Skip to content

docs: document "and" logic for labels #25692

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
stevenGravy merged 7 commits into from
May 5, 2023
Merged

docs: document "and" logic for labels #25692

Changes from 6 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
77fdb05
docs: document and logic for labels
stevenGravy May 5, 2023
256309a
update header
stevenGravy May 5, 2023
bf38403
verbiage update
stevenGravy May 5, 2023
7c0c263
verbiage update
stevenGravy May 5, 2023
5f974d6
fix spelling
stevenGravy May 5, 2023
d65fa01
Merge branch 'master' into stevenGravy/docs/rolelabeling
stevenGravy May 5, 2023
d5720cb
verbiage update
stevenGravy May 5, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 14 additions & 5 deletions docs/pages/access-controls/reference.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -149,10 +149,10 @@ Label | `v3`, `v4` and `v5` Default | `v6` Default
------------------ | -------------- | ---------------
`kubernetes_resources` | `[{"kind":"pod", "name":"*", "namespace":"*"}]` | `[]`

## RBAC for hosts
## RBAC for resources

A Teleport role can also define which hosts (nodes) a user can have access to.
This works by [labeling nodes](../management/admin/labels.mdx) and listing
A Teleport role defines which resources (applications, servers, databases,...) a user can have access to.
Comment thread
stevenGravy marked this conversation as resolved.
Outdated
This works by [labeling resources](../management/admin/labels.mdx) and listing
allow/deny labels in a role definition.

Consider the following use case:
Expand Down Expand Up @@ -186,16 +186,25 @@ spec:
'workload': ['database', 'backup']
```

Multiple label entries are treated as logical "AND" operations.
Comment thread
stevenGravy marked this conversation as resolved.
Outdated
As an example this entry would match to databases that have `env: prod` label and
`region` label `us-west-1` or `eu-central-1`.
Comment thread
stevenGravy marked this conversation as resolved.
Outdated
```yaml
db_labels:
'env': 'prod'
'region': ['us-west-1', 'eu-central-1']
```

<Admonition
type="tip"
title="Dynamic RBAC"
>
Node labels can be dynamic, i.e. determined at runtime by an output of an executable. In this case, you can implement "permissions follow workload"
Resource labels can be dynamic, i.e. determined at runtime by an output of an executable. In this case, you can implement "permissions follow workload"
policies (eg., any server where PostgreSQL is running becomes *automatically*
accessible only by the members of the "DBA" group and nobody else).
</Admonition>

### Extended Node labels syntax
### Extended labels syntax

Below are a few examples for more complex filtering using various regexes.

Expand Down