etcd: don't confuse prefixes during migration

[awly]

The prefix fetching logic has a bug: it treats everything starting with
/teleport as the legacy prefix data, even if it's /teleport-foo/bar.
This is an issue if user specifies /teleport-foo as their custom
prefix. Each restart will copy the data from /teleport-foo/... to
/teleport-foo-foo/....

Set the legacy prefix const to /teleport/ instead. This avoids
excessive copying during startup.

Fixes #4312

[russjones]

@awly Can we make a backup of everything under /teleport/ before we kick off the migration?

[awly]

@russjones we can probably backup the data we delete, under the custom prefix (not /teleport/).
I'll add that.

[awly]

@russjones PTAL

[fspmarshall]

I don't like the idea of having the logic be sensitive to the differences in proceeding/trailing slashes. Seems like an unnecessary footgun. Ideally prefix, /prefix, and /prefix/ would all mean the same thing from the user's perspective.

Otherwise, LGTM.

[awly]

@fspmarshall yeah, I agree.
We made /prefix and prefix the same, but not with trailing slashes. Now some users have data under /prefix//foo so we'll need to be careful when fixing this. That might need another migration :(

[benarent]

When we update the docs, I'll come back and update a setup guide for etcd, this does seem to follow the slightly confusing prefix logic of etcd as Forrest has pointed out https://etcd.io/docs/v3.3.12/op-guide/authentication/

btw, we should update #2883 to make it clear that it needs the trailing slash incase anyone else finds that ticket. ( or is this only an issue during a migration )

[fspmarshall]

We made /prefix and prefix the same, but not with trailing slashes. Now some users have data under /prefix//foo so we'll need to be careful when fixing this. That might need another migration :(

Huh. That is tricky. Its too bad we don't have a more well-defined format for the keys used by the Backend interface. It would be nice to be able to unambiguously separate path sections.

I suppose that while /prefix//foo looks a bit silly, at least it is unambiguous 🤷

[awly]

@benarent actually, all our backed keys start with a / so the trailing slash in prefix is not needed.
Updated the description.

Still need approval from @webvictim or @russjones for /examples/