From 466fccde360cec4d42d99b17a642470b4341be5e Mon Sep 17 00:00:00 2001 From: Julia Ogris Date: Tue, 11 Aug 2026 09:51:57 +1000 Subject: [PATCH] operator: Add role v9 CRD kind (#68737) * operator: Add role v9 CRD kind Register a TeleportRoleV9 kind with the Kubernetes operator so v9 roles can be managed declaratively. The reconciler reuses the shared RoleV6 storage type with a version override, the same way the v7 and v8 kinds do. Generated changes: make -C integrations/operator generate * operator: Drop preserve-unknown on app_resources Setting x-kubernetes-preserve-unknown-fields on app_resources rule items relaxed the CRD schema to store fields it does not declare, so the operator could reject them on decode. That keeps invalid data in cluster state and is hard to walk back once shipped, even after Kubernetes field validation improves. Rely on the structural schema and server-side field validation to reject unknown fields at the API server instead, and drop the tests that asserted the operator-side rejection. * operator: Match the reconciler factory signature The scoped operator work added an OperatorMetadata parameter to ReconcilerFactory and updated every existing role reconciler. The v9 reconciler was written before that change, so master and this branch each compile alone but not once merged, and the merge queue rejects the result. Take the parameter and ignore it, as the v6 to v8 reconcilers do. --- .../resources-teleport-dev-rolesv9.mdx | 711 +++++++ .../resources.teleport.dev_rolesv9.yaml | 1658 +++++++++++++++++ .../apis/resources/v1/rolev9_types.go | 95 + .../resources/v1/zz_generated.deepcopy.go | 69 + .../bases/resources.teleport.dev_rolesv9.yaml | 1658 +++++++++++++++++ .../resources/rolev9_controller_test.go | 148 ++ .../resources/rolevX_controller.go | 19 +- .../operator/controllers/resources/setup.go | 1 + integrations/operator/crdgen/handlerequest.go | 5 +- 9 files changed, 4360 insertions(+), 4 deletions(-) create mode 100644 docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-rolesv9.mdx create mode 100644 examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_rolesv9.yaml create mode 100644 integrations/operator/apis/resources/v1/rolev9_types.go create mode 100644 integrations/operator/config/crd/bases/resources.teleport.dev_rolesv9.yaml create mode 100644 integrations/operator/controllers/resources/rolev9_controller_test.go diff --git a/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-rolesv9.mdx b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-rolesv9.mdx new file mode 100644 index 00000000000..b934a79bfe7 --- /dev/null +++ b/docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-rolesv9.mdx @@ -0,0 +1,711 @@ +--- +title: TeleportRoleV9 +description: Provides a comprehensive list of fields in the TeleportRoleV9 resource available through the Teleport Kubernetes operator +page_type: reference +--- + +{/*Auto-generated file. Do not edit.*/} +{/*To regenerate, navigate to integrations/operator and run "make crd-docs".*/} + +{/* Disable the outdated name check since custom resource fields occasionally +need to refer to these. */} +{/* vale 3rd-party-products.former-names = NO */} + +This guide lists the fields in the `TeleportRoleV9` +resource, which you can apply after installing the Teleport Kubernetes operator. + + +## resources.teleport.dev/v1 + +**apiVersion:** resources.teleport.dev/v1 + +|Field|Type|Description| +|---|---|---| +|apiVersion|string|APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources| +|kind|string|Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds| +|metadata|object|| +|spec|[object](#spec)|Role resource definition v9 from Teleport| + +### spec + +|Field|Type|Description| +|---|---|---| +|allow|[object](#specallow)|Allow is the set of conditions evaluated to grant access.| +|deny|[object](#specdeny)|Deny is the set of conditions evaluated to deny access. Deny takes priority over allow.| +|options|[object](#specoptions)|Options is for OpenSSH options like agent forwarding.| + +### spec.allow + +|Field|Type|Description| +|---|---|---| +|account_assignments|[][object](#specallowaccount_assignments-items)|AccountAssignments holds the list of account assignments affected by this condition.| +|app_labels|[object](#specallowapp_labels)|AppLabels is a map of labels used as part of the RBAC system.| +|app_labels_expression|string|AppLabelsExpression is a predicate expression used to allow/deny access to Apps.| +|app_resources|[][object](#specallowapp_resources-items)|AppResources is the list of rules controlling access to an app's resources on each HTTP request. It is valid only in role version v9 and above, and only under allow.| +|aws_role_arns|[]string|AWSRoleARNs is a list of AWS role ARNs this role is allowed to assume.| +|azure_identities|[]string|AzureIdentities is a list of Azure identities this role is allowed to assume.| +|beam_labels|[object](#specallowbeam_labels)|BeamLabels are used in the RBAC system to allow/deny access to beams.| +|beam_labels_expression|string|BeamLabelsExpression is a predicate expression used to allow/deny access to beams.| +|cluster_labels|[object](#specallowcluster_labels)|ClusterLabels is a map of node labels (used to dynamically grant access to clusters).| +|cluster_labels_expression|string|ClusterLabelsExpression is a predicate expression used to allow/deny access to remote Teleport clusters.| +|db_labels|[object](#specallowdb_labels)|DatabaseLabels are used in RBAC system to allow/deny access to databases.| +|db_labels_expression|string|DatabaseLabelsExpression is a predicate expression used to allow/deny access to Databases.| +|db_names|[]string|DatabaseNames is a list of database names this role is allowed to connect to.| +|db_permissions|[][object](#specallowdb_permissions-items)|DatabasePermissions specifies a set of permissions that will be granted to the database user when using automatic database user provisioning.| +|db_roles|[]string|DatabaseRoles is a list of databases roles for automatic user creation.| +|db_service_labels|[object](#specallowdb_service_labels)|DatabaseServiceLabels are used in RBAC system to allow/deny access to Database Services.| +|db_service_labels_expression|string|DatabaseServiceLabelsExpression is a predicate expression used to allow/deny access to Database Services.| +|db_users|[]string|DatabaseUsers is a list of databases users this role is allowed to connect as.| +|desktop_groups|[]string|DesktopGroups is a list of groups for created desktop users to be added to| +|gcp_service_accounts|[]string|GCPServiceAccounts is a list of GCP service accounts this role is allowed to assume.| +|github_permissions|[][object](#specallowgithub_permissions-items)|GitHubPermissions defines GitHub integration related permissions.| +|group_labels|[object](#specallowgroup_labels)|GroupLabels is a map of labels used as part of the RBAC system.| +|group_labels_expression|string|GroupLabelsExpression is a predicate expression used to allow/deny access to user groups.| +|host_groups|[]string|HostGroups is a list of groups for created users to be added to| +|host_sudoers|[]string|HostSudoers is a list of entries to include in a users sudoer file| +|impersonate|[object](#specallowimpersonate)|Impersonate specifies what users and roles this role is allowed to impersonate by issuing certificates or other possible means.| +|join_sessions|[][object](#specallowjoin_sessions-items)|JoinSessions specifies policies to allow users to join other sessions.| +|kubernetes_groups|[]string|KubeGroups is a list of kubernetes groups| +|kubernetes_labels|[object](#specallowkubernetes_labels)|KubernetesLabels is a map of kubernetes cluster labels used for RBAC.| +|kubernetes_labels_expression|string|KubernetesLabelsExpression is a predicate expression used to allow/deny access to kubernetes clusters.| +|kubernetes_resources|[][object](#specallowkubernetes_resources-items)|KubernetesResources is the Kubernetes Resources this Role grants access to.| +|kubernetes_users|[]string|KubeUsers is an optional kubernetes users to impersonate| +|linux_desktop_labels|[object](#specallowlinux_desktop_labels)|LinuxDesktopLabels are used in the RBAC system to allow/deny access to Linux desktops.| +|linux_desktop_labels_expression|string|LinuxDesktopLabelsExpression is a predicate expression used to allow/deny access to Linux desktops.| +|linux_desktop_logins|[]string|LinuxDesktopLogins is a list of desktop login names allowed/denied for Linux desktops.| +|logins|[]string|Logins is a list of *nix system logins.| +|mcp|[object](#specallowmcp)|MCPPermissions defines MCP servers related permissions.| +|node_labels|[object](#specallownode_labels)|NodeLabels is a map of node labels (used to dynamically grant access to nodes).| +|node_labels_expression|string|NodeLabelsExpression is a predicate expression used to allow/deny access to SSH nodes.| +|request|[object](#specallowrequest)|| +|require_session_join|[][object](#specallowrequire_session_join-items)|RequireSessionJoin specifies policies for required users to start a session.| +|review_requests|[object](#specallowreview_requests)|ReviewRequests defines conditions for submitting access reviews.| +|rules|[][object](#specallowrules-items)|Rules is a list of rules and their access levels. Rules are a high level construct used for access control.| +|spiffe|[][object](#specallowspiffe-items)|SPIFFE is used to allow or deny access to a role holder to generating a SPIFFE SVID.| +|windows_desktop_labels|[object](#specallowwindows_desktop_labels)|WindowsDesktopLabels are used in the RBAC system to allow/deny access to Windows desktops.| +|windows_desktop_labels_expression|string|WindowsDesktopLabelsExpression is a predicate expression used to allow/deny access to Windows desktops.| +|windows_desktop_logins|[]string|WindowsDesktopLogins is a list of desktop login names allowed/denied for Windows desktops.| +|workload_identity_labels|[object](#specallowworkload_identity_labels)|WorkloadIdentityLabels controls whether or not specific WorkloadIdentity resources can be invoked. Further authorization controls exist on the WorkloadIdentity resource itself.| +|workload_identity_labels_expression|string|WorkloadIdentityLabelsExpression is a predicate expression used to allow/deny access to issuing a WorkloadIdentity.| + +### spec.allow.account_assignments items + +|Field|Type|Description| +|---|---|---| +|account|string|| +|permission_set|string|| + +### spec.allow.app_labels + +|Field|Type|Description| +|---|---|---| +|key|string|| +|value|string|| + +### spec.allow.app_resources items + +|Field|Type|Description| +|---|---|---| +|allow_all|boolean|AllowAll grants unrestricted access to every path and method. It cannot be combined with any other field.| + +### spec.allow.beam_labels + +|Field|Type|Description| +|---|---|---| +|key|string|| +|value|string|| + +### spec.allow.cluster_labels + +|Field|Type|Description| +|---|---|---| +|key|string|| +|value|string|| + +### spec.allow.db_labels + +|Field|Type|Description| +|---|---|---| +|key|string|| +|value|string|| + +### spec.allow.db_permissions items + +|Field|Type|Description| +|---|---|---| +|match|[object](#specallowdb_permissions-itemsmatch)|Match is a list of object labels that must be matched for the permission to be granted.| +|permissions|[]string|Permission is the list of string representations of the permission to be given, e.g. SELECT, INSERT, UPDATE, ...| + +### spec.allow.db_permissions items.match + +|Field|Type|Description| +|---|---|---| +|key|string|| +|value|string|| + +### spec.allow.db_service_labels + +|Field|Type|Description| +|---|---|---| +|key|string|| +|value|string|| + +### spec.allow.github_permissions items + +|Field|Type|Description| +|---|---|---| +|orgs|[]string|| + +### spec.allow.group_labels + +|Field|Type|Description| +|---|---|---| +|key|string|| +|value|string|| + +### spec.allow.impersonate + +|Field|Type|Description| +|---|---|---| +|roles|[]string|Roles is a list of resources this role is allowed to impersonate| +|users|[]string|Users is a list of resources this role is allowed to impersonate, could be an empty list or a Wildcard pattern| +|where|string|Where specifies optional advanced matcher| + +### spec.allow.join_sessions items + +|Field|Type|Description| +|---|---|---| +|kinds|[]string|Kinds are the session kinds this policy applies to.| +|modes|[]string|Modes is a list of permitted participant modes for this policy.| +|name|string|Name is the name of the policy.| +|roles|[]string|Roles is a list of roles that you can join the session of.| + +### spec.allow.kubernetes_labels + +|Field|Type|Description| +|---|---|---| +|key|string|| +|value|string|| + +### spec.allow.kubernetes_resources items + +|Field|Type|Description| +|---|---|---| +|api_group|string|APIGroup specifies the Kubernetes API group of the Kubernetes resource. It supports wildcards.| +|kind|string|Kind specifies the Kubernetes Resource type.| +|name|string|Name is the resource name. It supports wildcards.| +|namespace|string|Namespace is the resource namespace. It supports wildcards.| +|verbs|[]string|Verbs are the allowed Kubernetes verbs for the following resource.| + +### spec.allow.linux_desktop_labels + +|Field|Type|Description| +|---|---|---| +|key|string|| +|value|string|| + +### spec.allow.mcp + +|Field|Type|Description| +|---|---|---| +|tools|[]string|Tools defines the list of tools allowed or denied for this role. Each entry can be a literal string, a glob pattern (e.g. "prefix_*"), or a regular expression (must start with '^' and end with '$'). If the list is empty, no tools are allowed.| + +### spec.allow.node_labels + +|Field|Type|Description| +|---|---|---| +|key|string|| +|value|string|| + +### spec.allow.request + +|Field|Type|Description| +|---|---|---| +|annotations|[object](#specallowrequestannotations)|Annotations is a collection of annotations to be programmatically appended to pending Access Requests at the time of their creation. These annotations serve as a mechanism to propagate extra information to plugins. Since these annotations support variable interpolation syntax, they also offer a mechanism for forwarding claims from an external identity provider, to a plugin via `{{external.trait_name}}` style substitutions.| +|claims_to_roles|[][object](#specallowrequestclaims_to_roles-items)|ClaimsToRoles specifies a mapping from claims (traits) to teleport roles.| +|kubernetes_resources|[][object](#specallowrequestkubernetes_resources-items)|kubernetes_resources can optionally enforce a requester to request only certain kinds of kube resources. Eg: Users can make request to either a resource kind "kube_cluster" or any of its subresources like "namespaces". This field can be defined such that it prevents a user from requesting "kube_cluster" and enforce requesting any of its subresources.| +|max_duration|string|MaxDuration is the amount of time the access will be granted for. If this is zero, the default duration is used.| +|reason|[object](#specallowrequestreason)|Reason defines settings for the reason for the access provided by the user.| +|roles|[]string|Roles is the name of roles which will match the request rule.| +|search_as_roles|[]string|SearchAsRoles is a list of extra roles which should apply to a user while they are searching for resources as part of a Resource Access Request, and defines the underlying roles which will be requested as part of any Resource Access Request.| +|suggested_reviewers|[]string|SuggestedReviewers is a list of reviewer suggestions. These can be teleport usernames, but that is not a requirement.| +|thresholds|[][object](#specallowrequestthresholds-items)|Thresholds is a list of thresholds, one of which must be met in order for reviews to trigger a state-transition. If no thresholds are provided, a default threshold of 1 for approval and denial is used.| + +### spec.allow.request.annotations + +|Field|Type|Description| +|---|---|---| +|key|string|| +|value|[]string|| + +### spec.allow.request.claims_to_roles items + +|Field|Type|Description| +|---|---|---| +|claim|string|Claim is a claim name.| +|roles|[]string|Roles is a list of static teleport roles to match.| +|value|string|Value is a claim value to match.| + +### spec.allow.request.kubernetes_resources items + +|Field|Type|Description| +|---|---|---| +|api_group|string|APIGroup specifies the Kubernetes Resource API group.| +|kind|string|kind specifies the Kubernetes Resource type.| + +### spec.allow.request.reason + +|Field|Type|Description| +|---|---|---| +|mode|string|Mode can be either "required" or "optional". Empty string is treated as "optional". If a role has the request reason mode set to "required", then reason is required for all Access Requests requesting roles or resources allowed by this role. It applies only to users who have this role assigned.| +|prompt|string|Prompt is a custom message prompted to the user for the requested roles or resources searchable as other roles. This is only applied to the requested roles and resources specifying the prompt.| + +### spec.allow.request.thresholds items + +|Field|Type|Description| +|---|---|---| +|approve|integer|Approve is the number of matching approvals needed for state-transition.| +|deny|integer|Deny is the number of denials needed for state-transition.| +|filter|string|Filter is an optional predicate used to determine which reviews count toward this threshold.| +|name|string|Name is the optional human-readable name of the threshold.| + +### spec.allow.require_session_join items + +|Field|Type|Description| +|---|---|---| +|count|integer|Count is the amount of people that need to be matched for this policy to be fulfilled.| +|filter|string|Filter is a predicate that determines what users count towards this policy.| +|kinds|[]string|Kinds are the session kinds this policy applies to.| +|modes|[]string|Modes is the list of modes that may be used to fulfill this policy.| +|name|string|Name is the name of the policy.| +|on_leave|string|OnLeave is the behaviour that's used when the policy is no longer fulfilled for a live session.| + +### spec.allow.review_requests + +|Field|Type|Description| +|---|---|---| +|claims_to_roles|[][object](#specallowreview_requestsclaims_to_roles-items)|ClaimsToRoles specifies a mapping from claims (traits) to teleport roles.| +|preview_as_roles|[]string|PreviewAsRoles is a list of extra roles which should apply to a reviewer while they are viewing a Resource Access Request for the purposes of viewing details such as the hostname and labels of requested resources.| +|roles|[]string|Roles is the name of roles which may be reviewed.