diff --git a/build.assets/tooling/go.sum b/build.assets/tooling/go.sum index ff194cf320d6d..4fb1dce53f258 100644 --- a/build.assets/tooling/go.sum +++ b/build.assets/tooling/go.sum @@ -1036,6 +1036,8 @@ oras.land/oras-go/v2 v2.6.0 h1:X4ELRsiGkrbeox69+9tzTu492FMUu7zJQW6eJU+I2oc= oras.land/oras-go/v2 v2.6.0/go.mod h1:magiQDfG6H1O9APp+rOsvCPcW1GD2MM7vgnKY0Y+u1o= pluginrpc.com/pluginrpc v0.5.0 h1:tOQj2D35hOmvHyPu8e7ohW2/QvAnEtKscy2IJYWQ2yo= pluginrpc.com/pluginrpc v0.5.0/go.mod h1:UNWZ941hcVAoOZUn8YZsMmOZBzbUjQa3XMns8RQLp9o= +rsc.io/ordered v1.1.1 h1:1kZM6RkTmceJgsFH/8DLQvkCVEYomVDJfBRLT595Uak= +rsc.io/ordered v1.1.1/go.mod h1:evAi8739bWVBRG9aaufsjVc202+6okf8u2QeVL84BCM= sigs.k8s.io/controller-runtime v0.22.4 h1:GEjV7KV3TY8e+tJ2LCTxUTanW4z/FmNB7l327UfMq9A= sigs.k8s.io/controller-runtime v0.22.4/go.mod h1:+QX1XUpTXN4mLoblf4tqr5CQcyHPAki2HLXqQMY6vh8= sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 h1:gBQPwqORJ8d8/YNZWEjoZs7npUVDpVXUUOFfW6CgAqE= diff --git a/integrations/event-handler/go.mod b/integrations/event-handler/go.mod index 2e214c1d00f65..10e934244f88b 100644 --- a/integrations/event-handler/go.mod +++ b/integrations/event-handler/go.mod @@ -384,6 +384,7 @@ require ( k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d // indirect mvdan.cc/sh/v3 v3.7.0 // indirect oras.land/oras-go/v2 v2.6.0 // indirect + rsc.io/ordered v1.1.1 // indirect sigs.k8s.io/controller-runtime v0.22.4 // indirect sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect sigs.k8s.io/kustomize/api v0.20.1 // indirect diff --git a/integrations/event-handler/go.sum b/integrations/event-handler/go.sum index 4c9dd797d2cd8..fb33e2b36ca3a 100644 --- a/integrations/event-handler/go.sum +++ b/integrations/event-handler/go.sum @@ -1182,6 +1182,8 @@ mvdan.cc/sh/v3 v3.7.0 h1:lSTjdP/1xsddtaKfGg7Myu7DnlHItd3/M2tomOcNNBg= mvdan.cc/sh/v3 v3.7.0/go.mod h1:K2gwkaesF/D7av7Kxl0HbF5kGOd2ArupNTX3X44+8l8= oras.land/oras-go/v2 v2.6.0 h1:X4ELRsiGkrbeox69+9tzTu492FMUu7zJQW6eJU+I2oc= oras.land/oras-go/v2 v2.6.0/go.mod h1:magiQDfG6H1O9APp+rOsvCPcW1GD2MM7vgnKY0Y+u1o= +rsc.io/ordered v1.1.1 h1:1kZM6RkTmceJgsFH/8DLQvkCVEYomVDJfBRLT595Uak= +rsc.io/ordered v1.1.1/go.mod h1:evAi8739bWVBRG9aaufsjVc202+6okf8u2QeVL84BCM= sigs.k8s.io/controller-runtime v0.22.4 h1:GEjV7KV3TY8e+tJ2LCTxUTanW4z/FmNB7l327UfMq9A= sigs.k8s.io/controller-runtime v0.22.4/go.mod h1:+QX1XUpTXN4mLoblf4tqr5CQcyHPAki2HLXqQMY6vh8= sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 h1:gBQPwqORJ8d8/YNZWEjoZs7npUVDpVXUUOFfW6CgAqE= diff --git a/integrations/terraform-mwi/go.mod b/integrations/terraform-mwi/go.mod index c2c4b8b9f2bfe..18203cdc70b9a 100644 --- a/integrations/terraform-mwi/go.mod +++ b/integrations/terraform-mwi/go.mod @@ -519,6 +519,7 @@ require ( k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d // indirect mvdan.cc/sh/v3 v3.7.0 // indirect oras.land/oras-go/v2 v2.6.0 // indirect + rsc.io/ordered v1.1.1 // indirect sigs.k8s.io/controller-runtime v0.22.4 // indirect sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect sigs.k8s.io/kustomize/api v0.20.1 // indirect diff --git a/integrations/terraform-mwi/go.sum b/integrations/terraform-mwi/go.sum index 44e8f2a94a225..21280b3672b4f 100644 --- a/integrations/terraform-mwi/go.sum +++ b/integrations/terraform-mwi/go.sum @@ -1769,6 +1769,8 @@ mvdan.cc/sh/v3 v3.7.0 h1:lSTjdP/1xsddtaKfGg7Myu7DnlHItd3/M2tomOcNNBg= mvdan.cc/sh/v3 v3.7.0/go.mod h1:K2gwkaesF/D7av7Kxl0HbF5kGOd2ArupNTX3X44+8l8= oras.land/oras-go/v2 v2.6.0 h1:X4ELRsiGkrbeox69+9tzTu492FMUu7zJQW6eJU+I2oc= oras.land/oras-go/v2 v2.6.0/go.mod h1:magiQDfG6H1O9APp+rOsvCPcW1GD2MM7vgnKY0Y+u1o= +rsc.io/ordered v1.1.1 h1:1kZM6RkTmceJgsFH/8DLQvkCVEYomVDJfBRLT595Uak= +rsc.io/ordered v1.1.1/go.mod h1:evAi8739bWVBRG9aaufsjVc202+6okf8u2QeVL84BCM= sigs.k8s.io/controller-runtime v0.22.4 