[v17] Operator support for Bot resource (#53453)

docs/pages/reference/operator-resources/resources-teleport-dev-botsv1.mdx

@@ -0,0 +1,38 @@
+---
+title: TeleportBotV1
+description: Provides a comprehensive list of fields in the TeleportBotV1 resource available through the Teleport Kubernetes operator
+tocDepth: 3
+---
+
+{/*Auto-generated file. Do not edit.*/}
+{/*To regenerate, navigate to integrations/operator and run "make crd-docs".*/}
+
+This guide is a comprehensive reference to the fields in the `TeleportBotV1`
+resource, which you can apply after installing the Teleport Kubernetes operator.
+
+
+## resources.teleport.dev/v1
+
+**apiVersion:** resources.teleport.dev/v1
+
+|Field|Type|Description|
+|---|---|---|
+|apiVersion|string|APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources|
+|kind|string|Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds|
+|metadata|object||
+|spec|[object](#spec)|Bot resource definition v1 from Teleport|
+
+### spec
+
+|Field|Type|Description|
+|---|---|---|
+|roles|[]string|The roles that the bot should be able to impersonate.|
+|traits|[][object](#spectraits-items)|The traits that will be associated with the bot for the purposes of role templating.  Where multiple specified with the same name, these will be merged by the server.|
+
+### spec.traits items
+
+|Field|Type|Description|
+|---|---|---|
+|name|string|The name of the trait. This is what allows the trait to be queried in role templates.|
+|values|[]string|The values associated with the named trait.|
+

examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_botsv1.yaml

@@ -0,0 +1,139 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  creationTimestamp: null
+  name: teleportbotsv1.resources.teleport.dev
+spec:
+  group: resources.teleport.dev
+  names:
+    kind: TeleportBotV1
+    listKind: TeleportBotV1List
+    plural: teleportbotsv1
+    shortNames:
+    - botv1
+    - botsv1
+    singular: teleportbotv1
+  scope: Namespaced
+  versions:
+  - name: v1
+    schema:
+      openAPIV3Schema:
+        description: BotV1 is the Schema for the botsv1 API
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: Bot resource definition v1 from Teleport
+            properties:
+              roles:
+                description: The roles that the bot should be able to impersonate.
+                items:
+                  type: string
+                nullable: true
+                type: array
+              traits:
+                description: The traits that will be associated with the bot for the
+                  purposes of role templating.  Where multiple specified with the
+                  same name, these will be merged by the server.
+                items:
+                  properties:
+                    name:
+                      description: The name of the trait. This is what allows the
+                        trait to be queried in role templates.
+                      type: string
+                    values:
+                      description: The values associated with the named trait.
+                      items:
+                        type: string
+                      nullable: true
+                      type: array
+                  type: object
+                nullable: true
+                type: array
+            type: object
+          status:
+            description: Status defines the observed state of the Teleport resource
+            properties:
+              conditions:
+                description: Conditions represent the latest available observations
+                  of an object's state
+                items:
+                  description: Condition contains details for one aspect of the current
+                    state of this API Resource.
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        lastTransitionTime is the last time the condition transitioned from one status to another.
+                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        message is a human readable message indicating details about the transition.
+                        This may be an empty string.
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      description: |-
+                        observedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      description: |-
+                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                        Producers of specific condition types may define expected values and meanings for this field,
+                        and whether the values are considered a guaranteed API.
+                        The value should be a CamelCase string.
+                        This field may not be empty.
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+              teleportResourceID:
+                format: int64
+                type: integer
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: null
+  storedVersions: null

examples/chart/teleport-cluster/charts/teleport-operator/templates/role.yaml

@@ -38,6 +38,8 @@ rules:
       - teleportopenssheiceserversv2/status
       - teleporttrustedclustersv2
       - teleporttrustedclustersv2/status
+      - teleportbotsv1
+      - teleportbotsv1/status
     verbs:
       - get
       - list

examples/chart/teleport-cluster/templates/auth/config.yaml

@@ -139,6 +139,14 @@ data:
               - read
               - update
               - delete
+          - resources:
+              - bot
+            verbs:
+              - list
+              - create
+              - read
+              - update
+              - delete
       deny: {}
     version: v7
     ---

integrations/operator/CONTRIBUTING.md

@@ -60,12 +60,9 @@ your resource version is added to the root `scheme` with a call like
 
 #### Add RBAC permissions for the new resource type
 
-Add Kubernetes RBAC permissions to allow the operator to work with the resources
-on the Kubernetes side.
-The cluster role spec is found in  `../../examples/chart/teleport-cluster/templates/auth/config.yaml`.
-
-Update the RBAC permissions in `hack/fixture-operator-role.yaml` to update
-operator the role used for debugging.
+- Grant the operator access to the Kubernetes resource in: `../../examples/chart/teleport-cluster/charts/templates/role.yaml`.
+- Grant the operator access to the Teleport resource in: `../../examples/chart/teleport-cluster/templates/auth/config.yaml`.
+- Update the RBAC permissions in `hack/fixture-operator-role.yaml` to update operator the role used for debugging.
 
