[v17] Fix major version check for stateless environment

api/proto/teleport/backendinfo/v1/backendinfo.proto

@@ -0,0 +1,40 @@
+// Copyright 2025 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package teleport.backendinfo.v1;
+
+import "teleport/header/v1/metadata.proto";
+
+option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/backendinfo/v1;backendinfov1";
+
+// BackendInfo is a singleton resource that holds meta-information for the cluster's auth service.
+// It is used to store the auth instance last known version and is managed by the major version
+// check validator. After a cluster upgrade with a new version of the auth service, this
+// information is overridden with data from the new auth instance.
+message BackendInfo {
+  string kind = 1;
+  string sub_kind = 2;
+  string version = 3;
+  teleport.header.v1.Metadata metadata = 4;
+
+  BackendInfoSpec spec = 5;
+}
+
+// BackendInfoSpec encodes the parameters auth server meta-information.
+message BackendInfoSpec {
+  // teleport_version advertises the version of the auth server, e.g., "17.3.3" (without the leading "v").
+  string teleport_version = 1;
+}

api/types/backendinfo/info.go

@@ -0,0 +1,59 @@
+/*
+Copyright 2025 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package backendinfo
+
+import (
+	"github.com/gravitational/trace"
+
+	backendinfov1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/backendinfo/v1"
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	"github.com/gravitational/teleport/api/types"
+)
+
+// NewBackendInfo creates a new auth info resource.
+func NewBackendInfo(spec *backendinfov1.BackendInfoSpec) (*backendinfov1.BackendInfo, error) {
+	info := &backendinfov1.BackendInfo{
+		Kind:    types.KindBackendInfo,
+		Version: types.V1,
+		Metadata: &headerv1.Metadata{
+			Name: types.MetaNameBackendInfo,
+		},
+		Spec: spec,
+	}
+	if err := ValidateBackendInfo(info); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return info, nil
+}
+
+// ValidateBackendInfo checks that required parameters are set
+// for the specified BackendInfo.
+func ValidateBackendInfo(info *backendinfov1.BackendInfo) error {
+	switch {
+	case info.GetKind() != types.KindBackendInfo:
+		return trace.BadParameter("wrong BackendInfo Kind: %+q", info.Kind)
+	case info.GetMetadata().Name != types.MetaNameBackendInfo:
+		return trace.BadParameter("wrong BackendInfo Metadata name: %+q", info.GetMetadata().Name)
+	case info.GetSubKind() != "":
+		return trace.BadParameter("wrong BackendInfo SubKind: %+q", info.GetSubKind())
+	case info.GetVersion() != types.V1:
+		return trace.BadParameter("wrong BackendInfo Version: %+q", info.GetVersion())
+	default:
+		return nil
+	}
+}

api/types/constants.go

@@ -513,6 +513,12 @@ const (
 	// KindServerInfo contains info that should be applied to joining Nodes.
 	KindServerInfo = "server_info"
 
+	// KindBackendInfo contains backend info.
+	KindBackendInfo = "backend_info"
+
+	// MetaNameBackendInfo name backend info entity.
+	MetaNameBackendInfo = "backend-info"
+
 	// SubKindCloudInfo is a ServerInfo that was created by the Discovery
 	// service to match with a single discovered instance.
 	SubKindCloudInfo = "cloud_info"

lib/auth/auth.go

@@ -432,6 +432,12 @@ func NewServer(cfg *InitConfig, opts ...ServerOption) (*Server, error) {
 			Backend: cfg.Backend,
 		}
 	}
+	if cfg.BackendInfo == nil {
+		cfg.BackendInfo, err = local.NewBackendInfoService(cfg.Backend)
+		if err != nil {
+			return nil, trace.Wrap(err, "creating BackendInfo service")
+		}
+	}
 
 	if cfg.Logger == nil {
 		cfg.Logger = slog.With(teleport.ComponentKey, teleport.ComponentAuth)
@@ -536,6 +542,7 @@ func NewServer(cfg *InitConfig, opts ...ServerOption) (*Server, error) {
 		WorkloadIdentityX509Revocations: cfg.WorkloadIdentityX509Revocations,
 		StableUNIXUsersInternal:         cfg.StableUNIXUsers,
 		WorkloadIdentityX509Overrides:   cfg.WorkloadIdentityX509Overrides,
+		BackendInfoService:              cfg.BackendInfo,
 	}
 
 	as := Server{
@@ -760,6 +767,7 @@ type Services struct {
 	services.WorkloadIdentityX509Revocations
 	services.StableUNIXUsersInternal
 	services.WorkloadIdentityX509Overrides
+	services.BackendInfoService
 }
 
 // GetWebSession returns existing web session described by req.