Skip to content

[teleport-update] Add entitlement for unlimited managed updates #53603

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sclevine merged 4 commits into from
May 21, 2025
Merged

[teleport-update] Add entitlement for unlimited managed updates #53603

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
b644d81
Add UnlimitedManagedUpdates entitlement
sclevine Mar 31, 2025
3ae616d
tests
sclevine May 1, 2025
b565088
more tests
sclevine May 1, 2025
727950e
rename
sclevine May 19, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
53 changes: 27 additions & 26 deletions entitlements/entitlements.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,38 +27,39 @@ type EntitlementKind string
// All EntitlementKinds added here should also be added to AllEntitlements below and defaultEntitlements in
// web/packages/teleport/src/entitlement.ts.
const (
AccessLists EntitlementKind = "AccessLists"
AccessMonitoring EntitlementKind = "AccessMonitoring"
AccessRequests EntitlementKind = "AccessRequests"
App EntitlementKind = "App"
CloudAuditLogRetention EntitlementKind = "CloudAuditLogRetention"
DB EntitlementKind = "DB"
Desktop EntitlementKind = "Desktop"
DeviceTrust EntitlementKind = "DeviceTrust"
ExternalAuditStorage EntitlementKind = "ExternalAuditStorage"
FeatureHiding EntitlementKind = "FeatureHiding"
HSM EntitlementKind = "HSM"
Identity EntitlementKind = "Identity"
JoinActiveSessions EntitlementKind = "JoinActiveSessions"
K8s EntitlementKind = "K8s"
MobileDeviceManagement EntitlementKind = "MobileDeviceManagement"
OIDC EntitlementKind = "OIDC"
OktaSCIM EntitlementKind = "OktaSCIM"
OktaUserSync EntitlementKind = "OktaUserSync"
Policy EntitlementKind = "Policy"
SAML EntitlementKind = "SAML"
SessionLocks EntitlementKind = "SessionLocks"
UpsellAlert EntitlementKind = "UpsellAlert"
UsageReporting EntitlementKind = "UsageReporting"
LicenseAutoUpdate EntitlementKind = "LicenseAutoUpdate"
AccessGraphDemoMode EntitlementKind = "AccessGraphDemoMode"
AccessLists EntitlementKind = "AccessLists"
AccessMonitoring EntitlementKind = "AccessMonitoring"
AccessRequests EntitlementKind = "AccessRequests"
App EntitlementKind = "App"
CloudAuditLogRetention EntitlementKind = "CloudAuditLogRetention"
DB EntitlementKind = "DB"
Desktop EntitlementKind = "Desktop"
DeviceTrust EntitlementKind = "DeviceTrust"
ExternalAuditStorage EntitlementKind = "ExternalAuditStorage"
FeatureHiding EntitlementKind = "FeatureHiding"
HSM EntitlementKind = "HSM"
Identity EntitlementKind = "Identity"
JoinActiveSessions EntitlementKind = "JoinActiveSessions"
K8s EntitlementKind = "K8s"
MobileDeviceManagement EntitlementKind = "MobileDeviceManagement"
OIDC EntitlementKind = "OIDC"
OktaSCIM EntitlementKind = "OktaSCIM"
OktaUserSync EntitlementKind = "OktaUserSync"
Policy EntitlementKind = "Policy"
SAML EntitlementKind = "SAML"
SessionLocks EntitlementKind = "SessionLocks"
UnrestrictedManagedUpdates EntitlementKind = "UnrestrictedManagedUpdates"
UpsellAlert EntitlementKind = "UpsellAlert"
UsageReporting EntitlementKind = "UsageReporting"
LicenseAutoUpdate EntitlementKind = "LicenseAutoUpdate"
AccessGraphDemoMode EntitlementKind = "AccessGraphDemoMode"
)

// AllEntitlements returns all Entitlements; should be 1:1 with the const declared above.
var AllEntitlements = []EntitlementKind{
AccessLists, AccessMonitoring, AccessRequests, App, CloudAuditLogRetention, DB, Desktop, DeviceTrust,
ExternalAuditStorage, FeatureHiding, HSM, Identity, JoinActiveSessions, K8s, MobileDeviceManagement, OIDC, OktaSCIM,
OktaUserSync, Policy, SAML, SessionLocks, UpsellAlert, UsageReporting, LicenseAutoUpdate, AccessGraphDemoMode,
OktaUserSync, Policy, SAML, SessionLocks, UnrestrictedManagedUpdates, UpsellAlert, UsageReporting, LicenseAutoUpdate, AccessGraphDemoMode,
}

// BackfillFeatures ensures entitlements are backwards compatible.
Expand Down
124 changes: 64 additions & 60 deletions entitlements/entitlements_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,59 +67,61 @@ func TestBackfillFeatures(t *testing.T) {
MobileDeviceManagement: false,
AccessMonitoringConfigured: false,
Entitlements: map[string]*proto.EntitlementInfo{
string(AccessLists): {Enabled: true, Limit: 111},
string(AccessMonitoring): {Enabled: true, Limit: 2113},
string(AccessRequests): {Enabled: true, Limit: 39},
string(App): {Enabled: false},
string(CloudAuditLogRetention): {Enabled: true},
string(DB): {Enabled: true},
string(Desktop): {Enabled: true},
string(DeviceTrust): {Enabled: true, Limit: 103},
string(ExternalAuditStorage): {Enabled: true},
string(FeatureHiding): {Enabled: true},
string(HSM): {Enabled: true},
string(Identity): {Enabled: true},
string(JoinActiveSessions): {Enabled: true},
string(K8s): {Enabled: true},
string(MobileDeviceManagement): {Enabled: true},
string(OIDC): {Enabled: true},
string(OktaSCIM): {Enabled: true},
string(OktaUserSync): {Enabled: true},
string(Policy): {Enabled: true},
string(SAML): {Enabled: true},
string(SessionLocks): {Enabled: true},
string(UpsellAlert): {Enabled: true},
string(UsageReporting): {Enabled: true},
string(LicenseAutoUpdate): {Enabled: true},
string(AccessGraphDemoMode): {Enabled: true},
string(AccessLists): {Enabled: true, Limit: 111},
string(AccessMonitoring): {Enabled: true, Limit: 2113},
string(AccessRequests): {Enabled: true, Limit: 39},
string(App): {Enabled: false},
string(CloudAuditLogRetention): {Enabled: true},
string(DB): {Enabled: true},
string(Desktop): {Enabled: true},
string(DeviceTrust): {Enabled: true, Limit: 103},
string(ExternalAuditStorage): {Enabled: true},
string(FeatureHiding): {Enabled: true},
string(HSM): {Enabled: true},
string(Identity): {Enabled: true},
string(JoinActiveSessions): {Enabled: true},
string(K8s): {Enabled: true},
string(MobileDeviceManagement): {Enabled: true},
string(OIDC): {Enabled: true},
string(OktaSCIM): {Enabled: true},
string(OktaUserSync): {Enabled: true},
string(Policy): {Enabled: true},
string(SAML): {Enabled: true},
string(SessionLocks): {Enabled: true},
string(UpsellAlert): {Enabled: true},
string(UsageReporting): {Enabled: true},
string(LicenseAutoUpdate): {Enabled: true},
string(AccessGraphDemoMode): {Enabled: true},
string(UnrestrictedManagedUpdates): {Enabled: true},
},
},
expected: map[string]*proto.EntitlementInfo{
string(AccessLists): {Enabled: true, Limit: 111},
string(AccessMonitoring): {Enabled: true, Limit: 2113},
string(AccessRequests): {Enabled: true, Limit: 39},
string(App): {Enabled: false},
string(CloudAuditLogRetention): {Enabled: true},
string(DB): {Enabled: true},
string(Desktop): {Enabled: true},
string(DeviceTrust): {Enabled: true, Limit: 103},
string(ExternalAuditStorage): {Enabled: true},
string(FeatureHiding): {Enabled: true},
string(HSM): {Enabled: true},
string(Identity): {Enabled: true},
string(JoinActiveSessions): {Enabled: true},
string(K8s): {Enabled: true},
string(MobileDeviceManagement): {Enabled: true},
string(OIDC): {Enabled: true},
string(OktaSCIM): {Enabled: true},
string(OktaUserSync): {Enabled: true},
string(Policy): {Enabled: true},
string(SAML): {Enabled: true},
string(SessionLocks): {Enabled: true},
string(UpsellAlert): {Enabled: true},
string(UsageReporting): {Enabled: true},
string(LicenseAutoUpdate): {Enabled: true},
string(AccessGraphDemoMode): {Enabled: true},
string(AccessLists): {Enabled: true, Limit: 111},
string(AccessMonitoring): {Enabled: true, Limit: 2113},
string(AccessRequests): {Enabled: true, Limit: 39},
string(App): {Enabled: false},
string(CloudAuditLogRetention): {Enabled: true},
string(DB): {Enabled: true},
string(Desktop): {Enabled: true},
string(DeviceTrust): {Enabled: true, Limit: 103},
string(ExternalAuditStorage): {Enabled: true},
string(FeatureHiding): {Enabled: true},
string(HSM): {Enabled: true},
string(Identity): {Enabled: true},
string(JoinActiveSessions): {Enabled: true},
string(K8s): {Enabled: true},
string(MobileDeviceManagement): {Enabled: true},
string(OIDC): {Enabled: true},
string(OktaSCIM): {Enabled: true},
string(OktaUserSync): {Enabled: true},
string(Policy): {Enabled: true},
string(SAML): {Enabled: true},
string(SessionLocks): {Enabled: true},
string(UpsellAlert): {Enabled: true},
string(UsageReporting): {Enabled: true},
string(LicenseAutoUpdate): {Enabled: true},
string(AccessGraphDemoMode): {Enabled: true},
string(UnrestrictedManagedUpdates): {Enabled: true},
},
},
{
Expand Down Expand Up @@ -192,11 +194,12 @@ func TestBackfillFeatures(t *testing.T) {
string(SAML): {Enabled: true},
string(SessionLocks): {Enabled: true},
// defaults, no legacy equivalent
string(UsageReporting): {Enabled: false},
string(UpsellAlert): {Enabled: false},
string(CloudAuditLogRetention): {Enabled: false},
string(LicenseAutoUpdate): {Enabled: false},
string(AccessGraphDemoMode): {Enabled: false},
string(UsageReporting): {Enabled: false},
string(UpsellAlert): {Enabled: false},
string(CloudAuditLogRetention): {Enabled: false},
string(LicenseAutoUpdate): {Enabled: false},
string(AccessGraphDemoMode): {Enabled: false},
string(UnrestrictedManagedUpdates): {Enabled: false},
},
},
{
Expand Down Expand Up @@ -266,11 +269,12 @@ func TestBackfillFeatures(t *testing.T) {
string(SAML): {Enabled: true},

