Teleport 12 Test Plan #20132

russjones · 2023-01-12T17:19:49Z

Manual Testing Plan

Below are the items that should be manually tested with each release of Teleport.
These tests should be run on both a fresh installation of the version to be released
as well as an upgrade of the previous version of Teleport.

User accounting @tigrato

Verify that active interactive sessions are tracked in /var/run/utmp on Linux.
Verify that interactive sessions are logged in /var/log/wtmp on Linux.

Combinations @capnspacehook

For some manual testing, many combinations need to be tested. For example, for
interactive sessions the 12 combinations are below.

Teleport with EKS/GKE @AntonAM

Deploy Teleport on a single EKS cluster
Deploy Teleport on two EKS clusters and connect them via trusted cluster feature
Deploy Teleport Proxy outside GKE cluster fronting connections to it (use this script to generate a kubeconfig)
Deploy Teleport Proxy outside EKS cluster fronting connections to it (use this script to generate a kubeconfig)

Teleport with multiple Kubernetes clusters @AntonAM

Note: you can use GKE or EKS or minikube to run Kubernetes clusters.
Minikube is the only caveat - it's not reachable publicly so don't run a proxy there.

Kubernetes auto-discovery @tigrato

Kubernetes Secret Storage @tigrato

Kubernetes Secret storage for Agent's Identity
- Install Teleport agent with a short-lived token
  - Validate if the Teleport is installed as a Kubernetes Statefulset
  - Restart the agent after token TTL expires to see if it reuses the same identity.
- Force cluster CA rotation

Kubernetes Pod RBAC @tigrato

Teleport with FIPS mode @r0mant

Perform trusted clusters, Web and SSH sanity check with all teleport components deployed in FIPS mode.

ACME @mdwn

Teleport can fetch TLS certificate automatically using ACME protocol.

Migrations @r0mant @zmb3

Migrate trusted clusters from 2.4.0 to 2.5.0
- Migrate auth server on main cluster, then rest of the servers on main cluster
  SSH should work for both main and old clusters
- Migrate auth server on remote cluster, then rest of the remote cluster
  SSH should work

Command Templates

When interacting with a cluster, the following command templates are useful:

OpenSSH

# when connecting to the recording proxy, `-o 'ForwardAgent yes'` is required.
ssh -o "ProxyCommand ssh -o 'ForwardAgent yes' -p 3023 %[email protected] -s proxy:%h:%p" \
  node.example.com

# the above command only forwards the agent to the proxy, to forward the agent
# to the target node, `-o 'ForwardAgent yes'` needs to be passed twice.
ssh -o "ForwardAgent yes" \
  -o "ProxyCommand ssh -o 'ForwardAgent yes' -p 3023 %[email protected] -s proxy:%h:%p" \
  node.example.com

# when connecting to a remote cluster using OpenSSH, the subsystem request is
# updated with the name of the remote cluster.
ssh -o "ProxyCommand ssh -o 'ForwardAgent yes' -p 3023 %[email protected] -s proxy:%h:%[email protected]" \
  node.foo.com

Teleport

# when connecting to a OpenSSH node, remember `-p 22` needs to be passed.
tsh --proxy=proxy.example.com --user=<username> --insecure ssh -p 22 node.example.com

# an agent can be forwarded to the target node with `-A`
tsh --proxy=proxy.example.com --user=<username> --insecure ssh -A -p 22 node.example.com

# the --cluster flag is used to connect to a node in a remote cluster.
tsh --proxy=proxy.example.com --user=<username> --insecure ssh --cluster=foo.com -p 22 node.foo.com

Teleport with SSO Providers @camscale

GitHub External SSO @Tener

Teleport OSS
- GitHub organization without external SSO succeeds
- GitHub organization with external SSO fails
Teleport Enterprise
- GitHub organization without external SSO succeeds
- GitHub organization with external SSO succeeds

`tctl sso` family of commands @Tener

For help with setting up sso connectors, check out the Quick GitHub/SAML/OIDC Setup Tips

tctl sso configure helps to construct a valid connector definition:

tctl sso configure github ... creates valid connector definitions
tctl sso configure oidc ... creates valid connector definitions
tctl sso configure saml ... creates valid connector definitions

tctl sso test test a provided connector definition, which can be loaded from
file or piped in with tctl sso configure or tctl get --with-secrets. Valid
connectors are accepted, invalid are rejected with sensible error messages.

