release: bump Teleport fork to v18.10.0 - #8
Closed
felipeasantos wants to merge 2057 commits into
Closed
Conversation
…ional#67273) * Add shared UserDisplayName component * Remove vertical alignment from UserDisplayName component and add missing license header to index file * Refactor UserDisplayName component to use variables for rendering primary, secondary, and username values * Refactor UserDisplayName component: update test descriptions, simplify secondary value rendering, and adjust type exports * Enhance UserDisplayName stories: add layout variants and improve layout examples * added a playground story * inline UserDisplayNameProps interface into function parameters
…ravitational#67288) * Use session params in regular session. * Add regression test.
…67297) * docs: adding agentic identity in feature matrix * post-meeting: Chris W. edits * organizing Beams in per-feature structure to match rest of the tables * Firecracker and beam lifecycle details
) Backport of gravitational#66987 to branch/v18. Stagger expiry times so items land in different lease buckets, eliminating the per-run sleep overhead which caused the test to exceed the Flaky Tests Detector timeout.
Fixes an off-by-one error in the `tsh dmi-read` output parser and adds tests for same. Backports: gravitational#66992
As an empty challenge is never legal, this patch tightens the `devicetrust` signer and verifier to explicitly reject them. Changelog: Tightened signature handling in Device Trust
It was observed in cloud that proxies will hang on deletion if they lose connection to auth prior to being terminated. This will cause pods to hang until the termination grace period is hit which can be quite long in some cases. Testing this in cloud allowed disconnected proxies to exit quickly when terminated.
…t advertise tools version (gravitational#67379) * Connect: Improve error message for pre-v17 clusters that may not advertise tools version * Drop `advertised an empty tools version`
The resource ref generator was not properly handling API_HYBRID protobuf files. When protoc generates code for API_HYBRID protos (configured in buf-go.gen.yaml), it creates two versions: 1. Regular .pb.go files with exported struct fields (build tag: !protoopaque) 2. _protoopaque.pb.go files with xxx_hidden_* fields (build tag: protoopaque) The generator was randomly picking up whichever file it encountered first. When it selected the protoopaque variant, all struct fields were unexported (starting with xxx_hidden_), causing them to be filtered out during documentation generation, resulting in empty or incomplete reference pages. This change adds a filter to skip _protoopaque.pb.go files during the source code walk, ensuring the generator only processes regular .pb.go files that contain properly exported fields with full documentation. This fix enables proper documentation generation for all API_HYBRID resources, including bot_instance and other protobuf-based resources. This is a temporary change, we must convert resource geneneration to use proto as source instead of go structs otherwise we will never be able to migrate to proto opaque api. Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
…oard in the Web UI SSH Terminal (gravitational#67276) * Add `web_terminal_copy_mode` role option (gravitational#66597) * block copying in the web terminal if role option is present (gravitational#66944)
* Add ui interaction event protos * make grpc * Add userEventService method * Fix signature * Fix username field it would have been logging the hash of "" * Fix type for v18
Replace anonymous sync.Mutex embedding in instancesCache with a named mu field so Lock/Unlock/TryLock are no longer promoted onto the type. Removes a latent self-deadlock foot-gun and the accidental sync.Locker implementation. No behavioral change.
…#67373) * Add Networking Reference Troubleshooting section See gravitational#62997 Edit the Networking Reference to add a Troubleshooting section covering three common networking errors when setting up a Teleport cluster: - Connection reset by peer - First record does not look like a TLS handshake - Authentication handshake failed (teleport.cluster.local) * Edit Networking Reference connection reset section Make the guidance more general and explain the origin for users who may not be familiar with TCP fundamentals. * Clarify the Networking reference Responds to **zmb3** feedback: - Don't use code style to refer to a Teleport process. - Use a broader level of detail for the "connection reset" discussion. - Remove incorrect indication that that the Proxy Service has a SAN.
…ational#67339) * kube: dedupe SPDY streams, guard nil resize (cherry picked from commit a8adb71) * kube: cancellable notify send in waitStreamReply (cherry picked from commit f87f3e1) * kube: simplify resizeQueue nil-safe test (cherry picked from commit b2bc67a) * kube: baseline goleak before test (cherry picked from commit 0bb5eb2) * drop goleak test on backport
…l#67227) (gravitational#67381) (cherry picked from commit 8c15be1)
* [v18] Docs: Okta Integration Network * Fix the groups mapping example
* docs: add Redshift DBeaver connection guide * Update docs/pages/connect-your-client/third-party/gui-clients.mdx Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com> --------- Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
The function was left around until teleport.e used scopes.Features. The last usage has since been converted and is now safe for removal.
