GitHub Proxy part 2: git_server resource, service, and RBAC #49393

greedy52 · 2024-11-24T02:09:59Z

part of:

GitHub proxy MVP #48762

Sorry for the bit list of files. Mostly just boiler plate code for a new resource.

Resource yaml

kind: git_server
sub_kind: github
version: v2
spec:
  github:
    integration: github-my-org
    organization: my-org

Then:

$ tctl create -f resource_github_server.yaml
$ tctl get git_servers

…/48762_git_server

lib/auth/gitserver/gitserverv1/service.go

tool/tctl/common/resource_command.go

r0mant · 2024-11-25T21:41:24Z

tool/tctl/common/resource_command.go

+	case types.KindGitServer:
+		var servers []types.Server
+
+		// TODO(greedy52) use unified resource request once available.


JFYI - @tcsc is exposing Accounts for the Identity Center integration to unified resource view in #49301, we should use a common approach for all new resources we're adding.

api/proto/teleport/gitserver/v1/git_server_service.proto

api/proto/teleport/legacy/types/types.proto

smallinsky · 2024-11-26T11:04:40Z

lib/auth/gitserver/gitserverv1/service.go

+		if serverV2, err := toServerV2(server); err != nil {
+			return nil, trace.Wrap(err)


How this can happen

it shouldn't. just safety check

lib/auth/gitserver/gitserverv1/service.go

smallinsky · 2024-11-26T11:19:40Z

api/proto/teleport/gitserver/v1/git_server_service.proto

+// CreateGitServerRequest is a request to create a Git server.
+message CreateGitServerRequest {
+  // Server is the Git server to create.
+  types.ServerV2 server = 1;


Theoretical question :-)
If there any possible way to not mix gogole proto with legacy deprecated gogo proto ?

it's probably doable, i haven't tried. But i will have to do conversions back AND force in a LOT of places as git_server will rely on existing SSH transport. I prefer use the old type and keep backend consistent as the other server resources.

Is types.ServerV2 leveraged for literally anything here? Is it planned to work for arbitrary git servers reached directly from the server?

Is it planned to work for arbitrary git servers reached directly from the server?

What do you mean?

Do you mean directly from the proxy server? there will be git agents eventually for private/self-hosted git services.

Well, the entire point of ServerV2 is that it has a bunch of fields that make sense for servers - so far, a git_server with subkind github is literally only using metadata and one field that was added to ServerSpecV2 that only makes sense in that exact scenario, so I was wondering if in the future we're planning to make use of ServerV2.

i was thinking yes. For example, a git_server for self-hosted gitlab is basically a non-agentless SSH server that uses its own CA to sign.

I am open to switching git_server to its own type. What worries me more is whether I have to convert this type to satisfy the types.Server interface and/or refactor the SSH transport along the way.

What do you think?

github-actions · 2024-11-27T14:30:06Z

🤖 Vercel preview here: https://docs-2kv7muz8t-goteleport.vercel.app/docs

github-actions · 2024-11-27T14:32:20Z

🤖 Vercel preview here: https://docs-dk4vp5vo8-goteleport.vercel.app/docs

public-teleport-github-review-bot · 2024-11-27T15:41:24Z

@greedy52 - this PR will require admin approval to merge due to its size. Consider breaking it up into a series smaller changes.

github-actions · 2024-11-27T15:51:21Z

🤖 Vercel preview here: https://docs-65k658emc-goteleport.vercel.app/docs

github-actions · 2024-11-27T16:05:03Z

🤖 Vercel preview here: https://docs-ng3o76b5d-goteleport.vercel.app/docs

public-teleport-github-review-bot · 2024-11-27T16:31:30Z

@greedy52 See the table below for backport results.

Branch	Result
branch/v17	Failed

* git_server resource and role.allow.github_permissions * implicit RO on KindGitServer * review comments * fix ut * make -C integrations/operator crd * fix ut again * make crds-up-to-date and make -C integrations/terraform docs

* GitHub Proxy part 1: github integration resource (#48999) * github integration resource * fix lib/web * revert withSecrets * use static credentials * address review comments * fix ut * GitHub Proxy part 2: git_server resource, service, and RBAC (#49393) * git_server resource and role.allow.github_permissions * implicit RO on KindGitServer * review comments * fix ut * make -C integrations/operator crd * fix ut again * make crds-up-to-date and make -C integrations/terraform docs * GitHub proxy part 1.5: integration in web ui (#49561) * GitHub proxy part 1.5: integration in web ui * fix lint * GitHub Proxy part 3.5: caching PluginStaticCredentials (#49472) * GitHub Proxy part 3.5: caching PluginStaticCredentials * fix lint * GitHub proxy part 2.5: git_server cache (#49564) * GitHub proxy part 2.5: git_server cache * revert event * fix getAll * review comments * GitHub Proxy part 3: gen github user cert and export CA (#49396) * GitHub Proxy part 3: gen github user cert and export CA * address pr comment * minor refactor * use cache * fix build and cache * GitHub proxy part 4: `tsh git ls` with unified resource (#49596) * GitHub proxy part 4: tsh git ls * fix ut * update username note * fix * GitHub proxy part 5: OAuth flow to retrieve GitHub identity (#49849) * GitHub proxy part 5: OAuth flow to retrieve GitHub identity * review comments round1 * review comments round 2 and update tsh git list * make -C integrations/operator crd * make -C integrations/terraform docs * fix flaky test * GitHub proxy part 6.5: tsh git ssh/clone/config (#50044) * GitHub proxy part 6.5: tsh git ssh/clone/config * review comments * fix test * fix ut for lookpath * fix logger and update dependency version * go mod tidy for integrations * GitHub proxy part 7: audit events (#49923) * GitHub proxy part 7: audit events * make Git Command consistent * fix typo * GitHub proxy: git command recorder (#50505) * GitHub proxy: recording git command * address review * review comments * allow flags after repository for git-upload-pack * GitHub proxy part 6: proxing Git using SSH transport (#49980) * GitHub proxy part 6: proxing Git using SSH transport * better command parsing and update suite * refactor * revert unnecearrty files * address review comments * ut fix * revert localsite_test.go * change special suffix to teleport-github-org for routing * fix routing ut * minor typo edit * fix ut after sshca change * add UT to sshutils * minor review comments * fix api ut because of special suffix change * GitServerReadOnlyClient * downgrade error to warning * run go mod tidy. not sure why it's needed * rename mock.go to mock_test.go * GitHub Proxy: complete audit event flow and add an enterprise guard (#51049) * fix lint and remove accidently checked-in binary * Fix flaky git.TestForwardServer test (#51112)

