[v18] Add vnet config audit events

.gitattributes

@@ -9,3 +9,5 @@ docs/theme/js/theme.js linguist-vendored=false
 *_pb.ts linguist-generated
 *_pb.grpc-*.ts linguist-generated
 *_pb.client.ts linguist-generated
+
+*.golden -text

.github/CODEOWNERS

@@ -1,8 +1,25 @@
 # Merge rules are governed by logic in the Workflow Bot. Protect the
 # .github/workflows directory (and the merge logic) using CODEOWNERS.
-/.github/workflows/ @klizhentas @russjones @r0mant @zmb3 @fheinecke @camscale @tcsc @rosstimothy
-/build.assets/tooling/cmd/difftest/ @klizhentas @russjones @r0mant @zmb3
+/.github/workflows/ @klizhentas @russjones @r0mant @zmb3 @fheinecke @camscale @doggydogworld @rosstimothy
+/.github/actions/ @klizhentas @russjones @r0mant @zmb3 @fheinecke @camscale @doggydogworld @rosstimothy
+/build.assets/tooling/cmd/difftest/ @klizhentas @russjones @r0mant @zmb3 @rosstimothy
 
-# Owners for dependency updates in JS packages.
-/pnpm-lock.yaml @avatus @gzdunek @ravicious
-web/packages/teleterm/package.json @gzdunek @ravicious
+# Owners for JS dependency updates.
+/pnpm-lock.yaml @avatus @gzdunek @ravicious @zmb3 @r0mant
+/web/packages/teleterm/package.json @gzdunek @ravicious
+
+# Owners for Go dependency updates.
+/go.mod @russjones @r0mant @zmb3 @rosstimothy
+/api/go.mod @russjones @r0mant @zmb3 @rosstimothy
+/assets/aws/go.mod @russjones @r0mant @zmb3 @rosstimothy
+/assets/backport/go.mod @russjones @r0mant @zmb3 @rosstimothy
+/build.assets/tooling/go.mod @russjones @r0mant @zmb3 @rosstimothy @fheinecke @camscale @doggydogworld
+/integrations/terraform/go.mod @russjones @r0mant @zmb3 @rosstimothy @hugoShaka @tigrato
+/integrations/terraform-mwi/go.mod @russjones @r0mant @zmb3 @rosstimothy @hugoShaka @tigrato @strideynet
+/integrations/event-handler/go.mod @russjones @r0mant @zmb3 @rosstimothy @hugoShaka @tigrato
+
+# Owners for Rust dependency updates.
+/Cargo.toml @russjones @r0mant @zmb3 @rosstimothy @fspmarshall @espadolini
+/tool/fdpass-teleport/Cargo.toml @russjones @r0mant @zmb3 @rosstimothy @fspmarshall @espadolini
+/web/packages/shared/libs/ironrdp/Cargo.toml @russjones @r0mant @zmb3 @rosstimothy @fspmarshall @espadolini @probakowski
+/lib/srv/desktop/rdp/rdpclient/Cargo.toml @russjones @r0mant @zmb3 @rosstimothy @fspmarshall @espadolini @probakowski

.github/ISSUE_TEMPLATE/test-plan-docs.md

@@ -102,10 +102,10 @@ version of Teleport.
   and verify their accuracy while using the newly released major version of
   Teleport.
 
-  - [ ] General [installation page](../../docs/pages/installation.mdx): ensure
+  - [ ] General [installation page](../../docs/pages/installation/installation.mdx): ensure
     that installation methods support the new release candidate.
   - [ ] [Teleport Community
-    Edition](../../docs/pages/admin-guides/deploy-a-cluster/linux-demo.mdx) demo
+    Edition](../../docs/pages/get-started/deploy-community.mdx) demo
     guide.
   - [ ] [Teleport Enterprise (Cloud)](../../docs/pages/get-started.mdx) getting
     started guide.

.github/ISSUE_TEMPLATE/testplan.md

@@ -569,6 +569,10 @@ on the remote host. Note that the `--callback` URL must be able to resolve to th
 [Docs](https://goteleport.com/docs/agents/join-services-to-your-cluster/gcp/)
 - [ ] Join a Teleport node running in a GCP VM.
 