h1:GEjV7KV3TY8e+tJ2LCTxUTanW4z/FmNB7l327UfMq9A= sigs.k8s.io/controller-runtime v0.22.4/go.mod h1:+QX1XUpTXN4mLoblf4tqr5CQcyHPAki2HLXqQMY6vh8= sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 h1:gBQPwqORJ8d8/YNZWEjoZs7npUVDpVXUUOFfW6CgAqE= diff --git a/integrations/terraform/go.mod b/integrations/terraform/go.mod index 1e26edabac396..5d4a97422e3b0 100644 --- a/integrations/terraform/go.mod +++ b/integrations/terraform/go.mod @@ -517,6 +517,7 @@ require ( k8s.io/utils v0.0.0-20250820121507-0af2bda4dd1d // indirect mvdan.cc/sh/v3 v3.7.0 // indirect oras.land/oras-go/v2 v2.6.0 // indirect + rsc.io/ordered v1.1.1 // indirect sigs.k8s.io/controller-runtime v0.22.4 // indirect sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect sigs.k8s.io/kustomize/api v0.20.1 // indirect diff --git a/integrations/terraform/go.sum b/integrations/terraform/go.sum index 82569dea17b13..b26db9103de04 100644 --- a/integrations/terraform/go.sum +++ b/integrations/terraform/go.sum @@ -2123,6 +2123,8 @@ mvdan.cc/sh/v3 v3.7.0/go.mod h1:K2gwkaesF/D7av7Kxl0HbF5kGOd2ArupNTX3X44+8l8= oras.land/oras-go/v2 v2.6.0 h1:X4ELRsiGkrbeox69+9tzTu492FMUu7zJQW6eJU+I2oc= oras.land/oras-go/v2 v2.6.0/go.mod h1:magiQDfG6H1O9APp+rOsvCPcW1GD2MM7vgnKY0Y+u1o= rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8= +rsc.io/ordered v1.1.1 h1:1kZM6RkTmceJgsFH/8DLQvkCVEYomVDJfBRLT595Uak= +rsc.io/ordered v1.1.1/go.mod h1:evAi8739bWVBRG9aaufsjVc202+6okf8u2QeVL84BCM= rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0= rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA= sigs.k8s.io/controller-runtime v0.22.4 h1:GEjV7KV3TY8e+tJ2LCTxUTanW4z/FmNB7l327UfMq9A= diff --git a/lib/auth/auth.go b/lib/auth/auth.go index 50d2a7a06412b..cf3293588e653 100644 --- a/lib/auth/auth.go +++ b/lib/auth/auth.go @@ -103,6 +103,7 @@ import ( "github.com/gravitational/teleport/lib/backend" "github.com/gravitational/teleport/lib/boundkeypair" "github.com/gravitational/teleport/lib/cache" + inventorycache "github.com/gravitational/teleport/lib/cache/inventory" "github.com/gravitational/teleport/lib/cryptosuites" "github.com/gravitational/teleport/lib/decision" "github.com/gravitational/teleport/lib/defaults" @@ -1256,6 +1257,9 @@ type Server struct { // GlobalNotificationCache is a cache of global notifications. GlobalNotificationCache *services.GlobalNotificationCache + // inventoryCache is a cache of unified instances (teleport instances and bot instances). + inventoryCache *inventorycache.InventoryCache + // workloadIdentityX509CAOverrideGetter is a getter for CA overrides for // SPIFFE X.509 certificate issuance. Optional, set in enterprise code. workloadIdentityX509CAOverrideGetter services.WorkloadIdentityX509CAOverrideGetter @@ -1578,6 +1582,20 @@ func (a *Server) SetGlobalNotificationCache(globalNotificationCache *services.Gl a.GlobalNotificationCache = globalNotificationCache } +// SetInventoryCache sets the inventory cache. +func (a *Server) SetInventoryCache(inventoryCache *inventorycache.InventoryCache) { + a.lock.Lock() + defer a.lock.Unlock() + a.inventoryCache = inventoryCache +} + +// GetInventoryCache returns the inventory cache. +func (a *Server) GetInventoryCache() *inventorycache.InventoryCache { + a.lock.RLock() + defer a.lock.RUnlock() + return a.inventoryCache +} + func (a *Server) SetLockWatcher(lockWatcher *services.LockWatcher) { a.lock.Lock() defer a.lock.Unlock() @@ -2337,6 +2355,12 @@ func (a *Server) Close() error { errs = append(errs, err) } + if inventoryCache := a.GetInventoryCache(); inventoryCache != nil { + if err := inventoryCache.Close(); err != nil { + errs = append(errs, err) + } + } + if a.Services.AuditLogSessionStreamer != nil { if err := a.Services.AuditLogSessionStreamer.Close(); err != nil { errs = append(errs, err) diff --git