Teleport Plugins @greedy52

Test receiving a message via Teleport Slackbot
Test receiving a new Jira Ticket via Teleport Jira

AWS Node Joining @gabrielcorado

Docs

On EC2 instance with ec2:DescribeInstances permissions for local account:
TELEPORT_TEST_EC2=1 go test ./integration -run TestEC2NodeJoin
On EC2 instance with any attached role:
TELEPORT_TEST_EC2=1 go test ./integration -run TestIAMNodeJoin
EC2 Join method in IoT mode with node and auth in different AWS accounts
IAM Join method in IoT mode with node and auth in different AWS accounts

Kubernetes Node Joining @gabrielcorado

Join a Teleport node running in the same Kubernetes cluster via a Kubernetes ProvisionToken

Cloud Labels @GavinFrazar

Create an EC2 instance with tags in instance metadata enabled
and with tag foo: bar. Verify that a node running on the instance has label
aws/foo=bar.
Create an Azure VM with tag foo: bar. Verify that a node running on the
instance has label azure/foo=bar.

Passwordless @codingllama

This feature has additional build requirements, so it should be tested with a pre-release build from Drone (eg: https://get.gravitational.com/teleport-v10.0.0-alpha.2-linux-amd64-bin.tar.gz).

This sections complements "Users -> Managing MFA devices". tsh binaries for
each operating system (Linux, macOS and Windows) must be tested separately for
FIDO2 items.

Device Trust @sfreiberg

Device Trust requires Teleport Enterprise.

This feature has additional build requirements, so it should be tested with a
pre-release build from Drone (eg:
https://get.gravitational.com/teleport-v10.0.0-alpha.2-linux-amd64-bin.tar.gz).

Client-side enrollment requires a signed tsh for macOS, make sure to use the
tsh binary from tsh.app.

A simple formula for testing device authorization is:

# Before enrollment.
# Replace with other kinds of access, as appropriate (db, kube, etc)
tsh ssh node-that-requires-device-trust
> ERROR: ssh: rejected: administratively prohibited (unauthorized device)
# Register the device.
# Get the serial number from "Apple -> About This Mac".
tctl devices add --os=macos --asset-tag=<SERIAL_NUMBER> --enroll
# Enroll the device.
tsh device enroll --token=<TOKEN_FROM_COMMAND_ABOVE>
tsh logout; tsh login
# After enrollment
tsh ssh node-that-requires-device-trust
> $

Hardware Key Support @Joerger

Hardware Key Support is an Enterprise feature and is not available for OSS.

You will need a YubiKey 4.3+ to test this feature.

This feature has additional build requirements, so it should be tested with a pre-release build from Drone (eg: https://get.gravitational.com/teleport-ent-v11.0.0-alpha.2-linux-amd64-bin.tar.gz).

Server Access @Joerger

These tests should be carried out sequentially. tsh tests should be carried out on Linux, MacOS, and Windows.

tsh login as user with Webauthn login and no hardware key requirement.
Request a role with role.role_options.require_session_mfa: hardware_key - tsh login --request-roles=hardware_key_required

Assuming the role should force automatic re-login with yubikey
tsh ssh
- Requires yubikey to be connected for re-login
- Prompts for per-session MFA

Request a role with role.role_options.require_session_mfa: hardware_key_touch - tsh login --request-roles=hardware_key_touch_required

Assuming the role should force automatic re-login with yubikey
- Prompts for touch if not cached (last touch within 15 seconds)
tsh ssh
- Requires yubikey to be connected for re-login
- Prompts for touch if not cached

tsh logout and tsh login as the user with no hardware key requirement.
Upgrade auth settings to auth_service.authentication.require_session_mfa: hardware_key

Using the existing login session (tsh ls) should force automatic re-login with yubikey
tsh ssh
- Requires yubikey to be connected for re-login
- Prompts for per-session MFA

Upgrade auth settings to auth_service.authentication.require_session_mfa: hardware_key_touch

Using the existing login session (tsh ls) should force automatic re-login with yubikey
- Prompts for touch if not cached
tsh ssh
- Requires yubikey to be connected for re-login
- Prompts for touch if not cached

Other @GavinFrazar

Set auth_service.authentication.require_session_mfa: hardware_key_touch in your cluster auth settings.

