Skip to content

[v16] Fix TF role preset rule addition logic #51321

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hugoShaka merged 1 commit into from
Jan 22, 2025
Merged

[v16] Fix TF role preset rule addition logic #51321

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
60 changes: 29 additions & 31 deletions lib/services/presets.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -591,34 +591,31 @@ func NewPresetTerraformProviderRole() types.Role {
NodeLabels: map[string]apiutils.Strings{types.Wildcard: []string{types.Wildcard}},
// Every resource currently supported by the Terraform provider.
Rules: []types.Rule{
{
Resources: []string{
types.KindAccessList,
types.KindApp,
types.KindClusterAuthPreference,
types.KindClusterMaintenanceConfig,
types.KindClusterNetworkingConfig,
types.KindDatabase,
types.KindDevice,
types.KindGithub,
types.KindLoginRule,
types.KindNode,
types.KindOIDC,
types.KindOktaImportRule,
types.KindRole,
types.KindSAML,
types.KindSessionRecordingConfig,
types.KindToken,
types.KindTrustedCluster,
types.KindUser,
types.KindBot,
types.KindInstaller,
types.KindAccessMonitoringRule,
types.KindStaticHostUser,
types.KindWorkloadIdentity,
},
Verbs: RW(),
},
// You must add new resources as separate rules for the
// default rule addition logic to work properly.
types.NewRule(types.KindAccessList, RW()),
types.NewRule(types.KindApp, RW()),
types.NewRule(types.KindClusterAuthPreference, RW()),
types.NewRule(types.KindClusterMaintenanceConfig, RW()),
types.NewRule(types.KindClusterNetworkingConfig, RW()),
types.NewRule(types.KindDatabase, RW()),
types.NewRule(types.KindDevice, RW()),
types.NewRule(types.KindGithub, RW()),
types.NewRule(types.KindLoginRule, RW()),
types.NewRule(types.KindNode, RW()),
types.NewRule(types.KindOIDC, RW()),
types.NewRule(types.KindOktaImportRule, RW()),
types.NewRule(types.KindRole, RW()),
types.NewRule(types.KindSAML, RW()),
types.NewRule(types.KindSessionRecordingConfig, RW()),
types.NewRule(types.KindToken, RW()),
types.NewRule(types.KindTrustedCluster, RW()),
types.NewRule(types.KindUser, RW()),
types.NewRule(types.KindBot, RW()),
types.NewRule(types.KindInstaller, RW()),
types.NewRule(types.KindAccessMonitoringRule, RW()),
types.NewRule(types.KindStaticHostUser, RW()),
types.NewRule(types.KindWorkloadIdentity, RW()),
},
},
},
Expand Down Expand Up @@ -649,9 +646,10 @@ func bootstrapRoleMetadataLabels() map[string]map[string]string {
}

var defaultAllowRulesMap = map[string][]types.Rule{
teleport.PresetAuditorRoleName: NewPresetAuditorRole().GetRules(types.Allow),
teleport.PresetEditorRoleName: NewPresetEditorRole().GetRules(types.Allow),
teleport.PresetAccessRoleName: NewPresetAccessRole().GetRules(types.Allow),
teleport.PresetAuditorRoleName: NewPresetAuditorRole().GetRules(types.Allow),
teleport.PresetEditorRoleName: NewPresetEditorRole().GetRules(types.Allow),
teleport.PresetAccessRoleName: NewPresetAccessRole().GetRules(types.Allow),
teleport.PresetTerraformProviderRoleName: NewPresetTerraformProviderRole().GetRules(types.Allow),
}

// defaultAllowRules has the Allow rules that should be set as default when
Expand Down
109 changes: 109 additions & 0 deletions lib/services/presets_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@ import (
"github.com/gravitational/teleport/api/constants"
apidefaults "github.com/gravitational/teleport/api/defaults"
"github.com/gravitational/teleport/api/types"
apiutils "github.com/gravitational/teleport/api/utils"
"github.com/gravitational/teleport/lib/modules"
)

