[v14] Client tools managed updates #52025

vapopov · 2025-02-11T05:51:30Z

Backports:

to branch/v14

Related: https://github.com/gravitational/cloud/issues/11856

Changelog: Client tools {tctl,tsh} auto-updates controlled by cluster configuration
Changelog: Fixed client tools auto-updates executed by aliases (causes recursive alias error)
Changelog: Added support for customizing the base URL for downloading Teleport packages used in client tools managed updates

* Expose client tools auto update for find endpoint (#46785) * Expose client tools auto update for find endpoint * Group auto update settings in find response Log error instead returning error Add tests auto update settings in find endpoint Add check for not implemented error * Add more test cases * Client AutoUpdate proto structure changes (#47532) * Update client autoupdate proto structure * Replace with reserved * Fix unit tests * Add more info in proto * Rename proto to be aligned RFD namings * Replace enum type for ToolsMode to string * Add packaging utility for client tools auto updates (#47060) * Add packaging utility for client tools auto updates * Add error handling for close functions * Move archive to existing utils package * Move archive helpers to integration/helper CR changes * CR changes * CR changes * CR changes Replace creating directory with extract path as argument * CR changes * Validate full size before un-archive Extract files to extractDir with ignore dir structure * Change compressing with relative paths Add test for cleanup and fix skip logic * CR changes * CR changes * Fix linter * Client tools auto update (#47466) * Add client tools auto update * Replace fork for posix platform for re-exec Move integration tests to client tools specific dir Use context cancellation with SIGTERM, SIGINT Remove cancelable tee reader with context replacement Renaming * Fix syscall path execution Fix archive cleanup if hash is not valid Limit the archive write bytes * Cover the case with single package for darwin platform after v17 * Move updater logic to tools package * Move context out from the library Base URL renaming * Add more context in comments * Changes in find endpoint * Replace test http server with `httptest` Replace hash for bytes matching Proper temp file close for archive download * Add more context to comments * Move feature flag to main package to be reused * Constant rename * Replace build tag with lib/modules to identify enterprise build * Replace fips tag with modules flag * Client auto updates integration for {tctl,tsh} (#47815) * Client auto updates integration for tctl/tsh * Add version validation Fix recursive version check for darwin platform Fix cleanup for multi-package support * Fix identifying tools removal from home directory * Replace ToolsMode with ToolsAutoUpdate * Reuse insecure flag for tests * Fix CheckRemote with login * Fix windows administrative access requirement Update must be able to be canceled, re-execute with latest version or last updated Show progress bar before request is made * Fix update cancellation for login action Address review comments * Add signal handler with stack context cancellation * Use copy instead of hard link for windows Fix progress bar if we can't receive size of package * Replace with list in order to support manual cancel * Download archive package to temp directory * Decrease timeout for client tools proxy call * Add audit logs for auto update resources (#48218) * Connect: Make sure tsh auto-updates are turned off * Add dir for code shared between Node.js processes * Connect: Make sure tsh auto-updates are turned off * Pass TELEPORT_TOOLS_VERSION=off to tsh vnet-daemon * Disable client tools auto update disabled if there are no home dir (#49159) Move updater to general tools package * Move client auto update helper to lib package (#49247)

…50244) * Restrict AutoUpdateVersion to be created/updated for cloud * Check builtin Admin role and Cloud feature * More informative error message * Remove KindAutoUpdateAgentRollout from editor role preset

…49532) (#49676)

* Fix auto-update re-exec arguments modified by aliases * Make arguments to be required to set * Restore progress bar show before request * Improve integration tests to execute with `tsh` and `tctl` Added a full-cycle integration test to verify client tools auto-updates within a test cluster by modifying AutoUpdateConfig and AutoUpdateVersion resources. The test executes the login command using alias configurations to ensure no recursive re-execution occurs. The updater binary used in integration tests has been replaced with the `Run` logic of tctl and tsh. * Set generated test password by env variable instead of constant value * Restore priority of env check over remote check In case of double re-execution case we should stop second one to prevent loop re-execution Drop localDir set during compilation

