Add a new `role.options` field called `request_mode.kubernetes_resources` #47173

kimlisa · 2024-10-03T22:42:49Z

Defines a new role.options field called request_mode.

For now it holds a field kubernetes_resources that follows same format as existing allow.kubernetes_resources, except the only field we support in the options field is Kind (defining other fields will reject the role upserting actions).

The Kind allows admins to define what kube subresources a user can request during request creation and disallow requesting request for kube_cluster. It allows the wildcard to mean allow request to any kube subresources.

If role.options.request_mode is not defined, or length 0, it means a user can request for kube_cluster or any of its subresources.

example, if requester role says:

kind: role
metadata:
  name: requester
spec:
  allow:
    request:
      search_as_roles:
      - kube-access
  options:
    request_mode:
      kubernetes_resources:
      - kind: namespace

requesting kind kube_cluster is denied:

tsh request create --resource /kimlisa22.cloud.gravitational.io/kube_cluster/coffee-kube-cluster 
Creating request...
ERROR: Not allowed to request Kubernetes resource kind "kube_cluster". Allowed kinds: [namespace].
Try searching for specific kinds with:
> tsh request search --kube-cluster=KUBE_CLUSTER_NAME --kind=KIND

requesting kind pod is denied:

tsh request create --resource /kimlisa22.cloud.gravitational.io/pod/coffee-kube-cluster/kube-system/coredns-7db6d8ff4d-mhjlv
Creating request...
ERROR: Not allowed to request Kubernetes resource kind "pod". Allowed kinds: [namespace].
Try searching for specific kinds with:
> tsh request search --kube-cluster=KUBE_CLUSTER_NAME --kind=KIND

requesting kind namespace is allowed:

tsh request create --resource /kimlisa22.cloud.gravitational.io/namespace/coffee-kube-cluster/coffee-1
Creating request...
Request ID:     01925493-ea75-7641-ba4c-7cb01ff35fbe                                         
Username:       [email protected]                                                        
Roles:          access-kube-coffee, access-kube-pumpkin                                      
Resources:      ["/kimlisa22.cloud.gravitational.io/namespace/coffee-kube-cluster/coffee-1"] 
Reason:         [none]                                                                       
Reviewers:      [none] (suggested)                                                           
Access Expires: 2024-10-03 23:49:01                                                          
Status:         PENDING                                                                      

hint: use 'tsh login --request-id=<request-id>' to login with an approved request

Waiting for request approval...

wildcard example output:

tsh request create --resource /kimlisa22.cloud.gravitational.io/kube_cluster/coffee-kube-cluster 
Creating request...
ERROR: Not allowed to request Kubernetes resource kind "kube_cluster". Allowed kinds: [cronjob configmap kube_node deployment clusterrolebinding clusterrole rolebinding job daemonset ingress namespace service persistentvolumeclaim replicaset statefulset kube_role certificatesigningrequest pod secret serviceaccount persistentvolume].
Try searching for specific kinds with:
> tsh request search --kube-cluster=KUBE_CLUSTER_NAME --kind=KIND

changelog: Define a new role.options field called request_mode.kubernetes_resources that allows admins to define what kinds of Kubernetes resources a requester can make.

github-actions · 2024-10-03T22:43:34Z

The PR changelog entry failed validation: Changelog entry not found in the PR body. Please add a "no-changelog" label to the PR, or changelog lines starting with changelog: followed by the changelog entries for the PR.

tigrato · 2024-10-04T08:56:30Z

api/proto/teleport/legacy/types/types.proto

@@ -2664,6 +2666,13 @@ message AccessCapabilitiesRequest {
  bool FilterRequestableRolesByResource = 6 [(gogoproto.jsontag) = "filter_requestable_roles_by_resource,omitempty"];
 }

+message AccessRequestMode {
+  repeated KubernetesResource KubernetesResources = 1 [


Can we use a dedicated type for this setting?
Reusing the KubernetesResource gives confusion because you can set a lot of data that isn't allowed

kimlisa · 2024-10-08T15:54:13Z

friendly ping @tigrato @nklaassen

tigrato

Can you please add unmarshal from/to yaml of roles with this section defined?

