Skip to content

Machine ID: Leaf cluster support for SSH multiplexer#43484

Merged
strideynet merged 8 commits intomasterfrom
strideynet/ssh-multiplexer-multi-cluster-support
Jun 28, 2024
Merged

Machine ID: Leaf cluster support for SSH multiplexer#43484
strideynet merged 8 commits intomasterfrom
strideynet/ssh-multiplexer-multi-cluster-support

Conversation

@strideynet
Copy link
Copy Markdown
Contributor

@strideynet strideynet commented Jun 25, 2024

Closes #43477

Modifies the SSH multiplexer protocol to support specifying a target cluster and modifies the generation of the known_hosts and ssh_config to include all accessible clusters.

The additional "|cluster" suffix added to the protocol is optional - if omitted the old behaviour of using the cluster that the bot has authenticated is used. This means that using a ssh_config generated by a previous version with a newer version of tbot will not result in an error.

However, the opposite is not true. Using a ssh_config generated by a newer tbot with an older tbot's tunnel will result in an error:

~/code/gravitational/teleport git:[master]
ssh -F ../teleport-scratch/tbot-ssh/ssh-proxy/ssh_config_old -p 13022 noah@macbook.root.tele.ottr.sh echo foo
failed connecting to host macbook:13022|root.tele.ottr.sh: failed to receive cluster details response
        failed to dial target host
        direct dialing to nodes not found in inventory is not supported
Connection closed by /Users/noah/code/gravitational/teleport-scratch/tbot-ssh/ssh-proxy/v1.sock port 0

We could roll to a v2.sock to make this error a little clearer since the socket wouldn't exist, but, they'd still get an error. Given that the ssh_config is generated by the tbot that hosts the tunnel, the only scenario where this could be encountered is if the user maintains a custom ssh_config and starts using cluster targetting with an older version of tbot. Additionally, the SSH multiplexer has only existed for 1 or 2 patch versions. This makes it feel to me like it's not worth rolling to v2.sock - but let me know your thoughts.

changelog: Added support for dialling leaf clusters to the tbot SSH multiplexer

@strideynet strideynet marked this pull request as ready for review June 27, 2024 12:45
@gravitational gravitational deleted a comment from github-actions Bot Jun 27, 2024
@gravitational gravitational deleted a comment from github-actions Bot Jun 27, 2024
@strideynet strideynet added this pull request to the merge queue Jun 28, 2024
Merged via the queue into master with commit 95f67eb Jun 28, 2024
@strideynet strideynet deleted the strideynet/ssh-multiplexer-multi-cluster-support branch June 28, 2024 09:35
@public-teleport-github-review-bot
Copy link
Copy Markdown

@strideynet See the table below for backport results.

Branch Result
branch/v15 Failed
branch/v16 Failed

strideynet added a commit that referenced this pull request Jun 28, 2024
* Start hacking on multicluster support for ssh multiplexer

* Support specifying cluster name via multiplexing request

* Generate known_hosts and ssh_config with multiple clusters

* Remove unnecessary parameter

* Test for specified and unspecified cluster name

* Clarify comment
strideynet added a commit that referenced this pull request Jun 28, 2024
* Start hacking on multicluster support for ssh multiplexer

* Support specifying cluster name via multiplexing request

* Generate known_hosts and ssh_config with multiple clusters

* Remove unnecessary parameter

* Test for specified and unspecified cluster name

* Clarify comment
github-merge-queue Bot pushed a commit that referenced this pull request Jun 28, 2024
…43635)

* Machine ID: Leaf cluster support for SSH multiplexer (#43484)

* Start hacking on multicluster support for ssh multiplexer

* Support specifying cluster name via multiplexing request

* Generate known_hosts and ssh_config with multiple clusters

* Remove unnecessary parameter

* Test for specified and unspecified cluster name

* Clarify comment

* Remove unnecessary ctx arg
github-merge-queue Bot pushed a commit that referenced this pull request Jun 28, 2024
* Start hacking on multicluster support for ssh multiplexer

* Support specifying cluster name via multiplexing request

* Generate known_hosts and ssh_config with multiple clusters

* Remove unnecessary parameter

* Test for specified and unspecified cluster name

* Clarify comment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Machine ID: SSH multiplexer should support Leaf clusters.

3 participants