From 43b10dc8ac4beb4539807543b65ae45f54f7a847 Mon Sep 17 00:00:00 2001 From: Steven Martin Date: Mon, 13 Mar 2023 11:40:51 -0400 Subject: [PATCH 1/6] Add tip on Kubernetes resources --- docs/pages/kubernetes-access/controls.mdx | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/docs/pages/kubernetes-access/controls.mdx b/docs/pages/kubernetes-access/controls.mdx index fe5b2d392c93c..acd80d6350220 100644 --- a/docs/pages/kubernetes-access/controls.mdx +++ b/docs/pages/kubernetes-access/controls.mdx @@ -445,6 +445,13 @@ value begins with `^` and ends in `$`, the Kubernetes Service will treat it as a regular expression using Go's `re2` syntax (see the `re2` [README](https://github.com/google/re2/wiki/Syntax)). + + For a user to have Kubernetes access `kubernetes_groups` or `kubernetes_users` + must also be assigned within a role to a user. `kubernetes_resources` configuration + requires the users or groups within the Kubernetes clusters have access to the pods + and does not grant additional access if the Kubernetes role does not. + + ## How the Kubernetes Service evaluates Teleport roles When a Teleport user makes a request to a Kubernetes cluster's API server, the From 72fee85dcb48de48d6b40952ef162467cdf7f25a Mon Sep 17 00:00:00 2001 From: Steven Martin Date: Mon, 13 Mar 2023 13:45:21 -0400 Subject: [PATCH 2/6] remove space Co-authored-by: Alex Fornuto --- docs/pages/kubernetes-access/controls.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/pages/kubernetes-access/controls.mdx b/docs/pages/kubernetes-access/controls.mdx index acd80d6350220..549b012de3380 100644 --- a/docs/pages/kubernetes-access/controls.mdx +++ b/docs/pages/kubernetes-access/controls.mdx @@ -447,7 +447,7 @@ regular expression using Go's `re2` syntax (see the `re2` For a user to have Kubernetes access `kubernetes_groups` or `kubernetes_users` - must also be assigned within a role to a user. `kubernetes_resources` configuration + must also be assigned within a role to a user. `kubernetes_resources` configuration requires the users or groups within the Kubernetes clusters have access to the pods and does not grant additional access if the Kubernetes role does not. From 89a418a9e90f50dca658ef73f8620faeaf170ca8 Mon Sep 17 00:00:00 2001 From: Steven Martin Date: Mon, 24 Apr 2023 08:43:34 -0400 Subject: [PATCH 3/6] update wording --- docs/pages/kubernetes-access/controls.mdx | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/docs/pages/kubernetes-access/controls.mdx b/docs/pages/kubernetes-access/controls.mdx index 549b012de3380..e818db44ab612 100644 --- a/docs/pages/kubernetes-access/controls.mdx +++ b/docs/pages/kubernetes-access/controls.mdx @@ -447,9 +447,11 @@ regular expression using Go's `re2` syntax (see the `re2` For a user to have Kubernetes access `kubernetes_groups` or `kubernetes_users` - must also be assigned within a role to a user. `kubernetes_resources` configuration - requires the users or groups within the Kubernetes clusters have access to the pods - and does not grant additional access if the Kubernetes role does not. + must also be assigned within a role to a user. The groups or user assigned must + be associated to roles with access to the pods within that Kubernetes + cluster. Teleport does not alter the those roles to allow or deny access. + Teleport confirms access based on the Teleport `pod` role settings at + the Teleport Kubernetes service and then by the Kubernetes cluster RBAC. ## How the Kubernetes Service evaluates Teleport roles From 669a37811be15163be35f1585bdafc835dd06274 Mon Sep 17 00:00:00 2001 From: Steven Martin Date: Mon, 24 Apr 2023 08:47:10 -0400 Subject: [PATCH 4/6] update wording --- docs/pages/kubernetes-access/controls.mdx | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/pages/kubernetes-access/controls.mdx