* Add client tools auto update tctl commands * Always print version for watch command Restrict update empty target version Rename command to upsert * Add alias on/off for tools mode Rename update command to configure * Add semantic version validation * Drop watch command for autoupdate * Replace Upsert with Update/Create Add format option for output json/yaml * Change update message * Use get/set naming for client-tools * Add mode to response * Change sub-command help messages Leave only aliases for enabled/disabled * Reorganize tctl commands to have commands not required auth client * Propagate insecure flag with global config to commands by context * Fix autoupdate command without auth client * Change commands to enable/disable/target * Add retry in case of the parallel request * Add more than one retry Code review changes

* Add templates for client tools auto-update download url * Change to base url setting by env MakeURL moved to common function to be general for both, agent and client tools * Add godoc for common function and constant for default package * Use flags and version arguments instead of revision * Move base url env to shared constant

public-teleport-github-review-bot · 2025-02-11T05:52:06Z

@vapopov - this PR will require admin approval to merge due to its size. Consider breaking it up into a series smaller changes.

vapopov · 2025-02-12T19:33:01Z

@ravicious could you please take a look on:
https://github.com/gravitational/teleport/pull/52025/files#diff-bd472f37cf18048f7c811cf4ad6578f4239014c73b65925548e0050adc05ee1eR71
https://github.com/gravitational/teleport/pull/52025/files#diff-8248abda507bbfd6116df3caf97da6cc186ef8705af654a54dd0fb62c1085672R26
if I don't miss anything in backporting related to teleport-connect

ravicious · 2025-02-14T17:20:43Z

It's missing changes in mainProcess.ts which pass the env var when running tsh daemon start. Give me a sec, because I think we did some refactoring in how we start tshd in v15 or v16.

ravicious · 2025-02-14T17:37:31Z

Now the Connect changes in this PR match the same changes that were in fed28b2de6 from #48648.

vapopov · 2025-02-15T01:02:34Z

@ravicious thank you!

* Fix windows permission error with self replace * Aggregate errors * Update comments

vapopov added 6 commits February 10, 2025 17:58

Restrict AutoUpdateVersion to be created/updated for cloud (#49008) (#…

d9de24a

…50244) * Restrict AutoUpdateVersion to be created/updated for cloud * Check builtin Admin role and Cloud feature * More informative error message * Remove KindAutoUpdateAgentRollout from editor role preset

Add remove tctl command for AutoUpdateConfig and AutoUpdateVersion (#…

17a64cb

…49532) (#49676)

vapopov added the backport label Feb 11, 2025

vapopov requested review from sclevine and hugoShaka February 11, 2025 05:51

github-actions bot added audit-log Issues related to Teleports Audit Log size/xl tctl tctl - Teleport admin tool tsh tsh - Teleport's command line tool for logging into nodes running Teleport. ui labels Feb 11, 2025

github-actions bot requested a review from r0mant February 11, 2025 05:52

Fix tests after backporting

eb4ca79

vapopov force-pushed the vapopv/client-tools-autoupdates-v14 branch from f7a0e2c to eb4ca79 Compare February 11, 2025 22:45

tigrato approved these changes Feb 12, 2025

View reviewed changes

Pass TELEPORT_TOOLS_VERSION=off when starting tshd

23a2b0a

r0mant approved these changes Feb 18, 2025

View reviewed changes

public-teleport-github-review-bot bot removed request for sclevine and hugoShaka February 18, 2025 19:56

Prevent keystore cleanup to remove bin directory (#52331)

ddc42ec

vapopov force-pushed the vapopv/client-tools-autoupdates-v14 branch from a692ca2 to 290b52a Compare February 21, 2025 05:46

Don't show the progress bar until the request to the CDN is made

7e1e167

Fix Windows permission error with self remove (#52316)

052e338

* Fix windows permission error with self replace * Aggregate errors * Update comments

vapopov force-pushed the vapopv/client-tools-autoupdates-v14 branch from 290b52a to 052e338 Compare February 26, 2025 01:07