gravitational/teleport
1
0
Fork 0
mirror of https://github.com/gravitational/teleport.git synced 2026-10-12 02:15:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

Clarify requirement that spec.assigned_scope be equiv or descendent to scope for ScopedToken (#64211)

Browse Source 
* Clarify equiv||descendent nature of `spec.assigned_scope` in RFD

* Update proto

* spag: remove "a"
This commit is contained in:
Noah Stride
2026-03-03 18:13:10 +00:00
committed by GitHub
parent aa041c38a7
commit 4957fd0f2f
3 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/gen/proto/go/teleport/scopes/joining/v1/token.pb.go
+2
View File
@@ -144,6 +144,8 @@ func (x *ScopedToken) GetStatus() *ScopedTokenStatus {
type ScopedTokenSpec struct {
state protoimpl.MessageState `protogen:"open.v1"`
// The scope to which this token is assigned.
//
// Must be equivalent or descendent to the scope of the token itself.
AssignedScope string `protobuf:"bytes,1,opt,name=assigned_scope,json=assignedScope,proto3" json:"assigned_scope,omitempty"`
// The list of roles associated with the token. They will be converted
// to metadata in the SSH and X509 certificates issued to the user of the
api/proto/teleport/scopes/joining/v1/token.proto
+2
View File
@@ -51,6 +51,8 @@ message ScopedToken {
// ScopedTokenSpec is the specification of a scoped token.
message ScopedTokenSpec {
// The scope to which this token is assigned.
//
// Must be equivalent or descendent to the scope of the token itself.
string assigned_scope = 1;
// The list of roles associated with the token. They will be converted
rfd/0229a-scoped-join-tokens.md
+6
View File
@@ -86,6 +86,8 @@ to facilitate existing provisioning semantics.
message ScopedTokenSpec {
- // AssignedScope is the scope to which this token is assigned.
+ // The scope to which this token is assigned.
+ //
* // Must be equivalent or descendent to the scope of the token itself.
string assigned_scope = 1;
- // TODO(fspmarshall): port relevant token features to scoped tokens.
@@ -167,6 +169,10 @@ keypair join method manages the registration secret. The `token` join method
will require specifying both the token's name and secret when using scoped
tokens.
The `spec.assigned_scope` field specifies the scope that will be assigned to any
resource provisioned using this token. This must be specified and must be
equivalent or descendent to the `scope` of the token resource itself.
### Provisioning
Scoped resources will be provisioned by extending the existing `Join` RPC to