tigrato · 2024-10-09T16:39:33Z

api/proto/teleport/legacy/types/types.proto

@@ -2639,6 +2639,8 @@ message AccessCapabilities {
  // AutoRequest indicates whether the request strategy indicates that a
  // request should be automatically generated on login.
  bool AutoRequest = 6 [(gogoproto.jsontag) = "auto_request,omitempty"];
+  // RequestMode defines what resource kinds a user can request for applicable resources.
+  AccessRequestMode RequestMode = 7 [(gogoproto.jsontag) = "request_mode,omitempty"];


Suggested change

AccessRequestMode RequestMode = 7 [(gogoproto.jsontag) = "request_mode,omitempty"];

AccessRequestMode request_mode = 7 [(gogoproto.jsontag) = "request_mode,omitempty"];

Recently we started adopting the camel case for new fields

tigrato · 2024-10-09T16:39:41Z

api/proto/teleport/legacy/types/types.proto

+// Modeled after existing message KubernetesResource.
+message RequestModeKubernetesResource {
+  // Kind specifies the Kubernetes Resource type.
+  string Kind = 1 [(gogoproto.jsontag) = "kind,omitempty"];


Suggested change

string Kind = 1 [(gogoproto.jsontag) = "kind,omitempty"];

string kind = 1 [(gogoproto.jsontag) = "kind,omitempty"];

tigrato · 2024-10-09T16:40:17Z

api/proto/teleport/legacy/types/types.proto

@@ -3295,7 +3322,6 @@ message DatabasePermission {
 // KubernetesResource is the Kubernetes resource identifier.
 message KubernetesResource {
  // Kind specifies the Kubernetes Resource type.
-  // At the moment only "pod" is supported.


tigrato · 2024-10-09T16:42:48Z

lib/services/access_request.go

+
+		// Validate kube request kinds.
+		// If request mode is defined, then any request for kube_cluster will be rejected.
+		isResourceRequest := len(req.GetRequestedResourceIDs()) > 0


what happens if multiple roles back this access request?
Should we return an error only if none of them support the kind. If role doesn't support the kind Y, we won't use for access to resources of Kind Y

kimlisa · 2024-10-16T07:47:21Z

i made a few adjustments based on review:

the request mode found on the same role as the search as roles will be enforced:

querying for kube resources with search as roles will prune roles that doesn't match request mode with request type
when creating request, request modes will be enforced during:
- pruning search as roles with only root resource request
- pruning search as roles with leaf and root resources (pruning doesn't happen, but we will still enforce request mode without any special matchers)
- requesting custom roles, users can manually change/request roles so this will skip pruning check altogether, but we will still enforce request mode checking without any special matchers

…sting leaf/root resources

…ources

github-actions bot added the size/md label Oct 3, 2024

github-actions bot requested review from fheinecke and nklaassen October 3, 2024 22:43

kimlisa requested a review from tigrato October 3, 2024 22:43

kimlisa changed the title ~~Lisa/add request mode role option~~ Add a new role.options field called request_mode.kubernetes_resources Oct 3, 2024

tigrato reviewed Oct 4, 2024

View reviewed changes

kimlisa force-pushed the lisa/add-request-mode-role-option branch 3 times, most recently from ae41067 to b03a2f3 Compare October 4, 2024 21:58

kimlisa requested a review from tigrato October 4, 2024 21:59

kimlisa force-pushed the lisa/add-request-mode-role-option branch 2 times, most recently from 945322f to 70ecfbb Compare October 7, 2024 03:18

