Support resource label filtering in role where clauses for lock and workload_identity resources

[andrew-h-teleport]

What would you like Teleport to do?
Allow teleport roles to restrict actions (read, list, create, update, delete) on lock and workload_identity resources using metadata label conditions in a role's where clause. For example:
where: equals(resource.metadata.labels["key"], "value")

(I suspect this limitation applies to other resource types too.)

What problem does this solve?
Allows admins to apply more granular access to resources.

If a workaround exists, please include it.
No real workaround beyond being selective and using the where clause where it is supported. Grant un-scoped access for lock and workload_identity resources while applying resource-label filtering to supported resources like user and bot:

kind: role
version: v7
metadata:
  name: example
spec:
  allow:
    rules:
      # Resource-label filtering works for user and bot
      - resources: [user, bot]
        verbs: [read, list, create, update, delete]
        where: equals(resource.metadata.labels["key"], "value")
      # Unscoped permissions currently required for lock and workload identity
      - resources: [workload_identity, lock]
        verbs: [read, list, create, update, delete]

[strideynet]

Do you understand a little more about the customer's use-case here? Is this about allowing them to define administrators for a sub-set of their resources? If so, it's likely this will be better answered by scopes down the line.