Improve tsh profile support.

[benarent]

What happened:
If a customer has multiple Teleport proxies, customers use ➜ $ tsh login --proxy=work.example.com to login.

If you are working with multiple Teleport proxies you need to switch each time with, and tsh sets the profile to the last one it logged in.

Examples of apps with different profile systems.

• AWS-CLI
• OSS-AWS based on RVM
• Heroku Accounts

What you expected to happen

• tsh user should know what their default profile is.
• tsh can set a default profile.
• tsh users easily list all known profiles, and output current certificate status ( e.g. time left before reauthorisation )
• tsh users can login to an account using a profile alais vs full URL
• tsh users can remove accounts.

[klizhentas]

I think user profile should be more like ini profile that never gets overwritten and our default ~/.tsh/profile.yaml should be treated like internal state database file.

So devs can write things like this:

# cluster name
[staging]
k8s-cluster=
user=alice

[prod]
...

I was also thinking about using elisp as prfofile engine:

(setq cluster 'staging)

(defun select-cluster ()
  (mapc (lambda (K) 
	      (let* ((key (car K)) (fun (cdr K)))
           (define-key cluster-map (parse-cluster key) fun)))
	    '(("<right>" . cluster-next-match)
	      ("<left>"  . cluster-prev-match)
	      ("<up>"    . ignore             )
	      ("<down>"  . ignore             ))))
(add-hook 'select-cluster 'select-cluster-hook-local-keys)

...

Just kidding about lisp one :)

[webvictim]

Would also be nice to let devs add port forwarding, agent forwarding etc to their profile files:

[staginghost21839]
login=staginguser
agent_forwarding=yes
port_forwarding=54321:localhost:12345,3434:localhost:3434

Then tsh ssh staginghost21839 would automatically do the same as tsh ssh -A -L 54321:localhost:12345,3434:localhost:3434 -l staginguser staginghost21839

[wreed4]

For what it's worth I found a work around here for easily switching between two teleport instances:

alias t_one="echo teleport.one.url.without.port.io > ~/.tsh/current-profile"
alias t_two="echo teleport.two.url.without.port.io > ~/.tsh/current-profile"

Obviously replace the url with the real one.

[webvictim]

We merged this recently: #5395 - it basically allows you to 'pin' a terminal to a given cluster by running eval $(tsh env) after logging in.

[et304383]

For what it's worth I found a work around here for easily switching between two teleport instances:

alias t_one="echo teleport.one.url.without.port.io > ~/.tsh/current-profile"
alias t_two="echo teleport.two.url.without.port.io > ~/.tsh/current-profile"

Obviously replace the url with the real one.

I can't believe this is the way to deal with multiple profiles. At th very least, tsh login should factor in that you're already logged in and just switch the current profile over.

[alwaysastudent]

The easiest way to solve this is to expose an environment variable that can pick up the current profile. Then we can toggle that env variable on-demand to the profile we want.

[zmb3]

See also #2972

[ravicious]

I don't know what the state of tsh was in 2019, but at this point the issue likely represents different problems for different people.

• tsh user should know what their default profile is.
• tsh can set a default profile.

tsh has no notion of a default profile. It works more like kubectl where there's a current profile that, in theory, can be changed globally, but tsh doesn't expose an easy way of changing it yet.

• tsh users easily list all known profiles, and output current certificate status ( e.g. time left before reauthorisation )

tsh status does that now.

• tsh users can login to an account using a profile alias vs full URL

I'm not sure what an alias for a profile would be. We could probably let users set custom profile aliases through ~/.tsh/config/config.yaml, which today is used for setting command aliases.

• tsh users can remove accounts.

This is in theory supported by tsh logout --proxy example.com --user alice, but it's a bit weird because it behaves differently than tsh logout. tsh logout just wipes everything so that if you execute tsh status afterwards, you see nothing. Providing the flags for the proxy and the user causes tsh to overwrite the cert but keep the profile, which means that tsh status still shows it.

It also forces you to provide both the proxy and the user flags. The user flag is in theory unnecessary, as tsh doesn't support multiple users per proxy.

---

The way I understand the issue as of today is that tsh lacks subcommands for switching the current profile and removing a specific profile.

Another issue that's present in the current codebase is that there's a bunch of cases where under specific circumstances a tsh call might override the current profile without the user knowing that. IIRC, lib/client.RetryWithRelogin does that by default. So if someone is switched to a different profile with eval $(tsh env), that function is going to change the current profile. This also affects #25806.