Database Acces: tsh proxy db
Application Access: tsh login app && tsh proxy app

Performance @rosstimothy @fspmarshall

Perform all tests on the following configurations:

With default networking configuration
With Proxy Peering Enabled
With TLS Routing Enabled

Cluster with 10K direct dial nodes:

etcd
DynamoDB
Firestore

Cluster with 10K reverse tunnel nodes:

etcd
DynamoDB
Firestore

Cluster with 500 trusted clusters:

etcd
DynamoDB
Firestore

Soak Test @rosstimothy @fspmarshall

Run 30 minute soak test with a mix of interactive/non-interactive sessions for both direct and reverse tunnel nodes:

tsh bench --duration=30m user@direct-dial-node ls
tsh bench -i --duration=30m user@direct-dial-node ps uax

tsh bench --duration=30m user@reverse-tunnel-node ls
tsh bench -i --duration=30m user@reverse-tunnel-node ps uax

Observe prometheus metrics for goroutines, open files, RAM, CPU, Timers and make sure there are no leaks

Verify that prometheus metrics are accurate.

Concurrent Session Test

Cluster with 1k reverse tunnel nodes

Run a concurrent session test that will spawn 5 interactive sessions per node in the cluster:

tsh bench sessions --max=5000 user ls
tsh bench sessions --max=5000 --web user ls

Verify that all 5000 sessions are able to be established.
Verify that tsh and the web UI are still functional.

Robustness @rosstimothy @fspmarshall

Connectivity Issues:

Verify that a lack of connectivity to Auth does not prevent access to
resources which do not require a moderated session and in async recording
mode from an already issued certificate.
Verify that a lack of connectivity to Auth prevents access to resources
which require a moderated session and in async recording mode from an already
issued certificate.

Teleport with Cloud Providers @hugoShaka

AWS @hugoShaka

Deploy Teleport to AWS. Using DynamoDB & S3
Deploy Teleport Enterprise to AWS. Using HA Setup https://gravitational.com/teleport/docs/aws-terraform-guide/

GCP @hugoShaka

Deploy Teleport to GCP. Using Cloud Firestore & Cloud Storage
Deploy Teleport to GKE. Google Kubernetes engine.
Deploy Teleport Enterprise to GCP.

IBM @hugoShaka

Deploy Teleport to IBM Cloud. Using IBM Database for etcd & IBM Object Store
Deploy Teleport to IBM Cloud Kubernetes.
Deploy Teleport Enterprise to IBM Cloud.

Application Access @mdwn

Database Access @smallinsky

TLS Routing @smallinsky

Verify that teleport proxy v2 configuration starts only a single listener. @Tener

version: v2
teleport:
  proxy_service:
    enabled: "yes"
    public_addr: ['root.example.com']
    web_listen_addr: 0.0.0.0:3080

Run Teleport Proxy in multiplex mode auth_service.proxy_listener_mode: "multiplex" @Tener
- Trusted cluster
  - Setup trusted clusters using single port setup web_proxy_addr == tunnel_addr
```
kind: trusted_cluster
spec:
  ...
  web_proxy_addr: root.example.com:443
  tunnel_addr: root.example.com:443
  ...
```
Database Access
- Verify that tsh db connect works through proxy running in multiplex mode
  - Postgres @GavinFrazar
  - MySQL @Tener
  - MariaDB @Tener
  - MongoDB @GavinFrazar
  - CockroachDB @Tener
  - Redis @greedy52
  - MSSQL @gabrielcorado
  - Snowflake @smallinsky
  - Elasticsearch. @greedy52
  - Cassandra/ScyllaDB. @gabrielcorado
- Verify connecting to a database through TLS ALPN SNI local proxy tsh db proxy with a GUI client. @greedy52 @GavinFrazar @smallinsky @Tener
- Verify tsh proxy db with teleport proxy behind ALB. @greedy52
Application Access @smallinsky
- Verify app access through proxy running in multiplex mode
SSH Access @gabrielcorado
- Connect to a OpenSSH server through a local ssh proxy ssh -o "ForwardAgent yes" -o "ProxyCommand tsh proxy ssh" [email protected]
- Connect to a OpenSSH server on leaf-cluster through a local ssh proxyssh -o "ForwardAgent yes" -o "ProxyCommand tsh proxy ssh --user=%r --cluster=leaf-cluster %h:%p" [email protected]
- Verify tsh ssh access through proxy running in multiplex mode
Kubernetes access: @Tener
- Verify kubernetes access through proxy running in multiplex mode

