opensource/teleport
3
0
Fork 0
mirror of https://github.com/gravitational/teleport.git synced 2026-09-19 01:58:44 +08:00
Code Issues Packages Projects Releases Wiki Activity

Add support for beams to RBAC roles (#65511)

Browse Source 
* Add support for beams to RBAC roles

* Add KindBeam to LabelMatcherKinds

* Update CRDs

* Add beam labels and expression to role/trait tests
This commit is contained in:
Dan Upton
2026-04-09 17:50:35 +00:00
committed by GitHub
parent 962765384f
commit ca377d262a
24 changed files with 3075 additions and 2436 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/proto/teleport/legacy/types/types.proto
+11
View File
@@ -4105,6 +4105,17 @@ message RoleConditions {
// LinuxDesktopLabelsExpression is a predicate expression used to allow/deny
// access to Linux desktops.
string LinuxDesktopLabelsExpression = 49 [(gogoproto.jsontag) = "linux_desktop_labels_expression,omitempty"];
// BeamLabels are used in the RBAC system to allow/deny access to beams.
wrappers.LabelValues BeamLabels = 50 [
(gogoproto.nullable) = false,
(gogoproto.jsontag) = "beam_labels,omitempty",
(gogoproto.customtype) = "Labels"
];
// BeamLabelsExpression is a predicate expression used to allow/deny access
// to beams.
string BeamLabelsExpression = 51 [(gogoproto.jsontag) = "beam_labels_expression,omitempty"];
}
// IdentityCenterAccountAssignment captures an AWS Identity Center account
api/types/derived.gen.go
+3 -1
View File
@@ -954,7 +954,9 @@ func deriveTeleportEqual_48(this, that *RoleConditions) bool {
deriveTeleportEqual_88(this.MCP, that.MCP) &&
deriveTeleportEqual_29(this.LinuxDesktopLogins, that.LinuxDesktopLogins) &&
deriveTeleportEqual_76(this.LinuxDesktopLabels, that.LinuxDesktopLabels) &&
this.LinuxDesktopLabelsExpression == that.LinuxDesktopLabelsExpression
this.LinuxDesktopLabelsExpression == that.LinuxDesktopLabelsExpression &&
deriveTeleportEqual_76(this.BeamLabels, that.BeamLabels) &&
this.BeamLabelsExpression == that.BeamLabelsExpression
}
// deriveTeleportEqual_49 returns whether this and that are equal.
api/types/role.go
+8
View File
@@ -1468,6 +1468,7 @@ func (r *RoleV6) CheckAndSetDefaults() error {
r.Spec.Allow.WindowsDesktopLabels,
r.Spec.Allow.GroupLabels,
r.Spec.Allow.WorkloadIdentityLabels,
r.Spec.Allow.BeamLabels,
} {
if err := checkWildcardSelector(labels); err != nil {
return trace.Wrap(err)
@@ -2258,6 +2259,8 @@ func (r *RoleV6) GetLabelMatchers(rct RoleConditionType, kind string) (LabelMatc
return r.makeGitServerLabelMatchers(cond), nil
case KindWorkloadIdentity:
return LabelMatchers{cond.WorkloadIdentityLabels, cond.WorkloadIdentityLabelsExpression}, nil
case KindBeam:
return LabelMatchers{cond.BeamLabels, cond.BeamLabelsExpression}, nil
}
return LabelMatchers{}, trace.BadParameter("can't get label matchers for resource kind %q", kind)
}
@@ -2315,6 +2318,10 @@ func (r *RoleV6) SetLabelMatchers(rct RoleConditionType, kind string, labelMatch
cond.WorkloadIdentityLabels = labelMatchers.Labels
cond.WorkloadIdentityLabelsExpression = labelMatchers.Expression
return nil
case KindBeam:
cond.BeamLabels = labelMatchers.Labels
cond.BeamLabelsExpression = labelMatchers.Expression
return nil
}
return trace.BadParameter("can't set label matchers for resource kind %q", kind)
}
@@ -2429,6 +2436,7 @@ var LabelMatcherKinds = []string{
KindWindowsDesktop,
KindWindowsDesktopService,
KindUserGroup,
KindBeam,
}
const (
api/types/role_test.go
+28
View File
@@ -1418,3 +1418,31 @@ func TestRoleGitHubPermissions(t *testing.T) {
GitHubOrgLabel: []string{"jedi", "night-watch"},
}}, denyMatchers)
}
func TestRoleBeamLabelMatchers(t *testing.T) {
role, err := NewRole("beam-role", RoleSpecV6{
Allow: RoleConditions{
BeamLabels: Labels{"env": []string{"prod"}},
BeamLabelsExpression: `labels["env"] == "prod"`,
},
Deny: RoleConditions{
BeamLabels: Labels{"owner": []string{"alice"}},
BeamLabelsExpression: `labels["owner"] == "alice"`,
},
})
require.NoError(t, err)
allowMatchers, err := role.GetLabelMatchers(Allow, KindBeam)
require.NoError(t, err)
require.Equal(t, LabelMatchers{
Labels: Labels{"env": []string{"prod"}},
Expression: `labels["env"] == "prod"`,
}, allowMatchers)
denyMatchers, err := role.GetLabelMatchers(Deny, KindBeam)
require.NoError(t, err)
require.Equal(t, LabelMatchers{
Labels: Labels{"owner": []string{"alice"}},
Expression: `labels["owner"] == "alice"`,
}, denyMatchers)
}
api/types/types.pb.go
+2537 -2435
View File
File diff suppressed because it is too large Load Diff
docs/pages/includes/role-spec.mdx
+8
View File
@@ -312,6 +312,13 @@ spec:
'env': 'prod'
'team': '{{external.team}}'
# beam_labels: a user with this role will be allowed to manage Beam
# resources with labels matching below.
#
# Supports role templating with traits.
beam_labels:
'teleport.internal/beam/owner': 'user@example.com'
# node_labels_expression has the same purpose as node_labels but
# supports predicate expressions to configure custom logic.
# A user with this role will be allowed to access nodes if they are in the
@@ -331,6 +338,7 @@ spec:
windows_desktop_labels_expression: 'labels["env"] == "staging"'
group_labels_expression: 'labels["env"] == "staging"'
workload_identity_labels_expression: 'labels["env"] == "staging"'
beam_labels_expression: 'labels["env"] == "staging"'
# aws_role_arns allows a user with this role to assume AWS roles when
# accessing AWS console using UI or AWS API using CLI
docs/pages/reference/access-controls/roles.mdx
+2
View File
@@ -255,6 +255,7 @@ conditions:
- `windows_desktop_labels_expression`
- `group_labels_expression`
- `workload_identity_labels_expression`
- `beam_labels_expression`
Check out our
[predicate language](predicate-language.mdx)
@@ -770,6 +771,7 @@ Labels for resources enrolled with Teleport:
|`node_labels`|[SSH Servers](../../enroll-resources/server-access/server-access.mdx)|
|`windows_desktop_labels`|[Windows desktops](../../enroll-resources/server-access/server-access.mdx)|
|`workload_identity_labels`|[Workload Identities](../machine-workload-identity/workload-identity/workload-identity-resource.mdx)|
|`beam_labels`|Beams|
Principals a user can assume on infrastructure resources:
- `aws_role_arns`
docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-roles.mdx
+36
View File
@@ -42,6 +42,8 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
|app_labels_expression|string|AppLabelsExpression is a predicate expression used to allow/deny access to Apps.|
|aws_role_arns|[]string|AWSRoleARNs is a list of AWS role ARNs this role is allowed to assume.|
|azure_identities|[]string|AzureIdentities is a list of Azure identities this role is allowed to assume.|
|beam_labels|[object](#specallowbeam_labels)|BeamLabels are used in the RBAC system to allow/deny access to beams.|
|beam_labels_expression|string|BeamLabelsExpression is a predicate expression used to allow/deny access to beams.|
|cluster_labels|[object](#specallowcluster_labels)|ClusterLabels is a map of node labels (used to dynamically grant access to clusters).|
|cluster_labels_expression|string|ClusterLabelsExpression is a predicate expression used to allow/deny access to remote Teleport clusters.|
|db_labels|[object](#specallowdb_labels)|DatabaseLabels are used in RBAC system to allow/deny access to databases.|
@@ -98,6 +100,13 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
|key|string||
|value|string||
### spec.allow.beam_labels
|Field|Type|Description|
|---|---|---|
|key|string||
|value|string||
### spec.allow.cluster_labels
|Field|Type|Description|
@@ -320,6 +329,8 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
|app_labels_expression|string|AppLabelsExpression is a predicate expression used to allow/deny access to Apps.|
|aws_role_arns|[]string|AWSRoleARNs is a list of AWS role ARNs this role is allowed to assume.|
|azure_identities|[]string|AzureIdentities is a list of Azure identities this role is allowed to assume.|
|beam_labels|[object](#specdenybeam_labels)|BeamLabels are used in the RBAC system to allow/deny access to beams.|
|beam_labels_expression|string|BeamLabelsExpression is a predicate expression used to allow/deny access to beams.|
|cluster_labels|[object](#specdenycluster_labels)|ClusterLabels is a map of node labels (used to dynamically grant access to clusters).|
|cluster_labels_expression|string|ClusterLabelsExpression is a predicate expression used to allow/deny access to remote Teleport clusters.|
|db_labels|[object](#specdenydb_labels)|DatabaseLabels are used in RBAC system to allow/deny access to databases.|
@@ -376,6 +387,13 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
|key|string||
|value|string||
### spec.deny.beam_labels
|Field|Type|Description|
|---|---|---|
|key|string||
|value|string||
### spec.deny.cluster_labels
|Field|Type|Description|
@@ -701,6 +719,8 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
|app_labels_expression|string|AppLabelsExpression is a predicate expression used to allow/deny access to Apps.|
|aws_role_arns|[]string|AWSRoleARNs is a list of AWS role ARNs this role is allowed to assume.|
|azure_identities|[]string|AzureIdentities is a list of Azure identities this role is allowed to assume.|
|beam_labels|[object](#specallowbeam_labels)|BeamLabels are used in the RBAC system to allow/deny access to beams.|
|beam_labels_expression|string|BeamLabelsExpression is a predicate expression used to allow/deny access to beams.|
|cluster_labels|[object](#specallowcluster_labels)|ClusterLabels is a map of node labels (used to dynamically grant access to clusters).|
|cluster_labels_expression|string|ClusterLabelsExpression is a predicate expression used to allow/deny access to remote Teleport clusters.|
|db_labels|[object](#specallowdb_labels)|DatabaseLabels are used in RBAC system to allow/deny access to databases.|
@@ -757,6 +777,13 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
|key|string||
|value|string||
### spec.allow.beam_labels
|Field|Type|Description|
|---|---|---|
|key|string||
|value|string||
### spec.allow.cluster_labels
|Field|Type|Description|
@@ -979,6 +1006,8 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
|app_labels_expression|string|AppLabelsExpression is a predicate expression used to allow/deny access to Apps.|
|aws_role_arns|[]string|AWSRoleARNs is a list of AWS role ARNs this role is allowed to assume.|