| +|submit_for_users|[]string|SubmitForUsers is used by Teleport plugins to indicate they can submit reviews on behalf of other users. Reviews submitted for a user are evaluated against that user's own RBAC permissions. Supports wildcard (*).| +|where|string|Where is an optional predicate which further limits which requests are reviewable.| + +### spec.allow.review_requests.claims_to_roles items + +|Field|Type|Description| +|---|---|---| +|claim|string|Claim is a claim name.| +|roles|[]string|Roles is a list of static teleport roles to match.| +|value|string|Value is a claim value to match.| + +### spec.allow.rules items + +|Field|Type|Description| +|---|---|---| +|actions|[]string|Actions specifies optional actions taken when this rule matches| +|resources|[]string|Resources is a list of resources| +|verbs|[]string|Verbs is a list of verbs| +|where|string|Where specifies optional advanced matcher| + +### spec.allow.spiffe items + +|Field|Type|Description| +|---|---|---| +|dns_sans|[]string|DNSSANs specifies matchers for the SPIFFE ID DNS SANs. Each requested DNS SAN is compared against all matchers configured and if any match, the condition is considered to be met. The matcher by default allows '*' to be used to indicate zero or more of any character. Prepend '^' and append '$' to instead switch to matching using the Go regex syntax. Example: *.example.com would match foo.example.com| +|ip_sans|[]string|IPSANs specifies matchers for the SPIFFE ID IP SANs. Each requested IP SAN is compared against all matchers configured and if any match, the condition is considered to be met. The matchers should be specified using CIDR notation, it supports IPv4 and IPv6. Examples: - 10.0.0.0/24 would match 10.0.0.0 to 10.255.255.255 - 10.0.0.42/32 would match only 10.0.0.42| +|path|string|Path specifies a matcher for the SPIFFE ID path. It should not include the trust domain and should start with a leading slash. The matcher by default allows '*' to be used to indicate zero or more of any character. Prepend '^' and append '$' to instead switch to matching using the Go regex syntax. Example: - /svc/foo/*/bar would match /svc/foo/baz/bar - ^\/svc\/foo\/.*\/bar$ would match /svc/foo/baz/bar| + +### spec.allow.windows_desktop_labels + +|Field|Type|Description| +|---|---|---| +|key|string|| +|value|string|| + +### spec.allow.workload_identity_labels + +|Field|Type|Description| +|---|---|---| +|key|string|| +|value|string|| + +### spec.deny + +|Field|Type|Description| +|---|---|---| +|account_assignments|[][object](#specdenyaccount_assignments-items)|AccountAssignments holds the list of account assignments affected by this condition.| +|app_labels|[object](#specdenyapp_labels)|AppLabels is a map of labels used as part of the RBAC system.| +|app_labels_expression|string|AppLabelsExpression is a predicate expression used to allow/deny access to Apps.| +|app_resources|[][object](#specdenyapp_resources-items)|AppResources is the list of rules controlling access to an app's resources on each HTTP request. It is valid only in role version v9 and above, and only under allow.| +|aws_role_arns|[]string|AWSRoleARNs is a list of AWS role ARNs this role is allowed to assume.| +|azure_identities|[]string|AzureIdentities is a list of Azure identities this role is allowed to assume.| +|beam_labels|[object](#specdenybeam_labels)|BeamLabels are used in the RBAC system to allow/deny access to beams.| +|beam_labels_expression|string|BeamLabelsExpression is a predicate expression used to allow/deny access to beams.| +|cluster_labels|[object](#specdenycluster_labels)|ClusterLabels is a map of node labels (used to dynamically grant access to clusters).| +|cluster_labels_expression|string|ClusterLabelsExpression is a predicate expression used to allow/deny access to remote Teleport clusters.| +|db_labels|[object](#specdenydb_labels)|DatabaseLabels are used in RBAC system to allow/deny access to databases.| +|db_labels_expression|string|DatabaseLabelsExpression is a predicate expression used to allow/deny access to Databases.| +|db_names|[]string|DatabaseNames is a list of database names this role is allowed to connect to.| +|db_permissions|[][object](#specdenydb_permissions-items)|DatabasePermissions specifies a set of permissions that will be granted to the database user when using automatic database user provisioning.| +|db_roles|[]string|DatabaseRoles is a list of databases roles for automatic user creation.| +|db_service_labels|[object](#specdenydb_service_labels)|DatabaseServiceLabels are used in RBAC system to allow/deny access to Database Services.| +|db_service_labels_expression|string|DatabaseServiceLabelsExpression is a predicate expression used to allow/deny access to Database Services.| +|db_users|[]string|DatabaseUsers is a list of databases users this role is allowed to connect as.| +|desktop_groups|[]string|DesktopGroups is a list of groups for created desktop users to be added to| +|gcp_service_accounts|[]string|GCPServiceAccounts is a list of GCP service accounts this role is allowed to assume.| +|github_permissions|[][object](#specdenygithub_permissions-items)|GitHubPermissions defines GitHub integration related permissions.| +|group_labels|[object](#specdenygroup_labels)|GroupLabels is a map of labels used as part of the RBAC system.| +|group_labels_expression|string|GroupLabelsExpression is a predicate expression used to allow/deny access to user groups.| +|host_groups|[]string|HostGroups is a list of groups for created users to be added to| +|host_sudoers|[]string|HostSudoers is a list of entries to include in a users sudoer file| +|impersonate|[object](#specdenyimpersonate)|Impersonate specifies what users and roles this role is allowed to impersonate by issuing certificates or other possible means.| +|join_sessions|[][object](#specdenyjoin_sessions-items)|JoinSessions specifies policies to allow users to join other sessions.| +|kubernetes_groups|[]string|KubeGroups is a list of kubernetes groups| +|kubernetes_labels|[object](#specdenykubernetes_labels)|KubernetesLabels is a map of kubernetes cluster labels used for RBAC.| +|kubernetes_labels_expression|string|KubernetesLabelsExpression is a predicate expression used to allow/deny access to kubernetes clusters.| +|kubernetes_resources|[][object](#specdenykubernetes_resources-items)|KubernetesResources is the Kubernetes Resources this Role grants access to.| +|kubernetes_users|[]string|KubeUsers is an optional kubernetes users to impersonate| +|linux_desktop_labels|[object](#specdenylinux_desktop_labels)|LinuxDesktopLabels are used in the RBAC system to allow/deny access to Linux desktops.| +|linux_desktop_labels_expression|string|LinuxDesktopLabelsExpression is a predicate expression used to allow/deny access to Linux desktops.| +|linux_desktop_logins|[]string|LinuxDesktopLogins is a list of desktop login names allowed/denied for Linux desktops.| +|logins|[]string|Logins is a list of *nix system logins.| +|mcp|[object](#specdenymcp)|MCPPermissions defines MCP servers related permissions.| +|node_labels|[object](#specdenynode_labels)|NodeLabels is a map of node labels (used to dynamically grant access to nodes).| +|node_labels_expression|string|NodeLabelsExpression is a predicate expression used to allow/deny access to SSH nodes.| +|request|[object](#specdenyrequest)|| +|require_session_join|[][object](#specdenyrequire_session_join-items)|RequireSessionJoin specifies policies for required users to start a session.| +|review_requests|[object](#specdenyreview_requests)|ReviewRequests defines conditions for submitting access reviews.| +|rules|[][object](#specdenyrules-items)|Rules is a list of rules and their access levels. Rules are a high level construct used for access control.| +|spiffe|[][object](#specdenyspiffe-items)|SPIFFE is used to allow or deny access to a role holder to generating a SPIFFE SVID.| +|windows_desktop_labels|[object](#specdenywindows_desktop_labels)|WindowsDesktopLabels are used in the RBAC system to allow/deny access to Windows desktops.| +|windows_desktop_labels_expression|string|WindowsDesktopLabelsExpression is a predicate expression used to allow/deny access to Windows desktops.| +|windows_desktop_logins|[]string|WindowsDesktopLogins is a list of desktop login names allowed/denied for Windows desktops.| +|workload_identity_labels|[object](#specdenyworkload_identity_labels)|WorkloadIdentityLabels controls whether or not specific WorkloadIdentity resources can be invoked. Further authorization controls exist on the WorkloadIdentity resource itself.| +|workload_identity_labels_expression|string|WorkloadIdentityLabelsExpression is a predicate expression used to allow/deny access to issuing a WorkloadIdentity.| + +### spec.deny.account_assignments items + +|Field|Type|Description| +|---|---|---| +|account|string|| +|permission_set|string|| + +### spec.deny.app_labels + +|Field|Type|Description| +|---|---|---| +|key|string|| +|value|string|| + +### spec.deny.app_resources items + +|Field|Type|Description| +|---|---|---| +|allow_all|boolean|AllowAll grants unrestricted access to every path and method. It cannot be combined with any other field.| + +### spec.deny.beam_labels + +|Field|Type|Description| +|---|---|---| +|key|string|| +|value|string|| + +### spec.deny.cluster_labels + +|Field|Type|Description| +|---|---|---| +|key|string|| +|value|string|| + +### spec.deny.db_labels + +|Field|Type|Description| +|---|---|---| +|key|string|| +|value|string|| + +### spec.deny.db_permissions items + +|Field|Type|Description| +|---|---|---| +|match|[object](#specdenydb_permissions-itemsmatch)|Match is a list of object labels that must be matched for the permission to be granted.| +|permissions|[]string|Permission is the list of string representations of the permission to be given, e.g. SELECT, INSERT, UPDATE, ...| + +### spec.deny.db_permissions items.match + +|Field|Type|Description| +|---|---|---| +|key|string|| +|value|string|| + +### spec.deny.db_service_labels + +|Field|Type|Description| +|---|---|---| +|key|string|| +|value|string|| + +### spec.deny.github_permissions items + +|Field|Type|Description| +|---|---|---| +|orgs|[]string|| + +### spec.deny.group_labels + +|Field|Type|Description| +|---|---|---| +|key|string|| +|value|string|| + +### spec.deny.impersonate + +|Field|Type|Description| +|---|---|---| +|roles|[]string|Roles is a list of resources this role is allowed to impersonate| +|users|[]string|Users is a list of resources this role is allowed to impersonate, could be an empty list or a Wildcard pattern| +|where|string|Where specifies optional advanced matcher| + +### spec.deny.join_sessions items + +|Field|Type|Description| +|---|---|---| +|kinds|[]string|Kinds are the session kinds this policy applies to.| +|modes|[]string|Modes is a list of permitted participant modes for this policy.| +|name|string|Name is the name of the policy.| +|roles|[]string|Roles is a list of roles that you can join the session of.| + +### spec.deny.kubernetes_labels + +|Field|Type|Description| +|---|---|---| +|key|string|| +|value|string|| + +### spec.deny.kubernetes_resources items + +|Field|Type|Description| +|---|---|---| +|api_group|string|APIGroup specifies the Kubernetes API group of the Kubernetes resource. It supports wildcards.| +|kind|string|Kind specifies the Kubernetes Resource type.| +|name|string|Name is the resource name. It supports wildcards.| +|namespace|string|Namespace is the resource namespace. It supports wildcards.| +|verbs|[]string|Verbs are the allowed Kubernetes verbs for the following resource.| + +### spec.deny.linux_desktop_labels + +|Field|Type|Description| +|---|---|---| +|key|string|| +|value|string|| + +### spec.deny.mcp + +|Field|Type|Description| +|---|---|---| +|tools|[]string|Tools defines the list of tools allowed or denied for this role. Each entry can be a literal string, a glob pattern (e.g. "prefix_*"), or a regular expression (must start with '^' and end with '$'). If the list is empty, no tools are allowed.| + +### spec.deny.node_labels + +|Field|Type|Description| +|---|---|---| +|key|string|| +|value|string|| + +### spec.deny.request + +|Field|Type|Description| +|---|---|---| +|annotations|[object](#specdenyrequestannotations)|Annotations is a collection of annotations to be programmatically appended to pending Access Requests at the time of their creation. These annotations serve as a mechanism to propagate extra information to plugins. Since these annotations support variable interpolation syntax, they also offer a mechanism for forwarding claims from an external identity provider, to a plugin via `{{external.trait_name}}` style substitutions.| +|claims_to_roles|[][object](#specdenyrequestclaims_to_roles-items)|ClaimsToRoles specifies a mapping from claims (traits) to teleport roles.| +|kubernetes_resources|[][object](#specdenyrequestkubernetes_resources-items)|kubernetes_resources can optionally enforce a requester to request only certain kinds of kube resources. Eg: Users can make request to either a resource kind "kube_cluster" or any of its subresources like "namespaces". This field can be defined such that it prevents a user from requesting "kube_cluster" and enforce requesting any of its subresources.| +|max_duration|string|MaxDuration is the amount of time the access will be granted for. If this is zero, the default duration is used.| +|reason|[object](#specdenyrequestreason)|Reason defines settings for the reason for the access provided by the user.| +|roles|[]string|Roles is the name of roles which will match the request rule.| +|search_as_roles|[]string|SearchAsRoles is a list of extra roles which should apply to a user while they are searching for resources as part of a Resource Access Request, and defines the underlying roles which will be requested as part of any Resource Access Request.| +|suggested_reviewers|[]string|SuggestedReviewers is a list of reviewer suggestions. These can be teleport usernames, but that is not a requirement.| +|thresholds|[][object](#specdenyrequestthresholds-items)|Thresholds is a list of thresholds, one of which must be met in order for reviews to trigger a state-transition. If no thresholds are provided, a default threshold of 1 for approval and denial is used.| + +### spec.deny.request.annotations + +|Field|Type|Description| +|---|---|---| +|key|string|| +|value|[]string|| + +### spec.deny.request.claims_to_roles items + +|Field|Type|Description| +|---|---|---| +|claim|string|Claim is a claim name.| +|roles|[]string|Roles is a list of static teleport roles to match.| +|value|string|Value is a claim value to match.| + +### spec.deny.request.kubernetes_resources items + +|Field|Type|Description| +|---|---|---| +|api_group|string|APIGroup specifies the Kubernetes Resource API group.| +|kind|string|kind specifies the Kubernetes Resource type.| + +### spec.deny.request.reason + +|Field|Type|Description| +|---|---|---| +|mode|string|Mode can be either "required" or "optional". Empty string is treated as "optional". If a role has the request reason mode set to "required", then reason is required for all Access Requests requesting roles or resources allowed by this role. It applies only to users who have this role assigned.| +|prompt|string|Prompt is a custom message prompted to the user for the requested roles or resources searchable as other roles. This is only applied to the requested roles and resources specifying the prompt.| + +### spec.deny.request.thresholds items + +|Field|Type|Description| +|---|---|---| +|approve|integer|Approve is the number of matching approvals needed for state-transition.| +|deny|integer|Deny is the number of denials needed for state-transition.| +|filter|string|Filter is an optional predicate used to determine which reviews count toward this threshold.| +|name|string|Name is the optional human-readable name of the threshold.| + +### spec.deny.require_session_join items + +|Field|Type|Description| +|---|---|---| +|count|integer|Count is the amount of people that need to be matched for this policy to be fulfilled.| +|filter|string|Filter is a predicate that determines what users count towards this policy.| +|kinds|[]string|Kinds are the session kinds this policy applies to.| +|modes|[]string|Modes is the list of modes that may be used to fulfill this policy.| +|name|string|Name is the name of the policy.| +|on_leave|string|OnLeave is the behaviour that's used when the policy is no longer fulfilled for a live session.| + +### spec.deny.review_requests + +|Field|Type|Description| +|---|---|---| +|claims_to_roles|[][object](#specdenyreview_requestsclaims_to_roles-items)|ClaimsToRoles specifies a mapping from claims (traits) to teleport roles.| +|preview_as_roles|[]string|PreviewAsRoles is a list of extra roles which should apply to a reviewer while they are viewing a Resource Access Request for the purposes of viewing details such as the hostname and labels of requested resources.| +|roles|[]string|Roles is the name of roles which may be reviewed.| +|submit_for_users|[]string|SubmitForUsers is used by Teleport plugins to indicate they can submit reviews on behalf of other users. Reviews submitted for a user are evaluated against that user's own RBAC permissions. Supports wildcard (*).| +|where|string|Where is an optional predicate which further limits which requests are reviewable.| + +### spec.deny.review_requests.claims_to_roles items + +|Field|Type|Description| +|---|---|---| +|claim|string|Claim is a claim name.| +|roles|[]string|Roles is a list of static teleport roles to match.| +|value|string|Value is a claim value to match.| + +### spec.deny.rules items + +|Field|Type|Description| +|---|---|---| +|actions|[]string|Actions specifies optional actions taken when this rule matches| +|resources|[]string|Resources is a list of resources| +|verbs|[]string|Verbs is a list of verbs| +|where|string|Where specifies optional advanced matcher| + +### spec.deny.spiffe items + +|Field|Type|Description| +|---|---|---| +|dns_sans|[]string|DNSSANs specifies matchers for the SPIFFE ID DNS SANs. Each requested DNS SAN is compared against all matchers configured and if any match, the condition is considered to be met. The matcher by default allows '*' to be used to indicate zero or more of any character. Prepend '^' and append '$' to instead switch to matching using the Go regex syntax. Example: *.example.com would match foo.example.com| +|ip_sans|[]string|IPSANs specifies matchers for the SPIFFE ID IP SANs. Each requested IP SAN is compared against all matchers configured and if any match, the condition is considered to be met. The matchers should be specified using CIDR notation, it supports IPv4 and IPv6. Examples: - 10.0.0.0/24 would match 10.0.0.0 to 10.255.255.255 - 10.0.0.42/32 would match only 10.0.0.42| +|path|string|Path specifies a matcher for the SPIFFE ID path. It should not include the trust domain and should start with a leading slash. The matcher by default allows '*' to be used to indicate zero or more of any character. Prepend '^' and append '$' to instead switch to matching using the Go regex syntax. Example: - /svc/foo/*/bar would match /svc/foo/baz/bar - ^\/svc\/foo\/.