Add a new `role.allow.request` field called `kubernetes_resources` by kimlisa · Pull Request #47173 · gravitational/teleport

kimlisa · 2024-10-03T22:42:49Z

Defines a new role.allow.request field called kubernetes_resources.

For now it holds a field kubernetes_resources that follows same format as existing allow.kubernetes_resources, except the only field we support in the options field is Kind (defining other fields will reject the role upserting actions).

The Kind allows admins to define what kube subresources a user can request during request creation and disallow requesting request for kube_cluster. It allows the wildcard to mean allow request to any kube subresources.

If role.allow.request.kubernetes_resources is not defined, or length 0, it means a user can request for kube_cluster or any of its subresources.

example, if requester role says:

kind: role
metadata:
  name: requester
spec:
  allow:
    request:
      search_as_roles:
      - kube-access
  options:
    request_mode:
      kubernetes_resources:
      - kind: namespace

requesting kind kube_cluster is denied:

tsh request create --resource /kimlisa22.cloud.gravitational.io/kube_cluster/coffee-kube-cluster 

Creating request...
ERROR: your Teleport role's "request.kubernetes_resources" field did not allow requesting to some or all of the requested Kubernetes resources. allowed kinds for each requestable roles: access-kube-pumpkin: [pod], access: [pod], access-kube-coffee: [namespace]
Try searching for specific kinds with:
> tsh request search --kube-cluster=KUBE_CLUSTER_NAME --kind=KIND

requesting kind pod is denied:

tsh request create --resource /kimlisa22.cloud.gravitational.io/pod/coffee-kube-cluster/kube-system/coredns-7db6d8ff4d-mhjlv

Creating request...
ERROR: your Teleport role's "request.kubernetes_resources" field did not allow requesting to some or all of the requested Kubernetes resources. allowed kinds for each requestable roles: access-kube-coffee: [namespace]
Try searching for specific kinds with:
> tsh request search --kube-cluster=KUBE_CLUSTER_NAME --kind=KIND

requesting kind namespace is allowed:

Creating request...
Request ID:     0192bc03-0421-765b-9f5d-db01d9f7f647                                                    
Username:       lisa+1@goteleport.com                                                                   
Roles:          access-kube-coffee                                                                      
Resources:      ["/kimlisa22.cloud.gravitational.io/namespace/coffee-kube-cluster/coffee-kube-cluster"] 
Reason:         [none]                                                                                  
Reviewers:      [none] (suggested)                                                                      
Access Expires: 2024-10-24 01:51:54                                                                     
Status:         PENDING                                                                                 

hint: use 'tsh login --request-id=<request-id>' to login with an approved request

Waiting for request approval...

wildcard example output:

tsh request create --resource /kimlisa22.cloud.gravitational.io/kube_cluster/coffee-kube-cluster 

Creating request...
ERROR: your Teleport role's "request.kubernetes_resources" field did not allow requesting to some or all of the requested Kubernetes resources. allowed kinds for each requestable roles: access-kube-coffee: [pod secret configmap namespace service serviceaccount kube_node persistentvolume persistentvolumeclaim deployment replicaset statefulset daemonset clusterrole kube_role clusterrolebinding rolebinding cronjob job certificatesigningrequest ingress]
Try searching for specific kinds with:
> tsh request search --kube-cluster=KUBE_CLUSTER_NAME --kind=KIND

changelog: Define a new role.allow.request field called kubernetes_resources that allows admins to define what kinds of Kubernetes resources a requester can make.

github-actions · 2024-10-03T22:43:34Z

The PR changelog entry failed validation: Changelog entry not found in the PR body. Please add a "no-changelog" label to the PR, or changelog lines starting with changelog: followed by the changelog entries for the PR.

tigrato · 2024-10-04T08:56:30Z

 }

+message AccessRequestMode {
+  repeated KubernetesResource KubernetesResources = 1 [


Can we use a dedicated type for this setting?
Reusing the KubernetesResource gives confusion because you can set a lot of data that isn't allowed

kimlisa · 2024-10-08T15:54:13Z

friendly ping @tigrato @nklaassen

tigrato

Can you please add unmarshal from/to yaml of roles with this section defined?

kimlisa · 2024-10-16T07:47:21Z

i made a few adjustments based on review:

the request mode found on the same role as the search as roles will be enforced:

querying for kube resources with search as roles will prune roles that doesn't match request mode with request type
when creating request, request modes will be enforced during:
- pruning search as roles with only root resource request
- pruning search as roles with leaf and root resources (pruning doesn't happen, but we will still enforce request mode without any special matchers)
- requesting custom roles, users can manually change/request roles so this will skip pruning check altogether, but we will still enforce request mode checking without any special matchers

tigrato

In addition to these changes, you’ll also need to update the following code:

teleport/lib/kube/grpc/grpc.go

Lines 161 to 163 in 64922df

    
           if req.UseSearchAsRoles { 
        
           	extraRoles = append(extraRoles, userContext.Checker.GetAllowedSearchAsRoles()...) 
        
