Add integration access rule to web user context#24256
Conversation
public-teleport-github-review-bot
Bot
removed request for
marcoandredinis and
strideynet
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
| // Plugins defines whether the user has access to manage hosted plugin instances | ||
| Plugins access `json:"plugins"` | ||
| // Integrations defines whether the user has access to manage integrations. | ||
| Integrations access `json:"integrations"` |
There was a problem hiding this comment.
@marcoandredinis i just realized that the frontend will need to check for both integration.create and integration.use before starting the aws integration b/c at the list rds dbs screen we will need to use the integration?
There was a problem hiding this comment.
Yes 👍
We'll need the use verb in order to call Integration's APIs
There was a problem hiding this comment.
Do we really need a new verb for this?
I'm concerned that we just add random verbs like this that are only used for one particular feature and then never document them, and after doing this for years we have a confusing RBAC system that no one can understand.
For example, I can totally see a support ticket coming in that says "my role has the use verb for desktops but I can't connect to the desktop, why?"
Is there a way to use the existing RBAC system that we have today rather than extend it just for thi feature?
There was a problem hiding this comment.
Well, we considered other options but ended up with the use verb
Do you think one of the following would be better?
- another role option:
integration_labels - re-use another "standard" verb to check when calling a 3rd party API:
integration.create? - change the verb to
executeand hopefully it can become a standard verb from now on to indicate that the role allows execution of some kind in the resource (ssh into a node, kube exec in a pod, ...)
cc @r0mant
There was a problem hiding this comment.
I don't think we have other existing verbs we can reuse here tbh. Other verbs we have are either for CRUD actions, or were also introduced specifically for individual features. For example, we have VerbRotate, VerbCreateEnrolleToken, VerbEnroll: https://github.com/gravitational/teleport/blob/master/api/types/constants.go.
Compared to these, VerbUse is actually less "random" concept IMO, for example Kubernetes uses it (no pun intended) in its RBAC too.
5 participants
in response to #24133
part of #22129
Add the new
integrationsrule to the web ui user context