Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Apply trait in leafs as in root #6389

Closed
stevenGravy opened this issue Apr 9, 2021 · 0 comments · Fixed by #6540
Closed

Apply trait in leafs as in root #6389

stevenGravy opened this issue Apr 9, 2021 · 0 comments · Fixed by #6540
Assignees
Labels
c-te Internal Customer Reference feature-request Used for new features in Teleport, improvements to current should be #enhancements rbac Issues related to Role Based Access Control trusted-cluster
Milestone

Comments

@stevenGravy
Copy link
Contributor

stevenGravy commented Apr 9, 2021

Description

What happened:

Within a root cluster you can specify traits within a node_label. This may not be intended functionality but it is currently available. If you attempt to use that same trait setting within a leaf cluster it will not apply.

kind: role
metadata:
  # insert the name of your role here:
  name: new_role_name
spec:
  # This example defines an administrative role. It maps to Kubernetes "admin"
  # group and allows SSH to every node.
  allow:
    # This role is mapped to Kuberntes 'admin' group.
    kubernetes_groups: [admin]

    # List of allowed SSH logins
    logins: [root]

    # List of node labels that users can SSH into
    node_labels:
      tier: '{{external.env}}'


  # The 'deny' section can have similar settings that override their 'allow' counterparts
  deny:
    logins: ['guest']

  options:
      # Limits user credentials to 8 hours. After the time to live (TTL) expires,
      # users must re-login
      max_session_ttl: 8h0m0s
  # The deny section uses the identical format as the 'allow' section.
  # The deny rules always override allow rules.
  deny: {}
version: v3

What you expected to happen:

Traits are applied in leafs or there is an option to include existing labels.

Reproduction Steps

As minimally and precisely as possible, describe step-by-step how to reproduce the problem.

  1. Create the same role at the root and leaf cluster
    2.map the root role to the leaf
  2. attempt to access similar labeled nodes. it will work at the root but not the leaf

Server Details

  • Teleport version (run teleport version): 6.0.2
  • Server OS (e.g. from /etc/os-release): ubuntu 20.04
  • Where are you running Teleport? (e.g. AWS, GCP, Dedicated Hardware): AWS
  • Additional details:
@stevenGravy stevenGravy added bug rbac Issues related to Role Based Access Control trusted-cluster feature-request Used for new features in Teleport, improvements to current should be #enhancements and removed bug labels Apr 9, 2021
@stevenGravy stevenGravy changed the title Trait applied in root not applied in leafs Apply trait in leafs as in root Apr 14, 2021
@russjones russjones added this to the 6.2 "Buffalo" milestone Apr 15, 2021
@r0mant r0mant added the c-te Internal Customer Reference label Apr 21, 2021
# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
c-te Internal Customer Reference feature-request Used for new features in Teleport, improvements to current should be #enhancements rbac Issues related to Role Based Access Control trusted-cluster
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants