Teleterm: add support for access requesting kube namespaces

lib/teleterm/apiserver/handler/handler_clusters.go

@@ -119,6 +119,7 @@ func newAPIRootClusterWithDetails(cluster *clusters.ClusterWithDetails) (*api.Cl
 	}
 	apiCluster.LoggedInUser.RequestableRoles = cluster.RequestableRoles
 	apiCluster.LoggedInUser.SuggestedReviewers = cluster.SuggestedReviewers
+	apiCluster.LoggedInUser.RequestMode = cluster.RequestMode
 	apiCluster.AuthClusterId = cluster.AuthClusterID
 	apiCluster.LoggedInUser.Acl = cluster.ACL
 	userType, err := clusters.UserTypeFromString(cluster.UserType)

lib/teleterm/clusters/cluster.go

@@ -79,6 +79,8 @@ type ClusterWithDetails struct {
 	ProxyVersion string
 	// ShowResources tells if the cluster can show requestable resources on the resources page.
 	ShowResources constants.ShowResources
+	// RequestMode defines access request mode for specific resources.
+	RequestMode *api.AccessRequestMode
 }
 
 // Connected indicates if connection to the cluster can be established
@@ -194,17 +196,29 @@ func (c *Cluster) GetWithDetails(ctx context.Context, authClient authclient.Clie
 		Cluster:            c,
 		SuggestedReviewers: caps.SuggestedReviewers,
 		RequestableRoles:   caps.RequestableRoles,
-		Features:           authPingResponse.ServerFeatures,
-		AuthClusterID:      authClusterID,
-		ACL:                acl,
-		UserType:           user.GetUserType(),
-		ProxyVersion:       clusterPingResponse.ServerVersion,
-		ShowResources:      webConfig.UI.ShowResources,
+		RequestMode: &api.AccessRequestMode{
+			KubernetesResources: makeKubernetesRequestMode(caps.RequestMode.KubernetesResources),
+		},
+		Features:      authPingResponse.ServerFeatures,
+		AuthClusterID: authClusterID,
+		ACL:           acl,
+		UserType:      user.GetUserType(),
+		ProxyVersion:  clusterPingResponse.ServerVersion,
+		ShowResources: webConfig.UI.ShowResources,
 	}
 
 	return withDetails, nil
 }
 
+func makeKubernetesRequestMode(resources []types.RequestModeKubernetesResource) []*api.RequestModeKubernetesResource {
+	apiResources := make([]*api.RequestModeKubernetesResource, 0, len(resources))
+	for _, resource := range resources {
+		apiResources = append(apiResources, &api.RequestModeKubernetesResource{Kind: resource.Kind})
+	}
+
+	return apiResources
+}
+
 func convertToAPIResourceAccess(access services.ResourceAccess) *api.ResourceAccess {
 	return &api.ResourceAccess{
 		List:   access.List,

proto/teleport/lib/teleterm/v1/cluster.proto

@@ -70,6 +70,21 @@
   SHOW_RESOURCES_ACCESSIBLE_ONLY = 2;
 }
 
+// RequestModeKubernetesResources is the Kubernetes resource identifier used
+// in access request mode settings.
+// Modeled after existing message KubernetesResource.
+message RequestModeKubernetesResource {
+  // Kind specifies the Kubernetes Resource type.
+  string kind = 1;
+}
+
+// AccessRequestMode describes request mode settings for applicable resources.
+message AccessRequestMode {
+  // KubernetesResources defines which Kubernetes subresources a user can
+  // request during request creation.
+  repeated RequestModeKubernetesResource kubernetes_resources = 1;
+}
+
 // LoggedInUser describes a logged-in user
 message LoggedInUser {
   // name is the user name
@@ -97,6 +112,8 @@
     USER_TYPE_SSO = 2;
   }
   UserType user_type = 8;
+  // RequestMode defines what resource kinds a user can request for applicable resources.
+  AccessRequestMode request_mode = 9;
 }
 
