[v16] Remove feature flag for VNet launch daemon (#44994)

* Do not execute vnet-admin-setup if tsh was built with daemon support

* Remove feature flag

* Don't show background item notification when launch daemon is not supported

* Update docs

* Fix typo

Co-authored-by: Grzegorz Zdunek <gzdunek@users.noreply.github.com>

---------

Co-authored-by: Grzegorz Zdunek <gzdunek@users.noreply.github.com>

docs/pages/connect-your-client/vnet.mdx

@@ -32,9 +32,10 @@ have `tcp://` as the protocol in their addresses.
 Click "Connect" next to the TCP app. This starts VNet if it's not already running. Alternatively,
 you can start VNet through the connection list in the top left.
 
-VNet needs to set up a network device and configure DNS on your device, so it'll ask for admin
-permissions. For now your password is needed each time you start VNet, but we're working on showing
-the prompt only once.
+During the first launch, macOS will prompt you to enable a background item for tsh.app. VNet needs
+this background item in order to configure DNS on your device. To enable the background item, either
+interact with the system notification or go to System Settings > General > Login Items and look for
+tsh.app under "Allow in the Background".
 
 ![VNet starting up](../../img/use-teleport/vnet-starting@2x.png)
 

lib/teleterm/vnet/service_daemon_darwin.go

@@ -21,20 +21,14 @@ package vnet
 
 import (
 	"context"
-	"os"
 
 	"github.com/gravitational/trace"
 
 	api "github.com/gravitational/teleport/gen/proto/go/teleport/lib/teleterm/vnet/v1"
-	"github.com/gravitational/teleport/lib/vnet"
 	vnetdaemon "github.com/gravitational/teleport/lib/vnet/daemon"
 )
 
 func (s *Service) GetBackgroundItemStatus(ctx context.Context, req *api.GetBackgroundItemStatusRequest) (*api.GetBackgroundItemStatusResponse, error) {
-	if os.Getenv(vnet.EnvFeatureFlag) != "yes" {
-		return nil, trace.NotImplemented("tsh was built with VNet daemon support, but the feature flag is not enabled")
-	}
-
 	status, err := vnetdaemon.DaemonStatus()
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -55,6 +49,8 @@ func backgroundItemStatusFromServiceStatus(status vnetdaemon.ServiceStatus) api.
 		return api.BackgroundItemStatus_BACKGROUND_ITEM_STATUS_REQUIRES_APPROVAL
 	case vnetdaemon.ServiceStatusNotFound:
 		return api.BackgroundItemStatus_BACKGROUND_ITEM_STATUS_NOT_FOUND
+	case vnetdaemon.ServiceStatusNotSupported:
+		return api.BackgroundItemStatus_BACKGROUND_ITEM_STATUS_NOT_SUPPORTED
 	default:
 		return api.BackgroundItemStatus_BACKGROUND_ITEM_STATUS_UNSPECIFIED
 	}

lib/vnet/daemon/client_darwin.go

@@ -200,6 +200,8 @@ const (
 	ServiceStatusEnabled          ServiceStatus = 1
 	ServiceStatusRequiresApproval ServiceStatus = 2
 	ServiceStatusNotFound         ServiceStatus = 3
+	// ServiceStatusNotSupported is returned by us when macOS version is < 13.0.
+	ServiceStatusNotSupported ServiceStatus = -1
 )
 
 func (s ServiceStatus) String() string {
@@ -212,6 +214,8 @@ func (s ServiceStatus) String() string {
 		return "requires approval"
 	case ServiceStatusNotFound:
 		return "not found"
+	case ServiceStatusNotSupported:
+		return "not supported"
 	default:
 		return strconv.Itoa(int(s))
 	}

lib/vnet/setup_daemon_darwin.go

@@ -21,22 +21,14 @@ package vnet
 
 import (
 	"context"
-	"os"
 
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/lib/vnet/daemon"
 )
 
-const EnvFeatureFlag = "VNETDAEMON"
-
 func execAdminProcess(ctx context.Context, config daemon.Config) error {
-	// TODO(ravicious): Remove the feature env var after the daemon gets implemented.
-	if os.Getenv(EnvFeatureFlag) == "yes" {
-		return trace.Wrap(daemon.RegisterAndCall(ctx, config))
-	}
-
-	return trace.Wrap(execAdminSubcommand(ctx, config))
+	return trace.Wrap(daemon.RegisterAndCall(ctx, config))
 }
 
 func DaemonSubcommand(ctx context.Context) error {

proto/teleport/lib/teleterm/vnet/v1/vnet_service.proto

@@ -80,4 +80,5 @@ enum BackgroundItemStatus {
   BACKGROUND_ITEM_STATUS_ENABLED = 2;
   BACKGROUND_ITEM_STATUS_REQUIRES_APPROVAL = 3;
   BACKGROUND_ITEM_STATUS_NOT_FOUND = 4;
+  BACKGROUND_ITEM_STATUS_NOT_SUPPORTED = 5;
 }