|azure_identities|[]string|AzureIdentities is a list of Azure identities this role is allowed to assume.|
|beam_labels|[object](#specdenybeam_labels)|BeamLabels are used in the RBAC system to allow/deny access to beams.|
|beam_labels_expression|string|BeamLabelsExpression is a predicate expression used to allow/deny access to beams.|
|cluster_labels|[object](#specdenycluster_labels)|ClusterLabels is a map of node labels (used to dynamically grant access to clusters).|
|cluster_labels_expression|string|ClusterLabelsExpression is a predicate expression used to allow/deny access to remote Teleport clusters.|
|db_labels|[object](#specdenydb_labels)|DatabaseLabels are used in RBAC system to allow/deny access to databases.|
@@ -1035,6 +1064,13 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
|key|string||
|value|string||
### spec.deny.beam_labels
|Field|Type|Description|
|---|---|---|
|key|string||
|value|string||
### spec.deny.cluster_labels
|Field|Type|Description|
docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-rolesv6.mdx
+18
View File
@@ -42,6 +42,8 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
|app_labels_expression|string|AppLabelsExpression is a predicate expression used to allow/deny access to Apps.|
|aws_role_arns|[]string|AWSRoleARNs is a list of AWS role ARNs this role is allowed to assume.|
|azure_identities|[]string|AzureIdentities is a list of Azure identities this role is allowed to assume.|
|beam_labels|[object](#specallowbeam_labels)|BeamLabels are used in the RBAC system to allow/deny access to beams.|
|beam_labels_expression|string|BeamLabelsExpression is a predicate expression used to allow/deny access to beams.|
|cluster_labels|[object](#specallowcluster_labels)|ClusterLabels is a map of node labels (used to dynamically grant access to clusters).|
|cluster_labels_expression|string|ClusterLabelsExpression is a predicate expression used to allow/deny access to remote Teleport clusters.|
|db_labels|[object](#specallowdb_labels)|DatabaseLabels are used in RBAC system to allow/deny access to databases.|
@@ -98,6 +100,13 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
|key|string||
|value|string||
### spec.allow.beam_labels
|Field|Type|Description|
|---|---|---|
|key|string||
|value|string||
### spec.allow.cluster_labels
|Field|Type|Description|
@@ -320,6 +329,8 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
|app_labels_expression|string|AppLabelsExpression is a predicate expression used to allow/deny access to Apps.|
|aws_role_arns|[]string|AWSRoleARNs is a list of AWS role ARNs this role is allowed to assume.|
|azure_identities|[]string|AzureIdentities is a list of Azure identities this role is allowed to assume.|
|beam_labels|[object](#specdenybeam_labels)|BeamLabels are used in the RBAC system to allow/deny access to beams.|
|beam_labels_expression|string|BeamLabelsExpression is a predicate expression used to allow/deny access to beams.|
|cluster_labels|[object](#specdenycluster_labels)|ClusterLabels is a map of node labels (used to dynamically grant access to clusters).|
|cluster_labels_expression|string|ClusterLabelsExpression is a predicate expression used to allow/deny access to remote Teleport clusters.|
|db_labels|[object](#specdenydb_labels)|DatabaseLabels are used in RBAC system to allow/deny access to databases.|
@@ -376,6 +387,13 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
|key|string||
|value|string||
### spec.deny.beam_labels
|Field|Type|Description|
|---|---|---|
|key|string||
|value|string||
### spec.deny.cluster_labels
|Field|Type|Description|
docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-rolesv7.mdx
+18
View File
@@ -42,6 +42,8 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
|app_labels_expression|string|AppLabelsExpression is a predicate expression used to allow/deny access to Apps.|
|aws_role_arns|[]string|AWSRoleARNs is a list of AWS role ARNs this role is allowed to assume.|
|azure_identities|[]string|AzureIdentities is a list of Azure identities this role is allowed to assume.|
|beam_labels|[object](#specallowbeam_labels)|BeamLabels are used in the RBAC system to allow/deny access to beams.|
|beam_labels_expression|string|BeamLabelsExpression is a predicate expression used to allow/deny access to beams.|
|cluster_labels|[object](#specallowcluster_labels)|ClusterLabels is a map of node labels (used to dynamically grant access to clusters).|
|cluster_labels_expression|string|ClusterLabelsExpression is a predicate expression used to allow/deny access to remote Teleport clusters.|
|db_labels|[object](#specallowdb_labels)|DatabaseLabels are used in RBAC system to allow/deny access to databases.|
@@ -98,6 +100,13 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
|key|string||
|value|string||
### spec.allow.beam_labels
|Field|Type|Description|
|---|---|---|
|key|string||
|value|string||
### spec.allow.cluster_labels
|Field|Type|Description|
@@ -320,6 +329,8 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
|app_labels_expression|string|AppLabelsExpression is a predicate expression used to allow/deny access to Apps.|
|aws_role_arns|[]string|AWSRoleARNs is a list of AWS role ARNs this role is allowed to assume.|
|azure_identities|[]string|AzureIdentities is a list of Azure identities this role is allowed to assume.|
|beam_labels|[object](#specdenybeam_labels)|BeamLabels are used in the RBAC system to allow/deny access to beams.|
|beam_labels_expression|string|BeamLabelsExpression is a predicate expression used to allow/deny access to beams.|
|cluster_labels|[object](#specdenycluster_labels)|ClusterLabels is a map of node labels (used to dynamically grant access to clusters).|