git_server resource and role.allow.github_permissions

8def2e8

greedy52 added the backport/branch/v17 label Nov 24, 2024

greedy52 changed the title ~~GitHub Proxy part 2: git_server and RBAC~~ GitHub Proxy part 2: git_server resource, service, and RBAC Nov 24, 2024

Merge branch 'master' of github.com:gravitational/teleport into STeve…

177eeec

…/48762_git_server

greedy52 force-pushed the STeve/48762_git_server branch from 227c801 to 177eeec Compare November 25, 2024 01:45

greedy52 requested review from r0mant and smallinsky November 25, 2024 17:12

greedy52 marked this pull request as ready for review November 25, 2024 17:12

github-actions bot added size/lg tctl tctl - Teleport admin tool labels Nov 25, 2024

github-actions bot requested a review from rudream November 25, 2024 17:12

greedy52 added the no-changelog Indicates that a PR does not require a changelog entry label Nov 25, 2024

r0mant approved these changes Nov 25, 2024

View reviewed changes

smallinsky reviewed Nov 26, 2024

View reviewed changes

greedy52 added 2 commits November 26, 2024 15:52

implicit RO on KindGitServer

e3562bc

review comments

217e560

smallinsky approved these changes Nov 27, 2024

View reviewed changes

public-teleport-github-review-bot bot removed the request for review from rudream November 27, 2024 09:35

greedy52 added 2 commits November 27, 2024 09:11

fix ut

d1cc126

make -C integrations/operator crd

b1115d1

greedy52 temporarily deployed to vercel November 27, 2024 14:19 — with GitHub Actions Inactive

fix ut again

5402836

greedy52 temporarily deployed to vercel November 27, 2024 14:21 — with GitHub Actions Inactive

greedy52 enabled auto-merge November 27, 2024 14:31

greedy52 temporarily deployed to vercel November 27, 2024 15:40 — with GitHub Actions Inactive

make crds-up-to-date and make -C integrations/terraform docs

84c1e6e

greedy52 force-pushed the STeve/48762_git_server branch from 2989a83 to 84c1e6e Compare November 27, 2024 15:54

greedy52 temporarily deployed to vercel November 27, 2024 15:54 — with GitHub Actions Inactive

greedy52 added this pull request to the merge queue Nov 27, 2024

Merged via the queue into master with commit fae535b Nov 27, 2024
43 checks passed

greedy52 deleted the STeve/48762_git_server branch November 27, 2024 16:30

This was referenced Nov 28, 2024

GitHub proxy part 2.5: git_server cache #49564

Merged

GitHub proxy MVP #48762

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

GitHub Proxy part 2: git_server resource, service, and RBAC #49393

GitHub Proxy part 2: git_server resource, service, and RBAC #49393

greedy52 commented Nov 24, 2024

r0mant Nov 25, 2024

smallinsky Nov 26, 2024

greedy52 Nov 26, 2024

smallinsky Nov 26, 2024

greedy52 Nov 26, 2024 •

edited

Loading

espadolini Dec 2, 2024

greedy52 Dec 2, 2024

espadolini Dec 3, 2024

greedy52 Dec 3, 2024

github-actions bot commented Nov 27, 2024

github-actions bot commented Nov 27, 2024

public-teleport-github-review-bot bot commented Nov 27, 2024

github-actions bot commented Nov 27, 2024

github-actions bot commented Nov 27, 2024

public-teleport-github-review-bot bot commented Nov 27, 2024

		if serverV2, err := toServerV2(server); err != nil {
		return nil, trace.Wrap(err)

GitHub Proxy part 2: git_server resource, service, and RBAC #49393

GitHub Proxy part 2: git_server resource, service, and RBAC #49393

Conversation

greedy52 commented Nov 24, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

greedy52 Nov 26, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

github-actions bot commented Nov 27, 2024

github-actions bot commented Nov 27, 2024

public-teleport-github-review-bot bot commented Nov 27, 2024

github-actions bot commented Nov 27, 2024

github-actions bot commented Nov 27, 2024

public-teleport-github-review-bot bot commented Nov 27, 2024

greedy52 Nov 26, 2024 •

edited

Loading