teleport 16.4.0

[BrewTestBot]

Created by brew bump

---

Created with brew bump-formula-pr.

release notes

## Description
Machine ID for HCP Terraform and Terraform Enterprise
Teleport now supports secure joining via Terraform Cloud, allowing Machine ID

workflows to run on Terraform Cloud without shared secrets.
SPIFFE Federation for Workload Identity
Teleport Workload Identity now supports SPIFFE Federation, allowing trust

relationships to be established between a Teleport cluster's trust domain and

trust domains managed by other SPIFFE compatible platforms. Establishing a

relationship between the trust domains enables workloads belonging to one trust

domain to validate the identity of workloads in the other trust domain, and vice

versa.
Multi-domain support for web applications
Teleport now supports web application access where one application depends on

another. For example, you may have a web application that depends on a backend

API service, both of which are separate apps protected by Teleport.
Okta integration status dashboard
Cluster admins are now able to get a detailed overview of the Okta integration

status in the Teleport web UI.
Other improvements and fixes

Fixed the web favicon not displaying on specific builds. #46736
Fixed regression in private key parser to handle mismatched PEM headers. #46727
Removed TXT record validation from custom DNS zones in VNet; VNet now supports any custom DNS zone, as long as it's included in vnet_config. #46722
Fixed audit log not recognizing static host user events. #46697
Fixes a bug in Kubernetes access that causes the error expected *metav1.PartialObjectMetadata object when trying to list resources. #46694
Added a new default_shell configuration for the static host users resource that works exactly the same as the create_host_user_default_shell configuration added for roles. #46688
Machine ID now generates cluster-specific ssh_config and known_hosts files which will always direct SSH connections made using them via Teleport. #46684
Fixed a regression that prevented the fish shell from starting in Teleport Connect. #46662
Added a new create_host_user_default_shell configuration under role options that changes the default shell of auto provisioned host users. #46648
Fixed an issue that prevented host user creation when the username was also listed in host_groups. #46635
Fixed tsh scp showing a login prompt when attempting to transfer a folder without the recursive option. #46603
The Teleport Terraform provider now supports AccessMonitoringRule resources. #46582
The teleport-plugin-slack chart can now deploy tbot to obtain and renew the Slack plugin credentials automatically. This setup is easier and more secure than signing long-lived credentials. #46581
Always show the device trust green shield for authenticated devices. #46565
Add new terraform_cloud joining method to enable secretless authentication on HCP Terraform jobs for the Teleport Terraform provider. #46049
Emit audit logs when creating, updating or deleting Teleport Plugins. #4939

Download
Download the current and previous releases of Teleport at https://goteleport.com/download.
Plugins
Download the current release of Teleport plugins from the links below.

Slack Linux amd64 | Linux arm64
Mattermost Linux amd64 | Linux arm64
Discord Linux amd64 | Linux arm64
Terraform Provider Linux amd64 | Linux arm64 | macOS amd64 | macOS arm64 | macOS universal
Event Handler Linux amd64 | Linux arm64 | macOS amd64
PagerDuty Linux amd64 | Linux arm64
Jira Linux amd64 | Linux arm64
Email Linux amd64 | Linux arm64
Microsoft Teams Linux amd64 | Linux arm64

Closes #182874

[stefanb]

Linux: No space left on device, trying on seff-hosted runner...

[stefanb]

macOS 13 and macOS 14 builds on x86-64 using Go 1.23 fail with:

  # github.com/gravitational/teleport/tool/teleport
  link: github.com/segmentio/parquet-go/hashprobe/aeshash: invalid reference to runtime.aeskeysched

...so resorted back to [email protected]

likely related to change

• hashprobe: remove dependency on runtime.aeskeysched parquet-go/parquet-go#142

not being referenced yet in v16.x.x, because Go 1.23 is only supported after gravitational/teleport@e401017 which will be available only in upcoming v17.x.x releases.

The builds succeeded on macOS/arm64 because it is using different "implementation".

[carlocab]

Ok to merge as-is, but would be nice to address the comments above at some point.

[github-actions]

@stefanb has requested bottles to be published to this PR.

[carlocab]

@stefanb, you need to mark conversations as resolved for PRs to merge. FYI