Desktop Access @ibeckermayer

Binaries compatibility @tobiaszheller

Verify tsh runs on:
- Windows 10
- MacOS

Machine ID @timothyb89

SSH

With a default Teleport instance configured with a SSH node:

Verify you are able to create a new bot user with tctl bots add robot --roles=access. Follow the instructions provided in the output to start tbot
Verify you are able to connect to the SSH node using openssh with the generated ssh_config in the destination directory
Verify that after the renewal period (default 20m, but this can be reduced via configuration), that newly generated certificates are placed in the destination directory
Verify that sending both SIGUSR1 and SIGHUP to a running tbot process causes a renewal and new certificates to be generated
Verify that you are able to make a connection to the SSH node using the ssh_config provided by tbot after each phase of a manual CA rotation.

Ensure the above tests are completed for both:

Directly connecting to the auth server
Connecting to the auth server via the proxy reverse tunnel

DB Access

With a default Postgres DB instance, a Teleport instance configured with DB access and a bot user configured:

Verify you are able to connect to and interact with a database using tbot db while tbot start is running

Host users creation @lxea

Host users creation docs
Host users creation RFD

Verify host users creation functionality
- non-existing users are created automatically
- users are added to groups
  - non-existing configured groups are created
  - created users are added to the teleport-system group
- users are cleaned up after their session ends
  - cleanup occurs if a program was left running after session ends
- sudoers file creation is successful
  - Invalid sudoers files are not created
- existing host users are not modified
- setting disable_create_host_user: true stops user creation from occurring

CA rotations @espadolini

Verify the CA rotation functionality itself (by checking in the backend or with tctl get cert_authority)
- standby phase: only active_keys, no additional_trusted_keys
- init phase: active_keys and additional_trusted_keys
- update_clients and update_servers phases: the certs from the init phase are swapped
- standby phase: only the new certs remain in active_keys, nothing in additional_trusted_keys
- rollback phase (second pass, after completing a regular rotation): same content as in the init phase
- standby phase after rollback: same content as in the previous standby phase
Verify functionality in all phases (clients might have to log in again in lieu of waiting for credentials to expire between phases)
- SSH session in tsh from a previous phase
- SSH session in web UI from a previous phase
- New SSH session with tsh
- New SSH session with web UI
- New SSH session in a child cluster on the same major version
- New SSH session in a child cluster on the previous major version
- New SSH session from a parent cluster
- Application access through a browser
- Application access through curl with tsh app login
- kubectl get po after tsh kube login
- Database access (no configuration change should be necessary if the database CA isn't rotated, other Teleport functionality should not be affected if only the database CA is rotated)

EC2 Discovery @lxea

EC2 Discovery docs

Verify EC2 instance discovery
- Only EC2 instances matching given AWS tags have the installer executed on them
- Only the IAM permissions mentioned in the discovery docs are required for operation
- Custom scripts specified in different matchers are executed
- Custom SSM documents specified in different matchers are executed
- New EC2 instances with matching AWS tags are discovered and added to the teleport cluster
  - Large numbers of EC2 instances (51+) are all successfully added to the cluster
- Nodes that have been discovered do not have the install script run on the node multiple times

Documentation @ptgott @alexfornuto

Checks should be performed on the version of documentation corresponding to the
major release we're testing for. For example, for Teleport 12 release use
branch/v12 branch and make sure to select "Version 12.0" in the documentation
version switcher.

