Chart.yaml b/examples/chart/teleport-cluster/Chart.yaml
@@ -1,4 +1,4 @@
-.version: &version "13.4.10"
+.version: &version "13.4.11"
 
 name: teleport-cluster
 apiVersion: v2

diff --git a/examples/chart/teleport-cluster/charts/teleport-operator/Chart.yaml b/examples/chart/teleport-cluster/charts/teleport-operator/Chart.yaml
@@ -1,4 +1,4 @@
-.version: &version "13.4.10"
+.version: &version "13.4.11"
 
 name: teleport-operator
 apiVersion: v2

diff --git a/examples/chart/teleport-cluster/tests/__snapshot__/auth_deployment_test.yaml.snap b/examples/chart/teleport-cluster/tests/__snapshot__/auth_deployment_test.yaml.snap
@@ -1,6 +1,6 @@
 should add an operator side-car when operator is enabled:
   1: |
-    image: public.ecr.aws/gravitational/teleport-operator:13.4.10
+    image: public.ecr.aws/gravitational/teleport-operator:13.4.11
     imagePullPolicy: IfNotPresent
     livenessProbe:
       httpGet:
@@ -41,7 +41,7 @@ should add an operator side-car when operator is enabled:
     - args:
       - --diag-addr=0.0.0.0:3000
       - --apply-on-startup=/etc/teleport/apply-on-startup.yaml
-      image: public.ecr.aws/gravitational/teleport-distroless:13.4.10
+      image: public.ecr.aws/gravitational/teleport-distroless:13.4.11
       imagePullPolicy: IfNotPresent
       lifecycle:
         preStop:
@@ -174,7 +174,7 @@ should set nodeSelector when set in values:
     - args:
       - --diag-addr=0.0.0.0:3000
       - --apply-on-startup=/etc/teleport/apply-on-startup.yaml
-      image: public.ecr.aws/gravitational/teleport-distroless:13.4.10
+      image: public.ecr.aws/gravitational/teleport-distroless:13.4.11
       imagePullPolicy: IfNotPresent
       lifecycle:
         preStop:
@@ -271,7 +271,7 @@ should set resources when set in values:
     - args:
       - --diag-addr=0.0.0.0:3000
       - --apply-on-startup=/etc/teleport/apply-on-startup.yaml
-      image: public.ecr.aws/gravitational/teleport-distroless:13.4.10
+      image: public.ecr.aws/gravitational/teleport-distroless:13.4.11
       imagePullPolicy: IfNotPresent
       lifecycle:
         preStop:
@@ -357,7 +357,7 @@ should set securityContext when set in values:
     - args:
       - --diag-addr=0.0.0.0:3000
       - --apply-on-startup=/etc/teleport/apply-on-startup.yaml
-      image: public.ecr.aws/gravitational/teleport-distroless:13.4.10
+      image: public.ecr.aws/gravitational/teleport-distroless:13.4.11
       imagePullPolicy: IfNotPresent
       lifecycle:
         preStop:

diff --git a/examples/chart/teleport-cluster/tests/__snapshot__/proxy_deployment_test.yaml.snap b/examples/chart/teleport-cluster/tests/__snapshot__/proxy_deployment_test.yaml.snap
@@ -5,7 +5,7 @@ should provision initContainer correctly when set in values:
       - wait
       - no-resolve
       - RELEASE-NAME-auth-v12.NAMESPACE.svc.cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:13.4.10
+      image: public.ecr.aws/gravitational/teleport-distroless:13.4.11
       name: wait-auth-update
     - args:
       - echo test
@@ -62,7 +62,7 @@ should set nodeSelector when set in values:
     containers:
     - args:
       - --diag-addr=0.0.0.0:3000
-      image: public.ecr.aws/gravitational/teleport-distroless:13.4.10
+      image: public.ecr.aws/gravitational/teleport-distroless:13.4.11
       imagePullPolicy: IfNotPresent
       lifecycle:
         preStop:
@@ -123,7 +123,7 @@ should set nodeSelector when set in values:
       - wait
       - no-resolve
       - RELEASE-NAME-auth-v12.NAMESPACE.svc.cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:13.4.10
+      image: public.ecr.aws/gravitational/teleport-distroless:13.4.11
       name: wait-auth-update
     nodeSelector:
       environment: security
@@ -174,7 +174,7 @@ should set resources when set in values:
     containers:
     - args:
       - --diag-addr=0.0.0.0:3000
-      image: public.ecr.aws/gravitational/teleport-distroless:13.4.10
+      image: public.ecr.aws/gravitational/teleport-distroless:13.4.11
       imagePullPolicy: IfNotPresent
       lifecycle:
         preStop:
@@ -242,7 +242,7 @@ should set resources when set in values:
       - wait
       - no-resolve
       - RELEASE-NAME-auth-v12.NAMESPACE.svc.cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:13.4.10
+      image: public.ecr.aws/gravitational/teleport-distroless:13.4.11
       name: wait-auth-update
     serviceAccountName: RELEASE-NAME-proxy
     terminationGracePeriodSeconds: 60
@@ -275,7 +275,7 @@ should set securityContext for initContainers when set in values:
     containers:
     - args:
       - --diag-addr=0.0.0.0:3000
-      image: public.ecr.aws/gravitational/teleport-distroless:13.4.10
+      image: public.ecr.aws/gravitational/teleport-distroless:13.4.11
       imagePullPolicy: IfNotPresent
       lifecycle:
         preStop:
@@ -343,7 +343,7 @@ should set securityContext for initContainers when set in values:
       - wait
       - no-resolve
       - RELEASE-NAME-auth-v12.NAMESPACE.svc.cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:13.4.10
+      image: public.ecr.aws/gravitational/teleport-distroless:13.4.11
       name: wait-auth-update
       securityContext:
         allowPrivilegeEscalation: false
@@ -383,7 +383,7 @@ should set securityContext when set in values:
     containers:
     - args:
       - --diag-addr=0.0.0.0:3000
-      image: public.ecr.aws/gravitational/teleport-distroless:13.4.10
+      image: public.ecr.aws/gravitational/teleport-distroless:13.4.11
       imagePullPolicy: IfNotPresent
       lifecycle:
         preStop:
@@ -451,7 +451,7 @@ should set securityContext when set in values:
       - wait
       - no-resolve
       - RELEASE-NAME-auth-v12.NAMESPACE.svc.cluster.local
-      image: public.ecr.aws/gravitational/teleport-distroless:13.4.10
+      image: public.ecr.aws/gravitational/teleport-distroless:13.4.11
       name: wait-auth-update
       securityContext:
         allowPrivilegeEscalation: false

diff --git a/examples/chart/teleport-kube-agent/Chart.yaml b/examples/chart/teleport-kube-agent/Chart.yaml
@@ -1,4 +1,4 @@
-.version: &version "13.4.10"
+.version: &version "13.4.11"
 
 name: teleport-kube-agent
 apiVersion: v2