 ### Debugging tips
 

integrations/operator/Makefile

@@ -82,7 +82,8 @@ crdgen: ## Generate CRDs
 PROTOS = \
 	teleport/loginrule/v1/loginrule.proto \
 	teleport/accesslist/v1/accesslist.proto \
-	teleport/legacy/types/types.proto
+	teleport/legacy/types/types.proto \
+	teleport/machineid/v1/bot.proto
 
 .PHONY: manifests
 manifests: crdgen controller-gen ## Generate WebhookConfiguration, ClusterRole and CustomResourceDefinition objects.

integrations/operator/README.md

@@ -24,6 +24,7 @@ The operator supports reconciling the following Kubernetes CRs:
 - TeleportOpenSSHEICEServerV2
 - TeleportOpenSSHServerV2
 - TeleportTrustedClusterV2
+- TeleportBotV1
 - TeleportSAMLConnector [1]
 - TeleportOIDCConnector [1]
 - TeleportLoginRule [1]

integrations/operator/apis/resources/v1/botv1_types.go

@@ -0,0 +1,104 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package v1
+
+import (
+	"google.golang.org/protobuf/encoding/protojson"
+	"google.golang.org/protobuf/proto"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	machineidv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/teleport/integrations/operator/apis/resources"
+)
+
+func init() {
+	SchemeBuilder.Register(&TeleportBotV1{}, &TeleportBotV1List{})
+}
+
+//+kubebuilder:object:root=true
+//+kubebuilder:subresource:status
+
+// TeleportBotV1 holds the kubernetes custom resources for Bot
+type TeleportBotV1 struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   *TeleportBotV1Spec `json:"spec,omitempty"`
+	Status resources.Status   `json:"status,omitempty"`
+}
+
+// TeleportBotV1Spec defines the desired state of TeleportBotV1
+type TeleportBotV1Spec machineidv1.BotSpec
+
+//+kubebuilder:object:root=true
+
+// TeleportBotV1List contains a list of TeleportBotV1
+type TeleportBotV1List struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []TeleportBotV1 `json:"items"`
+}
+
+// ToTeleport returns a Bot, which wraps the actual
+// [machineidv1.Bot] and implements the necessary interface methods used
+// by the TeleportResourceReconciler.
+func (l *TeleportBotV1) ToTeleport() *machineidv1.Bot {
+	resource := &machineidv1.Bot{
+		Kind:    types.KindBot,
+		Version: types.V1,
+		Metadata: &headerv1.Metadata{
+			Name:        l.Name,
+			Description: l.Annotations[resources.DescriptionKey],
+			Labels:      l.Labels,
+		},
+		Spec: (*machineidv1.BotSpec)(l.Spec),
+	}
+	return resource
+}
+
+// StatusConditions returns a pointer to Status.Conditions slice. This is used
+// by the teleport resource controller to report conditions back to on resource.
+func (l *TeleportBotV1) StatusConditions() *[]metav1.Condition {
+	return &l.Status.Conditions
+}
+
+// UnmarshalJSON delegates unmarshaling of the BotSpec to protojson, which is
+// necessary for the BotSpec (and other Proto RFD153 resources) to be
+// unmarshaled correctly from the unstructured object.
+func (spec *TeleportBotV1Spec) UnmarshalJSON(data []byte) error {
+	return protojson.UnmarshalOptions{
+		DiscardUnknown: true,
+	}.Unmarshal(data, (*machineidv1.BotSpec)(spec))
+}
+
+// MarshalJSON delegates marshaling of the BotSpec to protojson, which is
+// necessary for the BotSpec (and other Proto RFD153 resources) to be
+// marshaled correctly into the unstructured object.
+func (spec *TeleportBotV1Spec) MarshalJSON() ([]byte, error) {
+	return protojson.Marshal((*machineidv1.BotSpec)(spec))
+}
+
+// DeepCopyInto deep-copies one user spec into another.
+// Required to satisfy runtime.Object interface.
+func (spec *TeleportBotV1Spec) DeepCopyInto(out *TeleportBotV1Spec) {
+	proto.Reset((*machineidv1.BotSpec)(out))
+	proto.Merge((*machineidv1.BotSpec)(out), (*machineidv1.BotSpec)(spec))
+}

integrations/operator/apis/resources/v1/botv1_types_test.go

@@ -0,0 +1,34 @@
+/*
+ * Teleport
+ * Copyright (C) 2025  Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+package v1
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestTeleportBotV1Spec_DeepCopyInto(t *testing.T) {
+	in := &TeleportBotV1Spec{
+		Roles: []string{"roleA", "roleB"},
+	}
+	out := &TeleportBotV1Spec{}
+	in.DeepCopyInto(out)
+	require.Equal(t, in, out)
+}