// defaults, no legacy equivalent
string(UsageReporting): {Enabled: false},
string(UpsellAlert): {Enabled: false},
string(CloudAuditLogRetention): {Enabled: false},
string(LicenseAutoUpdate): {Enabled: false},
string(AccessGraphDemoMode): {Enabled: false},
string(UsageReporting): {Enabled: false},
string(UpsellAlert): {Enabled: false},
string(CloudAuditLogRetention): {Enabled: false},
string(LicenseAutoUpdate): {Enabled: false},
string(AccessGraphDemoMode): {Enabled: false},
string(UnrestrictedManagedUpdates): {Enabled: false},
// Identity off, fields false
string(Identity): {Enabled: false},
string(SessionLocks): {Enabled: false},
Expand Down
11 changes: 6 additions & 5 deletions lib/auth/autoupdate/autoupdatev1/service.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@ import (
"github.com/gravitational/teleport/api/types"
update "github.com/gravitational/teleport/api/types/autoupdate"
apievents "github.com/gravitational/teleport/api/types/events"
"github.com/gravitational/teleport/entitlements"
"github.com/gravitational/teleport/lib/authz"
"github.com/gravitational/teleport/lib/autoupdate/rollout"
"github.com/gravitational/teleport/lib/events"
Expand Down Expand Up @@ -1073,11 +1074,12 @@ func validateServerSideAgentConfig(config *autoupdate.AutoUpdateConfig) error {
return trace.Wrap(err, "validating autoupdate config")
}

var maxGroups int
isCloud := modules.GetModules().Features().Cloud
isLimitedCloud := modules.GetModules().Features().Cloud &&
!modules.GetModules().Features().Entitlements[entitlements.UnrestrictedManagedUpdates].Enabled

var maxGroups int
switch {
case isCloud && agentsSpec.GetStrategy() == update.AgentsStrategyHaltOnError:
case isLimitedCloud && agentsSpec.GetStrategy() == update.AgentsStrategyHaltOnError:
maxGroups = maxGroupsHaltOnErrorStrategyCloud
case agentsSpec.GetStrategy() == update.AgentsStrategyHaltOnError:
maxGroups = maxGroupsHaltOnErrorStrategy
Expand All @@ -1091,7 +1093,7 @@ func validateServerSideAgentConfig(config *autoupdate.AutoUpdateConfig) error {
return trace.BadParameter("max groups (%d) exceeded for strategy %s, %s schedule contains %d groups", maxGroups, agentsSpec.GetStrategy(), update.AgentsScheduleRegular, len(agentsSpec.GetSchedules().GetRegular()))
}

