diff --git a/api/proto/teleport/legacy/types/types.proto b/api/proto/teleport/legacy/types/types.proto index 715233129b36c..e7af9bc1ad3ec 100644 --- a/api/proto/teleport/legacy/types/types.proto +++ b/api/proto/teleport/legacy/types/types.proto @@ -1987,12 +1987,12 @@ message ProvisionTokenSpecV2BoundKeypair { // public key on first join, which may be used instead of preregistering a // public key with `initial_public_key`. If `initial_public_key` is set, // this value is ignored. Otherwise, if set, this value will be used to - // populate `.status.bound_keypair.intitial_join_secret`. If unset and no + // populate `.status.bound_keypair.registration_secret`. If unset and no // `initial_public_key` is provided, a random secure value will be generated // server-side to populate the status field. string RegistrationSecret = 2 [(gogoproto.jsontag) = "registration_secret,omitempty"]; - // MustRegisterBefore is an optional time before which registeration via + // MustRegisterBefore is an optional time before which registration via // initial join secret must be performed. Attempts to register using an // initial join secret after this timestamp will not be allowed. This may be // modified after creation if necessary to allow the initial registration to @@ -2066,7 +2066,7 @@ message ProvisionTokenStatusV2BoundKeypair { // RegistrationSecret contains a secret value that may be used for public key // registration during the initial join process if no public key is // preregistered. If `.spec.bound_keypair.onboarding.initial_public_key` - // is set, †his field will remain empty. Otherwise, if + // is set, this field will remain empty. Otherwise, if // `.spec.bound_keypair.onboarding.registration_secret` is set, that value // will be copied here. If that field is unset, a value will be randomly // generated. @@ -2093,9 +2093,9 @@ message ProvisionTokenStatusV2BoundKeypair { uint32 RecoveryCount = 4 [(gogoproto.jsontag) = "recovery_count"]; // LastRecoveredAt contains a timestamp of the last successful recovery - // attempt. Note that normal renewals do not count as a recovery attempt, - // however onboarding does, either with a preregistered key or registration - // secret. This corresponds with the last time `bound_bot_instance_id` was + // attempt. Note that normal renewals with valid client certificates do not + // count as a recovery attempt, however the initial join during onboarding + // does. This corresponds with the last time `bound_bot_instance_id` was // updated. google.protobuf.Timestamp LastRecoveredAt = 5 [ (gogoproto.stdtime) = true, diff --git a/api/types/types.pb.go b/api/types/types.pb.go index 2f4abd69cae9b..7430214752459 100644 --- a/api/types/types.pb.go +++ b/api/types/types.pb.go @@ -6355,11 +6355,11 @@ type ProvisionTokenSpecV2BoundKeypair_OnboardingSpec struct { // public key on first join, which may be used instead of preregistering a // public key with `initial_public_key`. If `initial_public_key` is set, // this value is ignored. Otherwise, if set, this value will be used to - // populate `.status.bound_keypair.intitial_join_secret`. If unset and no + // populate `.status.bound_keypair.registration_secret`. If unset and no // `initial_public_key` is provided, a random secure value will be generated // server-side to populate the status field. RegistrationSecret string `protobuf:"bytes,2,opt,name=RegistrationSecret,proto3" json:"registration_secret,omitempty"` - // MustRegisterBefore is an optional time before which registeration via + // MustRegisterBefore is an optional time before which registration via // initial join secret must be performed. Attempts to register using an // initial join secret after this timestamp will not be allowed. This may be // modified after creation if necessary to allow the initial registration to @@ -6525,7 +6525,7 @@ type ProvisionTokenStatusV2BoundKeypair struct { // RegistrationSecret contains a secret value that may be used for public key // registration during the initial join process if no public key is // preregistered. If `.spec.bound_keypair.onboarding.initial_public_key` - // is set, †his field will remain empty. Otherwise, if + // is set, this field will remain empty. Otherwise, if // `.spec.bound_keypair.onboarding.registration_secret` is set, that value // will be copied here. If that field is unset, a value will be randomly // generated. @@ -6548,9 +6548,9 @@ type ProvisionTokenStatusV2BoundKeypair struct { // or `insecure`. RecoveryCount uint32 `protobuf:"varint,4,opt,name=RecoveryCount,proto3" json:"recovery_count"` // LastRecoveredAt contains a timestamp of the last successful recovery - // attempt. Note that normal renewals do not count as a recovery attempt, - // however onboarding does, either with a preregistered key or registration - // secret. This corresponds with the last time `bound_bot_instance_id` was + // attempt. Note that normal renewals with valid client certificates do not + // count as a recovery attempt, however the initial join during onboarding + // does. This corresponds with the last time `bound_bot_instance_id` was // updated. LastRecoveredAt *time.Time `protobuf:"bytes,5,opt,name=LastRecoveredAt,proto3,stdtime" json:"last_recovered_at,omitempty"` // LastRotatedAt contains a timestamp of the last time the keypair was diff --git a/docs/pages/reference/terraform-provider/data-sources/provision_token.mdx b/docs/pages/reference/terraform-provider/data-sources/provision_token.mdx index 9e442133ac75c..aaef96d6cb7a1 100644 --- a/docs/pages/reference/terraform-provider/data-sources/provision_token.mdx +++ b/docs/pages/reference/terraform-provider/data-sources/provision_token.mdx @@ -132,8 +132,8 @@ Optional: Optional: - `initial_public_key` (String) InitialPublicKey is used to preregister a public key generated by `tbot keypair create`. When set, no initial join secret is generated or made available for use, and clients must have the associated private key available to join. If set, `initial_join_secret` and `must_register_before` are ignored. This value is written in SSH authorized_keys format. -- `must_register_before` (String) MustRegisterBefore is an optional time before which registeration via initial join secret must be performed. Attempts to register using an initial join secret after this timestamp will not be allowed. This may be modified after creation if necessary to allow the initial registration to take place. This value is ignored if `initial_public_key` is set. -- `registration_secret` (String) RegistrationSecret is a secret joining clients may use to register their public key on first join, which may be used instead of preregistering a public key with `initial_public_key`. If `initial_public_key` is set, this value is ignored. Otherwise, if set, this value will be used to populate `.status.bound_keypair.intitial_join_secret`. If unset and no `initial_public_key` is provided, a random secure value will be generated server-side to populate the status field. +- `must_register_before` (String) MustRegisterBefore is an optional time before which registration via initial join secret must be performed. Attempts to register using an initial join secret after this timestamp will not be allowed. This may be modified after creation if necessary to allow the initial registration to take place. This value is ignored if `initial_public_key` is set. +- `registration_secret` (String) RegistrationSecret is a secret joining clients may use to register their public key on first join, which may be used instead of preregistering a public key with `initial_public_key`. If `initial_public_key` is set, this value is ignored. Otherwise, if set, this value will be used to populate `.status.bound_keypair.registration_secret`. If unset and no `initial_public_key` is provided, a random secure value will be generated server-side to populate the status field. ### Nested Schema for `spec.bound_keypair.recovery` @@ -351,8 +351,8 @@ Optional: - `bound_bot_instance_id` (String) BoundBotInstanceID is the ID of the currently associated bot instance. A new bot instance is issued on each join; the new bot instance will have a `previous_bot_instance` set to this value, if any. - `bound_public_key` (String) BoundPublicKey contains the currently bound public key. If `.spec.bound_keypair.onboarding.initial_public_key` is set, that value will be copied here on creation, otherwise it will be populated as part of public key registration process. This value will be updated over time if keypair rotation takes place, and will always reflect the currently trusted public key. This value is written in SSH authorized_keys format. -- `last_recovered_at` (String) LastRecoveredAt contains a timestamp of the last successful recovery attempt. Note that normal renewals do not count as a recovery attempt, however onboarding does, either with a preregistered key or registration secret. This corresponds with the last time `bound_bot_instance_id` was updated. +- `last_recovered_at` (String) LastRecoveredAt contains a timestamp of the last successful recovery attempt. Note that normal renewals with valid client certificates do not count as a recovery attempt, however the initial join during onboarding does. This corresponds with the last time `bound_bot_instance_id` was updated. - `last_rotated_at` (String) LastRotatedAt contains a timestamp of the last time the keypair was rotated, if any. This is not set at initial join. - `recovery_count` (Number) RecoveryCount is a count of the total number of recoveries performed using this token. It is incremented for every successful join or rejoin. Recovery is only allowed if this value is less than `.spec.bound_keypair.recovery.limit`, or if the recovery mode is `relaxed` or `insecure`. -- `registration_secret` (String) RegistrationSecret contains a secret value that may be used for public key registration during the initial join process if no public key is preregistered. If `.spec.bound_keypair.onboarding.initial_public_key` is set, †his field will remain empty. Otherwise, if `.spec.bound_keypair.onboarding.registration_secret` is set, that value will be copied here. If that field is unset, a value will be