Release 15.4.30 (#52829)

gravitational · Mar 6, 2025 · e8faf5d · e8faf5d
1 parent cd38b27
commit e8faf5d
Show file tree

Hide file tree

Showing 44 changed files with 226 additions and 212 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1123,6 +1123,20 @@ follow the manual setup guide.
 All Teleport Assist functionality and OpenAI integration has been removed from
 Teleport.
 
+## 15.4.30 (03/05/25)
+
+* Escape user provided labels when creating the shell script that enrolls servers, applications and databases into Teleport. [#52706](https://github.com/gravitational/teleport/pull/52706)
+* Support setting the public address for discovered apps based on Kubernetes annotations. [#52702](https://github.com/gravitational/teleport/pull/52702)
+* Fixed `cannot execute: required file not found` error with the `teleport-spacelift-runner` image. [#52562](https://github.com/gravitational/teleport/pull/52562)
+* Updated go-jose/v4 to v4.0.5 (addresses CVE-2025-27144). [#52469](https://github.com/gravitational/teleport/pull/52469)
+* Updated /x/crypto and /x/oauth2 (addresses CVE-2025-22869 and CVE-2025-22868). [#52440](https://github.com/gravitational/teleport/pull/52440)
+* Added JSON response support to the `/webapi/auth/export` public certificate API endpoint. [#52328](https://github.com/gravitational/teleport/pull/52328)
+* Fixed Azure SQL Servers connect failures when the database agent runs on a VM scale set. [#52269](https://github.com/gravitational/teleport/pull/52269)
+* Fixed Postgres database access control privileges auto-provisioning to grant USAGE on schemas as needed for table privileges and fixed an issue that prevented user privileges from being revoked at the end of their session in some cases. [#52106](https://github.com/gravitational/teleport/pull/52106)
+
+Enterprise:
+* Reduce resource consumption resolving Okta applications during login.
+
 ## 15.4.29 (02/14/25)
 
 ### Security Fixes

diff --git a/Makefile b/Makefile
@@ -11,7 +11,7 @@
 #   Stable releases:   "1.0.0"
 #   Pre-releases:      "1.0.0-alpha.1", "1.0.0-beta.2", "1.0.0-rc.3"
 #   Master/dev branch: "1.0.0-dev"
-VERSION=15.4.29
+VERSION=15.4.30
 
 DOCKER_IMAGE ?= teleport
 

diff --git a/api/version.go b/api/version.go
diff --git a/build.assets/macos/tsh/tsh.app/Contents/Info.plist b/build.assets/macos/tsh/tsh.app/Contents/Info.plist
@@ -19,13 +19,13 @@
 		<key>CFBundlePackageType</key>
 		<string>APPL</string>
 		<key>CFBundleShortVersionString</key>
-		<string>15.4.29</string>
+		<string>15.4.30</string>
 		<key>CFBundleSupportedPlatforms</key>
 		<array>
 			<string>MacOSX</string>
 		</array>
 		<key>CFBundleVersion</key>
-		<string>15.4.29</string>
+		<string>15.4.30</string>
 		<key>DTCompiler</key>
 		<string>com.apple.compilers.llvm.clang.1_0</string>
 		<key>DTPlatformBuild</key>

diff --git a/build.assets/macos/tshdev/tsh.app/Contents/Info.plist b/build.assets/macos/tshdev/tsh.app/Contents/Info.plist
@@ -17,13 +17,13 @@
 		<key>CFBundlePackageType</key>
 		<string>APPL</string>
 		<key>CFBundleShortVersionString</key>
-		<string>15.4.29</string>
+		<string>15.4.30</string>
 		<key>CFBundleSupportedPlatforms</key>
 		<array>
 			<string>MacOSX</string>
 		</array>
 		<key>CFBundleVersion</key>
-		<string>15.4.29</string>
+		<string>15.4.30</string>
 		<key>DTCompiler</key>
 		<string>com.apple.compilers.llvm.clang.1_0</string>
 		<key>DTPlatformBuild</key>

diff --git a/e b/e
diff --git a/examples/chart/access/discord/Chart.yaml b/examples/chart/access/discord/Chart.yaml
@@ -1,4 +1,4 @@
-.version: &version "15.4.29"
+.version: &version "15.4.30"
 
