Skip to content

[v12] Fix tsh kube credentials when root cluster roles don't allow Kube access #33227

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tigrato merged 1 commit into from
Oct 11, 2023
Merged

[v12] Fix tsh kube credentials when root cluster roles don't allow Kube access #33227

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 20 additions & 2 deletions tool/tsh/kube.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -738,7 +738,18 @@ func (c *kubeCredentialsCommand) run(cf *CLIConf) error {
// via the RBAC rules, but we also need to make sure that the user has
// access to the cluster with at least one kubernetes_user or kubernetes_group
// defined.
if err := checkIfCertsAreAllowedToAccessCluster(k, c.kubeCluster); err != nil {
// This is a safety check in order to print a better message to the user even
// before hitting Teleport Kubernetes Proxy.
// We only enforce this check for root clusters, since we don't have knowledge
// of the RBAC role mappings for remote clusters.
rootClusterName, err := tc.RootClusterName(cf.Context)
if err != nil {
return trace.Wrap(err)
}
if err := checkIfCertsAreAllowedToAccessCluster(k,
rootClusterName,
c.teleportCluster,
c.kubeCluster); err != nil {
return trace.Wrap(err)
}
// Cache the new cert on disk for reuse.
Expand All @@ -762,7 +773,14 @@ func isNetworkError(err error) bool {
// defined. If not, it returns an error.
// This is a safety check in order to print a better message to the user even
// before hitting Teleport Kubernetes Proxy.
func checkIfCertsAreAllowedToAccessCluster(k *client.Key, kubeCluster string) error {
func checkIfCertsAreAllowedToAccessCluster(k *client.Key, rootCluster, teleportCluster, kubeCluster string) error {
// This is a safety check in order to print a better message to the user even
// before hitting Teleport Kubernetes Proxy.
// We only enforce this check for root clusters, since we don't have knowledge
// of the RBAC role mappings for remote clusters.
if rootCluster != teleportCluster {
return nil
}
for k8sCluster, cert := range k.KubeTLSCerts {
if k8sCluster != kubeCluster {
continue
Expand Down