Release 17.0.0-alpha.3

[camscale]

Changes since 17.0.0-alpha.2

• Fix app access regression to apps on leaf clusters. #48334
• Allow nested inclusion of Access Lists as Members and Owners in other Access Lists. #48312
• Define a new role.allow.request field called kubernetes_resources that allows admins to define what kinds of Kubernetes resources a requester can make. #48258
• Our tctl binaries for Mac will now be built with TouchID support. #48194
• Emit an audit event with file transfer information when an SFTP session is completed. #48167
• Updated host user creation to prevent local password expiration policies from affecting Teleport managed users. #48164
• Support SSO as a second factor method in CLI clients (tsh and tctl). This is an opt-in feature. #48157
• The preset editor role now has a default RW access to aws_ic_account kind. All other role will have a default implicit RO access to the saml_idp_service_provider and aws_ic_account kind. #48103
• Warn users about upcoming OTP for session MFA deprecation (tsh). #48102
• Teleport AMIs no longer source /etc/teleport.d/conf in the Proxy Service systemd unit. Use /etc/default/teleport if you want to set Proxy Service environment variables. #48092
• Added support for Entra ID directory synchronization for clusters without public internet access. #48088
• Ensure that Teleport can re-establish broken LDAP connections. #48007