Resources

Quick GitHub/SAML/OIDC Setup Tips

The text was updated successfully, but these errors were encountered:

Tener · 2023-01-12T19:53:16Z

@mdwn I've added these points to the test plan, seemingly under your remit:

- [ ] Verify [Azure CLI access](https://goteleport.com/docs/ver/12.x/application-access/guides/azure/) with `tsh app login`.
  - [ ] Can interact with Azure using `tsh az` commands.
  - [ ] Can interact with Azure using a combination of `tsh proxy az` and `az` commands.
- [ ] Verify [GCP CLI access](https://github.com/gravitational/teleport/pull/19905) with `tsh app login`.
  - [ ] Can interact with GCP using `tsh gcloud` commands.
  - [ ] Can interact with Google Cloud Storage using `tsh gsutil` commands.
  - [ ] Can interact with GCP/GCS using a combination of `tsh proxy gcloud` and `gcloud`/`gsutil` commands.

Both Azure and GCP integrations are on master and will be part of the cut tomorrow. The PR for the GCP docs is in review #19905, but slightly out of sync with the implementation; this will be corrected early next week. Please don't hesitate to ask me for any clarifications or tips.

I'll send PR updating the test plan template too.

GavinFrazar · 2023-01-12T20:16:51Z

I've added/edited these points to the test plan (for discovery and connect via local/remote cluster):

  - [ ] Azure single-server MySQL and Postgres
  - [ ] Azure flexible-server MySQL and Postgres

Added them to connect test because flexible server integration required an update to the way we modify db username in the engine.

Forgot to update the test plan template in #19759 I'll open a PR to update that template now as well.

espadolini · 2023-01-18T11:01:10Z

Added "Changing role map of existing Trusted Cluster" here and in #20325

tigrato · 2023-01-18T11:02:35Z

Added in #20274

hugoShaka · 2023-01-18T18:35:34Z

tctl does not default to local auth: #20346

timothyb89 · 2023-01-18T23:00:18Z

Regression in tsh breaks identity file loading (affects most tbot proxying features, including ssh/db access): #20373

and another small issue where tbot's ssh_config forgets nonstandard ports: #20378

GavinFrazar · 2023-01-19T02:25:18Z

#20384 issue with PIV yubikey integration

mdwn · 2023-01-19T03:19:41Z

AWS console is inaccessible via the Teleport UI: #20385

tigrato · 2023-01-19T12:28:16Z

The default access role misses permissions to list pods #20401

codingllama · 2023-01-19T18:53:08Z

tsh login --auth=local uses platform passwordless if it can (#20429). Not a huge deal, as it does respect other settings/flags, but I'll take a look.

mdwn · 2023-01-19T19:44:28Z

Setting Azure identities doesn't work for all valid characters in an identity string: #20434

hugoShaka · 2023-01-20T17:20:11Z

Helm chart deadlock: #20488

GavinFrazar · 2023-01-20T20:12:19Z

teleport db configure create --azure-sqlserver-discovery=$region generates invalid config yaml. fix here: #20496

codingllama · 2023-01-20T20:25:48Z

I've found some issues with device trust, unusual verbs (create_enroll_token and enroll) and RoleAdmin. Pushing patches soon. (FYI @sfreiberg.)

codingllama · 2023-01-20T20:56:54Z

I've found some issues with device trust, unusual verbs (create_enroll_token and enroll) and RoleAdmin. Pushing patches soon. (FYI @sfreiberg.)

Promised patches: #20505 and https://github.com/gravitational/teleport.e/pull/724. We'll need an e/ bump on branch/v12 after all is done.

codingllama · 2023-01-20T21:42:38Z

tctl devices rm issue: #20506

camscale · 2023-01-23T04:33:04Z

Okta SSO documentation setup issue: #20538

rosstimothy · 2023-01-23T22:07:07Z

etcd Load Testing

Agent Mesh

Soak Test

----Direct Dial Node Test----
tsh --insecure --proxy=monster.gravitational.co:3080 -i /etc/teleport/auth bench --duration=30m root@node-6f44d86564-lqmrg ls

* Requests originated: 17999
* Requests failed: 0

Histogram

Percentile Response Duration
---------- -----------------
25         150 ms
50         152 ms
75         156 ms
90         160 ms
95         165 ms
99         191 ms
100        455 ms