|cluster_labels_expression|string|ClusterLabelsExpression is a predicate expression used to allow/deny access to remote Teleport clusters.|
|db_labels|[object](#specdenydb_labels)|DatabaseLabels are used in RBAC system to allow/deny access to databases.|
@@ -376,6 +387,13 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
|key|string||
|value|string||
### spec.deny.beam_labels
|Field|Type|Description|
|---|---|---|
|key|string||
|value|string||
### spec.deny.cluster_labels
|Field|Type|Description|
docs/pages/reference/infrastructure-as-code/operator-resources/resources-teleport-dev-rolesv8.mdx
+18
View File
@@ -42,6 +42,8 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
|app_labels_expression|string|AppLabelsExpression is a predicate expression used to allow/deny access to Apps.|
|aws_role_arns|[]string|AWSRoleARNs is a list of AWS role ARNs this role is allowed to assume.|
|azure_identities|[]string|AzureIdentities is a list of Azure identities this role is allowed to assume.|
|beam_labels|[object](#specallowbeam_labels)|BeamLabels are used in the RBAC system to allow/deny access to beams.|
|beam_labels_expression|string|BeamLabelsExpression is a predicate expression used to allow/deny access to beams.|
|cluster_labels|[object](#specallowcluster_labels)|ClusterLabels is a map of node labels (used to dynamically grant access to clusters).|
|cluster_labels_expression|string|ClusterLabelsExpression is a predicate expression used to allow/deny access to remote Teleport clusters.|
|db_labels|[object](#specallowdb_labels)|DatabaseLabels are used in RBAC system to allow/deny access to databases.|
@@ -98,6 +100,13 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
|key|string||
|value|string||
### spec.allow.beam_labels
|Field|Type|Description|
|---|---|---|
|key|string||
|value|string||
### spec.allow.cluster_labels
|Field|Type|Description|
@@ -320,6 +329,8 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
|app_labels_expression|string|AppLabelsExpression is a predicate expression used to allow/deny access to Apps.|
|aws_role_arns|[]string|AWSRoleARNs is a list of AWS role ARNs this role is allowed to assume.|
|azure_identities|[]string|AzureIdentities is a list of Azure identities this role is allowed to assume.|
|beam_labels|[object](#specdenybeam_labels)|BeamLabels are used in the RBAC system to allow/deny access to beams.|
|beam_labels_expression|string|BeamLabelsExpression is a predicate expression used to allow/deny access to beams.|
|cluster_labels|[object](#specdenycluster_labels)|ClusterLabels is a map of node labels (used to dynamically grant access to clusters).|
|cluster_labels_expression|string|ClusterLabelsExpression is a predicate expression used to allow/deny access to remote Teleport clusters.|
|db_labels|[object](#specdenydb_labels)|DatabaseLabels are used in RBAC system to allow/deny access to databases.|
@@ -376,6 +387,13 @@ resource, which you can apply after installing the Teleport Kubernetes operator.
|key|string||
|value|string||
### spec.deny.beam_labels
|Field|Type|Description|
|---|---|---|
|key|string||
|value|string||
### spec.deny.cluster_labels
|Field|Type|Description|
docs/pages/reference/infrastructure-as-code/terraform-provider/data-sources/role.mdx
+4
View File
@@ -61,6 +61,8 @@ Optional:
- `app_labels_expression` (String) AppLabelsExpression is a predicate expression used to allow/deny access to Apps.
- `aws_role_arns` (List of String) AWSRoleARNs is a list of AWS role ARNs this role is allowed to assume.
- `azure_identities` (List of String) AzureIdentities is a list of Azure identities this role is allowed to assume.
- `beam_labels` (Map of List of String) BeamLabels are used in the RBAC system to allow/deny access to beams.
- `beam_labels_expression` (String) BeamLabelsExpression is a predicate expression used to allow/deny access to beams.
- `cluster_labels` (Map of List of String) ClusterLabels is a map of node labels (used to dynamically grant access to clusters).
- `cluster_labels_expression` (String) ClusterLabelsExpression is a predicate expression used to allow/deny access to remote Teleport clusters.
- `db_labels` (Map of List of String) DatabaseLabels are used in RBAC system to allow/deny access to databases.
@@ -273,6 +275,8 @@ Optional:
- `app_labels_expression` (String) AppLabelsExpression is a predicate expression used to allow/deny access to Apps.
- `aws_role_arns` (List of String) AWSRoleARNs is a list of AWS role ARNs this role is allowed to assume.
- `azure_identities` (List of String) AzureIdentities is a list of Azure identities this role is allowed to assume.
- `beam_labels` (Map of List of String) BeamLabels are used in the RBAC system to allow/deny access to beams.
- `beam_labels_expression` (String) BeamLabelsExpression is a predicate expression used to allow/deny access to beams.
- `cluster_labels` (Map of List of String) ClusterLabels is a map of node labels (used to dynamically grant access to clusters).
- `cluster_labels_expression` (String) ClusterLabelsExpression is a predicate expression used to allow/deny access to remote Teleport clusters.
- `db_labels` (Map of List of String) DatabaseLabels are used in RBAC system to allow/deny access to databases.
docs/pages/reference/infrastructure-as-code/terraform-provider/resources/role.mdx
+4
View File
@@ -123,6 +123,8 @@ Optional:
- `app_labels_expression` (String) AppLabelsExpression is a predicate expression used to allow/deny access to Apps.
- `aws_role_arns` (List of String) AWSRoleARNs is a list of AWS role ARNs this role is allowed to assume.
- `azure_identities` (List of String) AzureIdentities is a list of Azure identities this role is allowed to assume.