           }

These changes are necessary to prevent users who are blocked from requesting access to specific types from being able to verify the existence of those assets in k8s.

GetSearchAsRoles must return the search as roles allowed to be used for the particular kubernetes subresource and deny if none match.

It's not a blocker but it must be released before v17

tigrato · 2024-10-30T09:57:40Z

+		allowedKinds, deniedKinds := getKubeResourceKinds(m.kubernetesResource.allow[requestedRoleName]), getKubeResourceKinds(m.kubernetesResource.deny)
+
+		// Any resource is allowed.
+		if allowedKinds == nil && deniedKinds == nil {


should we check for len(xxx)==0?

sure i guess checking len is slightly safer b/c i'm thinking you're concerned this can happen

var array []string, by itself is nil
array := []string{} is not?

Yeah. If someone changes the approach from using a non-initialized array to an initialized array, the code won't catch it.

tigrato · 2024-10-30T09:58:08Z

+		}
+
+		// All supported kube kinds are allowed when there was nothing configured.
+		if allowedKinds == nil {


same as above

tigrato · 2024-10-30T10:04:35Z

 	// the access request can be reviewed. Defaults to 1 week.
 	requestTTL = 7 * day
+
+	InvalidKubernetesKindAccessRequest = `your Teleport role's "request.kubernetes_resources" field`


github-actions · 2024-11-01T00:03:01Z

🤖 Vercel preview here: https://docs-6onolp5ve-goteleport.vercel.app/docs/ver/preview

github-actions · 2024-11-01T00:18:09Z

🤖 Vercel preview here: https://docs-dnfaf44ij-goteleport.vercel.app/docs/ver/preview

public-teleport-github-review-bot · 2024-11-01T00:47:48Z

@kimlisa - this PR will require admin approval to merge due to its size. Consider breaking it up into a series smaller changes.

github-actions · 2024-11-01T00:57:43Z

🤖 Vercel preview here: https://docs-5jy8ahdem-goteleport.vercel.app/docs/ver/preview

public-teleport-github-review-bot · 2024-11-01T04:06:31Z

@kimlisa See the table below for backport results.

Branch	Result
branch/v16	Failed
branch/v17	Failed

…47173) * Add a new role.allow.request field called kubernetes_resources * Fix lint: update terraform docs

github-actions Bot added the size/md label Oct 3, 2024

github-actions Bot requested review from fheinecke and nklaassen October 3, 2024 22:43

kimlisa requested a review from tigrato October 3, 2024 22:43

kimlisa changed the title ~~Lisa/add request mode role option~~ Add a new role.options field called request_mode.kubernetes_resources Oct 3, 2024

tigrato reviewed Oct 4, 2024

View reviewed changes

kimlisa force-pushed the lisa/add-request-mode-role-option branch 3 times, most recently from ae41067 to b03a2f3 Compare October 4, 2024 21:58

kimlisa requested a review from tigrato October 4, 2024 21:59

kimlisa force-pushed the lisa/add-request-mode-role-option branch 2 times, most recently from 945322f to 70ecfbb Compare October 7, 2024 03:18

This was referenced Oct 8, 2024

Web: implement requesting for kube namespace selector #47345

Merged

Teleterm: add support for access requesting kube namespaces #47347

Merged

kimlisa force-pushed the lisa/add-request-mode-role-option branch from 70ecfbb to 352dbb1 Compare October 9, 2024 04:12

kimlisa added the backport/branch/v16 label Oct 9, 2024

kimlisa force-pushed the lisa/add-request-mode-role-option branch from 352dbb1 to ec9b6a8 Compare October 9, 2024 06:15

tigrato reviewed Oct 9, 2024

View reviewed changes

Comment thread api/proto/teleport/legacy/types/types.proto Outdated

Comment thread api/proto/teleport/legacy/types/types.proto Outdated

Comment thread api/proto/teleport/legacy/types/types.proto Outdated

Comment thread lib/services/access_request.go Outdated

kimlisa force-pushed the lisa/add-request-mode-role-option branch 2 times, most recently from 4892231 to f987020 Compare October 16, 2024 07:26

