Adding scoped joining of nodes using dynamic tokens by eriktate · Pull Request #60362 · gravitational/teleport

eriktate · 2025-10-17T15:59:09Z

This PR makes it possible to provision SSH nodes using scoped join tokens. The scope will be applied as metadata in both the instance and node host certificates.

lib/auth/state/identity.go

lib/auth/grpcserver.go

lib/decision/ssh_identity_test.go

lib/sshca/identity_test.go

api/proto/teleport/legacy/client/proto/authservice.proto

lib/auth/register.go

lib/join/iamjoin/iam.go

lib/join/join_test.go

lib/scopes/joining/token.go

lib/auth/state/identity.go

lib/auth/auth.go

lib/auth/join.go

lib/auth/auth.go

fspmarshall

Made some minor suggestions in the open discussion threads, but looks great overall.

…60362)

…60362) (#60758)

…60362)

eriktate force-pushed the eriktate/scoped-joins branch 2 times, most recently from bf2f583 to fb85a16 Compare October 17, 2025 18:39

rosstimothy reviewed Oct 17, 2025

View reviewed changes

lib/auth/state/identity.go Outdated Show resolved Hide resolved

lib/auth/grpcserver.go Outdated Show resolved Hide resolved

lib/decision/ssh_identity_test.go Outdated Show resolved Hide resolved

lib/sshca/identity_test.go Outdated Show resolved Hide resolved

eriktate force-pushed the eriktate/tctl-scoped-tokens branch from 39d932c to e20ed0e Compare October 20, 2025 19:47

eriktate force-pushed the eriktate/scoped-joins branch from fb85a16 to 1aa1adf Compare October 20, 2025 19:47

eriktate force-pushed the eriktate/tctl-scoped-tokens branch from e20ed0e to c9042a7 Compare October 20, 2025 20:10

eriktate force-pushed the eriktate/scoped-joins branch from 1aa1adf to cfd7cc1 Compare October 20, 2025 20:10

eriktate marked this pull request as ready for review October 20, 2025 22:58

eriktate requested review from fspmarshall and nklaassen October 20, 2025 22:58

github-actions bot added size/md tctl tctl - Teleport admin tool labels Oct 20, 2025

github-actions bot requested review from aadc-dev and avatus October 20, 2025 22:58

nklaassen reviewed Oct 21, 2025

View reviewed changes

eriktate force-pushed the eriktate/tctl-scoped-tokens branch from c9042a7 to cd3713a Compare October 21, 2025 11:49

eriktate force-pushed the eriktate/scoped-joins branch from cfd7cc1 to 93d5347 Compare October 21, 2025 11:58

eriktate force-pushed the eriktate/tctl-scoped-tokens branch from cd3713a to 802d9d2 Compare October 21, 2025 11:59

eriktate force-pushed the eriktate/scoped-joins branch from 93d5347 to 4007d49 Compare October 21, 2025 11:59

eriktate force-pushed the eriktate/tctl-scoped-tokens branch from 802d9d2 to bd5fbae Compare October 21, 2025 12:02

eriktate force-pushed the eriktate/scoped-joins branch 2 times, most recently from 52df527 to 8635dd6 Compare October 21, 2025 16:49

eriktate force-pushed the eriktate/tctl-scoped-tokens branch from a06ffaa to b4d17ad Compare October 21, 2025 16:49

eriktate force-pushed the eriktate/scoped-joins branch from 2ac53c5 to 5c26910 Compare October 21, 2025 17:39

nklaassen reviewed Oct 21, 2025

View reviewed changes

lib/auth/auth.go Outdated Show resolved Hide resolved

eriktate force-pushed the eriktate/tctl-scoped-tokens branch from b4d17ad to 3d2df71 Compare October 21, 2025 17:53

eriktate force-pushed the eriktate/scoped-joins branch 2 times, most recently from 507a010 to 94859ac Compare October 21, 2025 18:06

eriktate force-pushed the eriktate/tctl-scoped-tokens branch from 3d2df71 to 53825d3 Compare October 21, 2025 20:51