- `beam_labels` (Map of List of String) BeamLabels are used in the RBAC system to allow/deny access to beams.
- `beam_labels_expression` (String) BeamLabelsExpression is a predicate expression used to allow/deny access to beams.
- `cluster_labels` (Map of List of String) ClusterLabels is a map of node labels (used to dynamically grant access to clusters).
- `cluster_labels_expression` (String) ClusterLabelsExpression is a predicate expression used to allow/deny access to remote Teleport clusters.
- `db_labels` (Map of List of String) DatabaseLabels are used in RBAC system to allow/deny access to databases.
@@ -335,6 +337,8 @@ Optional:
- `app_labels_expression` (String) AppLabelsExpression is a predicate expression used to allow/deny access to Apps.
- `aws_role_arns` (List of String) AWSRoleARNs is a list of AWS role ARNs this role is allowed to assume.
- `azure_identities` (List of String) AzureIdentities is a list of Azure identities this role is allowed to assume.
- `beam_labels` (Map of List of String) BeamLabels are used in the RBAC system to allow/deny access to beams.
- `beam_labels_expression` (String) BeamLabelsExpression is a predicate expression used to allow/deny access to beams.
- `cluster_labels` (Map of List of String) ClusterLabels is a map of node labels (used to dynamically grant access to clusters).
- `cluster_labels_expression` (String) ClusterLabelsExpression is a predicate expression used to allow/deny access to remote Teleport clusters.
- `db_labels` (Map of List of String) DatabaseLabels are used in RBAC system to allow/deny access to databases.
examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_roles.yaml
+40
View File
@@ -69,6 +69,16 @@ spec:
type: string
nullable: true
type: array
beam_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
description: BeamLabels are used in the RBAC system to allow/deny
access to beams.
type: object
beam_labels_expression:
description: BeamLabelsExpression is a predicate expression used
to allow/deny access to beams.
type: string
cluster_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
@@ -703,6 +713,16 @@ spec:
type: string
nullable: true
type: array
beam_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
description: BeamLabels are used in the RBAC system to allow/deny
access to beams.
type: object
beam_labels_expression:
description: BeamLabelsExpression is a predicate expression used
to allow/deny access to beams.
type: string
cluster_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
@@ -1634,6 +1654,16 @@ spec:
type: string
nullable: true
type: array
beam_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
description: BeamLabels are used in the RBAC system to allow/deny
access to beams.
type: object
beam_labels_expression:
description: BeamLabelsExpression is a predicate expression used
to allow/deny access to beams.
type: string
cluster_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
@@ -2268,6 +2298,16 @@ spec:
type: string
nullable: true
type: array
beam_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
description: BeamLabels are used in the RBAC system to allow/deny
access to beams.
type: object
beam_labels_expression:
description: BeamLabelsExpression is a predicate expression used
to allow/deny access to beams.
type: string
cluster_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_rolesv6.yaml
+20
View File
@@ -72,6 +72,16 @@ spec:
type: string
nullable: true
type: array
beam_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
description: BeamLabels are used in the RBAC system to allow/deny
access to beams.
type: object
beam_labels_expression:
description: BeamLabelsExpression is a predicate expression used
to allow/deny access to beams.
type: string
cluster_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
@@ -706,6 +716,16 @@ spec:
type: string
nullable: true
type: array
beam_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
description: BeamLabels are used in the RBAC system to allow/deny
access to beams.
type: object
beam_labels_expression:
description: BeamLabelsExpression is a predicate expression used
to allow/deny access to beams.
type: string
cluster_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_rolesv7.yaml
+20
View File
@@ -72,6 +72,16 @@ spec:
type: string
nullable: true
type: array
beam_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
description: BeamLabels are used in the RBAC system to allow/deny
access to beams.
type: object
beam_labels_expression:
description: BeamLabelsExpression is a predicate expression used
to allow/deny access to beams.
type: string
cluster_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
@@ -706,6 +716,16 @@ spec:
type: string
nullable: true
type: array
beam_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
description: BeamLabels are used in the RBAC system to allow/deny
access to beams.
type: object
beam_labels_expression:
description: BeamLabelsExpression is a predicate expression used
to allow/deny access to beams.
type: string
cluster_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
examples/chart/teleport-cluster/charts/teleport-operator/operator-crds/resources.teleport.dev_rolesv8.yaml
+20
View File
@@ -72,6 +72,16 @@ spec:
type: string
nullable: true
type: array
beam_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
description: BeamLabels are used in the RBAC system to allow/deny
access to beams.
type: object
beam_labels_expression:
description: BeamLabelsExpression is a predicate expression used
to allow/deny access to beams.
type: string
cluster_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
@@ -706,6 +716,16 @@ spec:
type: string
nullable: true
type: array
beam_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
description: BeamLabels are used in the RBAC system to allow/deny
access to beams.
type: object
beam_labels_expression:
description: BeamLabelsExpression is a predicate expression used
to allow/deny access to beams.
type: string
cluster_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
integrations/operator/config/crd/bases/resources.teleport.dev_roles.yaml
+40
View File
@@ -69,6 +69,16 @@ spec:
type: string
nullable: true
type: array
beam_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
description: BeamLabels are used in the RBAC system to allow/deny
access to beams.
type: object
beam_labels_expression:
description: BeamLabelsExpression is a predicate expression used
to allow/deny access to beams.
type: string
cluster_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
@@ -703,6 +713,16 @@ spec:
type: string
nullable: true
type: array
beam_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
description: BeamLabels are used in the RBAC system to allow/deny
access to beams.
