Machine ID: Add `bitbucket` join method for Bitbucket Pipelines joining by timothyb89 · Pull Request #48724 · gravitational/teleport

timothyb89 · 2024-11-09T03:56:17Z

This adds a new bitbucket join method that Machine ID bots can use to authenticate to Teleport from Bitbucket Pipelines CI runs.

Minimal bitbucket pipeline config (using a custom build on my own infra with this patch):

image: atlassian/default-image:3

pipelines:
  custom:
    run-tbot:
      - step:
          oidc: true
          script:
            - wget https://builds.cursed.industries/teleport-v17.0.0-dev-linux-amd64-bin.tar.gz
            - tar zxvf teleport-v17.0.0-dev-linux-amd64-bin.tar.gz
            - ./teleport/tbot start identity --storage=./tbot-data --destination ./tbot-user --join-method=bitbucket --proxy-server=example.cloud.gravitational.io:443 --token=bot-bitbucket --oneshot
            - ssh -F ./tbot-user/ssh_config root@b54e07fe397f.example.cloud.gravitational.io echo "hello world"

And associated bitbucket-type join token:

kind: token
version: v2
metadata:
  # name will be specified in the `tbot` to use this token
  name: bot-bitbucket
spec:
  roles: [Bot]
  # bot_name should match the name of the bot created earlier in this guide.
  bot_name: bitbucket
  join_method: bitbucket
  bitbucket:
    identity_provider_url: 'https://api.bitbucket.org/2.0/workspaces/example/pipelines-config/identity/oidc'
    audience: 'ari:cloud:bitbucket::workspace/foo'
    allow:
    - workspace_uuid: '{foo}'

Fixes #28601

changelog: Support delegated joining for Bitbucket Pipelines in Machine ID

This adds a new `bitbucket` join method that Machine ID bots can use to authenticate to Teleport from Bitbucket Pipelines CI runs.

This also fully adds `deployment_environment_uuid` which was found to be missing.

…t-pipelines-joining

github-actions · 2024-11-12T03:52:56Z

🤖 Vercel preview here: https://docs-hl9n6zvuq-goteleport.vercel.app/docs/ver/preview

public-teleport-github-review-bot · 2024-11-12T04:03:43Z

@timothyb89 - this PR will require admin approval to merge due to its size. Consider breaking it up into a series smaller changes.

github-actions · 2024-11-12T04:04:54Z

🤖 Vercel preview here: https://docs-hzp7pdojr-goteleport.vercel.app/docs/ver/preview

github-actions · 2024-11-21T18:12:22Z

🤖 Vercel preview here: https://docs-pg96y6ii0-goteleport.vercel.app/docs

github-actions · 2024-11-21T18:21:11Z

🤖 Vercel preview here: https://docs-p0hyichos-goteleport.vercel.app/docs

github-actions · 2024-11-21T22:13:36Z

🤖 Vercel preview here: https://docs-peb5ift37-goteleport.vercel.app/docs

public-teleport-github-review-bot · 2024-11-21T23:25:45Z

@timothyb89 See the table below for backport results.

Branch	Result
branch/v16	Failed
branch/v17	Failed

…ng (#48724) * Add `bitbucket` join method for Bitbucket Pipelines joining This adds a new `bitbucket` join method that Machine ID bots can use to authenticate to Teleport from Bitbucket Pipelines CI runs. * Add unit tests for bitbucket joining This also fully adds `deployment_environment_uuid` which was found to be missing. * Fix imports * Update tf docs * Docs update * Update generated TF resources * Attempt to work around docs linter * Add provision token tests * Remove pipeline_uuid and step_uuid from protos Also, fix deploment_environment_uuid field name. * Remove references to removed fields in tests * Switch to go-oidc/v3 and remove now-redundant nbf check * Fix go.mod imports for the TF provider * Fix event-handler go.mod * Address review feedback; add 15s timeout to fetch provider metadata * Update lib/bitbucket/token_validator.go Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com> * Fix build after constant rename --------- Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>

* Machine ID: Documentation for Bitbucket Pipelines joining This adds guides and other documentation for the `bitbucket` join method, which allows Machine ID bots to join from Bitbucket Pipelines runs without shared secrets. Follow up to #48724 * Linter appeasement (round 1) * Add note about braces in UUIDs

This adds guides and other documentation for the `bitbucket` join method, which allows Machine ID bots to join from Bitbucket Pipelines runs without shared secrets. Follow up to #48724

…ng (#48724) (#49335) * Add `bitbucket` join method for Bitbucket Pipelines joining This adds a new `bitbucket` join method that Machine ID bots can use to authenticate to Teleport from Bitbucket Pipelines CI runs. * Add unit tests for bitbucket joining This also fully adds `deployment_environment_uuid` which was found to be missing. * Fix imports * Update tf docs * Docs update * Update generated TF resources * Attempt to work around docs linter * Add provision token tests * Remove pipeline_uuid and step_uuid from protos Also, fix deploment_environment_uuid field name. * Remove references to removed fields in tests * Switch to go-oidc/v3 and remove now-redundant nbf check * Fix go.mod imports for the TF provider * Fix event-handler go.mod * Address review feedback; add 15s timeout to fetch provider metadata * Update lib/bitbucket/token_validator.go * Fix build after constant rename --------- Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>

* Machine ID: Documentation for Bitbucket Pipelines joining This adds guides and other documentation for the `bitbucket` join method, which allows Machine ID bots to join from Bitbucket Pipelines runs without shared secrets. Follow up to #48724 * Linter appeasement (round 1) * Add note about braces in UUIDs

