Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Machine ID: Leaf cluster support for SSH multiplexer #43484

Merged
merged 8 commits into from
Jun 28, 2024

Conversation

strideynet
Copy link
Contributor

@strideynet strideynet commented Jun 25, 2024

Closes #43477

Modifies the SSH multiplexer protocol to support specifying a target cluster and modifies the generation of the known_hosts and ssh_config to include all accessible clusters.

The additional "|cluster" suffix added to the protocol is optional - if omitted the old behaviour of using the cluster that the bot has authenticated is used. This means that using a ssh_config generated by a previous version with a newer version of tbot will not result in an error.

However, the opposite is not true. Using a ssh_config generated by a newer tbot with an older tbot's tunnel will result in an error:

~/code/gravitational/teleport git:[master]
ssh -F ../teleport-scratch/tbot-ssh/ssh-proxy/ssh_config_old -p 13022 [email protected] echo foo
failed connecting to host macbook:13022|root.tele.ottr.sh: failed to receive cluster details response
        failed to dial target host
        direct dialing to nodes not found in inventory is not supported
Connection closed by /Users/noah/code/gravitational/teleport-scratch/tbot-ssh/ssh-proxy/v1.sock port 0

We could roll to a v2.sock to make this error a little clearer since the socket wouldn't exist, but, they'd still get an error. Given that the ssh_config is generated by the tbot that hosts the tunnel, the only scenario where this could be encountered is if the user maintains a custom ssh_config and starts using cluster targetting with an older version of tbot. Additionally, the SSH multiplexer has only existed for 1 or 2 patch versions. This makes it feel to me like it's not worth rolling to v2.sock - but let me know your thoughts.

changelog: Added support for dialling leaf clusters to the tbot SSH multiplexer

@strideynet strideynet marked this pull request as ready for review June 27, 2024 12:45
@gravitational gravitational deleted a comment from github-actions bot Jun 27, 2024
@gravitational gravitational deleted a comment from github-actions bot Jun 27, 2024
@strideynet strideynet added this pull request to the merge queue Jun 28, 2024
Merged via the queue into master with commit 95f67eb Jun 28, 2024
41 of 42 checks passed
@strideynet strideynet deleted the strideynet/ssh-multiplexer-multi-cluster-support branch June 28, 2024 09:35
@public-teleport-github-review-bot

@strideynet See the table below for backport results.

Branch Result
branch/v15 Failed
branch/v16 Failed

strideynet added a commit that referenced this pull request Jun 28, 2024
* Start hacking on multicluster support for ssh multiplexer

* Support specifying cluster name via multiplexing request

* Generate known_hosts and ssh_config with multiple clusters

* Remove unnecessary parameter

* Test for specified and unspecified cluster name

* Clarify comment
strideynet added a commit that referenced this pull request Jun 28, 2024
* Start hacking on multicluster support for ssh multiplexer

* Support specifying cluster name via multiplexing request

* Generate known_hosts and ssh_config with multiple clusters

* Remove unnecessary parameter

* Test for specified and unspecified cluster name

* Clarify comment
github-merge-queue bot pushed a commit that referenced this pull request Jun 28, 2024
…43635)

* Machine ID: Leaf cluster support for SSH multiplexer (#43484)

* Start hacking on multicluster support for ssh multiplexer

* Support specifying cluster name via multiplexing request

* Generate known_hosts and ssh_config with multiple clusters

* Remove unnecessary parameter

* Test for specified and unspecified cluster name

* Clarify comment

* Remove unnecessary ctx arg
github-merge-queue bot pushed a commit that referenced this pull request Jun 28, 2024
* Start hacking on multicluster support for ssh multiplexer

* Support specifying cluster name via multiplexing request

* Generate known_hosts and ssh_config with multiple clusters

* Remove unnecessary parameter

* Test for specified and unspecified cluster name

* Clarify comment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Machine ID: SSH multiplexer should support Leaf clusters.
3 participants