type: object
beam_labels_expression:
description: BeamLabelsExpression is a predicate expression used
to allow/deny access to beams.
type: string
cluster_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
@@ -1634,6 +1654,16 @@ spec:
type: string
nullable: true
type: array
beam_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
description: BeamLabels are used in the RBAC system to allow/deny
access to beams.
type: object
beam_labels_expression:
description: BeamLabelsExpression is a predicate expression used
to allow/deny access to beams.
type: string
cluster_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
@@ -2268,6 +2298,16 @@ spec:
type: string
nullable: true
type: array
beam_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
description: BeamLabels are used in the RBAC system to allow/deny
access to beams.
type: object
beam_labels_expression:
description: BeamLabelsExpression is a predicate expression used
to allow/deny access to beams.
type: string
cluster_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
integrations/operator/config/crd/bases/resources.teleport.dev_rolesv6.yaml
+20
View File
@@ -72,6 +72,16 @@ spec:
type: string
nullable: true
type: array
beam_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
description: BeamLabels are used in the RBAC system to allow/deny
access to beams.
type: object
beam_labels_expression:
description: BeamLabelsExpression is a predicate expression used
to allow/deny access to beams.
type: string
cluster_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
@@ -706,6 +716,16 @@ spec:
type: string
nullable: true
type: array
beam_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
description: BeamLabels are used in the RBAC system to allow/deny
access to beams.
type: object
beam_labels_expression:
description: BeamLabelsExpression is a predicate expression used
to allow/deny access to beams.
type: string
cluster_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
integrations/operator/config/crd/bases/resources.teleport.dev_rolesv7.yaml
+20
View File
@@ -72,6 +72,16 @@ spec:
type: string
nullable: true
type: array
beam_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
description: BeamLabels are used in the RBAC system to allow/deny
access to beams.
type: object
beam_labels_expression:
description: BeamLabelsExpression is a predicate expression used
to allow/deny access to beams.
type: string
cluster_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
@@ -706,6 +716,16 @@ spec:
type: string
nullable: true
type: array
beam_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
description: BeamLabels are used in the RBAC system to allow/deny
access to beams.
type: object
beam_labels_expression:
description: BeamLabelsExpression is a predicate expression used
to allow/deny access to beams.
type: string
cluster_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
integrations/operator/config/crd/bases/resources.teleport.dev_rolesv8.yaml
+20
View File
@@ -72,6 +72,16 @@ spec:
type: string
nullable: true
type: array
beam_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
description: BeamLabels are used in the RBAC system to allow/deny
access to beams.
type: object
beam_labels_expression:
description: BeamLabelsExpression is a predicate expression used
to allow/deny access to beams.
type: string
cluster_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
@@ -706,6 +716,16 @@ spec:
type: string
nullable: true
type: array
beam_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
description: BeamLabels are used in the RBAC system to allow/deny
access to beams.
type: object
beam_labels_expression:
description: BeamLabelsExpression is a predicate expression used
to allow/deny access to beams.
type: string
cluster_labels:
additionalProperties:
x-kubernetes-preserve-unknown-fields: true
integrations/terraform/tfschema/types_terraform.go
+128
View File
@@ -2701,6 +2701,15 @@ func GenSchemaRoleV6(ctx context.Context) (github_com_hashicorp_terraform_plugin
Optional: true,
Type: github_com_hashicorp_terraform_plugin_framework_types.ListType{ElemType: github_com_hashicorp_terraform_plugin_framework_types.StringType},
},
"beam_labels": GenSchemaLabels(ctx, github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
Description: "BeamLabels are used in the RBAC system to allow/deny access to beams.",
Optional: true,
}),
"beam_labels_expression": {
Description: "BeamLabelsExpression is a predicate expression used to allow/deny access to beams.",
Optional: true,
Type: github_com_hashicorp_terraform_plugin_framework_types.StringType,
},
"cluster_labels": GenSchemaLabels(ctx, github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
Description: "ClusterLabels is a map of node labels (used to dynamically grant access to clusters).",
Optional: true,
@@ -3232,6 +3241,15 @@ func GenSchemaRoleV6(ctx context.Context) (github_com_hashicorp_terraform_plugin
Optional: true,
Type: github_com_hashicorp_terraform_plugin_framework_types.ListType{ElemType: github_com_hashicorp_terraform_plugin_framework_types.StringType},
