Fix major version check for stateless environment

api/proto/teleport/authinfo/v1/authinfo.proto

@@ -0,0 +1,37 @@
+// Copyright 2025 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package teleport.authinfo.v1;
+
+import "teleport/header/v1/metadata.proto";
+
+option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/authinfo/v1;authinfov1";
+
+// AuthInfo holds meta-information for specific server.
+message AuthInfo {
+  string kind = 1;
+  string sub_kind = 2;
+  string version = 3;
+  teleport.header.v1.Metadata metadata = 4;
+
+  AuthInfoSpec spec = 5;
+}
+
+// AuthInfoSpec encodes the parameters auth server meta-information.
+message AuthInfoSpec {
+  // teleport_version advertises the version of the auth server, e.g., "17.3.3" (without the leading "v").
+  string teleport_version = 1;
+}

api/types/authinfo/info.go

@@ -0,0 +1,59 @@
+/*
+Copyright 2025 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package authinfo
+
+import (
+	"github.com/gravitational/trace"
+
+	authinfov1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/authinfo/v1"
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	"github.com/gravitational/teleport/api/types"
+)
+
+// NewAuthInfo creates a new auth info resource.
+func NewAuthInfo(spec *authinfov1.AuthInfoSpec) (*authinfov1.AuthInfo, error) {
+	info := &authinfov1.AuthInfo{
+		Kind:    types.KindAuthInfo,
+		Version: types.V1,
+		Metadata: &headerv1.Metadata{
+			Name: types.MetaNameAuthInfo,
+		},
+		Spec: spec,
+	}
+	if err := ValidateAuthInfo(info); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return info, nil
+}
+
+// ValidateAuthInfo checks that required parameters are set
+// for the specified AuthInfo.
+func ValidateAuthInfo(info *authinfov1.AuthInfo) error {
+	switch {
+	case info.GetKind() != types.KindAuthInfo:
+		return trace.BadParameter("wrong AuthInfo Kind: %+q", info.Kind)
+	case info.GetMetadata().Name != types.MetaNameAuthInfo:
+		return trace.BadParameter("wrong AuthInfo Metadata name: %+q", info.GetMetadata().Name)
+	case info.GetSubKind() != "":
+		return trace.BadParameter("wrong AuthInfo SubKind: %+q", info.GetSubKind())
+	case info.GetVersion() != types.V1:
+		return trace.BadParameter("wrong AuthInfo Version: %+q", info.GetVersion())
+	default:
+		return nil
+	}
+}

api/types/constants.go

@@ -516,6 +516,12 @@ const (
 	// KindServerInfo contains info that should be applied to joining Nodes.
 	KindServerInfo = "server_info"
 
+	// KindAuthInfo contains auth server info.
+	KindAuthInfo = "auth_info"
+
+	// MetaNameAuthInfo name auth server info entity.
+	MetaNameAuthInfo = "auth-info"
+
 	// SubKindCloudInfo is a ServerInfo that was created by the Discovery
 	// service to match with a single discovered instance.
 	SubKindCloudInfo = "cloud_info"

lib/auth/auth.go

@@ -439,6 +439,12 @@ func NewServer(cfg *InitConfig, opts ...ServerOption) (*Server, error) {
 			return nil, trace.Wrap(err, "creating HealthCheckConfigs service")
 		}
 	}
+	if cfg.AuthInfo == nil {
+		cfg.AuthInfo, err = local.NewAuthInfoService(cfg.Backend)
+		if err != nil {
+			return nil, trace.Wrap(err, "creating AuthInfo service")
+		}
+	}
 
 	if cfg.Logger == nil {
 		cfg.Logger = slog.With(teleport.ComponentKey, teleport.ComponentAuth)
@@ -545,6 +551,7 @@ func NewServer(cfg *InitConfig, opts ...ServerOption) (*Server, error) {
 		WorkloadIdentityX509Overrides:   cfg.WorkloadIdentityX509Overrides,
 		SigstorePolicies:                cfg.SigstorePolicies,
 		HealthCheckConfig:               cfg.HealthCheckConfig,
+		AuthInfoService:                 cfg.AuthInfo,
 	}
 
 	as := Server{
@@ -781,6 +788,7 @@ type Services struct {
 	services.WorkloadIdentityX509Overrides
 	services.SigstorePolicies
 	services.HealthCheckConfig
+	services.AuthInfoService
 }
 
 // GetWebSession returns existing web session described by req.

lib/auth/helpers.go

@@ -1231,12 +1231,12 @@ func NewFakeTeleportVersion() *FakeTeleportVersion {
 }
 
 // GetTeleportVersion returns current Teleport version.
-func (s FakeTeleportVersion) GetTeleportVersion(_ context.Context) (*semver.Version, error) {
-	return teleport.SemVersion, nil
+func (s FakeTeleportVersion) GetTeleportVersion(_ context.Context) (semver.Version, error) {
+	return *teleport.SemVersion, nil
 }
 
 // WriteTeleportVersion stub function for writing.
-func (s FakeTeleportVersion) WriteTeleportVersion(_ context.Context, _ *semver.Version) error {
+func (s FakeTeleportVersion) WriteTeleportVersion(_ context.Context, _ semver.Version) error {
 	return nil
 }