b/docs/pages/kubernetes-access/controls.mdx index e818db44ab612..b92252878b8da 100644 --- a/docs/pages/kubernetes-access/controls.mdx +++ b/docs/pages/kubernetes-access/controls.mdx @@ -446,10 +446,10 @@ regular expression using Go's `re2` syntax (see the `re2` [README](https://github.com/google/re2/wiki/Syntax)). - For a user to have Kubernetes access `kubernetes_groups` or `kubernetes_users` - must also be assigned within a role to a user. The groups or user assigned must - be associated to roles with access to the pods within that Kubernetes - cluster. Teleport does not alter the those roles to allow or deny access. + For a user to have Kubernetes access they must be asssigned a Teleport role that + contains `kubernetes_groups` or `kubernetes_users`. The groups or user assigned + must be associated to roles with access to the pods within that Kubernetes + cluster. Teleport does not alter those roles to allow or deny access. Teleport confirms access based on the Teleport `pod` role settings at the Teleport Kubernetes service and then by the Kubernetes cluster RBAC. From 746af2077c4061bcdd5cc97d87445bdf5d094eef Mon Sep 17 00:00:00 2001 From: Steven Martin Date: Mon, 24 Apr 2023 14:45:01 -0600 Subject: [PATCH 5/6] Update docs/pages/kubernetes-access/controls.mdx Co-authored-by: Alex Fornuto --- docs/pages/kubernetes-access/controls.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/pages/kubernetes-access/controls.mdx b/docs/pages/kubernetes-access/controls.mdx index b92252878b8da..ab395a699fce9 100644 --- a/docs/pages/kubernetes-access/controls.mdx +++ b/docs/pages/kubernetes-access/controls.mdx @@ -451,7 +451,7 @@ regular expression using Go's `re2` syntax (see the `re2` must be associated to roles with access to the pods within that Kubernetes cluster. Teleport does not alter those roles to allow or deny access. Teleport confirms access based on the Teleport `pod` role settings at - the Teleport Kubernetes service and then by the Kubernetes cluster RBAC. + the Teleport Kubernetes service, and then by the Kubernetes cluster RBAC. ## How the Kubernetes Service evaluates Teleport roles From 3ce2a5ab7430b2185e658cd480c60a5290a0fb95 Mon Sep 17 00:00:00 2001 From: Steven Martin Date: Mon, 15 May 2023 09:02:56 -0400 Subject: [PATCH 6/6] update language Co-authored-by: Paul Gottschling --- docs/pages/kubernetes-access/controls.mdx | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/pages/kubernetes-access/controls.mdx b/docs/pages/kubernetes-access/controls.mdx index ab395a699fce9..a47b8133146a4 100644 --- a/docs/pages/kubernetes-access/controls.mdx +++ b/docs/pages/kubernetes-access/controls.mdx @@ -446,12 +446,12 @@ regular expression using Go's `re2` syntax (see the `re2` [README](https://github.com/google/re2/wiki/Syntax)). - For a user to have Kubernetes access they must be asssigned a Teleport role that - contains `kubernetes_groups` or `kubernetes_users`. The groups or user assigned - must be associated to roles with access to the pods within that Kubernetes - cluster. Teleport does not alter those roles to allow or deny access. - Teleport confirms access based on the Teleport `pod` role settings at - the Teleport Kubernetes service, and then by the Kubernetes cluster RBAC. +For a user to access a pod named in a role's `kubernetes_resources` field, the user +must be assigned a Teleport role that contains at least one value within +`kubernetes_groups` or `kubernetes_users`. Teleport does not alter Kubernetes +roles to allow or deny access. Read the next section for an explanation of how the +Kubernetes Service evaluates Teleport roles in order to allow or deny access to +pods in a cluster. ## How the Kubernetes Service evaluates Teleport roles