kimlisa force-pushed the lisa/add-request-mode-role-option branch from f987020 to 7988cc6 Compare October 16, 2024 07:52

kimlisa requested a review from tigrato October 16, 2024 07:55

kimlisa force-pushed the lisa/add-request-mode-role-option branch 2 times, most recently from 449ca3d to 415537c Compare October 16, 2024 21:47

kimlisa marked this pull request as draft October 17, 2024 06:04

kimlisa force-pushed the lisa/add-request-mode-role-option branch from 415537c to 7f0453e Compare October 17, 2024 08:30

kimlisa marked this pull request as ready for review October 17, 2024 08:31

tigrato approved these changes Oct 30, 2024

View reviewed changes

public-teleport-github-review-bot Bot removed the request for review from fheinecke October 30, 2024 10:19

kimlisa force-pushed the lisa/add-request-mode-role-option branch 2 times, most recently from b243c2f to b98a970 Compare October 31, 2024 08:14

kimlisa mentioned this pull request Oct 31, 2024

Apply request.kubernetes_resources allow/deny settings when querying for kube resources #48196

Merged

kimlisa force-pushed the lisa/add-request-mode-role-option branch from b98a970 to 51998b5 Compare October 31, 2024 15:50

kimlisa added the backport/branch/v17 label Oct 31, 2024

kimlisa enabled auto-merge October 31, 2024 23:47

kimlisa force-pushed the lisa/add-request-mode-role-option branch from 51998b5 to d69b2f5 Compare October 31, 2024 23:52

kimlisa temporarily deployed to vercel October 31, 2024 23:52 — with GitHub Actions Inactive

Add a new role.allow.request field called kubernetes_resources

f8dc68e

kimlisa force-pushed the lisa/add-request-mode-role-option branch from d69b2f5 to f8dc68e Compare November 1, 2024 00:07

kimlisa temporarily deployed to vercel November 1, 2024 00:07 — with GitHub Actions Inactive

Fix lint: update terraform docs

012ed63

kimlisa temporarily deployed to vercel November 1, 2024 00:47 — with GitHub Actions Inactive

r0mant approved these changes Nov 1, 2024

View reviewed changes

kimlisa added this pull request to the merge queue Nov 1, 2024

github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Nov 1, 2024

kimlisa added this pull request to the merge queue Nov 1, 2024

Merged via the queue into master with commit a132be0 Nov 1, 2024

kimlisa deleted the lisa/add-request-mode-role-option branch November 1, 2024 04:05

kimlisa added a commit that referenced this pull request Nov 1, 2024

Add a new role.allow.request field called kubernetes_resources (#…

cfa6146

…47173) * Add a new role.allow.request field called kubernetes_resources * Fix lint: update terraform docs

This was referenced Nov 1, 2024

[v17] Add a new role.allow.request field called kubernetes_resources #48258

Merged

[v16] Add a new role.allow.request field called kubernetes_resources #48387

Merged

	if req.UseSearchAsRoles {
	extraRoles = append(extraRoles, userContext.Checker.GetAllowedSearchAsRoles()...)
	}

Conversation

kimlisa commented Oct 3, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 3, 2024

Uh oh!

tigrato Oct 4, 2024

Choose a reason for hiding this comment

Uh oh!

kimlisa commented Oct 8, 2024

Uh oh!

tigrato left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kimlisa commented Oct 16, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tigrato left a comment

Choose a reason for hiding this comment

Uh oh!

tigrato Oct 30, 2024

Choose a reason for hiding this comment

Uh oh!

kimlisa Oct 30, 2024

Choose a reason for hiding this comment

Uh oh!

tigrato Oct 30, 2024

Choose a reason for hiding this comment

Uh oh!

tigrato Oct 30, 2024

Choose a reason for hiding this comment

Uh oh!

tigrato Oct 30, 2024

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Nov 1, 2024

Uh oh!

github-actions Bot commented Nov 1, 2024

Uh oh!

public-teleport-github-review-bot Bot commented Nov 1, 2024

Uh oh!

github-actions Bot commented Nov 1, 2024

Uh oh!

Uh oh!

public-teleport-github-review-bot Bot commented Nov 1, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

kimlisa commented Oct 3, 2024 •

edited

Loading

kimlisa commented Oct 16, 2024 •

edited

Loading