if !isCloud {
if !isLimitedCloud {
return nil
}

Expand All @@ -1109,7 +1111,6 @@ func validateServerSideAgentConfig(config *autoupdate.AutoUpdateConfig) error {
if !maps.Equal(cloudWeekdays, weekdays) {
return trace.BadParameter("weekdays must be set to %v in cloud", cloudGroupUpdateDays)
}

}

if duration := computeMinRolloutTime(agentsSpec.GetSchedules().GetRegular()); duration > maxRolloutDurationCloudHours {
Expand Down
48 changes: 48 additions & 0 deletions lib/auth/autoupdate/autoupdatev1/service_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@ import (
"github.com/gravitational/teleport/api/types"
"github.com/gravitational/teleport/api/types/autoupdate"
apievents "github.com/gravitational/teleport/api/types/events"
"github.com/gravitational/teleport/entitlements"
"github.com/gravitational/teleport/lib/authz"
"github.com/gravitational/teleport/lib/backend/memory"
libevents "github.com/gravitational/teleport/lib/events"
Expand Down Expand Up @@ -883,6 +884,14 @@ func TestValidateServerSideAgentConfig(t *testing.T) {
Cloud: true,
},
}
cloudUnlimitedModules := &modules.TestModules{
TestFeatures: modules.Features{
Cloud: true,
Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
entitlements.UnrestrictedManagedUpdates: {Enabled: true},
},
},
}
selfHostedModules := &modules.TestModules{
TestFeatures: modules.Features{
Cloud: false,
Expand Down Expand Up @@ -925,6 +934,18 @@ func TestValidateServerSideAgentConfig(t *testing.T) {
},
expectErr: require.Error,
},
{
name: "over max groups halt-on-error cloud unlimited",
modules: cloudUnlimitedModules,
config: &autoupdatev1pb.AutoUpdateConfigSpecAgents{
Mode: autoupdate.AgentsUpdateModeEnabled,
Strategy: autoupdate.AgentsStrategyHaltOnError,
Schedules: &autoupdatev1pb.AgentAutoUpdateSchedules{
Regular: generateGroups(maxGroupsHaltOnErrorStrategy+1, cloudGroupUpdateDays),
},
},
expectErr: require.Error,
},
{
name: "over max groups halt-on-error cloud",
modules: cloudModules,
Expand All @@ -949,6 +970,18 @@ func TestValidateServerSideAgentConfig(t *testing.T) {
},
expectErr: require.Error,
},
{
name: "cloud unlimited should allow custom weekdays",
modules: cloudUnlimitedModules,
config: &autoupdatev1pb.AutoUpdateConfigSpecAgents{
Mode: autoupdate.AgentsUpdateModeEnabled,
Strategy: autoupdate.AgentsStrategyHaltOnError,
Schedules: &autoupdatev1pb.AgentAutoUpdateSchedules{
Regular: generateGroups(maxGroupsHaltOnErrorStrategyCloud, []string{"Mon"}),
},
},
expectErr: require.NoError,
},
{
name: "self-hosted should allow custom weekdays",
modules: selfHostedModules,
Expand Down Expand Up @@ -976,6 +1009,21 @@ func TestValidateServerSideAgentConfig(t *testing.T) {
},
expectErr: require.Error,
},
{
name: "cloud should allow long rollouts with entitlement",
modules: cloudUnlimitedModules,
config: &autoupdatev1pb.AutoUpdateConfigSpecAgents{
Mode: autoupdate.AgentsUpdateModeEnabled,
Strategy: autoupdate.AgentsStrategyHaltOnError,
Schedules: &autoupdatev1pb.AgentAutoUpdateSchedules{
Regular: []*autoupdatev1pb.AgentAutoUpdateGroup{
{Name: "g1", Days: cloudGroupUpdateDays},
{Name: "g2", Days: cloudGroupUpdateDays, WaitHours: maxRolloutDurationCloudHours},
},
},
},
expectErr: require.NoError,
},
{
name: "self-hosted should allow long rollouts",
modules: selfHostedModules,
Expand Down
Loading
Loading