randomly generated. +- `registration_secret` (String) RegistrationSecret contains a secret value that may be used for public key registration during the initial join process if no public key is preregistered. If `.spec.bound_keypair.onboarding.initial_public_key` is set, this field will remain empty. Otherwise, if `.spec.bound_keypair.onboarding.registration_secret` is set, that value will be copied here. If that field is unset, a value will be randomly generated. diff --git a/docs/pages/reference/terraform-provider/resources/provision_token.mdx b/docs/pages/reference/terraform-provider/resources/provision_token.mdx index 92a5a542442c8..190905df598a6 100644 --- a/docs/pages/reference/terraform-provider/resources/provision_token.mdx +++ b/docs/pages/reference/terraform-provider/resources/provision_token.mdx @@ -171,8 +171,8 @@ Optional: Optional: - `initial_public_key` (String) InitialPublicKey is used to preregister a public key generated by `tbot keypair create`. When set, no initial join secret is generated or made available for use, and clients must have the associated private key available to join. If set, `initial_join_secret` and `must_register_before` are ignored. This value is written in SSH authorized_keys format. -- `must_register_before` (String) MustRegisterBefore is an optional time before which registeration via initial join secret must be performed. Attempts to register using an initial join secret after this timestamp will not be allowed. This may be modified after creation if necessary to allow the initial registration to take place. This value is ignored if `initial_public_key` is set. -- `registration_secret` (String) RegistrationSecret is a secret joining clients may use to register their public key on first join, which may be used instead of preregistering a public key with `initial_public_key`. If `initial_public_key` is set, this value is ignored. Otherwise, if set, this value will be used to populate `.status.bound_keypair.intitial_join_secret`. If unset and no `initial_public_key` is provided, a random secure value will be generated server-side to populate the status field. +- `must_register_before` (String) MustRegisterBefore is an optional time before which registration via initial join secret must be performed. Attempts to register using an initial join secret after this timestamp will not be allowed. This may be modified after creation if necessary to allow the initial registration to take place. This value is ignored if `initial_public_key` is set. +- `registration_secret` (String) RegistrationSecret is a secret joining clients may use to register their public key on first join, which may be used instead of preregistering a public key with `initial_public_key`. If `initial_public_key` is set, this value is ignored. Otherwise, if set, this value will be used to populate `.status.bound_keypair.registration_secret`. If unset and no `initial_public_key` is provided, a random secure value will be generated server-side to populate the status field. ### Nested Schema for `spec.bound_keypair.recovery` @@ -390,7 +390,7 @@ Optional: - `bound_bot_instance_id` (String) BoundBotInstanceID is the ID of the currently associated bot instance. A new bot instance is issued on each join; the new bot instance will have a `previous_bot_instance` set to this value, if any. - `bound_public_key` (String) BoundPublicKey contains the currently bound public key. If `.spec.bound_keypair.onboarding.initial_public_key` is set, that value will be copied here on creation, otherwise it will be populated as part of public key registration process. This value will be updated over time if keypair rotation takes place, and will always reflect the currently trusted public key. This value is written in SSH authorized_keys format. -- `last_recovered_at` (String) LastRecoveredAt contains a timestamp of the last successful recovery attempt. Note that normal renewals do not count as a recovery attempt, however onboarding does, either with a preregistered key or registration secret. This corresponds with the last time `bound_bot_instance_id` was updated. +- `last_recovered_at` (String) LastRecoveredAt contains a timestamp of the last successful recovery attempt. Note that normal renewals with valid client certificates do not count as a recovery attempt, however the initial join during onboarding does. This corresponds with the last time `bound_bot_instance_id` was updated. - `last_rotated_at` (String) LastRotatedAt contains a timestamp of the last time the keypair was rotated, if any. This is not set at initial join. - `recovery_count` (Number) RecoveryCount is a count of the total number of recoveries performed using this token. It is incremented for every successful join or rejoin. Recovery is only allowed if this value is less than `.spec.bound_keypair.recovery.limit`, or if the recovery mode is `relaxed` or `insecure`. -- `registration_secret` (String) RegistrationSecret contains a secret value that may be used for public key registration during the initial join process if no public key is preregistered. If `.spec.bound_keypair.onboarding.initial_public_key` is set, †his field will remain empty. Otherwise, if `.spec.bound_keypair.onboarding.registration_secret` is set, that value will be copied here. If that field is unset, a value will be randomly generated. +- `registration_secret` (String) RegistrationSecret contains a secret value that may be used for public key registration during the initial join process if no public key is preregistered. If `.spec.bound_keypair.onboarding.initial_public_key` is set, this field will remain empty. Otherwise, if `.spec.bound_keypair.onboarding.registration_secret` is set, that value will be copied here. If that field is unset, a value will be randomly generated. diff --git a/integrations/terraform/tfschema/types_terraform.go b/integrations/terraform/tfschema/types_terraform.go index 8ddd65626f991..f5f8bd2845ff6 100644 --- a/integrations/terraform/tfschema/types_terraform.go +++ b/integrations/terraform/tfschema/types_terraform.go @@ -1324,12 +1324,12 @@ func GenSchemaProvisionTokenV2(ctx context.Context) (github_com_hashicorp_terraf Type: github_com_hashicorp_terraform_plugin_framework_types.StringType, }, "must_register_before": { - Description: "MustRegisterBefore is an optional time before which registeration via initial join secret must be performed. Attempts to register using an initial join secret after this timestamp will not be allowed. This may be modified after creation if necessary to allow the initial registration to take place. This value is ignored if `initial_public_key` is set.", + Description: "MustRegisterBefore is an optional time before which registration via initial join secret must be performed. Attempts to register using an initial join secret after this timestamp will not be allowed. This may be modified after creation if necessary to allow the initial registration to take place. This value is ignored if `initial_public_key` is set.", Optional: true, Type: UseRFC3339Time(), }, "registration_secret": { - Description: "RegistrationSecret is a secret joining clients may use to register their public key on first join, which may be used instead of preregistering a public key with `initial_public_key`. If `initial_public_key` is set, this value is ignored. Otherwise, if set, this value will be used to populate `.status.bound_keypair.intitial_join_secret`. If unset and no `initial_public_key` is provided, a random secure value will be generated server-side to populate the status field.", + Description: "RegistrationSecret is a secret joining clients may use to register their public key on first join, which may be used instead of preregistering a public key with `initial_public_key`. If `initial_public_key` is set, this value is ignored. Otherwise, if set, this value will be used to populate `.status.bound_keypair.registration_secret`. If unset and no `initial_public_key` is provided, a random secure value will be generated server-side to populate the status field.", Optional: true, Type: github_com_hashicorp_terraform_plugin_framework_types.StringType, }, @@ -1797,7 +1797,7 @@ func GenSchemaProvisionTokenV2(ctx context.Context) (github_com_hashicorp_terraf Type: github_com_hashicorp_terraform_plugin_framework_types.StringType, }, "last_recovered_at": { - Description: "LastRecoveredAt contains a timestamp of the last successful recovery attempt. Note that normal renewals do not count as a recovery attempt, however onboarding does, either with a preregistered key or registration secret. This corresponds with the last time `bound_bot_instance_id` was updated.", + Description: "LastRecoveredAt contains a timestamp of the last successful recovery attempt. Note that normal renewals with valid client certificates do not count as a recovery attempt, however the initial join during onboarding does. This corresponds with the last time `bound_bot_instance_id` was updated.", Optional: true, Type: UseRFC3339Time(), }, @@ -1812,7 +1812,7 @@ func GenSchemaProvisionTokenV2(ctx context.Context) (github_com_hashicorp_terraf Type: github_com_hashicorp_terraform_plugin_framework_types.Int64Type, }, "registration_secret": { - Description: "RegistrationSecret contains a secret value that may be used for public key registration during the initial join process if no public key is preregistered. If `.spec.bound_keypair.onboarding.initial_public_key` is set, †his field will remain empty. Otherwise, if `.spec.bound_keypair.onboarding.registration_secret` is set, that value will be copied here. If that field is unset, a value will be randomly generated.", + Description: "RegistrationSecret contains a secret value that may be used for public key registration during the initial join process if no public key is preregistered. If `.spec.bound_keypair.onboarding.initial_public_key` is set, this field will remain empty. Otherwise, if `.spec.bound_keypair.onboarding.registration_secret` is set, that value will be copied here. If that field is unset, a value will be randomly generated.", Optional: true, Type: github_com_hashicorp_terraform_plugin_framework_types.StringType, },