[v13] Add in group labels for role conditions.

api/proto/teleport/legacy/types/types.proto

@@ -2536,6 +2536,13 @@ message RoleConditions {
     (gogoproto.jsontag) = "db_service_labels,omitempty",
     (gogoproto.customtype) = "Labels"
   ];
+
+  // GroupLabels is a map of labels used as part of the RBAC system.
+  wrappers.LabelValues GroupLabels = 27 [
+    (gogoproto.nullable) = false,
+    (gogoproto.jsontag) = "group_labels,omitempty",
+    (gogoproto.customtype) = "Labels"
+  ];
 }
 
 // KubernetesResource is the Kubernetes resource identifier.

api/types/role.go

@@ -217,6 +217,11 @@ type Role interface {
 	GetDatabaseServiceLabels(RoleConditionType) Labels
 	// SetDatabaseLabels sets the map of db service labels this role is allowed or denied access to.
 	SetDatabaseServiceLabels(RoleConditionType, Labels)
+
+	// GetGroupLabels gets the map of group labels this role is allowed or denied access to.
+	GetGroupLabels(RoleConditionType) Labels
+	// SetGroupLabels sets the map of group labels this role is allowed or denied access to.
+	SetGroupLabels(RoleConditionType, Labels)
 }
 
 // NewRole constructs new standard V6 role.
@@ -770,6 +775,23 @@ func (r *RoleV6) setStaticFields() {
 	}
 }
 
+// GetGroupLabels gets the map of group labels this role is allowed or denied access to.
+func (r *RoleV6) GetGroupLabels(rct RoleConditionType) Labels {
+	if rct == Allow {
+		return r.Spec.Allow.GroupLabels
+	}
+	return r.Spec.Deny.GroupLabels
+}
+
+// SetGroupLabels sets the map of group labels this role is allowed or denied access to.
+func (r *RoleV6) SetGroupLabels(rct RoleConditionType, labels Labels) {
+	if rct == Allow {
+		r.Spec.Allow.GroupLabels = labels.Clone()
+	} else {
+		r.Spec.Deny.GroupLabels = labels.Clone()
+	}
+}
+
 // CheckAndSetDefaults checks validity of all parameters and sets defaults
 func (r *RoleV6) CheckAndSetDefaults() error {
 	r.setStaticFields()