eriktate force-pushed the eriktate/scoped-joins branch from 7db0ce6 to 517043a Compare October 21, 2025 20:54

eriktate force-pushed the eriktate/scoped-joins branch from 9d761ca to d5c4fd5 Compare October 27, 2025 16:44

eriktate force-pushed the eriktate/tctl-scoped-tokens branch from 3d97d66 to 73b2a30 Compare October 27, 2025 16:45

eriktate force-pushed the eriktate/scoped-joins branch from d5c4fd5 to 010fbaa Compare October 27, 2025 18:25

eriktate added the no-changelog Indicates that a PR does not require a changelog entry label Oct 27, 2025

Base automatically changed from eriktate/tctl-scoped-tokens to master October 27, 2025 18:36

eriktate force-pushed the eriktate/scoped-joins branch 2 times, most recently from 665a94f to 10beac3 Compare October 27, 2025 22:38

eriktate enabled auto-merge October 27, 2025 22:39

eriktate disabled auto-merge October 27, 2025 22:40

fspmarshall approved these changes Oct 28, 2025

View reviewed changes

eriktate force-pushed the eriktate/scoped-joins branch from 10beac3 to de78bbd Compare October 28, 2025 21:21

eriktate enabled auto-merge October 28, 2025 21:23

adding support for scoped joining of SSH nodes using dynamic tokens

d685ddd

eriktate force-pushed the eriktate/scoped-joins branch from de78bbd to d685ddd Compare October 28, 2025 21:39

eriktate added this pull request to the merge queue Oct 28, 2025

Merged via the queue into master with commit 198c0cd Oct 28, 2025
44 checks passed

eriktate deleted the eriktate/scoped-joins branch October 28, 2025 22:22

nklaassen mentioned this pull request Oct 29, 2025

Adds scope to ServerV2 in SSH heartbeats #60524

Merged

eriktate added a commit that referenced this pull request Oct 29, 2025

adding support for scoped joining of SSH nodes using dynamic tokens (#…

bf9ac13

…60362)

eriktate mentioned this pull request Oct 29, 2025

[v18] Adding scoped join tokens for SSH nodes #60758

Merged

fspmarshall pushed a commit that referenced this pull request Oct 31, 2025

adding support for scoped joining of SSH nodes using dynamic tokens (#…

945353d

…60362)

eriktate added a commit that referenced this pull request Nov 4, 2025

adding support for scoped joining of SSH nodes using dynamic tokens (#…

44588a5

…60362)

eriktate added a commit that referenced this pull request Nov 4, 2025

adding support for scoped joining of SSH nodes using dynamic tokens (#…

c22706c

…60362)

mmcallister pushed a commit that referenced this pull request Nov 6, 2025

adding support for scoped joining of SSH nodes using dynamic tokens (#…

3a8004b

…60362)

eriktate added a commit that referenced this pull request Nov 18, 2025

adding support for scoped joining of SSH nodes using dynamic tokens (#…

829113b

…60362)

eriktate added a commit that referenced this pull request Nov 18, 2025

adding support for scoped joining of SSH nodes using dynamic tokens (#…

e604836

…60362)

github-merge-queue bot pushed a commit that referenced this pull request Nov 18, 2025

adding support for scoped joining of SSH nodes using dynamic tokens (#…

34dedb1

…60362) (#60758)

mmcallister pushed a commit that referenced this pull request Nov 19, 2025

adding support for scoped joining of SSH nodes using dynamic tokens (#…

eb96b9b

…60362)

mmcallister pushed a commit that referenced this pull request Nov 20, 2025

adding support for scoped joining of SSH nodes using dynamic tokens (#…

c68b6de

…60362)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Adding scoped joining of nodes using dynamic tokens #60362

Adding scoped joining of nodes using dynamic tokens #60362
eriktate merged 1 commit intomasterfrom
eriktate/scoped-joins

eriktate commented Oct 17, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

fspmarshall left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

eriktate commented Oct 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

fspmarshall left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

eriktate commented Oct 17, 2025 •

edited

Loading