----Reverse Tunnel Node Test----
tsh --insecure --proxy=monster.gravitational.co:3080 -i /etc/teleport/auth bench --duration=30m root@iot-node-86b9c86bff-fgrxs ls

* Requests originated: 17999
* Requests failed: 0

Histogram

Percentile Response Duration
---------- -----------------
25         146 ms
50         150 ms
75         154 ms
90         162 ms
95         170 ms
99         191 ms
100        411 ms

Proxy Peering

10k Tunnel Nodes

https://teleportcoreteam.grafana.net/goto/5i-Am-T4z?orgId=1

10k Direct Dial Nodes

https://teleportcoreteam.grafana.net/goto/cv55cFT4z?orgId=1

500 Trusted Cluster

https://teleportcoreteam.grafana.net/goto/Oog2Abo4z?orgId=1

Soak Test

----Direct Dial Node Test----
tsh --insecure --proxy=monster.gravitational.co:3080 -i /etc/teleport/auth bench --duration=30m root@node-6f44d86564-frcnx ls

* Requests originated: 17999
* Requests failed: 0

Histogram

Percentile Response Duration
---------- -----------------
25         147 ms
50         149 ms
75         153 ms
90         156 ms
95         160 ms
99         188 ms
100        352 ms

----Reverse Tunnel Node Test----
tsh --insecure --proxy=monster.gravitational.co:3080 -i /etc/teleport/auth bench --duration=30m root@iot-node-86b9c86bff-x4pbr ls

* Requests originated: 17999
* Requests failed: 0

Histogram

Percentile Response Duration
---------- -----------------
25         164 ms
50         169 ms
75         176 ms
90         186 ms
95         191 ms
99         209 ms
100        439 ms

ravicious · 2023-01-24T10:04:47Z

~~teleport-ent macOS binaries are not signed.~~ https://github.com/gravitational/teleport.e/issues/741

Edit: It turns out it's a known issue.

codingllama · 2023-01-24T20:40:25Z

App Access and require_session_mfa issue: #20634.

alexfornuto · 2023-01-24T21:40:04Z

~~Docker tctl command failure: #20637.~~ Resolved

capnspacehook · 2023-01-25T16:42:22Z

Error connecting to leaf OpenSSH node: #20703

GavinFrazar · 2023-01-25T19:02:24Z

App Access and require_session_mfa issue: #20634.

Just want to note that my only remaining unchecked task is to use require_session_mfa: hardware_key_touch with app access, which also does not work (obviously)

codingllama · 2023-01-26T17:24:16Z

App Access and require_session_mfa issue: #20634.

Just want to note that my only remaining unchecked task is to use require_session_mfa: hardware_key_touch with app access, which also does not work (obviously)

Isn't hardware_key_touch functionally equivalent to no session MFA, due to the checks being client-side? Maybe chat with @Joerger to figure out if it's actually supposed to work.

Joerger · 2023-01-26T19:10:51Z

Just want to note that my only remaining unchecked task is to use require_session_mfa: hardware_key_touch with app access, which also does not work (obviously)

Isn't hardware_key_touch functionally equivalent to no session MFA, due to the checks being client-side? Maybe chat with @Joerger to figure out if it's actually supposed to work.

Yes, hardware_key_touch does actually work in v12, but hardware_key does not as it is functionally equivalent to require_session_mfa: yes. I've tested it so I'll check it off on the test plan.

Edit: I was wrong on this and the test I performed was inadequate (tsh proxy app does prompt for tap, but using the connection fails due to the app session using a different key on the server). This test should have been removed before as this lack of support was already discovered and documented.

GavinFrazar · 2023-01-26T23:59:24Z

tsh proxy aws --endpoint-url not working in alpha.1 & alpha.2: #20798

I think this broke when I did some refactoring work in app access.

