Support additional expected instance roles.#25718
Conversation
For enterprise specific services, there's no way to attach the Okta role to the current instance so that it's known to the inventory. This new config option will allow enterprise services to set this option to ensure that, when querying the inventory, these roles/services will display properly.
r0mant
left a comment
r0mant
left a comment
There was a problem hiding this comment.
Overall code looks good, just have a question about usage.
| // Register additional expected services for this Teleport instance. | ||
| // Meant for enterprise support. | ||
| for _, r := range cfg.AdditionalExpectedRoles { | ||
| process.SetExpectedInstanceRole(r.Role, r.IdentityEvent) | ||
| } |
There was a problem hiding this comment.
Super dumb question but if these are "additional roles", then why is this block right at the front of the function rather than after all "regular expected roles" below? :)
There was a problem hiding this comment.
Truth be told I was taking a cue from AdditionalReadyEvents, but thinking on it it should probably be this way so that the OSS process can overwrite any conflicting instances with the ones it expects. Not that I expect that to be a frequent occurrence.
| func (process *TeleportProcess) registerExpectedServices(cfg *servicecfg.Config) { | ||
| // Register additional expected services for this Teleport instance. | ||
| // Meant for enterprise support. | ||
| for _, r := range cfg.AdditionalExpectedRoles { |
There was a problem hiding this comment.
Also, why do we need to pass this to OSS via AdditionalExpectedRoles, can't enterprise code just use SetExpectedInstanceRole(...) on the process when initializing appropriate service?
There was a problem hiding this comment.
It cannot, unfortunately. Basically the inventory status message is created at the very beginning of NewTeleport, so the enterprise statuses never actually get the roles from SetExpectedInstanceRole.
r0mant
left a comment
r0mant
left a comment
There was a problem hiding this comment.
Overall code looks good, just have a question about usage.
4 participants
For enterprise specific services, there's no way to attach the Okta role to the current instance so that it's known to the inventory. This new config option will allow enterprise services to set this option to ensure that, when querying the inventory, these roles/services will display properly.