*\/bar$ would match /svc/foo/baz/bar| + +### spec.deny.windows_desktop_labels + +|Field|Type|Description| +|---|---|---| +|key|string|| +|value|string|| + +### spec.deny.workload_identity_labels + +|Field|Type|Description| +|---|---|---| +|key|string|| +|value|string|| + +### spec.options + +|Field|Type|Description| +|---|---|---| +|cert_extensions|[][object](#specoptionscert_extensions-items)|CertExtensions specifies the key/values| +|cert_format|string|CertificateFormat defines the format of the user certificate to allow compatibility with older versions of OpenSSH.| +|client_idle_timeout|string|ClientIdleTimeout sets disconnect clients on idle timeout behavior, if set to 0 means do not disconnect, otherwise is set to the idle duration.| +|create_db_user|boolean|CreateDatabaseUser enabled automatic database user creation.| +|create_db_user_mode|string or integer|CreateDatabaseUserMode allows users to be automatically created on a database when not set to off. 0 is "unspecified", 1 is "off", 2 is "keep", 3 is "best_effort_drop". Can be either the string or the integer representation of each option.| +|create_desktop_user|boolean|CreateDesktopUser allows users to be automatically created on a Windows desktop| +|create_host_user|boolean|Deprecated: use CreateHostUserMode instead.| +|create_host_user_default_shell|string|CreateHostUserDefaultShell is used to configure the default shell for newly provisioned host users.| +|create_host_user_mode|string or integer|CreateHostUserMode allows users to be automatically created on a host when not set to off. 0 is "unspecified"; 1 is "off"; 2 is "drop" (removed for v15 and above), 3 is "keep"; 4 is "insecure-drop". Can be either the string or the integer representation of each option.| +|desktop_clipboard|boolean|DesktopClipboard indicates whether clipboard sharing is allowed between the user's workstation and the remote desktop. It defaults to true unless explicitly set to false.| +|desktop_directory_sharing|boolean|DesktopDirectorySharing indicates whether directory sharing is allowed between the user's workstation and the remote desktop. It defaults to false unless explicitly set to true.| +|device_trust_mode|string|DeviceTrustMode is the device authorization mode used for the resources associated with the role. See DeviceTrust.Mode.| +|disconnect_expired_cert|boolean|DisconnectExpiredCert sets disconnect clients on expired certificates.| +|enhanced_recording|[]string|BPF defines what events to record for the BPF-based session recorder.| +|forward_agent|boolean|ForwardAgent is SSH agent forwarding.| +|idp|[object](#specoptionsidp)|IDP is a set of options related to accessing IdPs within Teleport. Requires Teleport Enterprise.| +|lock|string|Lock specifies the locking mode (strict|best_effort) to be applied with the role.| +|max_connections|integer|MaxConnections defines the maximum number of concurrent connections a user may hold.| +|max_kubernetes_connections|integer|MaxKubernetesConnections defines the maximum number of concurrent Kubernetes sessions a user may hold.| +|max_session_ttl|string|MaxSessionTTL defines how long a SSH session can last for.| +|max_sessions|integer|MaxSessions defines the maximum number of concurrent sessions per connection.| +|mfa_verification_interval|string|MFAVerificationInterval optionally defines the maximum duration that can elapse between successive MFA verifications. This variable is used to ensure that users are periodically prompted to verify their identity, enhancing security by preventing prolonged sessions without re-authentication when using tsh proxy * derivatives. It's only effective if the session requires MFA. If not set, defaults to `max_session_ttl`.| +|permit_x11_forwarding|boolean|PermitX11Forwarding authorizes use of X11 forwarding.| +|pin_source_ip|boolean|PinSourceIP forces the same client IP for certificate generation and usage| +|port_forwarding|boolean|Deprecated: Use SSHPortForwarding instead| +|record_session|[object](#specoptionsrecord_session)|RecordDesktopSession indicates whether desktop access sessions should be recorded. It defaults to true unless explicitly set to false.| +|request_access|string|RequestAccess defines the request strategy (optional|reason|always) where optional is the default.| +|request_prompt|string|RequestPrompt is an optional message which tells users what they aught to request.| +|require_session_mfa|string or integer|RequireMFAType is the type of MFA requirement enforced for this user. 0 is "OFF", 1 is "SESSION", 2 is "SESSION_AND_HARDWARE_KEY", 3 is "HARDWARE_KEY_TOUCH", 4 is "HARDWARE_KEY_PIN", 5 is "HARDWARE_KEY_TOUCH_AND_PIN". Can be either the string or the integer representation of each option.| +|ssh_file_copy|boolean|SSHFileCopy indicates whether remote file operations via SCP or SFTP are allowed over an SSH session. It defaults to true unless explicitly set to false.| +|ssh_port_forwarding|[object](#specoptionsssh_port_forwarding)|SSHPortForwarding configures what types of SSH port forwarding are allowed by a role.| +|web_terminal_clipboard_mode|string or integer|WebTerminalClipboardMode determines clipboard behavior in the Web UI terminal. Valid values are "unrestricted" and "no-copy". Defaults to "unrestricted" if unspecified. Can be either the string or the integer representation of each option.| + +### spec.options.cert_extensions items + +|Field|Type|Description| +|---|---|---| +|mode|string or integer|Mode is the type of extension to be used -- currently critical-option is not supported. 0 is "extension". Can be either the string or the integer representation of each option.| +|name|string|Name specifies the key to be used in the cert extension.| +|type|string or integer|Type represents the certificate type being extended, only ssh is supported at this time. 0 is "ssh". Can be either the string or the integer representation of each option.| +|value|string|Value specifies the value to be used in the cert extension.| + +### spec.options.idp + +|Field|Type|Description| +|---|---|---| +|saml|[object](#specoptionsidpsaml)|SAML are options related to the Teleport SAML IdP.| + +### spec.options.idp.saml + +|Field|Type|Description| +|---|---|---| +|enabled|boolean|Enabled is set to true if this option allows access to the Teleport SAML IdP.| + +### spec.options.record_session + +|Field|Type|Description| +|---|---|---| +|default|string|Default indicates the default value for the services.| +|desktop|boolean|Desktop indicates whether desktop sessions should be recorded. It defaults to true unless explicitly set to false.| +|ssh|string|SSH indicates the session mode used on SSH sessions.| + +### spec.options.ssh_port_forwarding + +|Field|Type|Description| +|---|---|---| +|local|[object](#specoptionsssh_port_forwardinglocal)|Allow local port forwarding.| +|remote|[object](#specoptionsssh_port_forwardingremote)|Allow remote port forwarding.| + +### spec.options.ssh_port_forwarding.local + +|Field|Type|Description| +|---|---|---| +|enabled|boolean|| + +### spec.options.ssh_port_forwarding.remote + +|Field|Type|Description| +|---|---|---| +|enabled|boolean|| + diff --git a/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_rolesv9.yaml b/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_rolesv9.yaml new file mode 100644 index 00000000000..220c5e8fee9 --- /dev/null +++ b/examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_rolesv9.yaml @@ -0,0 +1,1658 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + resources.teleport.dev/scoped: "false" + name: teleportrolesv9.resources.teleport.dev +spec: + group: resources.teleport.dev + names: + kind: TeleportRoleV9 + listKind: TeleportRoleV9List + plural: teleportrolesv9 + shortNames: + - rolev9 + - rolesv9 + singular: teleportrolev9 + scope: Namespaced + versions: + - name: v1 + schema: + openAPIV3Schema: + description: RoleV9 is the Schema for the rolesv9 API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Role resource definition v9 from Teleport + properties: + allow: + description: Allow is the set of conditions evaluated to grant access. + properties: + account_assignments: + description: AccountAssignments holds the list of account assignments + affected by this condition. + items: + properties: + account: + type: string + permission_set: + type: string + type: object + type: array + app_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: AppLabels is a map of labels used as part of the + RBAC system. + type: object + app_labels_expression: + description: AppLabelsExpression is a predicate expression used + to allow/deny access to Apps. + type: string + app_resources: + description: AppResources is the list of rules controlling access + to an app's resources on each HTTP request. It is valid only + in role version v9 and above, and only under allow. + items: + properties: + allow_all: + description: AllowAll grants unrestricted access to every + path and method. It cannot be combined with any other + field. + type: boolean + type: object + type: array + aws_role_arns: + description: AWSRoleARNs is a list of AWS role ARNs this role + is allowed to assume. + items: + type: string + nullable: true + type: array + azure_identities: + description: AzureIdentities is a list of Azure identities this + role is allowed to assume. + items: + type: string + nullable: true + type: array + beam_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: BeamLabels are used in the RBAC system to allow/deny + access to beams. + type: object + beam_labels_expression: + description: BeamLabelsExpression is a predicate expression used + to allow/deny access to beams. + type: string + cluster_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: ClusterLabels is a map of node labels (used to dynamically + grant access to clusters). + type: object + cluster_labels_expression: + description: ClusterLabelsExpression is a predicate expression + used to allow/deny access to remote Teleport clusters. + type: string + db_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: DatabaseLabels are used in RBAC system to allow/deny + access to databases. + type: object + db_labels_expression: + description: DatabaseLabelsExpression is a predicate expression + used to allow/deny access to Databases. + type: string + db_names: + description: DatabaseNames is a list of database names this role + is allowed to connect to. + items: + type: string + nullable: true + type: array + db_permissions: + description: DatabasePermissions specifies a set of permissions + that will be granted to the database user when using automatic + database user provisioning. + items: + properties: + match: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: Match is a list of object labels that must + be matched for the permission to be granted. + type: object + permissions: + description: Permission is the list of string representations + of the permission to be given, e.g. SELECT, INSERT, UPDATE, + ... + items: + type: string + nullable: true + type: array + type: object + type: array + db_roles: + description: DatabaseRoles is a list of databases roles for automatic + user creation. + items: + type: string + nullable: true + type: array + db_service_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: DatabaseServiceLabels are used in RBAC system to + allow/deny access to Database Services. + type: object + db_service_labels_expression: + description: DatabaseServiceLabelsExpression is a predicate expression + used to allow/deny access to Database Services. + type: string + db_users: + description: DatabaseUsers is a list of databases users this role + is allowed to connect as. + items: + type: string + nullable: true + type: array + desktop_groups: + description: DesktopGroups is a list of groups for created desktop + users to be added to + items: + type: string + nullable: true + type: array + gcp_service_accounts: + description: GCPServiceAccounts is a list of GCP service accounts + this role is allowed to assume. + items: + type: string + nullable: true + type: array + github_permissions: + description: GitHubPermissions defines GitHub integration related + permissions. + items: + properties: + orgs: + items: + type: string + nullable: true + type: array + type: object + type: array + group_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: GroupLabels is a map of labels used as part of the + RBAC system. + type: object + group_labels_expression: + description: GroupLabelsExpression is a predicate expression used + to allow/deny access to user groups. + type: string + host_groups: + description: HostGroups is a list of groups for created users + to be added to + items: + type: string + nullable: true + type: array + host_sudoers: + description: HostSudoers is a list of entries to include in a + users sudoer file + items: + type: string + nullable: true + type: array + impersonate: + description: Impersonate specifies what users and roles this role + is allowed to impersonate by issuing certificates or other possible + means. + nullable: true + properties: + roles: + description: Roles is a list of resources this role is allowed + to impersonate + items: + type: string + nullable: true + type: array + users: + description: Users is a list of resources this role is allowed + to impersonate, could be an empty list or a Wildcard pattern + items: + type: string + nullable: true + type: array + where: + description: Where specifies optional advanced matcher + type: string + type: object + join_sessions: + description: JoinSessions specifies policies to allow users to + join other sessions. + items: + properties: + kinds: + description: Kinds are the session kinds this policy applies + to. + items: + type: string + nullable: true + type: array + modes: + description: Modes is a list of permitted participant modes + for this policy. + items: + type: string + nullable: true + type: array + name: + description: Name is the name of the policy. + type: string + roles: + description: Roles is a list of roles that you can join + the session of. + items: + type: string + nullable: true + type: array + type: object + nullable: true + type: array + kubernetes_groups: + description: KubeGroups is a list of kubernetes groups + items: + type: string + nullable: true + type: array + kubernetes_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: KubernetesLabels is a map of kubernetes cluster labels + used for RBAC. + type: object + kubernetes_labels_expression: + description: KubernetesLabelsExpression is a predicate expression + used to allow/deny access to kubernetes clusters. + type: string + kubernetes_resources: + description: KubernetesResources is the Kubernetes Resources this + Role grants access to. + items: + properties: + api_group: + description: APIGroup specifies the Kubernetes API group + of the Kubernetes resource. It supports wildcards. + type: string + kind: + description: Kind specifies the Kubernetes Resource type. + type: string + name: + description: Name is the resource name. It supports wildcards. + type: string + namespace: + description: Namespace is the resource namespace. It supports + wildcards. + type: string + verbs: + description: Verbs are the allowed Kubernetes verbs for + the following resource. + items: + type: string + nullable: true + type: array + type: object + type: array + kubernetes_users: + description: KubeUsers is an optional kubernetes users to impersonate + items: + type: string + nullable: true + type: array + linux_desktop_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: LinuxDesktopLabels are used in the RBAC system to + allow/deny access to Linux desktops. + type: object + linux_desktop_labels_expression: + description: LinuxDesktopLabelsExpression is a predicate expression + used to allow/deny access to Linux desktops. + type: string + linux_desktop_logins: + description: LinuxDesktopLogins is a list of desktop login names + allowed/denied for Linux desktops. + items: + type: string + nullable: true + type: array + logins: + description: Logins is a list of *nix system logins. + items: + type: string + nullable: true + type: array + mcp: + description: MCPPermissions defines MCP servers related permissions. + nullable: true + properties: + tools: + description: Tools defines the list of tools allowed or denied + for this role. Each entry can be a literal string, a glob + pattern (e.g. "prefix_*"), or a regular expression (must + start with '^' and end with '$'). If the list is empty, + no tools are allowed. + items: + type: string + nullable: true + type: array + type: object + node_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: NodeLabels is a map of node labels (used to dynamically + grant access to nodes). + type: object + node_labels_expression: + description: NodeLabelsExpression is a predicate expression used + to allow/deny access to SSH nodes. + type: string + request: + nullable: true + properties: + annotations: + additionalProperties: + items: + type: string + type: array + description: Annotations is a collection of annotations to + be programmatically appended to pending Access Requests + at the time of their creation. These annotations serve as + a mechanism to propagate extra information to plugins. Since + these annotations support variable interpolation syntax, + they also offer a mechanism for forwarding claims from an + external identity provider, to a plugin via `{{external.trait_name}}` + style substitutions. + type: object + claims_to_roles: + description: ClaimsToRoles specifies a mapping from claims + (traits) to teleport roles. + items: + properties: + claim: + description: Claim is a claim name. + type: string + roles: + description: Roles is a list of static teleport roles + to match. + items: + type: string + nullable: true + type: array + value: + description: Value is a claim value to match. + type: string + type: object + type: array + kubernetes_resources: + description: 'kubernetes_resources can optionally enforce + a requester to request only certain kinds of kube resources. + Eg: Users can make request to either a resource kind "kube_cluster" + or any of its subresources like "namespaces". This field + can be defined such that it prevents a user from requesting + "kube_cluster" and enforce