},
"beam_labels": GenSchemaLabels(ctx, github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
Description: "BeamLabels are used in the RBAC system to allow/deny access to beams.",
Optional: true,
}),
"beam_labels_expression": {
Description: "BeamLabelsExpression is a predicate expression used to allow/deny access to beams.",
Optional: true,
Type: github_com_hashicorp_terraform_plugin_framework_types.StringType,
},
"cluster_labels": GenSchemaLabels(ctx, github_com_hashicorp_terraform_plugin_framework_tfsdk.Attribute{
Description: "ClusterLabels is a map of node labels (used to dynamically grant access to clusters).",
Optional: true,
@@ -30659,6 +30677,30 @@ func CopyRoleV6FromTerraform(_ context.Context, tf github_com_hashicorp_terrafor
}
}
}
{
a, ok := tf.Attrs["beam_labels"]
if !ok {
diags.Append(attrReadMissingDiag{"RoleV6.Spec.Allow.BeamLabels"})
}
CopyFromLabels(diags, a, &obj.BeamLabels)
}
{
a, ok := tf.Attrs["beam_labels_expression"]
if !ok {
diags.Append(attrReadMissingDiag{"RoleV6.Spec.Allow.BeamLabelsExpression"})
} else {
v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
if !ok {
diags.Append(attrReadConversionFailureDiag{"RoleV6.Spec.Allow.BeamLabelsExpression", "github.com/hashicorp/terraform-plugin-framework/types.String"})
} else {
var t string
if !v.Null && !v.Unknown {
t = string(v.Value)
}
obj.BeamLabelsExpression = t
}
}
}
}
}
}
@@ -32834,6 +32876,30 @@ func CopyRoleV6FromTerraform(_ context.Context, tf github_com_hashicorp_terrafor
}
}
}
{
a, ok := tf.Attrs["beam_labels"]
if !ok {
diags.Append(attrReadMissingDiag{"RoleV6.Spec.Deny.BeamLabels"})
}
CopyFromLabels(diags, a, &obj.BeamLabels)
}
{
a, ok := tf.Attrs["beam_labels_expression"]
if !ok {
diags.Append(attrReadMissingDiag{"RoleV6.Spec.Deny.BeamLabelsExpression"})
} else {
v, ok := a.(github_com_hashicorp_terraform_plugin_framework_types.String)
if !ok {
diags.Append(attrReadConversionFailureDiag{"RoleV6.Spec.Deny.BeamLabelsExpression", "github.com/hashicorp/terraform-plugin-framework/types.String"})
} else {
var t string
if !v.Null && !v.Unknown {
t = string(v.Value)
}
obj.BeamLabelsExpression = t
}
}
}
}
}
}
@@ -37887,6 +37953,37 @@ func CopyRoleV6ToTerraform(ctx context.Context, obj *github_com_gravitational_te
tf.Attrs["linux_desktop_labels_expression"] = v
}
}
{
t, ok := tf.AttrTypes["beam_labels"]
if !ok {
diags.Append(attrWriteMissingDiag{"RoleV6.Spec.Allow.BeamLabels"})
} else {
v := CopyToLabels(diags, obj.BeamLabels, t, tf.Attrs["beam_labels"])
tf.Attrs["beam_labels"] = v
}
}
{
t, ok := tf.AttrTypes["beam_labels_expression"]
if !ok {
diags.Append(attrWriteMissingDiag{"RoleV6.Spec.Allow.BeamLabelsExpression"})
} else {
v, ok := tf.Attrs["beam_labels_expression"].(github_com_hashicorp_terraform_plugin_framework_types.String)
if !ok {
i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
if err != nil {
diags.Append(attrWriteGeneralError{"RoleV6.Spec.Allow.BeamLabelsExpression", err})
}
v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
if !ok {
diags.Append(attrWriteConversionFailureDiag{"RoleV6.Spec.Allow.BeamLabelsExpression", "github.com/hashicorp/terraform-plugin-framework/types.String"})
}
v.Null = string(obj.BeamLabelsExpression) == ""
}
v.Value = string(obj.BeamLabelsExpression)
v.Unknown = false
tf.Attrs["beam_labels_expression"] = v
}
}
}
v.Unknown = false
tf.Attrs["allow"] = v
@@ -41660,6 +41757,37 @@ func CopyRoleV6ToTerraform(ctx context.Context, obj *github_com_gravitational_te
tf.Attrs["linux_desktop_labels_expression"] = v
}
}
{
t, ok := tf.AttrTypes["beam_labels"]
if !ok {
diags.Append(attrWriteMissingDiag{"RoleV6.Spec.Deny.BeamLabels"})
} else {
v := CopyToLabels(diags, obj.BeamLabels, t, tf.Attrs["beam_labels"])
tf.Attrs["beam_labels"] = v
}
}
{
t, ok := tf.AttrTypes["beam_labels_expression"]
if !ok {
diags.Append(attrWriteMissingDiag{"RoleV6.Spec.Deny.BeamLabelsExpression"})
} else {
v, ok := tf.Attrs["beam_labels_expression"].(github_com_hashicorp_terraform_plugin_framework_types.String)
if !ok {
i, err := t.ValueFromTerraform(ctx, github_com_hashicorp_terraform_plugin_go_tftypes.NewValue(t.TerraformType(ctx), nil))
if err != nil {
diags.Append(attrWriteGeneralError{"RoleV6.Spec.Deny.BeamLabelsExpression", err})
}
v, ok = i.(github_com_hashicorp_terraform_plugin_framework_types.String)
if !ok {
diags.Append(attrWriteConversionFailureDiag{"RoleV6.Spec.Deny.BeamLabelsExpression", "github.com/hashicorp/terraform-plugin-framework/types.String"})
}
v.Null = string(obj.BeamLabelsExpression) == ""
}
v.Value = string(obj.BeamLabelsExpression)
v.Unknown = false
tf.Attrs["beam_labels_expression"] = v
}
}
}
v.Unknown = false
tf.Attrs["deny"] = v
lib/services/role.go
+2
View File
@@ -364,6 +364,7 @@ func validateRoleExpressions(r types.Role) error {
{"windows_desktop_labels", types.KindWindowsDesktop},
{"windows_desktop_labels", types.KindDynamicWindowsDesktop},
{"group_labels", types.KindUserGroup},
{"beam_labels", types.KindBeam},
} {
labelMatchers, err := r.GetLabelMatchers(condition.condition, labels.kind)
if err != nil {