tool/tsh/common/vnet_daemon_darwin.go

@@ -0,0 +1,43 @@
+// Teleport
+// Copyright (C) 2024 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//go:build vnetdaemon
+// +build vnetdaemon
+
+package common
+
+import (
+	"log/slog"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/vnet"
+)
+
+func (c *vnetDaemonCommand) run(cf *CLIConf) error {
+	if cf.Debug {
+		utils.InitLogger(utils.LoggingForDaemon, slog.LevelDebug)
+	} else {
+		utils.InitLogger(utils.LoggingForDaemon, slog.LevelInfo)
+	}
+
+	return trace.Wrap(vnet.DaemonSubcommand(cf.Context))
+}
+
+func (c *vnetAdminSetupCommand) run(cf *CLIConf) error {
+	return trace.NotImplemented("tsh was built with support for VNet daemon, use %s instead", vnetDaemonSubCommand)
+}

tool/tsh/common/vnet_darwin.go

@@ -21,17 +21,12 @@ package common
 
 import (
 	"fmt"
-	"log/slog"
-	"os"
 
 	"github.com/alecthomas/kingpin/v2"
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport"
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/lib/utils"
 	"github.com/gravitational/teleport/lib/vnet"
-	"github.com/gravitational/teleport/lib/vnet/daemon"
 )
 
 type vnetCommand struct {
@@ -100,28 +95,6 @@ func newVnetAdminSetupCommand(app *kingpin.Application) *vnetAdminSetupCommand {
 	return cmd
 }
 
-func (c *vnetAdminSetupCommand) run(cf *CLIConf) error {
-	homePath := os.Getenv(types.HomeEnvVar)
-	if homePath == "" {
-		// This runs as root so we need to be configured with the user's home path.
-		return trace.BadParameter("%s must be set", types.HomeEnvVar)
-	}
-
-	config := daemon.Config{
-		SocketPath: c.socketPath,
-		IPv6Prefix: c.ipv6Prefix,
-		DNSAddr:    c.dnsAddr,
-		HomePath:   homePath,
-		ClientCred: daemon.ClientCred{
-			Valid: true,
-			Egid:  c.egid,
-			Euid:  c.euid,
-		},
-	}
-
-	return trace.Wrap(vnet.AdminSetup(cf.Context, config))
-}
-
 type vnetDaemonCommand struct {
 	*kingpin.CmdClause
 	// Launch daemons added through SMAppService are launched from a static .plist file, hence
@@ -131,17 +104,9 @@ type vnetDaemonCommand struct {
 
 func newVnetDaemonCommand(app *kingpin.Application) *vnetDaemonCommand {
 	return &vnetDaemonCommand{
-		// The command must match the command provided in the .plist file.
-		CmdClause: app.Command("vnet-daemon", "Start the VNet daemon").Hidden(),
+		CmdClause: app.Command(vnetDaemonSubCommand, "Start the VNet daemon").Hidden(),
 	}
 }
 
-func (c *vnetDaemonCommand) run(cf *CLIConf) error {
-	if cf.Debug {
-		utils.InitLogger(utils.LoggingForDaemon, slog.LevelDebug)
-	} else {
-		utils.InitLogger(utils.LoggingForDaemon, slog.LevelInfo)
-	}
-
-	return trace.Wrap(vnet.DaemonSubcommand(cf.Context))
-}
+// The command must match the command provided in the .plist file.
+const vnetDaemonSubCommand = "vnet-daemon"

tool/tsh/common/vnet_nodaemon_darwin.go

@@ -0,0 +1,56 @@
+// Teleport
+// Copyright (C) 2024 Gravitational, Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//go:build !vnetdaemon
+// +build !vnetdaemon
+
+package common
+
+import (
+	"os"
+
+	"github.com/gravitational/trace"
+
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/lib/vnet"
+	"github.com/gravitational/teleport/lib/vnet/daemon"
+)
+
+func (c *vnetDaemonCommand) run(cf *CLIConf) error {
+	return trace.NotImplemented("tsh was built without support for VNet daemon")
+}
+
+func (c *vnetAdminSetupCommand) run(cf *CLIConf) error {
+	homePath := os.Getenv(types.HomeEnvVar)
+	if homePath == "" {
+		// This runs as root so we need to be configured with the user's home path.
+		return trace.BadParameter("%s must be set", types.HomeEnvVar)
+	}
+
+	config := daemon.Config{
+		SocketPath: c.socketPath,
+		IPv6Prefix: c.ipv6Prefix,
+		DNSAddr:    c.dnsAddr,
+		HomePath:   homePath,
+		ClientCred: daemon.ClientCred{
+			Valid: true,
+			Egid:  c.egid,
+			Euid:  c.euid,
+		},
+	}
+
+	return trace.Wrap(vnet.AdminSetup(cf.Context, config))
+}

web/packages/teleterm/src/mainProcess/mainProcess.ts

@@ -188,9 +188,6 @@ export default class MainProcess {
         env: {
           ...process.env,
           TELEPORT_HOME: homeDir,
-          VNETDAEMON: this.configService.get('feature.vnetDaemon').value
-            ? 'yes'
-            : undefined,
         },
       }
     );