requesting any of its subresources.' + items: + properties: + api_group: + description: APIGroup specifies the Kubernetes Resource + API group. + type: string + kind: + description: kind specifies the Kubernetes Resource + type. + type: string + type: object + type: array + max_duration: + description: MaxDuration is the amount of time the access + will be granted for. If this is zero, the default duration + is used. + format: duration + type: string + reason: + description: Reason defines settings for the reason for the + access provided by the user. + nullable: true + properties: + mode: + description: Mode can be either "required" or "optional". + Empty string is treated as "optional". If a role has + the request reason mode set to "required", then reason + is required for all Access Requests requesting roles + or resources allowed by this role. It applies only to + users who have this role assigned. + type: string + prompt: + description: Prompt is a custom message prompted to the + user for the requested roles or resources searchable + as other roles. This is only applied to the requested + roles and resources specifying the prompt. + type: string + type: object + roles: + description: Roles is the name of roles which will match the + request rule. + items: + type: string + nullable: true + type: array + search_as_roles: + description: SearchAsRoles is a list of extra roles which + should apply to a user while they are searching for resources + as part of a Resource Access Request, and defines the underlying + roles which will be requested as part of any Resource Access + Request. + items: + type: string + nullable: true + type: array + suggested_reviewers: + description: SuggestedReviewers is a list of reviewer suggestions. These + can be teleport usernames, but that is not a requirement. + items: + type: string + nullable: true + type: array + thresholds: + description: Thresholds is a list of thresholds, one of which + must be met in order for reviews to trigger a state-transition. If + no thresholds are provided, a default threshold of 1 for + approval and denial is used. + items: + properties: + approve: + description: Approve is the number of matching approvals + needed for state-transition. + format: int32 + type: integer + deny: + description: Deny is the number of denials needed for + state-transition. + format: int32 + type: integer + filter: + description: Filter is an optional predicate used to + determine which reviews count toward this threshold. + type: string + name: + description: Name is the optional human-readable name + of the threshold. + type: string + type: object + type: array + type: object + require_session_join: + description: RequireSessionJoin specifies policies for required + users to start a session. + items: + properties: + count: + description: Count is the amount of people that need to + be matched for this policy to be fulfilled. + format: int32 + type: integer + filter: + description: Filter is a predicate that determines what + users count towards this policy. + type: string + kinds: + description: Kinds are the session kinds this policy applies + to. + items: + type: string + nullable: true + type: array + modes: + description: Modes is the list of modes that may be used + to fulfill this policy. + items: + type: string + nullable: true + type: array + name: + description: Name is the name of the policy. + type: string + on_leave: + description: OnLeave is the behaviour that's used when the + policy is no longer fulfilled for a live session. + type: string + type: object + nullable: true + type: array + review_requests: + description: ReviewRequests defines conditions for submitting + access reviews. + nullable: true + properties: + claims_to_roles: + description: ClaimsToRoles specifies a mapping from claims + (traits) to teleport roles. + items: + properties: + claim: + description: Claim is a claim name. + type: string + roles: + description: Roles is a list of static teleport roles + to match. + items: + type: string + nullable: true + type: array + value: + description: Value is a claim value to match. + type: string + type: object + type: array + preview_as_roles: + description: PreviewAsRoles is a list of extra roles which + should apply to a reviewer while they are viewing a Resource + Access Request for the purposes of viewing details such + as the hostname and labels of requested resources. + items: + type: string + nullable: true + type: array + roles: + description: Roles is the name of roles which may be reviewed. + items: + type: string + nullable: true + type: array + submit_for_users: + description: SubmitForUsers is used by Teleport plugins to + indicate they can submit reviews on behalf of other users. + Reviews submitted for a user are evaluated against that + user's own RBAC permissions. Supports wildcard (*). + items: + type: string + nullable: true + type: array + where: + description: Where is an optional predicate which further + limits which requests are reviewable. + type: string + type: object + rules: + description: Rules is a list of rules and their access levels. + Rules are a high level construct used for access control. + items: + properties: + actions: + description: Actions specifies optional actions taken when + this rule matches + items: + type: string + nullable: true + type: array + resources: + description: Resources is a list of resources + items: + type: string + nullable: true + type: array + verbs: + description: Verbs is a list of verbs + items: + type: string + nullable: true + type: array + where: + description: Where specifies optional advanced matcher + type: string + type: object + type: array + spiffe: + description: SPIFFE is used to allow or deny access to a role + holder to generating a SPIFFE SVID. + items: + properties: + dns_sans: + description: 'DNSSANs specifies matchers for the SPIFFE + ID DNS SANs. Each requested DNS SAN is compared against + all matchers configured and if any match, the condition + is considered to be met. The matcher by default allows + ''*'' to be used to indicate zero or more of any character. + Prepend ''^'' and append ''$'' to instead switch to matching + using the Go regex syntax. Example: *.example.com would + match foo.example.com' + items: + type: string + nullable: true + type: array + ip_sans: + description: 'IPSANs specifies matchers for the SPIFFE ID + IP SANs. Each requested IP SAN is compared against all + matchers configured and if any match, the condition is + considered to be met. The matchers should be specified + using CIDR notation, it supports IPv4 and IPv6. Examples: + - 10.0.0.0/24 would match 10.0.0.0 to 10.255.255.255 - + 10.0.0.42/32 would match only 10.0.0.42' + items: + type: string + nullable: true + type: array + path: + description: 'Path specifies a matcher for the SPIFFE ID + path. It should not include the trust domain and should + start with a leading slash. The matcher by default allows + ''*'' to be used to indicate zero or more of any character. + Prepend ''^'' and append ''$'' to instead switch to matching + using the Go regex syntax. Example: - /svc/foo/*/bar + would match /svc/foo/baz/bar - ^\/svc\/foo\/.*\/bar$ would + match /svc/foo/baz/bar' + type: string + type: object + nullable: true + type: array + windows_desktop_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: WindowsDesktopLabels are used in the RBAC system + to allow/deny access to Windows desktops. + type: object + windows_desktop_labels_expression: + description: WindowsDesktopLabelsExpression is a predicate expression + used to allow/deny access to Windows desktops. + type: string + windows_desktop_logins: + description: WindowsDesktopLogins is a list of desktop login names + allowed/denied for Windows desktops. + items: + type: string + nullable: true + type: array + workload_identity_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: WorkloadIdentityLabels controls whether or not specific + WorkloadIdentity resources can be invoked. Further authorization + controls exist on the WorkloadIdentity resource itself. + type: object + workload_identity_labels_expression: + description: WorkloadIdentityLabelsExpression is a predicate expression + used to allow/deny access to issuing a WorkloadIdentity. + type: string + type: object + deny: + description: Deny is the set of conditions evaluated to deny access. + Deny takes priority over allow. + properties: + account_assignments: + description: AccountAssignments holds the list of account assignments + affected by this condition. + items: + properties: + account: + type: string + permission_set: + type: string + type: object + type: array + app_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: AppLabels is a map of labels used as part of the + RBAC system. + type: object + app_labels_expression: + description: AppLabelsExpression is a predicate expression used + to allow/deny access to Apps. + type: string + app_resources: + description: AppResources is the list of rules controlling access + to an app's resources on each HTTP request. It is valid only + in role version v9 and above, and only under allow. + items: + properties: + allow_all: + description: AllowAll grants unrestricted access to every + path and method. It cannot be combined with any other + field. + type: boolean + type: object + type: array + aws_role_arns: + description: AWSRoleARNs is a list of AWS role ARNs this role + is allowed to assume. + items: + type: string + nullable: true + type: array + azure_identities: + description: AzureIdentities is a list of Azure identities this + role is allowed to assume. + items: + type: string + nullable: true + type: array + beam_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: BeamLabels are used in the RBAC system to allow/deny + access to beams. + type: object + beam_labels_expression: + description: BeamLabelsExpression is a predicate expression used + to allow/deny access to beams. + type: string + cluster_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: ClusterLabels is a map of node labels (used to dynamically + grant access to clusters). + type: object + cluster_labels_expression: + description: ClusterLabelsExpression is a predicate expression + used to allow/deny access to remote Teleport clusters. + type: string + db_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: DatabaseLabels are used in RBAC system to allow/deny + access to databases. + type: object + db_labels_expression: + description: DatabaseLabelsExpression is a predicate expression + used to allow/deny access to Databases. + type: string + db_names: + description: DatabaseNames is a list of database names this role + is allowed to connect to. + items: + type: string + nullable: true + type: array + db_permissions: + description: DatabasePermissions specifies a set of permissions + that will be granted to the database user when using automatic + database user provisioning. + items: + properties: + match: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: Match is a list of object labels that must + be matched for the permission to be granted. + type: object + permissions: + description: Permission is the list of string representations + of the permission to be given, e.g. SELECT, INSERT, UPDATE, + ... + items: + type: string + nullable: true + type: array + type: object + type: array + db_roles: + description: DatabaseRoles is a list of databases roles for automatic + user creation. + items: + type: string + nullable: true + type: array + db_service_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: DatabaseServiceLabels are used in RBAC system to + allow/deny access to Database Services. + type: object + db_service_labels_expression: + description: DatabaseServiceLabelsExpression is a predicate expression + used to allow/deny access to Database Services. + type: string + db_users: + description: DatabaseUsers is a list of databases users this role + is allowed to connect as. + items: + type: string + nullable: true + type: array + desktop_groups: + description: DesktopGroups is a list of groups for created desktop + users to be added to + items: + type: string + nullable: true + type: array + gcp_service_accounts: + description: GCPServiceAccounts is a list of GCP service accounts + this role is allowed to assume. + items: + type: string + nullable: true + type: array + github_permissions: + description: GitHubPermissions defines GitHub integration related + permissions. + items: + properties: + orgs: + items: + type: string + nullable: true + type: array + type: object + type: array + group_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: GroupLabels is a map of labels used as part of the + RBAC system. + type: object + group_labels_expression: + description: GroupLabelsExpression is a predicate expression used + to allow/deny access to user groups. + type: string + host_groups: + description: HostGroups is a list of groups for created users + to be added to + items: + type: string + nullable: true + type: array + host_sudoers: + description: HostSudoers is a list of entries to include in a + users sudoer file + items: + type: string + nullable: true + type: array + impersonate: + description: Impersonate specifies what users and roles this role + is allowed to impersonate by issuing certificates or other possible + means. + nullable: true + properties: + roles: + description: Roles is a list of resources this role is allowed + to impersonate + items: + type: string + nullable: true + type: array + users: + description: Users is a list of resources this role is allowed + to impersonate, could be an empty list or a Wildcard pattern + items: + type: string + nullable: true + type: array + where: + description: Where specifies optional advanced matcher + type: string + type: object + join_sessions: + description: JoinSessions specifies policies to allow users to + join other sessions. + items: + properties: + kinds: + description: Kinds are the session kinds this policy applies + to. + items: + type: string + nullable: true + type: array + modes: + description: Modes is a list of permitted participant modes + for this policy. + items: + type: string + nullable: true + type: array + name: + description: Name is the name of the policy. + type: string + roles: + description: Roles is a list of roles that you can join + the session of. + items: + type: string + nullable: true + type: array + type: object + nullable: true + type: array + kubernetes_groups: + description: KubeGroups is a list of kubernetes groups + items: + type: string + nullable: true + type: array + kubernetes_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: KubernetesLabels is a map of kubernetes cluster labels + used for RBAC. + type: object + kubernetes_labels_expression: + description: KubernetesLabelsExpression is a predicate expression + used to allow/deny access to kubernetes clusters. + type: string + kubernetes_resources: + description: KubernetesResources is the Kubernetes Resources this + Role grants access to. + items: + properties: + api_group: + description: APIGroup specifies the Kubernetes API group + of the Kubernetes resource. It supports wildcards. + type: string + kind: + description: Kind specifies the Kubernetes Resource type. + type: string + name: + description: Name is the resource name. It supports wildcards. + type: string + namespace: + description: Namespace is the resource namespace. It supports + wildcards. + type: string + verbs: + description: Verbs are the allowed Kubernetes verbs for + the following resource. + items: + type: string + nullable: true + type: array + type: object + type: array + kubernetes_users: + description: KubeUsers is an optional kubernetes users to impersonate + items: + type: string + nullable: true + type: array + linux_desktop_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: LinuxDesktopLabels are used in the RBAC system to + allow/deny access to Linux desktops. + type: object + linux_desktop_labels_expression: + description: LinuxDesktopLabelsExpression is a predicate expression + used to allow/deny access to Linux desktops. + type: string + linux_desktop_logins: + description: LinuxDesktopLogins is a list of desktop login names + allowed/denied for Linux desktops. + items: + type: string + nullable: true + type: array + logins: + description: Logins is a list of *nix system logins. + items: + type: string + nullable: true + type: array + mcp: + description: MCPPermissions defines MCP servers related permissions. + nullable: true + properties: + tools: + description: Tools defines the list of tools allowed or denied + for this role. Each entry can be a literal string, a glob + pattern (e.g. "prefix_*"), or a regular expression (must + start with '^' and end with '$'). If the list is empty, + no tools are allowed. + items: + type: string + nullable: true + type: array + type: object + node_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: NodeLabels is a map of node labels (used to dynamically + grant access to nodes). + type: object + node_labels_expression: + description: NodeLabelsExpression is a predicate expression used + to allow/deny access to SSH nodes. + type: string + request: + nullable: true + properties: + annotations: + additionalProperties: + items: + type: string + type: array + description: Annotations is a collection of annotations to + be programmatically appended to pending Access Requests + at the time of their creation. These annotations serve as + a mechanism to propagate extra information to plugins. Since + these annotations support variable interpolation syntax, + they also offer a mechanism for forwarding claims from an + external identity provider, to a plugin via `{{external.trait_name}}` + style substitutions. + type: object + claims_to_roles: + description: ClaimsToRoles specifies a mapping from claims + (traits) to teleport roles. + items: + properties: + claim: + description: Claim is a claim name. + type: string + roles: + description: Roles is a list of static teleport roles + to match. + items: + type: string + nullable: true + type: array + value: + description: Value is a claim value to match. + type: string + type: object + type: array + kubernetes_resources: + description: 'kubernetes_resources can optionally enforce + a requester to request only certain kinds of kube resources. + Eg: Users can make request to either a resource kind "kube_cluster" + or any of its subresources like "namespaces". This field + can be defined such that it prevents a user from requesting + "kube_cluster" and enforce requesting any of its subresources.' + items: + properties: + api_group: + description: APIGroup specifies the Kubernetes Resource + API group. + type: string + kind: + description: kind specifies the Kubernetes Resource + type. + type: string + type: object + type: array + max_duration: + description: MaxDuration is the amount of time the access + will be granted for. If this is zero, the default duration + is used. + format: duration + type: string + reason: + description: Reason defines settings for the reason for the + access provided by the user. + nullable: true + properties: + mode: + description: Mode can be either "required" or "optional". + Empty string is treated as "optional". If a role has + the request reason mode set to "required", then reason + is required for all Access Requests requesting roles + or resources allowed by this role. It applies only to + users who have this role assigned. + type: string + prompt: + description: Prompt is a custom message prompted to the + user for the requested roles or resources searchable + as other roles. This is only applied to the requested + roles and resources specifying the prompt. + type: string + type: object + roles: + description: Roles is the name of roles which will match the + request rule. + items: + type: string + nullable: true + type: array + search_as_roles: + description: SearchAsRoles is a list of extra roles which + should apply to a user while they are searching for resources + as part of a Resource Access Request, and defines the underlying + roles which will be requested as part of any Resource Access + Request. + items: + type: string + nullable: true + type: array + suggested_reviewers: + description: SuggestedReviewers is a list of reviewer suggestions. These + can be teleport usernames, but that is not a requirement. + items: + type: string + nullable: true + type: array + thresholds: + description: Thresholds is a list of thresholds, one of which + must be met in order for reviews to trigger a state-transition. If + no thresholds are provided, a default threshold of 1 for + approval and denial is used. + items: + properties: + approve: + description: Approve is the number of matching approvals + needed for state-transition. + format: int32 + type: integer + deny: + description: Deny is the number of denials needed for + state-transition. + format: int32 + type: integer + filter: + description: Filter is an optional predicate used to + determine which reviews count toward this threshold. + type: string + name: + description: Name is the optional human-readable name + of the threshold. + type: string + type: object + type: array + type: object + require_session_join: + description: RequireSessionJoin specifies policies for required + users to start a session. + items: + properties: + count: + description: Count is the amount of people that need to + be matched for this policy to be fulfilled. + format: int32 + type: integer + filter: + description: Filter is a predicate that determines what + users count towards this policy. + type: string + kinds: + description: Kinds are the session kinds this policy applies + to. + items: + type: string + nullable: true + type: array + modes: + description: Modes is the list of modes that may be used + to fulfill this policy. + items: + type: string + nullable: true + type: array + name: + description: Name is the name of the policy. + type: string + on_leave: + description: OnLeave is the behaviour that's used when the + policy is no longer fulfilled for a live session. + type: string + type: object + nullable: true + type: array + review_requests: + description: ReviewRequests defines conditions for submitting + access reviews. + nullable: true + properties: + claims_to_roles: + description: ClaimsToRoles specifies a mapping from claims + (traits) to teleport roles. + items: + properties: + claim: + description: Claim is a claim name. + type: string + roles: + description: Roles is a list of static teleport roles + to match. + items: + type: string + nullable: true + type: array + value: + description: Value is a claim value to match. + type: string + type: object + type: array + preview_as_roles: + description: PreviewAsRoles is a list of extra roles which + should apply to a reviewer while they are viewing a Resource + Access Request for the purposes of viewing details such + as the hostname and labels of requested resources. + items: + type: string + nullable: true + type: array + roles: + description: Roles is the name of roles which may be reviewed. + items: + type: string + nullable: true + type: array + submit_for_users: + description: SubmitForUsers is used by Teleport plugins to + indicate they can submit reviews on behalf of other users. + Reviews submitted for a user are evaluated against that + user's own RBAC permissions. Supports wildcard (*). + items: + type: string + nullable: true + type: array + where: + description: Where is an optional predicate which further + limits which requests are reviewable. + type: string + type: object + rules: + description: Rules is a list of rules and their access levels. + Rules are a high level construct used for access control. + items: + properties: + actions: + description: Actions specifies optional actions taken when + this rule matches + items: + type: string + nullable: true + type: array + resources: + description: Resources is a list of resources + items: + type: string + nullable: true + type: array + verbs: + description: Verbs is a list of verbs + items: + type: string + nullable: true + type: array + where: + description: Where specifies optional advanced matcher + type: string + type: object + type: array + spiffe: + description: SPIFFE is used to allow or deny access to a role + holder to generating a SPIFFE SVID. + items: + properties: + dns_sans: + description: 'DNSSANs specifies matchers for the SPIFFE + ID DNS SANs. Each requested DNS SAN is compared against + all matchers configured and if any match, the condition + is considered to be met. The matcher by default allows + ''*'' to be used to indicate zero or more of any character. + Prepend ''^'' and append ''$'' to instead switch to matching + using the Go regex syntax. Example: *.example.com would + match foo.example.com' + items: + type: string + nullable: true + type: array + ip_sans: + description: 'IPSANs specifies matchers for the SPIFFE ID + IP SANs. Each requested IP SAN is compared against all + matchers configured and if any match, the condition is + considered to be met. The matchers should be specified + using CIDR notation, it supports IPv4 and IPv6. Examples: + - 10.0.0.0/24 would match 10.0.0.0 to 10.255.255.255 - + 10.0.0.42/32 would match only 10.0.0.42' + items: + type: string + nullable: true + type: array + path: + description: 'Path specifies a matcher for the SPIFFE ID + path. It should not include the trust domain and should + start with a leading slash. The matcher by default allows + ''*'' to be used to indicate zero or more of any character. + Prepend ''^'' and append ''$'' to instead switch to matching + using the Go regex syntax. Example: - /svc/foo/*/bar + would match /svc/foo/baz/bar - ^\/svc\/foo\/.*\/bar$ would + match /svc/foo/baz/bar' + type: string + type: object + nullable: true + type: array + windows_desktop_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: WindowsDesktopLabels are used in the RBAC system + to allow/deny access to Windows desktops. + type: object + windows_desktop_labels_expression: + description: WindowsDesktopLabelsExpression is a predicate expression + used to allow/deny access to Windows desktops. + type: string + windows_desktop_logins: + description: WindowsDesktopLogins is a list of desktop login names + allowed/denied for Windows desktops. + items: + type: string + nullable: true + type: array + workload_identity_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: WorkloadIdentityLabels controls whether or not specific + WorkloadIdentity resources can be invoked. Further authorization + controls exist on the WorkloadIdentity resource itself. + type: object + workload_identity_labels_expression: + description: WorkloadIdentityLabelsExpression is a predicate expression + used to allow/deny access to issuing a WorkloadIdentity. + type: string + type: object + options: + description: Options is for OpenSSH options like agent forwarding. + properties: + cert_extensions: + description: CertExtensions specifies the key/values + items: + properties: + mode: + description: Mode is the type of extension to be used -- + currently critical-option is not supported. 0 is "extension". + x-kubernetes-int-or-string: true + name: + description: Name specifies the key to be used in the cert + extension. + type: string + type: + description: Type represents the certificate type being + extended, only ssh is supported at this time. 0 is "ssh". + x-kubernetes-int-or-string: true + value: + description: Value specifies the value to be used in the + cert extension. + type: string + type: object + nullable: true + type: array + cert_format: + description: CertificateFormat defines the format of the user + certificate to allow compatibility with older versions of OpenSSH. + type: string + client_idle_timeout: + description: ClientIdleTimeout sets disconnect clients on idle + timeout behavior, if set to 0 means do not disconnect, otherwise + is set to the idle duration. + format: duration + type: string + create_db_user: + description: CreateDatabaseUser enabled automatic database user + creation. + type: boolean + create_db_user_mode: + description: CreateDatabaseUserMode allows users to be automatically + created on a database when not set to off. 0 is "unspecified", + 1 is "off", 2 is "keep", 3 is "best_effort_drop". + x-kubernetes-int-or-string: true + create_desktop_user: + description: CreateDesktopUser allows users to be automatically + created on a Windows desktop + type: boolean + create_host_user: + description: 'Deprecated: use CreateHostUserMode instead.' + type: boolean + create_host_user_default_shell: + description: CreateHostUserDefaultShell is used to configure the + default shell for newly provisioned host users. + type: string + create_host_user_mode: + description: CreateHostUserMode allows users to be automatically + created on a host when not set to off. 0 is "unspecified"; 1 + is "off"; 2 is "drop" (removed for v15 and above), 3 is "keep"; + 4 is "insecure-drop". + x-kubernetes-int-or-string: true + desktop_clipboard: + description: DesktopClipboard indicates whether clipboard sharing + is allowed between the user's workstation and the remote desktop. + It defaults to true unless explicitly set to false. + type: boolean + desktop_directory_sharing: + description: DesktopDirectorySharing indicates whether directory + sharing is allowed between the user's workstation and the remote + desktop. It defaults to false unless explicitly set to true. + type: boolean + device_trust_mode: + description: DeviceTrustMode is the device authorization mode + used for the resources associated with the role. See DeviceTrust.Mode. + type: string + disconnect_expired_cert: + description: DisconnectExpiredCert sets disconnect clients on + expired certificates. + type: boolean + enhanced_recording: + description: BPF defines what events to record for the BPF-based + session recorder. + items: + type: string + nullable: true + type: array + forward_agent: + description: ForwardAgent is SSH agent forwarding. + type: boolean + idp: + description: IDP is a set of options related to accessing IdPs + within Teleport. Requires Teleport Enterprise. + nullable: true + properties: + saml: + description: SAML are options related to the Teleport SAML + IdP. + nullable: true + properties: + enabled: + description: Enabled is set to true if this option allows + access to the Teleport SAML IdP. + type: boolean + type: object + type: object + lock: + description: Lock specifies the locking mode (strict|best_effort) + to be applied with the role. + type: string + max_connections: + description: MaxConnections defines the maximum number of concurrent + connections a user may hold. + format: int64 + type: integer + max_kubernetes_connections: + description: MaxKubernetesConnections defines the maximum number + of concurrent Kubernetes sessions a user may hold. + format: int64 + type: integer + max_session_ttl: + description: MaxSessionTTL defines how long a SSH session can + last for. + format: duration + type: string + max_sessions: + description: MaxSessions defines the maximum number of concurrent + sessions per connection. + format: int64 + type: integer + mfa_verification_interval: + description: MFAVerificationInterval optionally defines the maximum + duration that can elapse between successive MFA verifications. + This variable is used to ensure that users are periodically + prompted to verify their identity, enhancing security by preventing + prolonged sessions without re-authentication when using tsh + proxy * derivatives. It's only effective if the session requires + MFA. If not set, defaults to `max_session_ttl`. + format: duration + type: string + permit_x11_forwarding: + description: PermitX11Forwarding authorizes use of X11 forwarding. + type: boolean + pin_source_ip: + description: PinSourceIP forces the same client IP for certificate + generation and usage + type: boolean + port_forwarding: + description: 'Deprecated: Use SSHPortForwarding instead' + type: boolean + record_session: + description: RecordDesktopSession indicates whether desktop access + sessions should be recorded. It defaults to true unless explicitly + set to false. + nullable: true + properties: + default: + description: Default indicates the default value for the services. + type: string + desktop: + description: Desktop indicates whether desktop sessions should + be recorded. It defaults to true unless explicitly set to + false. + type: boolean + ssh: + description: SSH indicates the session mode used on SSH sessions. + type: string + type: object + request_access: + description: RequestAccess defines the request strategy (optional|reason|always) + where optional is the default. + type: string + request_prompt: + description: RequestPrompt is an optional message which tells + users what they aught to request. + type: string + require_session_mfa: + description: RequireMFAType is the type of MFA requirement enforced + for this user. 0 is "OFF", 1 is "SESSION", 2 is "SESSION_AND_HARDWARE_KEY", + 3 is "HARDWARE_KEY_TOUCH", 4 is "HARDWARE_KEY_PIN", 5 is "HARDWARE_KEY_TOUCH_AND_PIN". + x-kubernetes-int-or-string: true + ssh_file_copy: + description: SSHFileCopy indicates whether remote file operations + via SCP or SFTP are allowed over an SSH session. It defaults + to true unless explicitly set to false. + type: boolean + ssh_port_forwarding: + description: SSHPortForwarding configures what types of SSH port + forwarding are allowed by a role. + nullable: true + properties: + local: + description: Allow local port forwarding. + nullable: true + properties: + enabled: + type: boolean + type: object + remote: + description: Allow remote port forwarding. + nullable: true + properties: + enabled: + type: boolean + type: object + type: object + web_terminal_clipboard_mode: + description: WebTerminalClipboardMode determines clipboard behavior + in the Web UI terminal. Valid values are "unrestricted" and + "no-copy". Defaults to "unrestricted" if unspecified. + x-kubernetes-int-or-string: true + type: object + type: object + status: + description: Status defines the observed state of the Teleport resource + properties: + conditions: + description: Conditions represent the latest available observations + of an object's state + items: + description: Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + teleportResourceID: + format: int64 + type: integer + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: null + storedVersions: null diff --git a/integrations/operator/apis/resources/v1/rolev9_types.go b/integrations/operator/apis/resources/v1/rolev9_types.go new file mode 100644 index 00000000000..d9d77111c4f --- /dev/null +++ b/integrations/operator/apis/resources/v1/rolev9_types.go @@ -0,0 +1,95 @@ +/* + * Teleport + * Copyright (C) 2026 Gravitational, Inc. + * + * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU Affero General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Affero General Public License for more details. + * + * You should have received a copy of the GNU Affero General Public License + * along with this program. If not, see . + */ + +package v1 + +import ( + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + + "github.com/gravitational/teleport/api/types" + "github.com/gravitational/teleport/integrations/operator/apis/resources/teleportcr" +) + +func init() { + SchemeBuilder.Register(&TeleportRoleV9{}, &TeleportRoleV9List{}) +} + +// TeleportRoleV9Spec defines the desired state of TeleportRoleV9 +type TeleportRoleV9Spec TeleportRoleV8Spec + +//+kubebuilder:object:root=true +//+kubebuilder:subresource:status + +// TeleportRoleV9 is the Schema for the roles API +type TeleportRoleV9 struct { + metav1.TypeMeta `json:",inline"` + metav1.ObjectMeta `json:"metadata"` + + Spec TeleportRoleV9Spec `json:"spec"` + Status teleportcr.Status `json:"status"` +} + +//+kubebuilder:object:root=true + +// TeleportRoleV9List contains a list of TeleportRoleV9 +type TeleportRoleV9List struct { + metav1.TypeMeta `json:",inline"` + metav1.ListMeta `json:"metadata"` + Items []TeleportRoleV9 `json:"items"` +} + +func (r TeleportRoleV9) ToTeleport() types.Role { + return &types.RoleV6{ + Kind: types.KindRole, + Version: types.V9, + Metadata: types.Metadata{ + Name: r.Name, + Labels: r.Labels, + Description: r.Annotations[teleportcr.DescriptionKey], + }, + Spec: types.RoleSpecV6(r.Spec), + } +} + +// Marshal serializes a spec into binary data. +func (spec *TeleportRoleV9Spec) Marshal() ([]byte, error) { + return (*TeleportRoleV8Spec)(spec).Marshal() +} + +// Unmarshal deserializes a spec from binary data. +func (spec *TeleportRoleV9Spec) Unmarshal(data []byte) error { + return (*TeleportRoleV8Spec)(spec).Unmarshal(data) +} + +// DeepCopyInto deep-copies one role spec into another. +// Required to satisfy runtime.Object interface. +func (spec *TeleportRoleV9Spec) DeepCopyInto(out *TeleportRoleV9Spec) { + data, err := spec.Marshal() + if err != nil { + panic(err) + } + *out = TeleportRoleV9Spec{} + if err := out.Unmarshal(data); err != nil { + panic(err) + } +} + +// StatusConditions returns a pointer to Status.Conditions slice. +func (r *TeleportRoleV9) StatusConditions() *[]metav1.Condition { + return &r.Status.Conditions +} diff --git a/integrations/operator/apis/resources/v1/zz_generated.deepcopy.go