Skip to content

[v13] Prevent Cloud tenants from being a leaf cluster #35688

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rosstimothy merged 1 commit into from
Dec 13, 2023
Merged

[v13] Prevent Cloud tenants from being a leaf cluster #35688

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions lib/auth/auth_with_roles.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4366,6 +4366,11 @@ func (a *ServerWithRoles) GetTrustedCluster(ctx context.Context, name string) (t

// UpsertTrustedCluster creates or updates a trusted cluster.
func (a *ServerWithRoles) UpsertTrustedCluster(ctx context.Context, tc types.TrustedCluster) (types.TrustedCluster, error) {
// Don't allow a Cloud tenant to be a leaf cluster.
if modules.GetModules().Features().Cloud {
return nil, trace.NotImplemented("cloud tenants cannot be leaf clusters")
}

if err := a.action(apidefaults.Namespace, types.KindTrustedCluster, types.VerbCreate, types.VerbUpdate); err != nil {
return nil, trace.Wrap(err)
}
Expand All @@ -4374,9 +4379,9 @@ func (a *ServerWithRoles) UpsertTrustedCluster(ctx context.Context, tc types.Tru
}

func (a *ServerWithRoles) ValidateTrustedCluster(ctx context.Context, validateRequest *ValidateTrustedClusterRequest) (*ValidateTrustedClusterResponse, error) {
// Don't allow leaf clusters if running in Cloud.
// Don't allow a leaf cluster to be added to a Cloud tenant.
if modules.GetModules().Features().Cloud {
return nil, trace.NotImplemented("cloud clusters do not support trusted cluster resources")
return nil, trace.NotImplemented("leaf clusters cannot be added to cloud tenants")
}

// the token provides it's own authorization and authentication
Expand Down
18 changes: 17 additions & 1 deletion lib/auth/trustedcluster_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -394,7 +394,7 @@ func TestValidateTrustedCluster(t *testing.T) {
)
})

t.Run("trusted clusters prevented on cloud", func(t *testing.T) {
t.Run("Cloud prohibits adding leaf clusters", func(t *testing.T) {
modules.SetTestModules(t, &modules.TestModules{
TestFeatures: modules.Features{Cloud: true},
})
Expand Down Expand Up @@ -624,4 +624,20 @@ func TestUpsertTrustedCluster(t *testing.T) {
_, err = a.UpsertTrustedCluster(ctx, trustedCluster)
require.NoError(t, err)
})
t.Run("Cloud prohibits being a leaf cluster", func(t *testing.T) {
modules.SetTestModules(t, &modules.TestModules{
TestFeatures: modules.Features{Cloud: true},
})

tc, err := types.NewTrustedCluster("test", types.TrustedClusterSpecV2{
RoleMap: []types.RoleMapping{
{Remote: teleport.PresetAccessRoleName, Local: []string{teleport.PresetAccessRoleName}},
},
})
require.NoError(t, err, "creating trusted cluster resource")

server := ServerWithRoles{authServer: a}
_, err = server.UpsertTrustedCluster(ctx, tc)
require.True(t, trace.IsNotImplemented(err), "UpsertTrustedCluster returned an unexpected error, got = %v (%T), want trace.NotImplementedError", err, err)
})
}