… joining (#49337) * Machine ID: Add `bitbucket` join method for Bitbucket Pipelines joining (#48724) * Add `bitbucket` join method for Bitbucket Pipelines joining This adds a new `bitbucket` join method that Machine ID bots can use to authenticate to Teleport from Bitbucket Pipelines CI runs. * Add unit tests for bitbucket joining This also fully adds `deployment_environment_uuid` which was found to be missing. * Fix imports * Update tf docs * Docs update * Update generated TF resources * Attempt to work around docs linter * Add provision token tests * Remove pipeline_uuid and step_uuid from protos Also, fix deploment_environment_uuid field name. * Remove references to removed fields in tests * Switch to go-oidc/v3 and remove now-redundant nbf check * Fix go.mod imports for the TF provider * Fix event-handler go.mod * Address review feedback; add 15s timeout to fetch provider metadata * Update lib/bitbucket/token_validator.go Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com> * Fix build after constant rename --------- Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com> * Fix logger for v16 --------- Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>

* Machine ID: Documentation for Bitbucket Pipelines joining This adds guides and other documentation for the `bitbucket` join method, which allows Machine ID bots to join from Bitbucket Pipelines runs without shared secrets. Follow up to #48724 * Linter appeasement (round 1) * Add note about braces in UUIDs * Adjust steps for v16 without new CLI features * Linter appeasement * Remove reference to a specific identity output type

Add bitbucket join method for Bitbucket Pipelines joining

eda4a35

This adds a new `bitbucket` join method that Machine ID bots can use to authenticate to Teleport from Bitbucket Pipelines CI runs.

zmb3 reviewed Nov 10, 2024

View reviewed changes

Comment thread lib/bitbucket/bitbucket.go

Comment thread lib/bitbucket/token_validator.go Outdated

timothyb89 requested a review from strideynet November 11, 2024 23:31

timothyb89 added 4 commits November 11, 2024 20:31

Add unit tests for bitbucket joining

d902da1

This also fully adds `deployment_environment_uuid` which was found to be missing.

Fix imports

afd7b50

Merge remote-tracking branch 'origin/master' into timothyb89/bitbucke…

eab4ff8

…t-pipelines-joining

Update tf docs

a45b359

timothyb89 temporarily deployed to vercel November 12, 2024 03:42 — with GitHub Actions Inactive

Docs update

b3b7e30

timothyb89 temporarily deployed to vercel November 12, 2024 03:54 — with GitHub Actions Inactive

timothyb89 added backport/branch/v17 machine-id labels Nov 12, 2024

Update generated TF resources

fef4b82

timothyb89 had a problem deploying to vercel November 12, 2024 04:03 — with GitHub Actions Failure

timothyb89 marked this pull request as ready for review November 12, 2024 04:03

github-actions Bot added documentation helm size/xl labels Nov 12, 2024

github-actions Bot requested review from bernardjkim, hugoShaka, marcoandredinis, mmcallister, ptgott, r0mant, tigrato, xinding33 and zmb3 November 12, 2024 04:03

public-teleport-github-review-bot Bot removed request for bernardjkim, mmcallister, ptgott, r0mant and xinding33 November 21, 2024 18:10

Fix build after constant rename

41e54c6

timothyb89 temporarily deployed to vercel November 21, 2024 22:03 — with GitHub Actions Inactive

timothyb89 added this pull request to the merge queue Nov 21, 2024

github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Nov 21, 2024

timothyb89 added this pull request to the merge queue Nov 21, 2024

github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Nov 21, 2024

timothyb89 added this pull request to the merge queue Nov 21, 2024

Merged via the queue into master with commit dee7a6f Nov 21, 2024

timothyb89 deleted the timothyb89/bitbucket-pipelines-joining branch November 21, 2024 23:24

timothyb89 mentioned this pull request Nov 21, 2024

[v17] Machine ID: Add bitbucket join method for Bitbucket Pipelines joining (#48724) #49335

Merged

timothyb89 mentioned this pull request Nov 22, 2024

[v16] Machine ID: Add bitbucket join method for Bitbucket Pipelines joining #49337

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Machine ID: Add `bitbucket` join method for Bitbucket Pipelines joining#48724

Machine ID: Add `bitbucket` join method for Bitbucket Pipelines joining#48724
timothyb89 merged 20 commits intomasterfrom
timothyb89/bitbucket-pipelines-joining

timothyb89 commented Nov 9, 2024 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Nov 12, 2024

Uh oh!

public-teleport-github-review-bot Bot commented Nov 12, 2024

Uh oh!

github-actions Bot commented Nov 12, 2024

Uh oh!

github-actions Bot commented Nov 21, 2024

Uh oh!

github-actions Bot commented Nov 21, 2024

Uh oh!

github-actions Bot commented Nov 21, 2024

Uh oh!

Uh oh!

Uh oh!

public-teleport-github-review-bot Bot commented Nov 21, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

timothyb89 commented Nov 9, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Nov 12, 2024

Uh oh!

public-teleport-github-review-bot Bot commented Nov 12, 2024

Uh oh!

github-actions Bot commented Nov 12, 2024

Uh oh!

github-actions Bot commented Nov 21, 2024

Uh oh!

github-actions Bot commented Nov 21, 2024

Uh oh!

github-actions Bot commented Nov 21, 2024

Uh oh!

Uh oh!

Uh oh!

public-teleport-github-review-bot Bot commented Nov 21, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

timothyb89 commented Nov 9, 2024 •

edited

Loading