 apiVersion: v2
 name: teleport-plugin-discord

diff --git a/examples/chart/access/discord/tests/__snapshot__/configmap_test.yaml.snap b/examples/chart/access/discord/tests/__snapshot__/configmap_test.yaml.snap
@@ -24,6 +24,6 @@ should match the snapshot:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-discord
-        app.kubernetes.io/version: 15.4.29
-        helm.sh/chart: teleport-plugin-discord-15.4.29
+        app.kubernetes.io/version: 15.4.30
+        helm.sh/chart: teleport-plugin-discord-15.4.30
       name: RELEASE-NAME-teleport-plugin-discord
diff --git a/examples/chart/access/discord/tests/__snapshot__/deployment_test.yaml.snap b/examples/chart/access/discord/tests/__snapshot__/deployment_test.yaml.snap
@@ -7,8 +7,8 @@ should match the snapshot:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-discord
-        app.kubernetes.io/version: 15.4.29
-        helm.sh/chart: teleport-plugin-discord-15.4.29
+        app.kubernetes.io/version: 15.4.30
+        helm.sh/chart: teleport-plugin-discord-15.4.30
       name: RELEASE-NAME-teleport-plugin-discord
     spec:
       replicas: 1
@@ -22,8 +22,8 @@ should match the snapshot:
             app.kubernetes.io/instance: RELEASE-NAME
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: teleport-plugin-discord
-            app.kubernetes.io/version: 15.4.29
-            helm.sh/chart: teleport-plugin-discord-15.4.29
+            app.kubernetes.io/version: 15.4.30
+            helm.sh/chart: teleport-plugin-discord-15.4.30
         spec:
           containers:
           - command:

diff --git a/examples/chart/access/email/Chart.yaml b/examples/chart/access/email/Chart.yaml
@@ -1,4 +1,4 @@
-.version: &version "15.4.29"
+.version: &version "15.4.30"
 