GavinFrazar · 2023-01-27T00:10:16Z

tsh db connect fails when PIV is enabled (not in all configurations): #20799

I didn't notice this in my first pass through the test plan because I didn't trip on one of the configurations that has the issue.

fspmarshall · 2023-01-30T17:28:57Z

DynamoDB

Direct Dial Scaling

Direct Dial Soak

$ tsh bench --duration=30m root@ip-172-31-8-224-us-west-2-compute-internal ls

* Requests originated: 17999
* Requests failed: 0

Histogram

Percentile Response Duration
---------- -----------------
25         156 ms
50         165 ms
75         178 ms
90         188 ms
95         194 ms
99         219 ms
100        2767 ms

$ tsh bench --interactive --duration=30m root@ip-172-31-8-224-us-west-2-compute-internal ps aux

* Requests originated: 17999
* Requests failed: 0

Histogram

Percentile Response Duration
---------- -----------------
25         164 ms
50         174 ms
75         186 ms
90         194 ms
95         201 ms
99         223 ms
100        1677 ms

Tunnel Scaling

Tunnel Soak

$ tsh bench --duration=30m root@ip-172-31-8-224-us-west-2-compute-internal ls


* Requests originated: 17999
* Requests failed: 0

Histogram

Percentile Response Duration
---------- -----------------
25         176 ms
50         183 ms
75         192 ms
90         204 ms
95         212 ms
99         250 ms
100        2229 ms

$ tsh bench --interactive --duration=30m root@ip-172-31-8-224-us-west-2-compute-internal ps aux


* Requests originated: 17998
* Requests failed: 0

Histogram

Percentile Response Duration
---------- -----------------
25         184 ms
50         191 ms
75         201 ms
90         213 ms
95         220 ms
99         260 ms
100        2805 ms

fspmarshall · 2023-01-30T17:34:12Z

Note about ssh agent forwarding and ssh file copying RBAC tests: The RBAC section of the testplan mentions that we expect access denied to show up in the audit log for all items, but ssh agent forwarding and ssh file copying do not generate access denied events. I checked the code for these checks, and it appears that they aren't intended to emit events currently, so this doesn't seem to be a regression.

I've marked these sections as complete in the testplan because teleport seems to be working as intended, but it may be worth considering adding access denied events for these items.

alexfornuto · 2023-01-30T17:47:29Z

Verify Teleport versions throughout documentation are correct and reflect upcoming release:

#20643

hugoShaka · 2023-01-30T22:11:24Z

teleport-cluster chart v12 breaks when used with etcd backend: #20960

tigrato · 2023-01-31T12:07:15Z

Pod RBAC fails if the Kubernetes Vendor runs with compression enabled: #20980 - PR: #20981

@hugoShaka detected this issue when running a test in the IBM cloud

ibeckermayer · 2023-02-01T01:26:07Z

Issue and fix here: #21009

alexfornuto · 2023-02-06T19:41:02Z

Verify upcoming releases page is accurate:

This is under Documentation, but we don't have insight into what's being slated for the next release. I've prepped a page in #21283 for data to be added to, but maybe this should be considered part of #21317

russjones added the test-plan A list of tasks required to ship a successful product release. label Jan 12, 2023

Tener mentioned this issue Jan 18, 2023

tctl edit breaks SAML connectors #20326

Closed

camscale mentioned this issue Jan 30, 2023

Azure AD SSO setup screenshots out of date #20905

Closed

zmb3 closed this as completed Feb 9, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Teleport 12 Test Plan #20132

