teleport

Documentation

Overview

Package teleport keeps the desk's Teleport login: it reads the active profile's expiry from tsh and renews the login in a staging home, which replaces the profile directory in one exchange once the new login has succeeded. It reads metadata only (cluster, user, expiry), never the certificates or keys, and keeps tsh's output, which carries the one-time login URL, in a log file instead of returning it.

Index

• Variables
• func Due(p Profile, perr error, r Record, now time.Time, before time.Duration) (bool, string)
• type Profile
  • func ParseStatus(raw []byte) (Profile, error)
  • func Status(ctx context.Context, tsh, home string) (Profile, error)
  • func (p Profile) Left(now time.Time) time.Duration
• type Record
  • func (r Record) Failed(p Profile, perr error) bool
• type Renewal
  • func (r Renewal) Log() string
  • func (r Renewal) Previous() string
  • func (r Renewal) Renew(ctx context.Context, now time.Time) (Profile, error)

Variables

var ErrCallbackTimeout = errors.New("the proxy's SSO callback timed out")

ErrCallbackTimeout is a login whose SSO callback exchange with the proxy timed out after the browser's sign-in succeeded: a fresh attempt completes it.

var ErrNotLoggedIn = errors.New("not logged in")

ErrNotLoggedIn is a profile directory without an active profile.

Functions

func Due

func Due(p Profile, perr error, r Record, now time.Time, before time.Duration) (bool, string)

Due decides whether the keeper renews now: once less than before is left on the active profile, or none is active, unless a renewal of that very profile failed already. The reason says why not.

Types

type Profile

type Profile struct {
	Cluster    string    `json:"cluster"`
	Username   string    `json:"username"`
	ValidUntil time.Time `json:"valid_until"`
}

Profile is the active profile's metadata, as tsh status prints it.

func ParseStatus

func ParseStatus(raw []byte) (Profile, error)

ParseStatus reads the active profile from `tsh status --format=json`.

func Status

func Status(ctx context.Context, tsh, home string) (Profile, error)

Status reads the active profile of the profile directory home with tsh.

func (Profile) Left

func (p Profile) Left(now time.Time) time.Duration

Left is how long the profile is valid from now, negative once it expired.

type Record

type Record struct {
	// RenewedAt is the last renewal's time, ValidUntil the expiry it got.
	RenewedAt  time.Time `json:"renewedAt,omitzero"`
	ValidUntil time.Time `json:"validUntil,omitzero"`
	// FailedAt is the last failed renewal, FailedFor the expiry of the
	// profile it was to replace (zero: none was active), Reason why.
	FailedAt  time.Time `json:"failedAt,omitzero"`
	FailedFor time.Time `json:"failedFor,omitzero"`
	Reason    string    `json:"reason,omitempty"`
	// Waiting is why the keeper's last run that was due did not renew (the
	// browser lease is held), WaitingAt when.
	Waiting   string    `json:"waiting,omitempty"`
	WaitingAt time.Time `json:"waitingAt,omitzero"`
}

Record is what the keeper last did, kept in the state directory between its runs.

func (Record) Failed

func (r Record) Failed(p Profile, perr error) bool

Failed reports whether the record's failed renewal was for the profile p (read with perr): the keeper does not try that login again, a person does.

type Renewal

type Renewal struct {
	// Tsh is the tsh binary.
	Tsh string
	// Home is the profile directory the kube contexts' tsh reads (~/.tsh).
	Home string
	// Dir holds the staging home, the previous profile and the login log.
	Dir string
	// Proxy and Auth are tsh login's --proxy and --auth; an empty Auth is
	// the cluster's default connector.
	Proxy, Auth string
	// Timeout bounds the login, the browser's round trip included.
	Timeout time.Duration
	// Login runs the login into the staging home, its output into log; nil
	// is tsh login.
	Login func(ctx context.Context, home string, log *os.File) error
	// Status reads a profile directory; nil is Status with Tsh.
	Status func(ctx context.Context, home string) (Profile, error)
	// Retry, when set, hears the first login's ErrCallbackTimeout before
	// the one retry.
	Retry func(first error)
}

Renewal is one renewal of the login of the profile directory Home.

func (Renewal) Log

func (r Renewal) Log() string

Log is the file the last login's output went to: it carries the one-time login URL, so it is never printed.

func (Renewal) Previous

func (r Renewal) Previous() string

Previous is where the profile before the last renewal is kept.

func (Renewal) Renew

func (r Renewal) Renew(ctx context.Context, now time.Time) (Profile, error)

Renew logs in into an empty staging home (a valid profile makes tsh login print the status only) and, once that login holds a profile valid past now, exchanges the staging home with Home in one step: the old certificate serves until the new one is in place. The profile before is kept as Previous. A login that fails with ErrCallbackTimeout is retried once in the same staging home, its output appended to the log. On any failure Home stays as it was.