 // ACL is the access control list of the user

web/packages/shared/components/AccessRequests/NewRequest/kube.ts

@@ -19,6 +19,7 @@
 import { KubeResourceKind } from 'teleport/services/kube';
 
 import { PendingListItem } from './RequestCheckout';
+import { RequestableResourceKind } from './resource';
 
 export type KubeNamespaceRequest = {
   kubeCluster: string;
@@ -78,3 +79,16 @@ export function getKubeResourceRequestMode(
     disableCheckoutFromKubeRestrictions,
   };
 }
+
+export function requiresKubeResourceSelection({
+  dryRun,
+  requestMode,
+  kind,
+}: {
+  dryRun: boolean;
+  requestMode: KubeResourceKind[];
+  kind: RequestableResourceKind;
+}) {
+  const requiresKubeResourceSelection = requestMode.length > 0;
+  return dryRun && kind === 'kube_cluster' && requiresKubeResourceSelection;
+}

web/packages/teleterm/src/ui/AccessRequestCheckout/AccessRequestCheckout.tsx

@@ -32,6 +32,7 @@ import * as Icon from 'design/Icon';
 import { pluralize } from 'shared/utils/text';
 
 import { RequestCheckoutWithSlider } from 'shared/components/AccessRequests/NewRequest';
+import { excludeKubeClusterWithNamespaces } from 'shared/components/AccessRequests/NewRequest/kube';
 
 import useAccessRequestCheckout from './useAccessRequestCheckout';
 import { AssumedRolesBar } from './AssumedRolesBar';
@@ -102,6 +103,9 @@ export function AccessRequestCheckout() {
     pendingRequestTtlOptions,
     startTime,
     onStartTimeChange,
+    fetchKubeNamespaces,
+    bulkToggleKubeResources,
+    allowedKubeSubresourceKinds,
   } = useAccessRequestCheckout();
 
   const isRoleRequest = data[0]?.kind === 'role';
@@ -110,12 +114,21 @@ export function AccessRequestCheckout() {
     setShowCheckout(false);
   }
 
+  const filteredData = data?.filter(d =>
+    excludeKubeClusterWithNamespaces(d, data)
+  );
+
+  const numAddedResources = filteredData?.length;
+
   // We should rather detect how much space we have,
   // but for simplicity we only count items.
-  const moreToShow = Math.max(data.length - MAX_RESOURCES_IN_BAR_TO_SHOW, 0);
+  const moreToShow = Math.max(
+    filteredData.length - MAX_RESOURCES_IN_BAR_TO_SHOW,
+    0
+  );
   return (
     <>
-      {data.length > 0 && !isCollapsed() && (
+      {filteredData.length > 0 && !isCollapsed() && (
         <Box
           px={3}
           py={2}
@@ -133,17 +146,22 @@ export function AccessRequestCheckout() {
           >
             <Flex flexDirection="column" minWidth={0}>
               <Text mb={1}>
-                {data.length}{' '}
-                {pluralize(data.length, isRoleRequest ? 'role' : 'resource')}{' '}
+                {numAddedResources}{' '}
+                {pluralize(
+                  numAddedResources,
+                  isRoleRequest ? 'role' : 'resource'
+                )}{' '}
                 added to access request:
               </Text>
               <Flex gap={1} flexWrap="wrap">
-                {data
+                {filteredData
                   .slice(0, MAX_RESOURCES_IN_BAR_TO_SHOW)
                   .map(c => {
                     let resource = {
-                      name: c.name,
-                      key: `${c.clusterName}-${c.kind}-${c.id}`,
+                      name: c.subResourceName
+                        ? `${c.id}/${c.subResourceName}`
+                        : c.name,
+                      key: `${c.clusterName}-${c.kind}-${c.id}-${c.subResourceName}`,
                       Icon: undefined,
                     };
                     switch (c.kind) {
@@ -158,6 +176,7 @@ export function AccessRequestCheckout() {
                         resource.Icon = Icon.Database;
                         break;
                       case 'kube_cluster':
+                      case 'namespace':
                         resource.Icon = Icon.Kubernetes;
                         break;
                       case 'role':
@@ -259,12 +278,9 @@ export function AccessRequestCheckout() {
             setPendingRequestTtl={setPendingRequestTtl}
             startTime={startTime}
             onStartTimeChange={onStartTimeChange}
-            // TODO: these are placeholders to satisy linters.
-            // There is a split PR that handles teleterm support
-            // that will be merged right after this one (once both are approved)
-            bulkToggleKubeResources={() => null}
-            fetchKubeNamespaces={() => null}
-            allowedKubeSubresourceKinds={[]}
+            fetchKubeNamespaces={fetchKubeNamespaces}
+            bulkToggleKubeResources={bulkToggleKubeResources}
+            allowedKubeSubresourceKinds={allowedKubeSubresourceKinds}
           />
         )}
       </Transition>