a/lib/auth/grpcserver.go b/lib/auth/grpcserver.go index e0944193d5a45..4c4f9aa339b64 100644 --- a/lib/auth/grpcserver.go +++ b/lib/auth/grpcserver.go @@ -66,6 +66,7 @@ import ( gitserverv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/gitserver/v1" healthcheckconfigv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/healthcheckconfig/v1" integrationv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/integration/v1" + inventorypb "github.com/gravitational/teleport/api/gen/proto/go/teleport/inventory/v1" kubewaitingcontainerv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/kubewaitingcontainer/v1" loginrulev1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/loginrule/v1" machineidv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1" @@ -109,6 +110,7 @@ import ( "github.com/gravitational/teleport/lib/auth/gitserver/gitserverv1" "github.com/gravitational/teleport/lib/auth/healthcheckconfig/healthcheckconfigv1" "github.com/gravitational/teleport/lib/auth/integration/integrationv1" + "github.com/gravitational/teleport/lib/auth/inventory/inventoryv1" "github.com/gravitational/teleport/lib/auth/kubewaitingcontainer/kubewaitingcontainerv1" "github.com/gravitational/teleport/lib/auth/loginrule/loginrulev1" "github.com/gravitational/teleport/lib/auth/machineid/machineidv1" @@ -6036,6 +6038,16 @@ func NewGRPCServer(cfg GRPCServerConfig) (*GRPCServer, error) { } presencev1pb.RegisterPresenceServiceServer(server, presenceService) + inventoryService, err := inventoryv1.NewService(inventoryv1.ServiceConfig{ + Authorizer: cfg.Authorizer, + InventoryCache: cfg.AuthServer.GetInventoryCache(), + Logger: cfg.AuthServer.logger.With(teleport.ComponentKey, "inventory.service"), + }) + if err != nil { + return nil, trace.Wrap(err, "creating inventory service") + } + inventorypb.RegisterInventoryServiceServer(server, inventoryService) + botService, err := machineidv1.NewBotService(machineidv1.BotServiceConfig{ Authorizer: cfg.Authorizer, Cache: cfg.AuthServer.Cache, diff --git a/lib/cache/inventory/inventory_cache.go b/lib/cache/inventory/inventory_cache.go index f690c7a65ff79..b057af4f124a2 100644 --- a/lib/cache/inventory/inventory_cache.go +++ b/lib/cache/inventory/inventory_cache.go @@ -435,6 +435,7 @@ func (ic *InventoryCache) initializeAndWatch(ctx context.Context) error { // Mark cache as healthy. ic.healthy.Store(true) + ic.cfg.Logger.InfoContext(ctx, "Inventory cache init succeeded") // This runs infinitely until the context is canceled. ic.processEvents(ctx, watcher) diff --git a/lib/service/service.go b/lib/service/service.go index b1067d3a5e5f0..ac93bf7a48d47 100644 --- a/lib/service/service.go +++ b/lib/service/service.go @@ -110,6 +110,7 @@ import ( _ "github.com/gravitational/teleport/lib/backend/pgbk" "github.com/gravitational/teleport/lib/bpf" "github.com/gravitational/teleport/lib/cache" + inventorycache "github.com/gravitational/teleport/lib/cache/inventory" myrepl "github.com/gravitational/teleport/lib/client/db/mysql/repl" pgrepl "github.com/gravitational/teleport/lib/client/db/postgres/repl" dbrepl "github.com/gravitational/teleport/lib/client/db/repl" @@ -2461,6 +2462,19 @@ func (process *TeleportProcess) initAuthService() error { as.Cache = cache recordingEncryptionManager.SetCache(cache) + // Create the inventory cache. This will wait for the primary cache to be ready before starting. + invCache, err := inventorycache.NewInventoryCache(inventorycache.InventoryCacheConfig{ + PrimaryCache: cache, + Events: as.Services, + Inventory: as.Services, + BotInstanceBackend: as.Services, + Logger: process.logger.With(teleport.ComponentKey, "inventory.cache"), + }) + if err != nil { + return trace.Wrap(err, "creating inventory cache") + } + as.SetInventoryCache(invCache) + return nil }) if err != nil {