+### Oracle Node Joining
+[Docs](https://goteleport.com/docs/enroll-resources/agents/oracle/)
+- [ ] Join a Teleport node running in an OCI VM.
+
 ### Cloud Labels
 - [ ] Create an EC2 instance with [tags in instance metadata enabled](https://goteleport.com/docs/management/guides/ec2-tags/)
 and with tag `foo`: `bar`. Verify that a node running on the instance has label
@@ -740,6 +744,8 @@ tsh ssh node-that-requires-device-trust
     - [ ] K8s Access
     - [ ] App Access NOT enforced in global mode
     - [ ] Desktop Access NOT enforced in global mode
+  - [ ] device_trust.mode="required-for-humans" enforces enrolled devices for
+        humans, but bots (e.g. `tbot`) function on any device
   - [ ] Role-based authz enforces enrolled devices
         (device_trust.mode="optional" and role.spec.options.device_trust_mode="required")
     - [ ] SSH
@@ -1039,9 +1045,10 @@ tsh bench web sessions --max=5000 --web user ls
 - [ ] Verify [AWS console access](https://goteleport.com/docs/application-access/cloud-apis/aws-console/).
   - [ ] Can log into AWS web console through the web UI.
   - [ ] Can interact with AWS using `tsh` commands.
-    - [ ] `tsh aws`
-    - [ ] `tsh aws --endpoint-url` (this is a hidden flag)
-- [ ] Verify [Azure CLI access](https://goteleport.com/docs/application-access/cloud-apis/azure/) with `tsh apps login`.
+    - [ ] `tsh aws sts get-caller-identity`
+    - [ ] `tsh aws s3 ls`
+    - [ ] `tsh aws s3 cp ./file s3://<bucket>/test`
+- [ ] Verify [Azure CLI access](https://goteleport.com/docs/enroll-resources/application-access/cloud-apis/azure/) with `tsh apps login`.
   - [ ] Can interact with Azure using `tsh az` commands.
   - [ ] Can interact with Azure using a combination of `tsh proxy az` and `az` commands.
 - [ ] Verify [GCP CLI access](https://goteleport.com/docs/application-access/cloud-apis/google-cloud/) with `tsh apps login`.
@@ -1086,6 +1093,7 @@ manualy testing.
   - [ ] Amazon Redshift Serverless.
     - [ ] Verify connection to external AWS account works with `assume_role_arn: ""` and `external_id: "<id>"`
   - [ ] Amazon ElastiCache.
+  - [ ] Amazon ElastiCache Serverless.
   - [ ] Amazon MemoryDB.
   - [ ] Amazon OpenSearch.
   - [ ] Amazon Dynamodb.
@@ -1124,6 +1132,7 @@ manualy testing.
   - [ ] Amazon Redshift.
   - [ ] Amazon Redshift Serverless.
   - [ ] Amazon ElastiCache.
+  - [ ] Amazon ElastiCache Serverless.
   - [ ] Amazon MemoryDB.
   - [ ] Amazon OpenSearch.
   - [ ] Amazon Dynamodb.
@@ -1184,6 +1193,7 @@ manualy testing.
       - [x] Can detect and register Redshift clusters. (covered by E2E test)
       - [x] Can detect and register Redshift serverless workgroups, and their VPC endpoints. (covered by E2E test)
       - [ ] Can detect and register ElastiCache Redis clusters.
+      - [ ] Can detect and register ElastiCache Serverless Redis/Valkey clusters.
       - [ ] Can detect and register MemoryDB clusters.
       - [ ] Can detect and register OpenSearch domains.
       - [ ] Can detect and register DocumentDB clusters.
@@ -1639,6 +1649,7 @@ Verify that SSH works, and that resumable SSH is not interrupted across a contro
   - [ ] New EC2 instances with matching AWS tags are discovered and added to the teleport cluster
     - [ ] Large numbers of EC2 instances (51+) are all successfully added to the cluster
   - [ ] Nodes that have been discovered do not have the install script run on the node multiple times
+  - [ ] EC2 instances can be discovered in multiple accounts
 
 ## Azure Discovery
 

.github/ISSUE_TEMPLATE/webtestplan.md

@@ -132,6 +132,8 @@ For each, test the invite, reset, and login flows
 - [ ] Verify that error message is shown if an invite/reset is expired/invalid
 - [ ] Verify that account is locked after several unsuccessful login attempts
 
+- [ ] Verify that after logging in, user is automatically redirected to the login page when the session expires.
+
 #### Auth Connectors
 
 For help with setting up auth connectors, check out the [Quick GitHub/SAML/OIDC Setup Tips]