Teleport 12 Test Plan #20132

russjones commented Jan 12, 2023 •

edited by smallinsky

Loading

Tener commented Jan 12, 2023

GavinFrazar commented Jan 12, 2023

espadolini commented Jan 18, 2023

tigrato commented Jan 18, 2023 •

edited by r0mant

Loading

hugoShaka commented Jan 18, 2023 •

edited

Loading

timothyb89 commented Jan 18, 2023 •

edited

Loading

GavinFrazar commented Jan 19, 2023

mdwn commented Jan 19, 2023

tigrato commented Jan 19, 2023

codingllama commented Jan 19, 2023

mdwn commented Jan 19, 2023

hugoShaka commented Jan 20, 2023

GavinFrazar commented Jan 20, 2023

codingllama commented Jan 20, 2023

codingllama commented Jan 20, 2023

codingllama commented Jan 20, 2023

camscale commented Jan 23, 2023

rosstimothy commented Jan 23, 2023

ravicious commented Jan 24, 2023 •

edited

Loading

codingllama commented Jan 24, 2023

alexfornuto commented Jan 24, 2023 •

edited

Loading

capnspacehook commented Jan 25, 2023

GavinFrazar commented Jan 25, 2023

codingllama commented Jan 26, 2023

Joerger commented Jan 26, 2023 •

edited

Loading

GavinFrazar commented Jan 26, 2023

GavinFrazar commented Jan 27, 2023

fspmarshall commented Jan 30, 2023

fspmarshall commented Jan 30, 2023

alexfornuto commented Jan 30, 2023

hugoShaka commented Jan 30, 2023 •

edited

Loading

tigrato commented Jan 31, 2023

ibeckermayer commented Feb 1, 2023

alexfornuto commented Feb 6, 2023

Teleport 12 Test Plan #20132

Teleport 12 Test Plan #20132

Comments

russjones commented Jan 12, 2023 • edited by smallinsky Loading

Manual Testing Plan

User accounting @tigrato

Combinations @capnspacehook

Teleport with EKS/GKE @AntonAM

Teleport with multiple Kubernetes clusters @AntonAM

Kubernetes auto-discovery @tigrato

Kubernetes Secret Storage @tigrato

Kubernetes Pod RBAC @tigrato

Teleport with FIPS mode @r0mant

ACME @mdwn

Migrations @r0mant @zmb3

Command Templates

OpenSSH

Teleport

Teleport with SSO Providers @camscale

GitHub External SSO @Tener

tctl sso family of commands @Tener

Teleport Plugins @greedy52

AWS Node Joining @gabrielcorado

Kubernetes Node Joining @gabrielcorado

Cloud Labels @GavinFrazar

Passwordless @codingllama

Device Trust @sfreiberg

Hardware Key Support @Joerger

Server Access @Joerger

Other @GavinFrazar

Performance @rosstimothy @fspmarshall

Soak Test @rosstimothy @fspmarshall

Concurrent Session Test

Robustness @rosstimothy @fspmarshall

Teleport with Cloud Providers @hugoShaka

AWS @hugoShaka

GCP @hugoShaka

IBM @hugoShaka

Application Access @mdwn

Database Access @smallinsky

TLS Routing @smallinsky

Desktop Access @ibeckermayer

Binaries compatibility @tobiaszheller

Machine ID @timothyb89

SSH

DB Access

Host users creation @lxea

CA rotations @espadolini

EC2 Discovery @lxea

Documentation @ptgott @alexfornuto

Resources

Tener commented Jan 12, 2023

GavinFrazar commented Jan 12, 2023

espadolini commented Jan 18, 2023

tigrato commented Jan 18, 2023 • edited by r0mant Loading

hugoShaka commented Jan 18, 2023 • edited Loading

timothyb89 commented Jan 18, 2023 • edited Loading

GavinFrazar commented Jan 19, 2023

mdwn commented Jan 19, 2023

tigrato commented Jan 19, 2023

codingllama commented Jan 19, 2023

mdwn commented Jan 19, 2023

hugoShaka commented Jan 20, 2023

GavinFrazar commented Jan 20, 2023

codingllama commented Jan 20, 2023

codingllama commented Jan 20, 2023

codingllama commented Jan 20, 2023

camscale commented Jan 23, 2023

rosstimothy commented Jan 23, 2023

etcd Load Testing

Agent Mesh

10k Tunnel Nodes

10k Direct Dial Nodes

500 Trusted Cluster

Soak Test

Proxy Peering

10k Tunnel Nodes

10k Direct Dial Nodes

500 Trusted Cluster

Soak Test

russjones commented Jan 12, 2023 •

edited by smallinsky

Loading

`tctl sso` family of commands @Tener

tigrato commented Jan 18, 2023 •

edited by r0mant

Loading

hugoShaka commented Jan 18, 2023 •

edited

Loading

timothyb89 commented Jan 18, 2023 •

edited

Loading

ravicious commented Jan 24, 2023 •

edited

Loading

alexfornuto commented Jan 24, 2023 •

edited

Loading

Joerger commented Jan 26, 2023 •

edited

Loading

hugoShaka commented Jan 30, 2023 •

edited

Loading