* Desktop Access: Plumb Directory IDs through TDPB (gravitational#68033) * Add DirectoryID to shared directory responses and plumb them through to the RDP client. * Add 'multidirectory_sharing_supported' advertisement to TDPB ServerHello. * Desktop Access: Support Multiple Devices in Filesystem Backend (gravitational#68034) * Refactor filesystem backend to separate file caches and response handlers by directory/device_id. Add cancellation for pending requests when a directory needs to be removed, and work around idiosyncratic server behavior when removing filesystem devices that have open file handles. * Remain backwards compatible with older clients that don't set a 'DirectoryId' in their shared directory response messages by converting DirectoryId '0' to '2'. * Turn down some warnings and remove extraneous logs. * Drop 'tombstone' terminology. * Rework request cancellation. When a device is removed from the filesystem backend, the remove function returns a list of 'cancellation pdus' which need to be sent to cancel pending IO requests. The caller up at the RDP client level can write those directory to the write stream. This fixes a potential deadlock that could occur in the previous implementation due to cancellation requsts potentially filling the rdpdr channel. * remove dead code * Seems that we need to response to DirectoryNotifyChange requests rather than ignore them. Also, we must respond to 'ServerDriveQueryInformationRequest' requests with a 'CANCELLED' status if the device is marked for deletion. * Use a read interceptor to fix the DirectoryID field on incoming SharedDirectoryResponse messages so that the audit handlers see these correct IDs. * Rework device removal so that we hold the x224_lock while removing both the TeleportRdpdr's device handle and the top level rdpdr instance's device handle. This way the two instances are removed atomically, and the rdpdr backend can't dispatch any IO request for a device that we've just removed a directory context for (which would cause a fatal error). * Remove dead code and fix spelling. * Fix spelling Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com> --------- Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com> * Desktop Access: Support Multi-Directory Sharing and Removal (gravitational#65952) * Update audit cache and handlers to match shared directory read/write respponses based on (deviceId, completionId) tuples rather than just the completionId. (gravitational#68156) * Desktop Access: Drop Shared Directory Removal (gravitational#68260) * Mark directory removal as unsupported for now * Get rid of the remove/eject button from the multi-directory sharing menu. We're omitting support for removal for now. --------- Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
…ravitational#67728) (gravitational#68235) * Adjust ScopedRoleAssignment to refer to scoped Bot using SQN (gravitational#67728) * Adjust ScopedRoleAssignment to refer to scoped Bot using SQN * Adjust godocs to avoid triggering linter * fix scopes docs * gofmt
…tational#68217) * kube: guard force_terminate close with sync.Once * kube: make force_terminate test deterministic * kube: group forceTerminateOnce with forceTerminate
…on (gravitational#68228) Ensure that the EKSAuditLogWatcher fully completes before initializeAndWatchAccessGraph() completes, including the fetchers spawned by the watcher. This is done by adding the run of the EKSAuditLogWatcher to the waitgroup the initialize function uses to wait for the grpc connection to complete. The function does not return until this waitgroup is finished. Also add a WaitGroup to the EKSAuditLogWatcher to keep track of all the fetchers spawned so that the EKSAuditLogWatcher.Run() function does not return until all the fetchers have completed. This stops the fetchers from trying to use a closed grpc connection during cleanup.
