diff --git a/.github/ISSUE_TEMPLATE/testplan.md b/.github/ISSUE_TEMPLATE/testplan.md index 43f25f0d315c9..e54b5bf3c790b 100644 --- a/.github/ISSUE_TEMPLATE/testplan.md +++ b/.github/ISSUE_TEMPLATE/testplan.md @@ -180,67 +180,114 @@ as well as an upgrade of the previous version of Teleport. - [ ] Interact with a cluster using `tsh` - These commands should ideally be tested for recording and non-recording modes as they are implemented in a different ways. - - - [ ] tsh ssh \ - - [ ] tsh ssh \ - - [ ] tsh ssh \ - - [ ] tsh ssh \ - - [ ] tsh ssh -A \ - - [ ] tsh ssh -A \ - - [ ] tsh ssh -A \ - - [ ] tsh ssh -A \ - - [ ] tsh ssh \ ls - - [ ] tsh ssh \ ls - - [ ] tsh ssh \ ls - - [ ] tsh ssh \ ls - - [ ] tsh join \ - - [ ] tsh join \ - - [ ] tsh play \ - - [ ] tsh play \ - - [ ] tsh play \ - - [ ] tsh play \ - - [ ] tsh scp \ - - [ ] tsh scp \ - - [ ] tsh scp \ - - [ ] tsh scp \ - - [ ] tsh ssh -L \ - - [ ] tsh ssh -L \ - - [ ] tsh ssh -L \ - - [ ] tsh ssh -L \ - - [ ] tsh ssh -R \ - - [ ] tsh ssh -R \ - - [ ] tsh ssh -R \ - - [ ] tsh ssh -R \ - - [ ] tsh ls - - [ ] tsh clusters + These commands should ideally be tested for recording and non-recording modes as they are implemented in a different ways. + Recording can be disabled by adding `session_recording: off` to `auth_service` in your config. A regular node refers to + a [Teleport SSH service](https://goteleport.com/docs/enroll-resources/server-access/getting-started/). An agentless node is an [OpenSSH server](https://goteleport.com/docs/enroll-resources/server-access/openssh/openssh-agentless) that has been enrolled into Teleport. A remote cluster is a leaf cluster that is connected to a root cluster via a [trusted cluster setup](https://goteleport.com/docs/admin-guides/management/admin/trustedclusters/). Here's a recommended setup for testing: + +``` + ┌───────────────┐ + │ │ + ┌►│ Regular Node │ +┌───────────────┐ ┌───────────────┐ │ │ │ +│ │ │ │ │ └───────────────┘ +│ Root Cluster ├───►│ Leaf Cluster ├─┤ +│ │ │ │ │ ┌───────────────┐ +└───────────────┘ └───────────────┘ │ │ │ + └►│ OpenSSH Node │ + │ │ + └───────────────┘ +``` + +When you want to test a non-remote-cluster, use the Leaf Cluster as your proxy target. + + - [ ] `tsh ssh ` + - [ ] `tsh ssh ` + - [ ] `tsh ssh ` + - [ ] `tsh ssh ` + +Test agent had been forwarded by running `ssh-add -L` and check that your teleport keys are listed. Each cluster requires the `permit-agent-forwarding` flag and the role you're assuming in the leaf cluster needs `Agent Forwarding` enabled. Example connection command: +`tsh ssh -A --proxy $PROXY --cluster $REMOTE_CLUSTER $USER@$NODE_NAME` + + - [ ] `tsh ssh -A ` + - [ ] `tsh ssh -A ` + - [ ] `tsh ssh -A ` + - [ ] `tsh ssh -A ` + - [ ] `tsh ssh ls` + - [ ] `tsh ssh ls` + - [ ] `tsh ssh ls` + - [ ] `tsh ssh ls` + - [ ] `tsh join ` + - [ ] `tsh join ` + +For `tsh play`, ensure the role you assume on the leaf cluster has `read` and `list` for the `session` resource. Example allow rule: +```yaml +spec: + allow: + rules: + - resources: + - session + verbs: + - read + - list +``` + + - [ ] `tsh play ` + - [ ] `tsh play ` + - [ ] `tsh play ` + - [ ] `tsh play ` + - [ ] `tsh scp ` + - [ ] `tsh scp ` + - [ ] `tsh scp ` + - [ ] `tsh scp ` + +This forwards the local port to the remote node, test this with a web server running on the remote node, e.g. `python3 -m http.server 8000` on the remote node, setup a tunnel to the node with `tsh ssh -L 9000:localhost:8000 `, then `curl http://localhost:9000` from your local machine. + + - [ ] `tsh ssh -L ` + - [ ] `tsh ssh -L ` + - [ ] `tsh ssh -L ` + - [ ] `tsh ssh -L ` + +`-R` forwards the remote port to the local machine, test this with a web server running on your local machine, e.g. `python3 -m http.server 8000`, setup a tunnel to the node with `tsh ssh -R 9000:localhost:8000 `, then `curl http://localhost:9000` from the remote node. + + - [ ] `tsh ssh -R ` + - [ ] `tsh ssh -R ` + - [ ] `tsh ssh -R ` + - [ ] `tsh ssh -R ` + - [ ] `tsh ls` + - [ ] `tsh clusters` - [ ] Interact with a cluster using `ssh` - Make sure to test both recording and regular proxy modes. - - [ ] ssh \ - - [ ] ssh \ - - [ ] ssh \ - - [ ] ssh \ - - [ ] ssh -A \ - - [ ] ssh -A \ - - [ ] ssh -A \ - - [ ] ssh -A \ - - [ ] ssh \ ls - - [ ] ssh \ ls - - [ ] ssh \ ls - - [ ] ssh \ ls - - [ ] scp \ - - [ ] scp \ - - [ ] scp \ - - [ ] scp \ - - [ ] ssh -L \ - - [ ] ssh -L \ - - [ ] ssh -L \ - - [ ] ssh -L \ - - [ ] ssh -R \ - - [ ] ssh -R \ - - [ ] ssh -R \ - - [ ] ssh -R \ + + Make sure to test both recording and regular proxy modes. Generate an [SSH config](https://goteleport.com/docs/reference/cli/tsh/#tsh-config), one per cluster. An SSH command will look something like this: + + `ssh -p 22 -F /path/to/generated/ssh_config @.` + + To test connecting to a remote cluster, use the root cluster's `ssh_config` and the name of the remote cluster for ``. + + - [ ] `ssh ` + - [ ] `ssh ` + - [ ] `ssh ` + - [ ] `ssh ` + - [ ] `ssh -A ` + - [ ] `ssh -A ` + - [ ] `ssh -A ` + - [ ] `ssh -A ` + - [ ] `ssh ls` + - [ ] `ssh ls` + - [ ] `ssh ls` + - [ ] `ssh ls` + - [ ] `scp ` + - [ ] `scp ` + - [ ] `scp ` + - [ ] `scp ` + - [ ] `ssh -L ` + - [ ] `ssh -L ` + - [ ] `ssh -L ` + - [ ] `ssh -L ` + - [ ] `ssh -R ` + - [ ] `ssh -R ` + - [ ] `ssh -R ` + - [ ] `ssh -R ` - [ ] Verify proxy jump functionality Log into leaf cluster via root, shut down the root proxy and verify proxy jump works.