b/integrations/operator/apis/resources/v1/zz_generated.deepcopy.go index 652a797e2ad..1441ece0a13 100644 --- a/integrations/operator/apis/resources/v1/zz_generated.deepcopy.go +++ b/integrations/operator/apis/resources/v1/zz_generated.deepcopy.go @@ -1434,6 +1434,75 @@ func (in *TeleportRoleV8Spec) DeepCopy() *TeleportRoleV8Spec { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *TeleportRoleV9) DeepCopyInto(out *TeleportRoleV9) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) + in.Spec.DeepCopyInto(&out.Spec) + in.Status.DeepCopyInto(&out.Status) +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TeleportRoleV9. +func (in *TeleportRoleV9) DeepCopy() *TeleportRoleV9 { + if in == nil { + return nil + } + out := new(TeleportRoleV9) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *TeleportRoleV9) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *TeleportRoleV9List) DeepCopyInto(out *TeleportRoleV9List) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ListMeta.DeepCopyInto(&out.ListMeta) + if in.Items != nil { + in, out := &in.Items, &out.Items + *out = make([]TeleportRoleV9, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TeleportRoleV9List. +func (in *TeleportRoleV9List) DeepCopy() *TeleportRoleV9List { + if in == nil { + return nil + } + out := new(TeleportRoleV9List) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *TeleportRoleV9List) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TeleportRoleV9Spec. +func (in *TeleportRoleV9Spec) DeepCopy() *TeleportRoleV9Spec { + if in == nil { + return nil + } + out := new(TeleportRoleV9Spec) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *TeleportSAMLIdPServiceProviderV1) DeepCopyInto(out *TeleportSAMLIdPServiceProviderV1) { *out = *in diff --git a/integrations/operator/config/crd/bases/resources.teleport.dev_rolesv9.yaml b/integrations/operator/config/crd/bases/resources.teleport.dev_rolesv9.yaml new file mode 100644 index 00000000000..220c5e8fee9 --- /dev/null +++ b/integrations/operator/config/crd/bases/resources.teleport.dev_rolesv9.yaml @@ -0,0 +1,1658 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + resources.teleport.dev/scoped: "false" + name: teleportrolesv9.resources.teleport.dev +spec: + group: resources.teleport.dev + names: + kind: TeleportRoleV9 + listKind: TeleportRoleV9List + plural: teleportrolesv9 + shortNames: + - rolev9 + - rolesv9 + singular: teleportrolev9 + scope: Namespaced + versions: + - name: v1 + schema: + openAPIV3Schema: + description: RoleV9 is the Schema for the rolesv9 API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Role resource definition v9 from Teleport + properties: + allow: + description: Allow is the set of conditions evaluated to grant access. + properties: + account_assignments: + description: AccountAssignments holds the list of account assignments + affected by this condition. + items: + properties: + account: + type: string + permission_set: + type: string + type: object + type: array + app_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: AppLabels is a map of labels used as part of the + RBAC system. + type: object + app_labels_expression: + description: AppLabelsExpression is a predicate expression used + to allow/deny access to Apps. + type: string + app_resources: + description: AppResources is the list of rules controlling access + to an app's resources on each HTTP request. It is valid only + in role version v9 and above, and only under allow. + items: + properties: + allow_all: + description: AllowAll grants unrestricted access to every + path and method. It cannot be combined with any other + field. + type: boolean + type: object + type: array + aws_role_arns: + description: AWSRoleARNs is a list of AWS role ARNs this role + is allowed to assume. + items: + type: string + nullable: true + type: array + azure_identities: + description: AzureIdentities is a list of Azure identities this + role is allowed to assume. + items: + type: string + nullable: true + type: array + beam_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: BeamLabels are used in the RBAC system to allow/deny + access to beams. + type: object + beam_labels_expression: + description: BeamLabelsExpression is a predicate expression used + to allow/deny access to beams. + type: string + cluster_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: ClusterLabels is a map of node labels (used to dynamically + grant access to clusters). + type: object + cluster_labels_expression: + description: ClusterLabelsExpression is a predicate expression + used to allow/deny access to remote Teleport clusters. + type: string + db_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: DatabaseLabels are used in RBAC system to allow/deny + access to databases. + type: object + db_labels_expression: + description: DatabaseLabelsExpression is a predicate expression + used to allow/deny access to Databases. + type: string + db_names: + description: DatabaseNames is a list of database names this role + is allowed to connect to. + items: + type: string + nullable: true + type: array + db_permissions: + description: DatabasePermissions specifies a set of permissions + that will be granted to the database user when using automatic + database user provisioning. + items: + properties: + match: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: Match is a list of object labels that must + be matched for the permission to be granted. + type: object + permissions: + description: Permission is the list of string representations + of the permission to be given, e.g. SELECT, INSERT, UPDATE, + ... + items: + type: string + nullable: true + type: array + type: object + type: array + db_roles: + description: DatabaseRoles is a list of databases roles for automatic + user creation. + items: + type: string + nullable: true + type: array + db_service_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: DatabaseServiceLabels are used in RBAC system to + allow/deny access to Database Services. + type: object + db_service_labels_expression: + description: DatabaseServiceLabelsExpression is a predicate expression + used to allow/deny access to Database Services. + type: string + db_users: + description: DatabaseUsers is a list of databases users this role + is allowed to connect as. + items: + type: string + nullable: true + type: array + desktop_groups: + description: DesktopGroups is a list of groups for created desktop + users to be added to + items: + type: string + nullable: true + type: array + gcp_service_accounts: + description: GCPServiceAccounts is a list of GCP service accounts + this role is allowed to assume. + items: + type: string + nullable: true + type: array + github_permissions: + description: GitHubPermissions defines GitHub integration related + permissions. + items: + properties: + orgs: + items: + type: string + nullable: true + type: array + type: object + type: array + group_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: GroupLabels is a map of labels used as part of the + RBAC system. + type: object + group_labels_expression: + description: GroupLabelsExpression is a predicate expression used + to allow/deny access to user groups. + type: string + host_groups: + description: HostGroups is a list of groups for created users + to be added to + items: + type: string + nullable: true + type: array + host_sudoers: + description: HostSudoers is a list of entries to include in a + users sudoer file + items: + type: string + nullable: true + type: array + impersonate: + description: Impersonate specifies what users and roles this role + is allowed to impersonate by issuing certificates or other possible + means. + nullable: true + properties: + roles: + description: Roles is a list of resources this role is allowed + to impersonate + items: + type: string + nullable: true + type: array + users: + description: Users is a list of resources this role is allowed + to impersonate, could be an empty list or a Wildcard pattern + items: + type: string + nullable: true + type: array + where: + description: Where specifies optional advanced matcher + type: string + type: object + join_sessions: + description: JoinSessions specifies policies to allow users to + join other sessions. + items: + properties: + kinds: + description: Kinds are the session kinds this policy applies + to. + items: + type: string + nullable: true + type: array + modes: + description: Modes is a list of permitted participant modes + for this policy. + items: + type: string + nullable: true + type: array + name: + description: Name is the name of the policy. + type: string + roles: + description: Roles is a list of roles that you can join + the session of. + items: + type: string + nullable: true + type: array + type: object + nullable: true + type: array + kubernetes_groups: + description: KubeGroups is a list of kubernetes groups + items: + type: string + nullable: true + type: array + kubernetes_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: KubernetesLabels is a map of kubernetes cluster labels + used for RBAC. + type: object + kubernetes_labels_expression: + description: KubernetesLabelsExpression is a predicate expression + used to allow/deny access to kubernetes clusters. + type: string + kubernetes_resources: + description: KubernetesResources is the Kubernetes Resources this + Role grants access to. + items: + properties: + api_group: + description: APIGroup specifies the Kubernetes API group + of the Kubernetes resource. It supports wildcards. + type: string + kind: + description: Kind specifies the Kubernetes Resource type. + type: string + name: + description: Name is the resource name. It supports wildcards. + type: string + namespace: + description: Namespace is the resource namespace. It supports + wildcards. + type: string + verbs: + description: Verbs are the allowed Kubernetes verbs for + the following resource. + items: + type: string + nullable: true + type: array + type: object + type: array + kubernetes_users: + description: KubeUsers is an optional kubernetes users to impersonate + items: + type: string + nullable: true + type: array + linux_desktop_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: LinuxDesktopLabels are used in the RBAC system to + allow/deny access to Linux desktops. + type: object + linux_desktop_labels_expression: + description: LinuxDesktopLabelsExpression is a predicate expression + used to allow/deny access to Linux desktops. + type: string + linux_desktop_logins: + description: LinuxDesktopLogins is a list of desktop login names + allowed/denied for Linux desktops. + items: + type: string + nullable: true + type: array + logins: + description: Logins is a list of *nix system logins. + items: + type: string + nullable: true + type: array + mcp: + description: MCPPermissions defines MCP servers related permissions. + nullable: true + properties: + tools: + description: Tools defines the list of tools allowed or denied + for this role. Each entry can be a literal string, a glob + pattern (e.g. "prefix_*"), or a regular expression (must + start with '^' and end with '$'). If the list is empty, + no tools are allowed. + items: + type: string + nullable: true + type: array + type: object + node_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: NodeLabels is a map of node labels (used to dynamically + grant access to nodes). + type: object + node_labels_expression: + description: NodeLabelsExpression is a predicate expression used + to allow/deny access to SSH nodes. + type: string + request: + nullable: true + properties: + annotations: + additionalProperties: + items: + type: string + type: array + description: Annotations is a collection of annotations to + be programmatically appended to pending Access Requests + at the time of their creation. These annotations serve as + a mechanism to propagate extra information to plugins. Since + these annotations support variable interpolation syntax, + they also offer a mechanism for forwarding claims from an + external identity provider, to a plugin via `{{external.trait_name}}` + style substitutions. + type: object + claims_to_roles: + description: ClaimsToRoles specifies a mapping from claims + (traits) to teleport roles. + items: + properties: + claim: + description: Claim is a claim name. + type: string + roles: + description: Roles is a list of static teleport roles + to match. + items: + type: string + nullable: true + type: array + value: + description: Value is a claim value to match. + type: string + type: object + type: array + kubernetes_resources: + description: 'kubernetes_resources can optionally enforce + a requester to request only certain kinds of kube resources. + Eg: Users can make request to either a resource kind "kube_cluster" + or any of its subresources like "namespaces". This field + can be defined such that it prevents a user from requesting + "kube_cluster" and enforce requesting any of its subresources.' + items: + properties: + api_group: + description: APIGroup specifies the Kubernetes Resource + API group. + type: string + kind: + description: kind specifies the Kubernetes Resource + type. + type: string + type: object + type: array + max_duration: + description: MaxDuration is the amount of time the access + will be granted for. If this is zero, the default duration + is used. + format: duration + type: string + reason: + description: Reason defines settings for the reason for the + access provided by the user. + nullable: true + properties: + mode: + description: Mode can be either "required" or "optional". + Empty string is treated as "optional". If a role has + the request reason mode set to "required", then reason + is required for all Access Requests requesting roles + or resources allowed by this role. It applies only to + users who have this role assigned. + type: string + prompt: + description: Prompt is a custom message prompted to the + user for the requested roles or resources searchable + as other roles. This is only applied to the requested + roles and resources specifying the prompt. + type: string + type: object + roles: + description: Roles is the name of roles which will match the + request rule. + items: + type: string + nullable: true + type: array + search_as_roles: + description: SearchAsRoles is a list of extra roles which + should apply to a user while they are searching for resources + as part of a Resource Access Request, and defines the underlying + roles which will be requested as part of any Resource Access + Request. + items: + type: string + nullable: true + type: array + suggested_reviewers: + description: SuggestedReviewers is a list of reviewer suggestions. These + can be teleport usernames, but that is not a requirement. + items: + type: string + nullable: true + type: array + thresholds: + description: Thresholds is a list of thresholds, one of which + must be met in order for reviews to trigger a state-transition. If + no thresholds are provided, a default threshold of 1 for + approval and denial is used. + items: + properties: + approve: + description: Approve is the number of matching approvals + needed for state-transition. + format: int32 + type: integer + deny: + description: Deny is the number of denials needed for + state-transition. + format: int32 + type: integer + filter: + description: Filter is an optional predicate used to + determine which reviews count toward this threshold. + type: string + name: + description: Name is the optional human-readable name + of the threshold. + type: string + type: object + type: array + type: object + require_session_join: + description: RequireSessionJoin specifies policies for required + users to start a session. + items: + properties: + count: + description: Count is the amount of people that need to + be matched for this policy to be fulfilled. + format: int32 + type: integer + filter: + description: Filter is a predicate that determines what + users count towards this policy. + type: string + kinds: + description: Kinds are the session kinds this policy applies + to. + items: + type: string + nullable: true + type: array + modes: + description: Modes is the list of modes that may be used + to fulfill this policy. + items: + type: string + nullable: true + type: array + name: + description: Name is the name of the policy. + type: string + on_leave: + description: OnLeave is the behaviour that's used when the + policy is no longer fulfilled for a live session. + type: string + type: object + nullable: true + type: array + review_requests: + description: ReviewRequests defines conditions for submitting + access reviews. + nullable: true + properties: + claims_to_roles: + description: ClaimsToRoles specifies a mapping from claims + (traits) to teleport roles. + items: + properties: + claim: + description: Claim is a claim name. + type: string + roles: + description: Roles is a list of static teleport roles + to match. + items: + type: string + nullable: true + type: array + value: + description: Value is a claim value to match. + type: string + type: object + type: array + preview_as_roles: + description: PreviewAsRoles is a list of extra roles which + should apply to a reviewer while they are viewing a Resource + Access Request for the purposes of viewing details such + as the hostname and labels of requested resources. + items: + type: string + nullable: true + type: array + roles: + description: Roles is the name of roles which may be reviewed. + items: + type: string + nullable: true + type: array + submit_for_users: + description: SubmitForUsers is used by Teleport plugins to + indicate they can submit reviews on behalf of other users. + Reviews submitted for a user are evaluated against that + user's own RBAC permissions. Supports wildcard (*). + items: + type: string + nullable: true + type: array + where: + description: Where is an optional predicate which further + limits which requests are reviewable. + type: string + type: object + rules: + description: Rules is a list of rules and their access levels. + Rules are a high level construct used for access control. + items: + properties: + actions: + description: Actions specifies optional actions taken when + this rule matches + items: + type: string + nullable: true + type: array + resources: + description: Resources is a list of resources + items: + type: string + nullable: true + type: array + verbs: + description: Verbs is a list of verbs + items: + type: string + nullable: true + type: array + where: + description: Where specifies optional advanced matcher + type: string + type: object + type: array + spiffe: + description: SPIFFE is used to allow or deny access to a role + holder to generating a SPIFFE SVID. + items: + properties: + dns_sans: + description: 'DNSSANs specifies matchers for the SPIFFE + ID DNS SANs. Each requested DNS SAN is compared against + all matchers configured and if any match, the condition + is considered to be met. The matcher by default allows + ''*'' to be used to indicate zero or more of any character. + Prepend ''^'' and append ''$'' to instead switch to matching + using the Go regex syntax. Example: *.example.com would + match foo.example.com' + items: + type: string + nullable: true + type: array + ip_sans: + description: 'IPSANs specifies matchers for the SPIFFE ID + IP SANs. Each requested IP SAN is compared against all + matchers configured and if any match, the condition is + considered to be met. The matchers should be specified + using CIDR notation, it supports IPv4 and IPv6. Examples: + - 10.0.0.0/24 would match 10.0.0.0 to 10.255.255.255 - + 10.0.0.42/32 would match only 10.0.0.42' + items: + type: string + nullable: true + type: array + path: + description: 'Path specifies a matcher for the SPIFFE ID + path. It should not include the trust domain and should + start with a leading slash. The matcher by default allows + ''*'' to be used to indicate zero or more of any character. + Prepend ''^'' and append ''$'' to instead switch to matching + using the Go regex syntax. Example: - /svc/foo/*/bar + would match /svc/foo/baz/bar - ^\/svc\/foo\/.