This was referenced Oct 8, 2024

Web: implement requesting for kube namespace selector #47345

Open

Teleterm: add support for access requesting kube namespaces #47347

Open

kimlisa force-pushed the lisa/add-request-mode-role-option branch from 70ecfbb to 352dbb1 Compare October 9, 2024 04:12

kimlisa added the backport/branch/v16 label Oct 9, 2024

kimlisa force-pushed the lisa/add-request-mode-role-option branch from 352dbb1 to ec9b6a8 Compare October 9, 2024 06:15

tigrato reviewed Oct 9, 2024

View reviewed changes

kimlisa force-pushed the lisa/add-request-mode-role-option branch 2 times, most recently from 4892231 to f987020 Compare October 16, 2024 07:26

kimlisa force-pushed the lisa/add-request-mode-role-option branch from f987020 to 7988cc6 Compare October 16, 2024 07:52

kimlisa requested a review from tigrato October 16, 2024 07:55

kimlisa added 5 commits October 16, 2024 14:41

Define request mode proto field

6e76e61

Add role options request mode validator

c5400f7

Add request create kube request mode validator

3a52d3d

Return request mode with get web user context

ab8b51c

Update pb

d989b81

kimlisa added 3 commits October 16, 2024 14:42

Web: define request mode field

7ae1a2c

Define specific kind for request modes kube resources field

a39b82b

Add helpful hint when receiving kind error

14dda1e

kimlisa force-pushed the lisa/add-request-mode-role-option branch 2 times, most recently from 449ca3d to 415537c Compare October 16, 2024 21:47

kimlisa marked this pull request as draft October 17, 2024 06:04

kimlisa added 3 commits October 17, 2024 01:28

Check request modes when pruning, requesting modified roles, or reque…

2d9424e

…sting leaf/root resources

Prune search as roles not meeting request mode when querying kube res…

36a1b79

…ources

Update proto var name and remove unused fields

7f0453e

kimlisa force-pushed the lisa/add-request-mode-role-option branch from 415537c to 7f0453e Compare October 17, 2024 08:30

kimlisa marked this pull request as ready for review October 17, 2024 08:31

github-actions bot requested review from avatus and kiosion October 17, 2024 08:31

github-actions bot added kubernetes-access size/lg tsh tsh - Teleport's command line tool for logging into nodes running Teleport. ui labels Oct 17, 2024

kimlisa removed request for avatus and kiosion October 17, 2024 08:36

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add a new `role.options` field called `request_mode.kubernetes_resources` #47173

Add a new `role.options` field called `request_mode.kubernetes_resources` #47173

kimlisa commented Oct 3, 2024 •

edited

Loading

github-actions bot commented Oct 3, 2024

tigrato Oct 4, 2024

kimlisa commented Oct 8, 2024

tigrato left a comment

tigrato Oct 9, 2024

tigrato Oct 9, 2024

tigrato Oct 9, 2024

tigrato Oct 9, 2024

kimlisa commented Oct 16, 2024 •

edited

Loading

	AccessRequestMode RequestMode = 7 [(gogoproto.jsontag) = "request_mode,omitempty"];
	AccessRequestMode request_mode = 7 [(gogoproto.jsontag) = "request_mode,omitempty"];

	string Kind = 1 [(gogoproto.jsontag) = "kind,omitempty"];
	string kind = 1 [(gogoproto.jsontag) = "kind,omitempty"];

Add a new role.options field called request_mode.kubernetes_resources #47173

Are you sure you want to change the base?

Add a new role.options field called request_mode.kubernetes_resources #47173

Conversation

kimlisa commented Oct 3, 2024 • edited Loading

github-actions bot commented Oct 3, 2024

tigrato Oct 4, 2024

Choose a reason for hiding this comment

kimlisa commented Oct 8, 2024

tigrato left a comment

Choose a reason for hiding this comment

tigrato Oct 9, 2024

Choose a reason for hiding this comment

tigrato Oct 9, 2024

Choose a reason for hiding this comment

tigrato Oct 9, 2024

Choose a reason for hiding this comment

tigrato Oct 9, 2024

Choose a reason for hiding this comment

kimlisa commented Oct 16, 2024 • edited Loading

Add a new `role.options` field called `request_mode.kubernetes_resources` #47173

Add a new `role.options` field called `request_mode.kubernetes_resources` #47173

kimlisa commented Oct 3, 2024 •

edited

Loading

kimlisa commented Oct 16, 2024 •

edited

Loading