Add tsh command to resolve a single host #47689
Open
+296
−0
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
tsh resolve
allows identifying a single host either directly by hostname, or via custom search/predicate expression from a matched proxy template. The main use case is to provide a simple command for users that wish to useMatch exec
in their SSH config. Today, all matching in SSH config must be done via DNS and requires users to add some Teleport specific suffix/prefix, or use a wildcard entry to invoke a tsh proxy command.For example, the SSH config generated today via
tsh config
is the following:This allows connections to the Teleport SSH service without using tsh directly via
ssh foo.cluster-name
. However, when migrating to Teleport, that requires the user to alter their existing workflow to include the cluster-name suffix. To remedy this, users can now augment their SSH config to utilizeMatch exec
instead of globbing on the cluster name suffix with the following:By default tsh resolve will output the matching host, if one was found, but if the
-q
flag provided like in the example above the output will be silenced. If no matches are found, or multiple matches are found,tsh resolve
will exit with a non-zero exit code as per theMatch exec
requirements. If and only if a single host is resolved willtsh resolve
exit with a zero exit code.There are performance concerns that need to be taken into account before users adopt this in their SSH config. First, this may cause
tsh resolve
to be invoked on any SSH request. For example, even doing git pull/git push may now first requiretsh resolve
to exit with a non-zero exit code before interacting with the git remote. Additionally, whentsh resolve
finds a match, any connections to the node will require two connections to the cluster and two ListUnifiedResourcesRequests to resolve the host since the invocation oftsh resolve
andtsh proxy ssh
ortbot proxy ssh
do not share resources. For the reasons mentioned above, the SSH configuration generated bytsh config
was not updated to include this new command. If users want to opt into this behavior they must acknowledge the latency concerns by manually editing the config.changelog: Add a
resolve
command to tsh that may be used as the target for a Match exec condition in an SSH config.