* Make `VnetContext` tests depend on action order rather than no of calls * Explain the idea behind acknowledgement/dismissal being "sticky" * Update Jest mock outside of `act`
…ravitational#67277) (gravitational#68222) * chore: removed cloud city background and beams config refactor * chore: removed unneeded styling
* Add AppClient CA (gravitational#66273) * feat: introduce app_client CA * Apply suggestions from code review Co-authored-by: Krzysztof Skrzętnicki <krzysztof.skrzetnicki@goteleport.com> * fix(tctl): app client info being shown for other CAs due to fallthrough * Apply suggestions from code review Co-authored-by: Alan Parra <12500300+codingllama@users.noreply.github.com> * refactor(cryptosuites): update legacy algo --------- Co-authored-by: Krzysztof Skrzętnicki <krzysztof.skrzetnicki@goteleport.com> Co-authored-by: Alan Parra <12500300+codingllama@users.noreply.github.com> * `tbot` add `trust_domains` option for supported services (gravitational#66587) * feat: tbot trust_domains option for supported services * test(workloadidentity): adjust test assertion * Apply suggestions from code review Co-authored-by: Dan Upton <daniel@floppy.co> * refactor: code review suggestions * chore(workloadidentity): fix lint --------- Co-authored-by: Dan Upton <daniel@floppy.co> * Add `IssueTeleportWorkloadIdentity` RPC (gravitational#66691) * feat(workloadidentityv1): issue teleport workload identity * refactor(workloadidentityv1): code review suggestions * refactor(workloadidentityv1): code review suggestions * chore(workloadidentityv1): clarify comment * Apply suggestions from code review Co-authored-by: Noah Stride <noah@noahstride.co.uk> * chore(workloadidentityv1): code review suggestions and update --------- Co-authored-by: Noah Stride <noah@noahstride.co.uk> * App service use upstream TLS options (gravitational#66454) * feat: app service use upstream tls options * refactor: code review suggestions * refactor(upstreamtls): code review suggestions * test(app): provide missing transport options * chore(app): fix lint * Implement app access managed client certificates (gravitational#67701) * feat(app): issue client certificates for downstream connections * chore(upstreamtls): code review suggestions * chore(upstreamtls): use opaque grpc api * chore: docs lint and missing insecure flag --------- Co-authored-by: Krzysztof Skrzętnicki <krzysztof.skrzetnicki@goteleport.com> Co-authored-by: Alan Parra <12500300+codingllama@users.noreply.github.com> Co-authored-by: Dan Upton <daniel@floppy.co> Co-authored-by: Noah Stride <noah@noahstride.co.uk>
…gravitational#68338) * chore: Bump golang.org/x/image to v0.43.0 * tidy
#1) * add terraform config * add circleci config * fix build errors * include terraform lock file to the gitignore * add disclaimer to the README * Update CODEOWNERS * update circleci to build and push the distroless image * add PR template * disable atlantis
* add release script * remove sentinel job to prevent patch conflicts * update README * ensure version string is prefixed with 'v' if missing
* fix branch filters * add comment to ecr module * add allowed_pull_account ids comment
felipeasantos
had a problem deploying
to
docs-amplify
July 15, 2026 14:32 — with 
GitHub Actions
Failure
GitHub Actions
Failure
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. 🗂️ Base branches to auto review (4)
Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository: loadsmart/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Ran Plan for 3 projects:
1. dir:
|
Author
|
Closing per the documented release process (loadsmart/release.sh) which pushes the branch and tag directly without a PR. The release/v18.10.0 branch stays on origin as the tag target. Cherry-pick review notes preserved in this PR for reference. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
release/v18.10.0branch to the Loadsmart Teleport fork by rebasing our 5 CI/build-wrapper commits onto upstreamgravitational/teleport@v18.10.0.This is the source branch that will be tagged
v18.10.0to trigger the CircleCI pipeline that publishes distroless images to ECR (platform/teleport:18.10.0andplatform/teleport:18.10.0-arm64).Context
teleport.loadsmart.io: 18.2.4What's in this branch
Upstream
v18.10.0with our 5 Loadsmart commits reapplied on top (identical to the pattern used forrelease/v18.2.4):ci: add pipeline to build/push distroless images to loadsmart registry (#1)chore: add release script (#2)ci: add separate jobs for arm64 and amd64 distroless builds (#3)ci: fix branch filters (#4)add missing libs to the dockerfile distroless to make tctl workCherry-pick conflicts resolved
Two conflicts occurred on commit #1, both resolved by keeping the Loadsmart version (identical to
release/v18.2.4):.circleci/config.yml: upstream deleted the file, we keep our ECR build pipelinebuild.assets/Makefile(build-binariestarget): upstream addedREQUIRE_HOST_ARCH,LOG_GROUP_START/END, and OS/ARCH/RUNTIME parameterisation. We keep the simplerscl enableinvocation that's been building v18.0.0 through v18.2.4 successfully.build.assets/charts/Dockerfile-distrolesshad no conflict, verified identical between upstream v18.2.4 and v18.10.0.Verification
.circleci/config.yml, Dockerfile distroless withlibpam0g libaudit1 libcap-ng0 libfido2-1 libcbor0.8 libudev1 zlib1glibsMakefile:VERSION=18.10.0confirmedNext steps (out of this PR)
release/v18.2.4(or approve pushing tag directly on branch)v18.10.0onrelease/v18.10.0HEAD → CircleCI publishesplatform/teleport:18.10.0+:18.10.0-arm64to ECRdev/locals.tffirst (per Felipe's plan to apply dev cluster first), then production and remaining 9 agent envsaccess-hubPR: no code change required, but re-plan/apply expected to show role-default drift from Terraform provider v18 behaviourRisk
Low. Fork commits are pure CI/build wrappers, no Teleport source patches. Same shape as prior fork releases.