[v18] Implement Instance Inventory UI

[rudream]

backports the following PR's to branch/v18:

• Implement InventoryCache to cache instances #60535
• Implement filtering for instances #61089
• Expose instance inventory to client and add web endpoint #61657
• Initialize inventory cache on startup #61857
• [Web] Implement Instance Inventory UI #62027
• [Web] Fix desktop icon and label in Instance Inventory #62633
• Minor Inventory UI fixes #63094
• Fix filtering instances by no upgrader in instance inventory #63184
• Add Prometheus metrics to the inventory cache #63086
• Trim "v" prefix for all instance versions in inventory cache #63790

e counterpart: https://github.com/gravitational/teleport.e/pull/7826

Mostly clean backport, but had to use "github.com/gravitational/teleport/lib/utils/testutils/synctest" instead of testing/synctest since it required go 1.25 (see this PR for context)

Manual tests done:

• Verify that instances are listed and sortable by name, version, and type.
• Verify all filter controls work as intended.
• Verify all predicate queries for version (older_than, newer_than, between), updater group, and external upgrader work as intended.
• Verify having read and list permissions for bot_instance but not instance lists bot instances only, with a warning banner at the top saying you are missing instance permissions.
• Verify having read and list permissions for instance but not bot_instance lists instances only, with a warning banner at the top saying you are missing bot_instance permissions.
• Verify having no read and list permissions for neither bot_instance or instance does not list anything and just shows you the missing permissions banner.
• Verify clicking on a bot instance's "see services" button takes you to the instance dashboard focused on that specific bot instance.

[public-teleport-github-review-bot]

@rudream - this PR will require admin approval to merge due to its size. Consider breaking it up into a series smaller changes.

[rosstimothy]

I suggest backporting the entire inventory cache and instance ui feature set to v18 in a single PR so that you can run a manual test plan again prior to merging the feature and so that we can be 100% confident that the entire feature lands at the same time so nothing is missing when this gets released.

[nicholasmarais1158]

Tested in a cloud tenant and looks good.

@rudream I noticed my tenant has a lot of proxy instances on the list. Some from the previous version and others on the current version. The deployment has 4 pods, two auth and two proxy.

$ kubectl -n cloud-gravitational-io-nicholasmarais1158 --context platform.teleport.sh-tc-staging-cs-01-euc1 get pods

NAME                              READY   STATUS    RESTARTS   AGE
teleport-auth-bb9f9cf74-f8cpl     1/1     Running   0          35m
teleport-auth-bb9f9cf74-swj9n     1/1     Running   0          35m
teleport-proxy-57cfbcbbfc-rzrsv   1/1     Running   0          35m
teleport-proxy-57cfbcbbfc-sgd4g   1/1     Running   0          35m

Maybe it's because I just deployed and those extra instances will disappear later?

Screen.Recording.2026-01-14.at.17.26.46.mov

[nicholasmarais1158]

UI nit: Instance versions have a v prefix while bot instances do not. @rudream

[nicholasmarais1158]

Tested in a cloud tenant and looks good.

@rudream I noticed my tenant has a lot of proxy instances on the list. Some from the previous version and others on the current version. The deployment has 4 pods, two auth and two proxy.

$ kubectl -n cloud-gravitational-io-nicholasmarais1158 --context platform.teleport.sh-tc-staging-cs-01-euc1 get pods

NAME                              READY   STATUS    RESTARTS   AGE
teleport-auth-bb9f9cf74-f8cpl     1/1     Running   0          35m
teleport-auth-bb9f9cf74-swj9n     1/1     Running   0          35m
teleport-proxy-57cfbcbbfc-rzrsv   1/1     Running   0          35m
teleport-proxy-57cfbcbbfc-sgd4g   1/1     Running   0          35m

Maybe it's because I just deployed and those extra instances will disappear later?

Screen.Recording.2026-01-14.at.17.26.46.mov

Thinking about this again, perhaps the extra proxy instances are running in other regions. This would explain why there are so many - the kubectl get pods command is only showing those in eu-central-1 (euc1).

I think this is a non-issue.

[rudream]

Thinking about this again, perhaps the extra proxy instances are running in other regions. This would explain why there are so many - the kubectl get pods command is only showing those in eu-central-1 (euc1).

I think this is a non-issue.

@espadolini @fspmarshall can you confirm if this is fine and expected or whether we should look into this further? Whatever the case may be, I don't think this would be a bug with the new Instance Inventory UI/Cache since it just pulls whatever is present in the backend.

[espadolini]

Very likely, but a tctl get proxy_server would confirm it without having to know specifics about the deployment.

[nicholasmarais1158]

Very likely, but a tctl get proxy_server would confirm it without having to know specifics about the deployment.

Confirmed. There are 12 proxies in total, two in each of 6 regions.

$ tctl get proxy --format json | jq '[.[] | {hostname: .spec.hostname, region: .metadata.labels."teleport.internal/proxygroup-id"}] | sort_by(.region) | .[]'

{
  "hostname": "teleport-proxy-76878b8fd5-nkl5f",
  "region": "ap-south-1"
}
{
  "hostname": "teleport-proxy-76878b8fd5-2kkqg",
  "region": "ap-south-1"
}
{
  "hostname": "teleport-proxy-7bc6c8b498-d4xcm",
  "region": "ap-southeast-1"
}
{
  "hostname": "teleport-proxy-7bc6c8b498-t5wxv",
  "region": "ap-southeast-1"
}
{
  "hostname": "teleport-proxy-74675f9f88-vlzpr",
  "region": "eu-central-1"
}
{
  "hostname": "teleport-proxy-74675f9f88-5wmph",
  "region": "eu-central-1"
}
{
  "hostname": "teleport-proxy-5dcbcf87d-7q58l",
  "region": "sa-east-1"
}
{
  "hostname": "teleport-proxy-5dcbcf87d-p94bh",
  "region": "sa-east-1"
}
{
  "hostname": "teleport-proxy-c5f5c4554-bklrv",
  "region": "us-east-1"
}
{
  "hostname": "teleport-proxy-c5f5c4554-hg7vr",
  "region": "us-east-1"
}
{
  "hostname": "teleport-proxy-cb797ccf7-2xh8p",
  "region": "us-west-2"
}
{
  "hostname": "teleport-proxy-cb797ccf7-w7xcg",
  "region": "us-west-2"
}

[rudream]

Note that I've also added the changes from these PRs:

• Minor Inventory UI fixes #63094
• Fix filtering instances by no upgrader in instance inventory #63184