 apiVersion: v2
 name: teleport-plugin-email

diff --git a/examples/chart/access/email/tests/__snapshot__/configmap_test.yaml.snap b/examples/chart/access/email/tests/__snapshot__/configmap_test.yaml.snap
@@ -26,8 +26,8 @@ should match the snapshot (mailgun on):
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-email
-        app.kubernetes.io/version: 15.4.29
-        helm.sh/chart: teleport-plugin-email-15.4.29
+        app.kubernetes.io/version: 15.4.30
+        helm.sh/chart: teleport-plugin-email-15.4.30
       name: RELEASE-NAME-teleport-plugin-email
 should match the snapshot (smtp on):
   1: |
@@ -59,8 +59,8 @@ should match the snapshot (smtp on):
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-email
-        app.kubernetes.io/version: 15.4.29
-        helm.sh/chart: teleport-plugin-email-15.4.29
+        app.kubernetes.io/version: 15.4.30
+        helm.sh/chart: teleport-plugin-email-15.4.30
       name: RELEASE-NAME-teleport-plugin-email
 should match the snapshot (smtp on, no starttls):
   1: |
@@ -92,8 +92,8 @@ should match the snapshot (smtp on, no starttls):
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-email
-        app.kubernetes.io/version: 15.4.29
-        helm.sh/chart: teleport-plugin-email-15.4.29
+        app.kubernetes.io/version: 15.4.30
+        helm.sh/chart: teleport-plugin-email-15.4.30
       name: RELEASE-NAME-teleport-plugin-email
 should match the snapshot (smtp on, password file):
   1: |
@@ -125,8 +125,8 @@ should match the snapshot (smtp on, password file):
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-email
-        app.kubernetes.io/version: 15.4.29
-        helm.sh/chart: teleport-plugin-email-15.4.29
+        app.kubernetes.io/version: 15.4.30
+        helm.sh/chart: teleport-plugin-email-15.4.30
       name: RELEASE-NAME-teleport-plugin-email
 should match the snapshot (smtp on, roleToRecipients set):
   1: |
@@ -161,8 +161,8 @@ should match the snapshot (smtp on, roleToRecipients set):
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-email
-        app.kubernetes.io/version: 15.4.29
-        helm.sh/chart: teleport-plugin-email-15.4.29
+        app.kubernetes.io/version: 15.4.30
+        helm.sh/chart: teleport-plugin-email-15.4.30
       name: RELEASE-NAME-teleport-plugin-email
 should match the snapshot (smtp on, starttls disabled):
   1: |
@@ -194,6 +194,6 @@ should match the snapshot (smtp on, starttls disabled):
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-email
-        app.kubernetes.io/version: 15.4.29
-        helm.sh/chart: teleport-plugin-email-15.4.29
+        app.kubernetes.io/version: 15.4.30
+        helm.sh/chart: teleport-plugin-email-15.4.30
       name: RELEASE-NAME-teleport-plugin-email
diff --git a/examples/chart/access/email/tests/__snapshot__/deployment_test.yaml.snap b/examples/chart/access/email/tests/__snapshot__/deployment_test.yaml.snap
@@ -7,8 +7,8 @@ should be possible to override volume name (smtp on):
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-email
-        app.kubernetes.io/version: 15.4.29
-        helm.sh/chart: teleport-plugin-email-15.4.29
+        app.kubernetes.io/version: 15.4.30
+        helm.sh/chart: teleport-plugin-email-15.4.30
       name: RELEASE-NAME-teleport-plugin-email
     spec:
       replicas: 1
@@ -22,8 +22,8 @@ should be possible to override volume name (smtp on):
             app.kubernetes.io/instance: RELEASE-NAME
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: teleport-plugin-email
-            app.kubernetes.io/version: 15.4.29
-            helm.sh/chart: teleport-plugin-email-15.4.29
+            app.kubernetes.io/version: 15.4.30
+            helm.sh/chart: teleport-plugin-email-15.4.30
         spec:
           containers:
           - command:
@@ -34,7 +34,7 @@ should be possible to override volume name (smtp on):
             env:
             - name: TELEPORT_PLUGIN_FAIL_FAST
               value: "true"
-            image: public.ecr.aws/gravitational/teleport-plugin-email:15.4.29
+            image: public.ecr.aws/gravitational/teleport-plugin-email:15.4.30
             imagePullPolicy: IfNotPresent
             name: teleport-plugin-email
             ports:
@@ -75,8 +75,8 @@ should match the snapshot:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-email
-        app.kubernetes.io/version: 15.4.29
-        helm.sh/chart: teleport-plugin-email-15.4.29
+        app.kubernetes.io/version: 15.4.30
+        helm.sh/chart: teleport-plugin-email-15.4.30
       name: RELEASE-NAME-teleport-plugin-email
     spec:
       replicas: 1
@@ -90,8 +90,8 @@ should match the snapshot:
             app.kubernetes.io/instance: RELEASE-NAME
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: teleport-plugin-email
-            app.kubernetes.io/version: 15.4.29
-            helm.sh/chart: teleport-plugin-email-15.4.29
+            app.kubernetes.io/version: 15.4.30
+            helm.sh/chart: teleport-plugin-email-15.4.30
         spec:
           containers:
           - command:
@@ -136,8 +136,8 @@ should match the snapshot (mailgun on):
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-email
-        app.kubernetes.io/version: 15.4.29
-        helm.sh/chart: teleport-plugin-email-15.4.29
+        app.kubernetes.io/version: 15.4.30
+        helm.sh/chart: teleport-plugin-email-15.4.30
       name: RELEASE-NAME-teleport-plugin-email
     spec:
       replicas: 1
@@ -151,8 +151,8 @@ should match the snapshot (mailgun on):
             app.kubernetes.io/instance: RELEASE-NAME
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: teleport-plugin-email
-            app.kubernetes.io/version: 15.4.29
-            helm.sh/chart: teleport-plugin-email-15.4.29
+            app.kubernetes.io/version: 15.4.30
+            helm.sh/chart: teleport-plugin-email-15.4.30
         spec:
           containers:
           - command:
@@ -163,7 +163,7 @@ should match the snapshot (mailgun on):
             env:
             - name: TELEPORT_PLUGIN_FAIL_FAST
               value: "true"
-            image: public.ecr.aws/gravitational/teleport-plugin-email:15.4.29
+            image: public.ecr.aws/gravitational/teleport-plugin-email:15.4.30
             imagePullPolicy: IfNotPresent
             name: teleport-plugin-email
             ports:
@@ -204,8 +204,8 @@ should match the snapshot (smtp on):
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-email
-        app.kubernetes.io/version: 15.4.29
-        helm.sh/chart: teleport-plugin-email-15.4.29
+        app.kubernetes.io/version: 15.4.30
+        helm.sh/chart: teleport-plugin-email-15.4.30
       name: RELEASE-NAME-teleport-plugin-email
     spec:
       replicas: 1
@@ -219,8 +219,8 @@ should match the snapshot (smtp on):
             app.kubernetes.io/instance: RELEASE-NAME
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: teleport-plugin-email
-            app.kubernetes.io/version: 15.4.29
-            helm.sh/chart: teleport-plugin-email-15.4.29
+            app.kubernetes.io/version: 15.4.30
+            helm.sh/chart: teleport-plugin-email-15.4.30
         spec:
           containers:
           - command:
@@ -231,7 +231,7 @@ should match the snapshot (smtp on):
             env:
             - name: TELEPORT_PLUGIN_FAIL_FAST
               value: "true"
-            image: public.ecr.aws/gravitational/teleport-plugin-email:15.4.29
+            image: public.ecr.aws/gravitational/teleport-plugin-email:15.4.30
             imagePullPolicy: IfNotPresent
             name: teleport-plugin-email
             ports:
@@ -272,8 +272,8 @@ should mount external secret (mailgun on):
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-email
-        app.kubernetes.io/version: 15.4.29
-        helm.sh/chart: teleport-plugin-email-15.4.29
+        app.kubernetes.io/version: 15.4.30
+        helm.sh/chart: teleport-plugin-email-15.4.30
       name: RELEASE-NAME-teleport-plugin-email
     spec:
       replicas: 1
@@ -287,8 +287,8 @@ should mount external secret (mailgun on):
             app.kubernetes.io/instance: RELEASE-NAME
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: teleport-plugin-email
-            app.kubernetes.io/version: 15.4.29
-            helm.sh/chart: teleport-plugin-email-15.4.29
+            app.kubernetes.io/version: 15.4.30
+            helm.sh/chart: teleport-plugin-email-15.4.30
         spec:
           containers:
           - command:
@@ -299,7 +299,7 @@ should mount external secret (mailgun on):
             env:
             - name: TELEPORT_PLUGIN_FAIL_FAST
               value: "true"
-            image: public.ecr.aws/gravitational/teleport-plugin-email:15.4.29
+            image: public.ecr.aws/gravitational/teleport-plugin-email:15.4.30
             imagePullPolicy: IfNotPresent
             name: teleport-plugin-email
             ports:
@@ -340,8 +340,8 @@ should mount external secret (smtp on):
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-email
-        app.kubernetes.io/version: 15.4.29
-        helm.sh/chart: teleport-plugin-email-15.4.29
+        app.kubernetes.io/version: 15.4.30
+        helm.sh/chart: teleport-plugin-email-15.4.30
       name: RELEASE-NAME-teleport-plugin-email
     spec:
       replicas: 1
@@ -355,8 +355,8 @@ should mount external secret (smtp on):
             app.kubernetes.io/instance: RELEASE-NAME
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: teleport-plugin-email
-            app.kubernetes.io/version: 15.4.29
-            helm.sh/chart: teleport-plugin-email-15.4.29
+            app.kubernetes.io/version: 15.4.30
+            helm.sh/chart: teleport-plugin-email-15.4.30
         spec:
           containers:
           - command:
@@ -367,7 +367,7 @@ should mount external secret (smtp on):
             env:
             - name: TELEPORT_PLUGIN_FAIL_FAST
               value: "true"
-            image: public.ecr.aws/gravitational/teleport-plugin-email:15.4.29
+            image: public.ecr.aws/gravitational/teleport-plugin-email:15.4.30
             imagePullPolicy: IfNotPresent
             name: teleport-plugin-email
             ports:

diff --git a/examples/chart/access/jira/Chart.yaml b/examples/chart/access/jira/Chart.yaml
@@ -1,4 +1,4 @@
-.version: &version "15.4.29"
+.version: &version "15.4.30"
 
 apiVersion: v2
 name: teleport-plugin-jira

diff --git a/examples/chart/access/jira/tests/__snapshot__/configmap_test.yaml.snap b/examples/chart/access/jira/tests/__snapshot__/configmap_test.yaml.snap
@@ -32,6 +32,6 @@ should match the snapshot (smtp on):
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-jira
-        app.kubernetes.io/version: 15.4.29
-        helm.sh/chart: teleport-plugin-jira-15.4.29
+        app.kubernetes.io/version: 15.4.30
+        helm.sh/chart: teleport-plugin-jira-15.4.30
       name: RELEASE-NAME-teleport-plugin-jira
diff --git a/examples/chart/access/jira/tests/__snapshot__/deployment_test.yaml.snap b/examples/chart/access/jira/tests/__snapshot__/deployment_test.yaml.snap
@@ -7,8 +7,8 @@ should match the snapshot:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: teleport-plugin-jira
-        app.kubernetes.io/version: 15.4.29
-        helm.sh/chart: teleport-plugin-jira-15.4.29
+        app.kubernetes.io/version: 15.4.30
+        helm.sh/chart: teleport-plugin-jira-15.4.30
       name: RELEASE-NAME-teleport-plugin-jira
     spec:
       replicas: 1
@@ -22,8 +22,8 @@ should match the snapshot:
             app.kubernetes.io/instance: RELEASE-NAME
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: teleport-plugin-jira
-            app.kubernetes.io/version: 15.4.29
-            helm.sh/chart: teleport-plugin-jira-15.4.29
+            app.kubernetes.io/version: 15.4.30
+            helm.sh/chart: teleport-plugin-jira-15.4.30
         spec:
           containers:
           - command:

diff --git a/examples/chart/access/mattermost/Chart.yaml b/examples/chart/access/mattermost/Chart.yaml
@@ -1,4 +1,4 @@
-.version: &version "15.4.29"
+.version: &version "15.4.30"
 
 apiVersion: v2
 name: teleport-plugin-mattermost