*\/bar$ would + match /svc/foo/baz/bar' + type: string + type: object + nullable: true + type: array + windows_desktop_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: WindowsDesktopLabels are used in the RBAC system + to allow/deny access to Windows desktops. + type: object + windows_desktop_labels_expression: + description: WindowsDesktopLabelsExpression is a predicate expression + used to allow/deny access to Windows desktops. + type: string + windows_desktop_logins: + description: WindowsDesktopLogins is a list of desktop login names + allowed/denied for Windows desktops. + items: + type: string + nullable: true + type: array + workload_identity_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: WorkloadIdentityLabels controls whether or not specific + WorkloadIdentity resources can be invoked. Further authorization + controls exist on the WorkloadIdentity resource itself. + type: object + workload_identity_labels_expression: + description: WorkloadIdentityLabelsExpression is a predicate expression + used to allow/deny access to issuing a WorkloadIdentity. + type: string + type: object + deny: + description: Deny is the set of conditions evaluated to deny access. + Deny takes priority over allow. + properties: + account_assignments: + description: AccountAssignments holds the list of account assignments + affected by this condition. + items: + properties: + account: + type: string + permission_set: + type: string + type: object + type: array + app_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: AppLabels is a map of labels used as part of the + RBAC system. + type: object + app_labels_expression: + description: AppLabelsExpression is a predicate expression used + to allow/deny access to Apps. + type: string + app_resources: + description: AppResources is the list of rules controlling access + to an app's resources on each HTTP request. It is valid only + in role version v9 and above, and only under allow. + items: + properties: + allow_all: + description: AllowAll grants unrestricted access to every + path and method. It cannot be combined with any other + field. + type: boolean + type: object + type: array + aws_role_arns: + description: AWSRoleARNs is a list of AWS role ARNs this role + is allowed to assume. + items: + type: string + nullable: true + type: array + azure_identities: + description: AzureIdentities is a list of Azure identities this + role is allowed to assume. + items: + type: string + nullable: true + type: array + beam_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: BeamLabels are used in the RBAC system to allow/deny + access to beams. + type: object + beam_labels_expression: + description: BeamLabelsExpression is a predicate expression used + to allow/deny access to beams. + type: string + cluster_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: ClusterLabels is a map of node labels (used to dynamically + grant access to clusters). + type: object + cluster_labels_expression: + description: ClusterLabelsExpression is a predicate expression + used to allow/deny access to remote Teleport clusters. + type: string + db_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: DatabaseLabels are used in RBAC system to allow/deny + access to databases. + type: object + db_labels_expression: + description: DatabaseLabelsExpression is a predicate expression + used to allow/deny access to Databases. + type: string + db_names: + description: DatabaseNames is a list of database names this role + is allowed to connect to. + items: + type: string + nullable: true + type: array + db_permissions: + description: DatabasePermissions specifies a set of permissions + that will be granted to the database user when using automatic + database user provisioning. + items: + properties: + match: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: Match is a list of object labels that must + be matched for the permission to be granted. + type: object + permissions: + description: Permission is the list of string representations + of the permission to be given, e.g. SELECT, INSERT, UPDATE, + ... + items: + type: string + nullable: true + type: array + type: object + type: array + db_roles: + description: DatabaseRoles is a list of databases roles for automatic + user creation. + items: + type: string + nullable: true + type: array + db_service_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: DatabaseServiceLabels are used in RBAC system to + allow/deny access to Database Services. + type: object + db_service_labels_expression: + description: DatabaseServiceLabelsExpression is a predicate expression + used to allow/deny access to Database Services. + type: string + db_users: + description: DatabaseUsers is a list of databases users this role + is allowed to connect as. + items: + type: string + nullable: true + type: array + desktop_groups: + description: DesktopGroups is a list of groups for created desktop + users to be added to + items: + type: string + nullable: true + type: array + gcp_service_accounts: + description: GCPServiceAccounts is a list of GCP service accounts + this role is allowed to assume. + items: + type: string + nullable: true + type: array + github_permissions: + description: GitHubPermissions defines GitHub integration related + permissions. + items: + properties: + orgs: + items: + type: string + nullable: true + type: array + type: object + type: array + group_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: GroupLabels is a map of labels used as part of the + RBAC system. + type: object + group_labels_expression: + description: GroupLabelsExpression is a predicate expression used + to allow/deny access to user groups. + type: string + host_groups: + description: HostGroups is a list of groups for created users + to be added to + items: + type: string + nullable: true + type: array + host_sudoers: + description: HostSudoers is a list of entries to include in a + users sudoer file + items: + type: string + nullable: true + type: array + impersonate: + description: Impersonate specifies what users and roles this role + is allowed to impersonate by issuing certificates or other possible + means. + nullable: true + properties: + roles: + description: Roles is a list of resources this role is allowed + to impersonate + items: + type: string + nullable: true + type: array + users: + description: Users is a list of resources this role is allowed + to impersonate, could be an empty list or a Wildcard pattern + items: + type: string + nullable: true + type: array + where: + description: Where specifies optional advanced matcher + type: string + type: object + join_sessions: + description: JoinSessions specifies policies to allow users to + join other sessions. + items: + properties: + kinds: + description: Kinds are the session kinds this policy applies + to. + items: + type: string + nullable: true + type: array + modes: + description: Modes is a list of permitted participant modes + for this policy. + items: + type: string + nullable: true + type: array + name: + description: Name is the name of the policy. + type: string + roles: + description: Roles is a list of roles that you can join + the session of. + items: + type: string + nullable: true + type: array + type: object + nullable: true + type: array + kubernetes_groups: + description: KubeGroups is a list of kubernetes groups + items: + type: string + nullable: true + type: array + kubernetes_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: KubernetesLabels is a map of kubernetes cluster labels + used for RBAC. + type: object + kubernetes_labels_expression: + description: KubernetesLabelsExpression is a predicate expression + used to allow/deny access to kubernetes clusters. + type: string + kubernetes_resources: + description: KubernetesResources is the Kubernetes Resources this + Role grants access to. + items: + properties: + api_group: + description: APIGroup specifies the Kubernetes API group + of the Kubernetes resource. It supports wildcards. + type: string + kind: + description: Kind specifies the Kubernetes Resource type. + type: string + name: + description: Name is the resource name. It supports wildcards. + type: string + namespace: + description: Namespace is the resource namespace. It supports + wildcards. + type: string + verbs: + description: Verbs are the allowed Kubernetes verbs for + the following resource. + items: + type: string + nullable: true + type: array + type: object + type: array + kubernetes_users: + description: KubeUsers is an optional kubernetes users to impersonate + items: + type: string + nullable: true + type: array + linux_desktop_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: LinuxDesktopLabels are used in the RBAC system to + allow/deny access to Linux desktops. + type: object + linux_desktop_labels_expression: + description: LinuxDesktopLabelsExpression is a predicate expression + used to allow/deny access to Linux desktops. + type: string + linux_desktop_logins: + description: LinuxDesktopLogins is a list of desktop login names + allowed/denied for Linux desktops. + items: + type: string + nullable: true + type: array + logins: + description: Logins is a list of *nix system logins. + items: + type: string + nullable: true + type: array + mcp: + description: MCPPermissions defines MCP servers related permissions. + nullable: true + properties: + tools: + description: Tools defines the list of tools allowed or denied + for this role. Each entry can be a literal string, a glob + pattern (e.g. "prefix_*"), or a regular expression (must + start with '^' and end with '$'). If the list is empty, + no tools are allowed. + items: + type: string + nullable: true + type: array + type: object + node_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: NodeLabels is a map of node labels (used to dynamically + grant access to nodes). + type: object + node_labels_expression: + description: NodeLabelsExpression is a predicate expression used + to allow/deny access to SSH nodes. + type: string + request: + nullable: true + properties: + annotations: + additionalProperties: + items: + type: string + type: array + description: Annotations is a collection of annotations to + be programmatically appended to pending Access Requests + at the time of their creation. These annotations serve as + a mechanism to propagate extra information to plugins. Since + these annotations support variable interpolation syntax, + they also offer a mechanism for forwarding claims from an + external identity provider, to a plugin via `{{external.trait_name}}` + style substitutions. + type: object + claims_to_roles: + description: ClaimsToRoles specifies a mapping from claims + (traits) to teleport roles. + items: + properties: + claim: + description: Claim is a claim name. + type: string + roles: + description: Roles is a list of static teleport roles + to match. + items: + type: string + nullable: true + type: array + value: + description: Value is a claim value to match. + type: string + type: object + type: array + kubernetes_resources: + description: 'kubernetes_resources can optionally enforce + a requester to request only certain kinds of kube resources. + Eg: Users can make request to either a resource kind "kube_cluster" + or any of its subresources like "namespaces". This field + can be defined such that it prevents a user from requesting + "kube_cluster" and enforce requesting any of its subresources.' + items: + properties: + api_group: + description: APIGroup specifies the Kubernetes Resource + API group. + type: string + kind: + description: kind specifies the Kubernetes Resource + type. + type: string + type: object + type: array + max_duration: + description: MaxDuration is the amount of time the access + will be granted for. If this is zero, the default duration + is used. + format: duration + type: string + reason: + description: Reason defines settings for the reason for the + access provided by the user. + nullable: true + properties: + mode: + description: Mode can be either "required" or "optional". + Empty string is treated as "optional". If a role has + the request reason mode set to "required", then reason + is required for all Access Requests requesting roles + or resources allowed by this role. It applies only to + users who have this role assigned. + type: string + prompt: + description: Prompt is a custom message prompted to the + user for the requested roles or resources searchable + as other roles. This is only applied to the requested + roles and resources specifying the prompt. + type: string + type: object + roles: + description: Roles is the name of roles which will match the + request rule. + items: + type: string + nullable: true + type: array + search_as_roles: + description: SearchAsRoles is a list of extra roles which + should apply to a user while they are searching for resources + as part of a Resource Access Request, and defines the underlying + roles which will be requested as part of any Resource Access + Request. + items: + type: string + nullable: true + type: array + suggested_reviewers: + description: SuggestedReviewers is a list of reviewer suggestions. These + can be teleport usernames, but that is not a requirement. + items: + type: string + nullable: true + type: array + thresholds: + description: Thresholds is a list of thresholds, one of which + must be met in order for reviews to trigger a state-transition. If + no thresholds are provided, a default threshold of 1 for + approval and denial is used. + items: + properties: + approve: + description: Approve is the number of matching approvals + needed for state-transition. + format: int32 + type: integer + deny: + description: Deny is the number of denials needed for + state-transition. + format: int32 + type: integer + filter: + description: Filter is an optional predicate used to + determine which reviews count toward this threshold. + type: string + name: + description: Name is the optional human-readable name + of the threshold. + type: string + type: object + type: array + type: object + require_session_join: + description: RequireSessionJoin specifies policies for required + users to start a session. + items: + properties: + count: + description: Count is the amount of people that need to + be matched for this policy to be fulfilled. + format: int32 + type: integer + filter: + description: Filter is a predicate that determines what + users count towards this policy. + type: string + kinds: + description: Kinds are the session kinds this policy applies + to. + items: + type: string + nullable: true + type: array + modes: + description: Modes is the list of modes that may be used + to fulfill this policy. + items: + type: string + nullable: true + type: array + name: + description: Name is the name of the policy. + type: string + on_leave: + description: OnLeave is the behaviour that's used when the + policy is no longer fulfilled for a live session. + type: string + type: object + nullable: true + type: array + review_requests: + description: ReviewRequests defines conditions for submitting + access reviews. + nullable: true + properties: + claims_to_roles: + description: ClaimsToRoles specifies a mapping from claims + (traits) to teleport roles. + items: + properties: + claim: + description: Claim is a claim name. + type: string + roles: + description: Roles is a list of static teleport roles + to match. + items: + type: string + nullable: true + type: array + value: + description: Value is a claim value to match. + type: string + type: object + type: array + preview_as_roles: + description: PreviewAsRoles is a list of extra roles which + should apply to a reviewer while they are viewing a Resource + Access Request for the purposes of viewing details such + as the hostname and labels of requested resources. + items: + type: string + nullable: true + type: array + roles: + description: Roles is the name of roles which may be reviewed. + items: + type: string + nullable: true + type: array + submit_for_users: + description: SubmitForUsers is used by Teleport plugins to + indicate they can submit reviews on behalf of other users. + Reviews submitted for a user are evaluated against that + user's own RBAC permissions. Supports wildcard (*). + items: + type: string + nullable: true + type: array + where: + description: Where is an optional predicate which further + limits which requests are reviewable. + type: string + type: object + rules: + description: Rules is a list of rules and their access levels. + Rules are a high level construct used for access control. + items: + properties: + actions: + description: Actions specifies optional actions taken when + this rule matches + items: + type: string + nullable: true + type: array + resources: + description: Resources is a list of resources + items: + type: string + nullable: true + type: array + verbs: + description: Verbs is a list of verbs + items: + type: string + nullable: true + type: array + where: + description: Where specifies optional advanced matcher + type: string + type: object + type: array + spiffe: + description: SPIFFE is used to allow or deny access to a role + holder to generating a SPIFFE SVID. + items: + properties: + dns_sans: + description: 'DNSSANs specifies matchers for the SPIFFE + ID DNS SANs. Each requested DNS SAN is compared against + all matchers configured and if any match, the condition + is considered to be met. The matcher by default allows + ''*'' to be used to indicate zero or more of any character. + Prepend ''^'' and append ''$'' to instead switch to matching + using the Go regex syntax. Example: *.example.com would + match foo.example.com' + items: + type: string + nullable: true + type: array + ip_sans: + description: 'IPSANs specifies matchers for the SPIFFE ID + IP SANs. Each requested IP SAN is compared against all + matchers configured and if any match, the condition is + considered to be met. The matchers should be specified + using CIDR notation, it supports IPv4 and IPv6. Examples: + - 10.0.0.0/24 would match 10.0.0.0 to 10.255.255.255 - + 10.0.0.42/32 would match only 10.0.0.42' + items: + type: string + nullable: true + type: array + path: + description: 'Path specifies a matcher for the SPIFFE ID + path. It should not include the trust domain and should + start with a leading slash. The matcher by default allows + ''*'' to be used to indicate zero or more of any character. + Prepend ''^'' and append ''$'' to instead switch to matching + using the Go regex syntax. Example: - /svc/foo/*/bar + would match /svc/foo/baz/bar - ^\/svc\/foo\/.