Conversation
atburke
added
no-changelog
| @@ -0,0 +1,44 @@ | |||
| syntax = "proto3"; | |||
|
|
|||
| package teleport.statichostuser.v1; | |||
There was a problem hiding this comment.
What do you think about generalizing the package a bit to encompass all of auto user provisioning?
| package teleport.statichostuser.v1; | |
| package teleport.userprovisioning.v1; |
| rpc CreateStaticHostUser(CreateStaticHostUserRequest) returns (CreateStaticHostUserResponse); | ||
| // UpdateStaticHostUser updates an existing static host user. | ||
| rpc UpdateStaticHostUser(UpdateStaticHostUserRequest) returns (UpdateStaticHostUserResponse); | ||
| // UpsertStaticHostUser creates a new static host user or forcefully updates an existing static host user. | ||
| rpc UpsertStaticHostUser(UpsertStaticHostUserRequest) returns (UpsertStaticHostUserResponse); |
There was a problem hiding this comment.
https://github.com/gravitational/teleport/blob/master/rfd/0153-resource-guidelines.md#create
https://github.com/gravitational/teleport/blob/master/rfd/0153-resource-guidelines.md#update
https://github.com/gravitational/teleport/blob/master/rfd/0153-resource-guidelines.md#upsert
| rpc CreateStaticHostUser(CreateStaticHostUserRequest) returns (CreateStaticHostUserResponse); | |
| // UpdateStaticHostUser updates an existing static host user. | |
| rpc UpdateStaticHostUser(UpdateStaticHostUserRequest) returns (UpdateStaticHostUserResponse); | |
| // UpsertStaticHostUser creates a new static host user or forcefully updates an existing static host user. | |
| rpc UpsertStaticHostUser(UpsertStaticHostUserRequest) returns (UpsertStaticHostUserResponse); | |
| rpc CreateStaticHostUser(CreateStaticHostUserRequest) returns (StaticHostUser); | |
| // UpdateStaticHostUser updates an existing static host user. | |
| rpc UpdateStaticHostUser(UpdateStaticHostUserRequest) returns (StaticHostUser); | |
| // UpsertStaticHostUser creates a new static host user or forcefully updates an existing static host user. | |
| rpc UpsertStaticHostUser(UpsertStaticHostUserRequest) returns (StaticHostUser); |
| if u.Spec.NodeLabels != nil { | ||
| for key, value := range u.Spec.NodeLabels.Values { | ||
| if key == types.Wildcard && !(len(value.Values) == 1 && value.Values[0] == types.Wildcard) { | ||
| return trace.BadParameter("selector *:<val> is not supported") | ||
| } | ||
| } | ||
| } |
There was a problem hiding this comment.
This validation appears to be much more lax than the validation of equivalent fields of a role.
https://github.com/gravitational/teleport/blob/master/lib/services/role.go#L251
https://github.com/gravitational/teleport/blob/master/lib/services/role.go#L334-L348
There was a problem hiding this comment.
Trait templating doesn't apply here because when we create a host user, there won't be a user to pull traits from. I tried adding the expression validation, but it would require moving a LOT of stuff from lib/utils to api/utils and I think it would be much simpler to just do that in lib/services like we do for roles.
There was a problem hiding this comment.
I think it might make more sense for validation logic to be moved out of api and into a place that can make use of lib/utils in that case. If you want to omit it here and move it to lib/services or similar in a future PR that's fine with me.
| // node_labels is a map of node labels (used to dynamically grant access to | ||
| // nodes). |
There was a problem hiding this comment.
Here and below, update the comment since the labels here are used to select nodes, not to grant access to nodes.
| // node_labels is a map of node labels (used to dynamically grant access to | |
| // nodes). | |
| // node_labels is a map of node labels that will create a user | |
| // for this resource |
public-teleport-github-review-bot
Bot
removed the request for review
from rudream
This change adds the proto definition for the static host user resource and its gRPC service.
atburke
force-pushed
the
atburke/static-user-proto
branch
from
fa529da to
a134b2d
Compare
This change adds the proto definition for the static host user resource and its gRPC service.
4 participants
This change adds the proto definition for the static host user resource (RFD 175) and its gRPC service.
Part of #42712.