Expand Down Expand Up @@ -558,6 +559,114 @@ func TestAddRoleDefaults(t *testing.T) {
enterprise: true,
expectedErr: noChange,
},
{
// This test is here to validate that we properly fix a bug previously introduced in the TF role preset.
// All the new resources got added into the same rule, but the preset defaults system only supports adding
// new rules, not editing existing ones. The resources got removed from the main rule and put into
// smaller individual rules.
name: "terraform provider (bugfix of the missing resources)",
role: &types.RoleV6{
Kind: types.KindRole,
Version: types.V7,
Metadata: types.Metadata{
Name: teleport.PresetTerraformProviderRoleName,
Namespace: apidefaults.Namespace,
Description: "Default Terraform provider role",
Labels: map[string]string{
types.TeleportInternalResourceType: types.PresetResource,
},
},
Spec: types.RoleSpecV6{
Allow: types.RoleConditions{
AppLabels: map[string]apiutils.Strings{types.Wildcard: []string{types.Wildcard}},
DatabaseLabels: map[string]apiutils.Strings{types.Wildcard: []string{types.Wildcard}},
NodeLabels: map[string]apiutils.Strings{types.Wildcard: []string{types.Wildcard}},
WindowsDesktopLabels: map[string]apiutils.Strings{types.Wildcard: []string{types.Wildcard}},
Rules: []types.Rule{
{
Resources: []string{
types.KindAccessList,
types.KindApp,
types.KindClusterAuthPreference,
types.KindClusterMaintenanceConfig,
types.KindClusterNetworkingConfig,
types.KindDatabase,
types.KindDevice,
types.KindGithub,
types.KindLoginRule,
types.KindNode,
types.KindOIDC,
types.KindOktaImportRule,
types.KindRole,
types.KindSAML,
types.KindSessionRecordingConfig,
types.KindToken,
types.KindTrustedCluster,
types.KindUser,
// Some of the new resources got introduced, but not all
types.KindBot,
types.KindInstaller,
},
Verbs: RW(),
},
},
},
},
},
expectedErr: require.NoError,
expected: &types.RoleV6{
Kind: types.KindRole,
Version: types.V7,
Metadata: types.Metadata{
Name: teleport.PresetTerraformProviderRoleName,
Namespace: apidefaults.Namespace,
Description: "Default Terraform provider role",
Labels: map[string]string{
types.TeleportInternalResourceType: types.PresetResource,
},
},
Spec: types.RoleSpecV6{
Allow: types.RoleConditions{
AppLabels: map[string]apiutils.Strings{types.Wildcard: []string{types.Wildcard}},
DatabaseLabels: map[string]apiutils.Strings{types.Wildcard: []string{types.Wildcard}},
NodeLabels: map[string]apiutils.Strings{types.Wildcard: []string{types.Wildcard}},
WindowsDesktopLabels: map[string]apiutils.Strings{types.Wildcard: []string{types.Wildcard}},
Rules: []types.Rule{
{
Resources: []string{
types.KindAccessList,
types.KindApp,
types.KindClusterAuthPreference,
types.KindClusterMaintenanceConfig,
types.KindClusterNetworkingConfig,
types.KindDatabase,
types.KindDevice,
types.KindGithub,
types.KindLoginRule,
types.KindNode,
types.KindOIDC,
types.KindOktaImportRule,
types.KindRole,
types.KindSAML,
types.KindSessionRecordingConfig,
types.KindToken,
types.KindTrustedCluster,
types.KindUser,
// The resources that already got into the main rule are still present.
types.KindBot,
types.KindInstaller,
},
Verbs: RW(),
},
// The missing resources got added as individual rules
types.NewRule(types.KindAccessMonitoringRule, RW()),
types.NewRule(types.KindStaticHostUser, RW()),
types.NewRule(types.KindWorkloadIdentity, RW()),
},
},
},
},
},
}

for _, test := range tests {
Expand Down