*\/bar$ would + match /svc/foo/baz/bar' + type: string + type: object + nullable: true + type: array + windows_desktop_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: WindowsDesktopLabels are used in the RBAC system + to allow/deny access to Windows desktops. + type: object + windows_desktop_labels_expression: + description: WindowsDesktopLabelsExpression is a predicate expression + used to allow/deny access to Windows desktops. + type: string + windows_desktop_logins: + description: WindowsDesktopLogins is a list of desktop login names + allowed/denied for Windows desktops. + items: + type: string + nullable: true + type: array + workload_identity_labels: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: WorkloadIdentityLabels controls whether or not specific + WorkloadIdentity resources can be invoked. Further authorization + controls exist on the WorkloadIdentity resource itself. + type: object + workload_identity_labels_expression: + description: WorkloadIdentityLabelsExpression is a predicate expression + used to allow/deny access to issuing a WorkloadIdentity. + type: string + type: object + options: + description: Options is for OpenSSH options like agent forwarding. + properties: + cert_extensions: + description: CertExtensions specifies the key/values + items: + properties: + mode: + description: Mode is the type of extension to be used -- + currently critical-option is not supported. 0 is "extension". + x-kubernetes-int-or-string: true + name: + description: Name specifies the key to be used in the cert + extension. + type: string + type: + description: Type represents the certificate type being + extended, only ssh is supported at this time. 0 is "ssh". + x-kubernetes-int-or-string: true + value: + description: Value specifies the value to be used in the + cert extension. + type: string + type: object + nullable: true + type: array + cert_format: + description: CertificateFormat defines the format of the user + certificate to allow compatibility with older versions of OpenSSH. + type: string + client_idle_timeout: + description: ClientIdleTimeout sets disconnect clients on idle + timeout behavior, if set to 0 means do not disconnect, otherwise + is set to the idle duration. + format: duration + type: string + create_db_user: + description: CreateDatabaseUser enabled automatic database user + creation. + type: boolean + create_db_user_mode: + description: CreateDatabaseUserMode allows users to be automatically + created on a database when not set to off. 0 is "unspecified", + 1 is "off", 2 is "keep", 3 is "best_effort_drop". + x-kubernetes-int-or-string: true + create_desktop_user: + description: CreateDesktopUser allows users to be automatically + created on a Windows desktop + type: boolean + create_host_user: + description: 'Deprecated: use CreateHostUserMode instead.' + type: boolean + create_host_user_default_shell: + description: CreateHostUserDefaultShell is used to configure the + default shell for newly provisioned host users. + type: string + create_host_user_mode: + description: CreateHostUserMode allows users to be automatically + created on a host when not set to off. 0 is "unspecified"; 1 + is "off"; 2 is "drop" (removed for v15 and above), 3 is "keep"; + 4 is "insecure-drop". + x-kubernetes-int-or-string: true + desktop_clipboard: + description: DesktopClipboard indicates whether clipboard sharing + is allowed between the user's workstation and the remote desktop. + It defaults to true unless explicitly set to false. + type: boolean + desktop_directory_sharing: + description: DesktopDirectorySharing indicates whether directory + sharing is allowed between the user's workstation and the remote + desktop. It defaults to false unless explicitly set to true. + type: boolean + device_trust_mode: + description: DeviceTrustMode is the device authorization mode + used for the resources associated with the role. See DeviceTrust.Mode. + type: string + disconnect_expired_cert: + description: DisconnectExpiredCert sets disconnect clients on + expired certificates. + type: boolean + enhanced_recording: + description: BPF defines what events to record for the BPF-based + session recorder. + items: + type: string + nullable: true + type: array + forward_agent: + description: ForwardAgent is SSH agent forwarding. + type: boolean + idp: + description: IDP is a set of options related to accessing IdPs + within Teleport. Requires Teleport Enterprise. + nullable: true + properties: + saml: + description: SAML are options related to the Teleport SAML + IdP. + nullable: true + properties: + enabled: + description: Enabled is set to true if this option allows + access to the Teleport SAML IdP. + type: boolean + type: object + type: object + lock: + description: Lock specifies the locking mode (strict|best_effort) + to be applied with the role. + type: string + max_connections: + description: MaxConnections defines the maximum number of concurrent + connections a user may hold. + format: int64 + type: integer + max_kubernetes_connections: + description: MaxKubernetesConnections defines the maximum number + of concurrent Kubernetes sessions a user may hold. + format: int64 + type: integer + max_session_ttl: + description: MaxSessionTTL defines how long a SSH session can + last for. + format: duration + type: string + max_sessions: + description: MaxSessions defines the maximum number of concurrent + sessions per connection. + format: int64 + type: integer + mfa_verification_interval: + description: MFAVerificationInterval optionally defines the maximum + duration that can elapse between successive MFA verifications. + This variable is used to ensure that users are periodically + prompted to verify their identity, enhancing security by preventing + prolonged sessions without re-authentication when using tsh + proxy * derivatives. It's only effective if the session requires + MFA. If not set, defaults to `max_session_ttl`. + format: duration + type: string + permit_x11_forwarding: + description: PermitX11Forwarding authorizes use of X11 forwarding. + type: boolean + pin_source_ip: + description: PinSourceIP forces the same client IP for certificate + generation and usage + type: boolean + port_forwarding: + description: 'Deprecated: Use SSHPortForwarding instead' + type: boolean + record_session: + description: RecordDesktopSession indicates whether desktop access + sessions should be recorded. It defaults to true unless explicitly + set to false. + nullable: true + properties: + default: + description: Default indicates the default value for the services. + type: string + desktop: + description: Desktop indicates whether desktop sessions should + be recorded. It defaults to true unless explicitly set to + false. + type: boolean + ssh: + description: SSH indicates the session mode used on SSH sessions. + type: string + type: object + request_access: + description: RequestAccess defines the request strategy (optional|reason|always) + where optional is the default. + type: string + request_prompt: + description: RequestPrompt is an optional message which tells + users what they aught to request. + type: string + require_session_mfa: + description: RequireMFAType is the type of MFA requirement enforced + for this user. 0 is "OFF", 1 is "SESSION", 2 is "SESSION_AND_HARDWARE_KEY", + 3 is "HARDWARE_KEY_TOUCH", 4 is "HARDWARE_KEY_PIN", 5 is "HARDWARE_KEY_TOUCH_AND_PIN". + x-kubernetes-int-or-string: true + ssh_file_copy: + description: SSHFileCopy indicates whether remote file operations + via SCP or SFTP are allowed over an SSH session. It defaults + to true unless explicitly set to false. + type: boolean + ssh_port_forwarding: + description: SSHPortForwarding configures what types of SSH port + forwarding are allowed by a role. + nullable: true + properties: + local: + description: Allow local port forwarding. + nullable: true + properties: + enabled: + type: boolean + type: object + remote: + description: Allow remote port forwarding. + nullable: true + properties: + enabled: + type: boolean + type: object + type: object + web_terminal_clipboard_mode: + description: WebTerminalClipboardMode determines clipboard behavior + in the Web UI terminal. Valid values are "unrestricted" and + "no-copy". Defaults to "unrestricted" if unspecified. + x-kubernetes-int-or-string: true + type: object + type: object + status: + description: Status defines the observed state of the Teleport resource + properties: + conditions: + description: Conditions represent the latest available observations + of an object's state + items: + description: Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + teleportResourceID: + format: int64 + type: integer + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: null + storedVersions: null diff --git a/integrations/operator/controllers/resources/rolev9_controller_test.go b/integrations/operator/controllers/resources/rolev9_controller_test.go new file mode 100644 index 00000000000..591e3fe0613 --- /dev/null +++ b/integrations/operator/controllers/resources/rolev9_controller_test.go @@ -0,0 +1,148 @@ +/* + * Teleport + * Copyright (C) 2026 Gravitational, Inc. + * + * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU Affero General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Affero General Public License for more details. + * + * You should have received a copy of the GNU Affero General Public License + * along with this program. If not, see . + */ + +package resources_test + +import ( + "context" + "testing" + + "github.com/google/go-cmp/cmp" + "github.com/google/go-cmp/cmp/cmpopts" + "github.com/gravitational/trace" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + kclient "sigs.k8s.io/controller-runtime/pkg/client" + + "github.com/gravitational/teleport/api/types" + resourcesv1 "github.com/gravitational/teleport/integrations/operator/apis/resources/v1" + "github.com/gravitational/teleport/integrations/operator/controllers/reconcilers" + "github.com/gravitational/teleport/integrations/operator/controllers/resources" + "github.com/gravitational/teleport/integrations/operator/controllers/resources/testlib" +) + +var roleV9Spec = types.RoleSpecV6{ + Allow: types.RoleConditions{ + Logins: []string{"foo"}, + AppLabels: types.Labels{"env": {"dev", "prod"}}, + // allow_all is the only app_resources rule accepted on write. + AppResources: []types.AppResource{ + {AllowAll: true}, + }, + }, + Deny: types.RoleConditions{}, +} + +type roleV9TestingPrimitives struct { + setup *testSetup + reconcilers.ResourceWithLabelsAdapter[types.Role] +} + +func (g *roleV9TestingPrimitives) Init(setup *testSetup) { + g.setup = setup +} + +func (g *roleV9TestingPrimitives) SetupTeleportFixtures(ctx context.Context) error { + return nil +} + +func (g *roleV9TestingPrimitives) CreateTeleportResource(ctx context.Context, name string) error { + role, err := types.NewRoleWithVersion(name, types.V9, roleV9Spec) + if err != nil { + return trace.Wrap(err) + } + role.SetOrigin(types.OriginKubernetes) + _, err = g.setup.TeleportClient.CreateRole(ctx, role) + return trace.Wrap(err) +} + +func (g *roleV9TestingPrimitives) GetTeleportResource(ctx context.Context, name string) (types.Role, error) { + return g.setup.TeleportClient.GetRole(ctx, name) +} + +func (g *roleV9TestingPrimitives) DeleteTeleportResource(ctx context.Context, name string) error { + return trace.Wrap(g.setup.TeleportClient.DeleteRole(ctx, name)) +} + +func (g *roleV9TestingPrimitives) CreateKubernetesResource(ctx context.Context, name string) error { + role := &resourcesv1.TeleportRoleV9{ + ObjectMeta: metav1.ObjectMeta{ + Name: name, + Namespace: g.setup.Namespace.Name, + }, + Spec: resourcesv1.TeleportRoleV9Spec(roleV9Spec), + } + return trace.Wrap(g.setup.K8sClient.Create(ctx, role)) +} + +func (g *roleV9TestingPrimitives) DeleteKubernetesResource(ctx context.Context, name string) error { + role := &resourcesv1.TeleportRoleV9{ + ObjectMeta: metav1.ObjectMeta{ + Name: name, + Namespace: g.setup.Namespace.Name, + }, + } + return trace.Wrap(g.setup.K8sClient.Delete(ctx, role)) +} + +func (g *roleV9TestingPrimitives) GetKubernetesResource(ctx context.Context, name string) (*resourcesv1.TeleportRoleV9, error) { + role := &resourcesv1.TeleportRoleV9{} + obj := kclient.ObjectKey{ + Name: name, + Namespace: g.setup.Namespace.Name, + } + err := g.setup.K8sClient.Get(ctx, obj, role) + return role, trace.Wrap(err) +} + +func (g *roleV9TestingPrimitives) ModifyKubernetesResource(ctx context.Context, name string) error { + role, err := g.GetKubernetesResource(ctx, name) + if err != nil { + return trace.Wrap(err) + } + role.Spec.Allow.Logins = []string{"foo", "bar"} + return g.setup.K8sClient.Update(ctx, role) +} + +func (g *roleV9TestingPrimitives) CompareTeleportAndKubernetesResource(tResource types.Role, kubeResource *resourcesv1.TeleportRoleV9) (bool, string) { + ignoreServerSideDefaults := []cmp.Option{ + cmpopts.IgnoreFields(types.RoleSpecV6{}, "Options"), + cmpopts.IgnoreFields(types.RoleConditions{}, "Namespaces"), + } + diff := cmp.Diff(tResource, kubeResource.ToTeleport(), testlib.CompareOptions(ignoreServerSideDefaults...)...) + return diff == "", diff +} + +func TestTeleportRoleV9Creation(t *testing.T) { + test := &roleV9TestingPrimitives{} + testlib.ResourceCreationSynchronousTest(t, resources.NewRoleV9Reconciler, test) +} + +func TestTeleportRoleV9Deletion(t *testing.T) { + test := &roleV9TestingPrimitives{} + testlib.ResourceDeletionSynchronousTest(t, resources.NewRoleV9Reconciler, test) +} + +func TestTeleportRoleV9DeletionDrift(t *testing.T) { + test := &roleV9TestingPrimitives{} + testlib.ResourceDeletionDriftSynchronousTest(t, resources.NewRoleV9Reconciler, test) +} + +func TestTeleportRoleV9Update(t *testing.T) { + test := &roleV9TestingPrimitives{} + testlib.ResourceUpdateTestSynchronous(t, resources.NewRoleV9Reconciler, test) +} diff --git a/integrations/operator/controllers/resources/rolevX_controller.go b/integrations/operator/controllers/resources/rolevX_controller.go index b8ac4bd9e2c..4861c1f0e59 100644 --- a/integrations/operator/controllers/resources/rolevX_controller.go +++ b/integrations/operator/controllers/resources/rolevX_controller.go @@ -34,8 +34,8 @@ import ( // roleClient implements TeleportResourceClient and offers CRUD methods needed to reconcile roles // Currently the same client is used by all role versions. If we need to treat -// them differently at some point, for example by adding a Mutate function -// functions, we can always split the client into separate clients. +// them differently at some point, for example by adding a Mutate function, +// we can always split the client into separate clients. type roleClient struct { teleportClient *client.Client } @@ -122,3 +122,18 @@ func NewRoleV8Reconciler(client kclient.Client, tClient *client.Client, _ reconc return resourceReconciler, trace.Wrap(err, "building teleport resource reconciler") } + +// NewRoleV9Reconciler instantiates a new Kubernetes controller reconciling role v9 resources +func NewRoleV9Reconciler(client kclient.Client, tClient *client.Client, _ reconcilers.OperatorMetadata) (controllers.Reconciler, error) { + roleClient := &roleClient{ + teleportClient: tClient, + } + + resourceReconciler, err := reconcilers.NewTeleportResourceWithLabelsReconciler[types.Role, *resourcesv1.TeleportRoleV9]( + client, + roleClient, + reconcilers.Config{}, + ) + + return resourceReconciler, trace.Wrap(err, "building teleport resource reconciler") +} diff --git a/integrations/operator/controllers/resources/setup.go b/integrations/operator/controllers/resources/setup.go index 884192ba371..a773dfdcf40 100644 --- a/integrations/operator/controllers/resources/setup.go +++ b/integrations/operator/controllers/resources/setup.go @@ -63,6 +63,7 @@ var supportedReconcilers = []ReconcilerFactory{ NewRoleV6Reconciler, NewRoleV7Reconciler, NewRoleV8Reconciler, + NewRoleV9Reconciler, NewSAMLConnectorReconciler, NewSAMLIdPServiceProviderV1Reconciler, NewScopedRoleV1Reconciler, diff --git a/integrations/operator/crdgen/handlerequest.go b/integrations/operator/crdgen/handlerequest.go index 402b43e9481..cf091172ac1 100644 --- a/integrations/operator/crdgen/handlerequest.go +++ b/integrations/operator/crdgen/handlerequest.go @@ -172,11 +172,12 @@ func generateSchema(file *File, groupName string, format crdFormatFunc, resp *go {name: "RoleV6", opts: []resourceSchemaOption{withVersionOverride(types.V5), legacyWithoutVersionInKindOverride()}}, // For backward compatibility in v15, it actually creates v5 roles though. {name: "RoleV6", opts: []resourceSchemaOption{legacyWithoutVersionInKindOverride()}}, - // Role V6 and V7 have their own Kubernetes kind + // Role V6 through V9 each get their own versioned Kubernetes + // kind, all built from the shared RoleV6 message. {name: "RoleV6"}, - // Role V7 and V8 is using the RoleV6 message {name: "RoleV6", opts: []resourceSchemaOption{withVersionOverride(types.V7)}}, {name: "RoleV6", opts: []resourceSchemaOption{withVersionOverride(types.V8)}}, + {name: "RoleV6", opts: []resourceSchemaOption{withVersionOverride(types.V9)}}, {name: "AppV3", opts: []resourceSchemaOption{withVersionOverride(types.V3)}}, {name: "DatabaseV3", opts: []resourceSchemaOption{withVersionOverride(types.V3)}}, {name: "SAMLConnectorV2", opts: []resourceSchemaOption{legacyWithoutVersionInKindOverride()}},