GitLab Delegated Joining

[strideynet]

Closes #17059

• Automated tests
• Manual test GitLab cloud
• Manual test GitLab self-hosted

Docs will come in a future PR o7

[strideynet]

SaaS GitLab test

As of 6c85c3f - we now have working delegated joining. All that remains is adding all the remaining allow rule options and testing against self-hosted GitLab.

Sample workflow:

stages:          # List of stages for jobs, and their order of execution
  - build

build-job:       # This job runs in the build stage, which runs first.
  stage: build
  id_tokens:
    TBOT_GITLAB_JWT:
      aud: teleport.example.com
  script:
    - echo $CI_JOB_JWT | base64
    - echo $CI_JOB_JWT_V2 | base64
    - echo $TBOT_GITLAB_JWT | base64
    - whoami
    - ./tbot start --token=gitlab-bot --destination-dir=./tbot-user --auth-server=teleport.example.com:443 --join-method=gitlab --oneshot
    - ./tsh -i ./tbot-user/identity --proxy teleport.example.com:443 ls

Sample token config:

kind: token
version: v2
metadata:
  name: gitlab-bot
  expires: "3000-01-01T00:00:00Z"
spec:
  roles: [Bot]
  join_method: gitlab
  bot_name: gitlab-demo
  gitlab:
    allow:
      - sub: "project_path:strideynet/gitlab-sandbox:ref_type:branch:ref:main

[strideynet]

Remaining task is to stand up a self-hosted GitLab instance and test against this instance !

[strideynet]

GitLab instance stood up - will hopefully run a manual test against this instance tomorrow morning.

[strideynet]

Self-hosted test

.gitlab-ci.yml

stages:          # List of stages for jobs, and their order of execution
  - build

build-job:       # This job runs in the build stage, which runs first.
  stage: build
  id_tokens:
    TBOT_GITLAB_JWT:
      aud: teleport.example.com
  script:
    - ./tbot start --token=gitlab-self-hosted-bot --destination-dir=./tbot-user --data-dir=./tbot-data --auth-server=teleport.example.com:443 --join-method=gitlab --oneshot
    - TELEPORT_LOGIN=root ./tsh -i ./tbot-user/identity --proxy teleport.example.com:443 ls

ProvisionToken resource

kind: token
version: v2
metadata:
  name: gitlab-self-hosted-bot
  expires: "3000-01-01T00:00:00Z"
spec:
  roles: [Bot]
  join_method: gitlab
  bot_name: gitlab-demo
  gitlab:
    domain: gitlab.example.com
    allow:
      - project_path: noah/gitlab-sandbox
        ref_type: branch
        ref: main
        namespace_path: noah

I included some additional fields more than necessary in the allow rules just to check that all of these function as expected.

[strideynet]

Also manually tested:

• Incorrect audience token is rejected
• Correct issuer is enforced based on whether or not domain is set (e.g a Cloud issued ID token cannot be used against a self-hosted GitLab provision token)

[public-teleport-github-review-bot]

@strideynet See the table below for backport results.

Branch	Result
branch/v12	Failed