@@ -576,6 +577,7 @@ func ApplyTraits(r types.Role, traits map[string][]string) (types.Role, error) {
types.KindUserGroup,
types.KindSAMLIdPServiceProvider,
types.KindWorkloadIdentity,
types.KindBeam,
} {
labelMatchers, err := r.GetLabelMatchers(condition, kind)
if err != nil {
lib/services/role_test.go
+50
View File
@@ -41,6 +41,8 @@ import (
"github.com/gravitational/teleport"
"github.com/gravitational/teleport/api/constants"
apidefaults "github.com/gravitational/teleport/api/defaults"
beamsv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/beams/v1"
headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
"github.com/gravitational/teleport/api/types"
apievents "github.com/gravitational/teleport/api/types/events"
"github.com/gravitational/teleport/api/types/wrappers"
@@ -949,6 +951,9 @@ func TestValidateRole(t *testing.T) {
ClusterLabels: types.Labels{
"owner": {"{{email.localz(external.email)}}"},
},
BeamLabels: types.Labels{
"owner": {"{{email.localz(external.email)}}"},
},
},
Deny: types.RoleConditions{
Logins: []string{"test"},
@@ -970,6 +975,9 @@ func TestValidateRole(t *testing.T) {
ClusterLabels: types.Labels{
"owner": {"{{email.localz(external.email)}}"},
},
BeamLabels: types.Labels{
"owner": {"{{email.localz(external.email)}}"},
},
},
},
expectWarnings: []string{
@@ -979,12 +987,14 @@ func TestValidateRole(t *testing.T) {
"parsing allow.db_labels template expression",
"parsing allow.windows_desktop_labels template expression",
"parsing allow.cluster_labels template expression",
"parsing allow.beam_labels template expression",
"parsing deny.node_labels template expression",
"parsing deny.app_labels template expression",
"parsing deny.kubernetes_labels template expression",
"parsing deny.db_labels template expression",
"parsing deny.windows_desktop_labels template expression",
"parsing deny.cluster_labels template expression",
"parsing deny.beam_labels template expression",
"unsupported function: email.localz",
},
},
@@ -1000,6 +1010,7 @@ func TestValidateRole(t *testing.T) {
DatabaseServiceLabelsExpression: `containz(labels["env"], "staging")`,
WindowsDesktopLabelsExpression: `containz(labels["env"], "staging")`,
GroupLabelsExpression: `containz(labels["env"], "staging")`,
BeamLabelsExpression: `containz(labels["env"], "staging")`,
},
Deny: types.RoleConditions{
ClusterLabelsExpression: `containz(labels["env"], "staging")`,
@@ -1010,6 +1021,7 @@ func TestValidateRole(t *testing.T) {
DatabaseServiceLabelsExpression: `containz(labels["env"], "staging")`,
WindowsDesktopLabelsExpression: `containz(labels["env"], "staging")`,
GroupLabelsExpression: `containz(labels["env"], "staging")`,
BeamLabelsExpression: `containz(labels["env"], "staging")`,
},
},
expectWarnings: []string{
@@ -1019,12 +1031,14 @@ func TestValidateRole(t *testing.T) {
"parsing allow.db_labels_expression",
"parsing allow.windows_desktop_labels_expression",
"parsing allow.cluster_labels_expression",
"parsing allow.beam_labels_expression",
"parsing deny.node_labels_expression",
"parsing deny.app_labels_expression",
"parsing deny.kubernetes_labels_expression",
"parsing deny.db_labels_expression",
"parsing deny.windows_desktop_labels_expression",
"parsing deny.cluster_labels_expression",
"parsing deny.beam_labels_expression",
"unsupported function: containz",
},
},
@@ -1204,6 +1218,7 @@ func BenchmarkValidateRole(b *testing.B) {
DatabaseLabels: types.Labels{"env": {`{{regexp.replace(external["allow-envs"], "^env-(.*)$", "$1")}}`}},
WindowsDesktopLabels: types.Labels{"env": {`{{regexp.replace(external["allow-envs"], "^env-(.*)$", "$1")}}`}},
ClusterLabels: types.Labels{"env": {`{{regexp.replace(external["allow-envs"], "^env-(.*)$", "$1")}}`}},
BeamLabels: types.Labels{"env": {`{{regexp.replace(external["allow-envs"], "^env-(.*)$", "$1")}}`}},
Rules: []types.Rule{
{
Resources: []string{types.KindRole},
@@ -3001,6 +3016,8 @@ func TestApplyTraits(t *testing.T) {
outGitHubPermissions []types.GitHubPermission
inMCPPermissions *types.MCPPermissions
outMCPPermissions *types.MCPPermissions
inBeamLabels types.Labels
outBeamLabels types.Labels
}
tests := []struct {
comment string
@@ -3825,6 +3842,29 @@ func TestApplyTraits(t *testing.T) {
},
},
},
{
comment: "Beam labels in allow and deny rules",
inTraits: map[string][]string{
"foo": {"bar"},
"baz": {"qux"},
},
allow: rule{
inBeamLabels: types.Labels{
"label1": {"{{external.foo}}"},
},
outBeamLabels: types.Labels{
"label1": {"bar"},
},
},
deny: rule{
inBeamLabels: types.Labels{
"label2": {"{{external.baz}}"},
},
outBeamLabels: types.Labels{
"label2": {"qux"},
},
},
},
}
for _, tt := range tests {
t.Run(tt.comment, func(t *testing.T) {
@@ -3858,6 +3898,7 @@ func TestApplyTraits(t *testing.T) {
KubernetesResources: tt.allow.inKubeResources,
GitHubPermissions: tt.allow.inGitHubPermissions,
MCP: tt.allow.inMCPPermissions,
BeamLabels: tt.allow.inBeamLabels,
},
Deny: types.RoleConditions{
Logins: tt.deny.inLogins,
@@ -3881,6 +3922,7 @@ func TestApplyTraits(t *testing.T) {
KubernetesResources: tt.deny.inKubeResources,
GitHubPermissions: tt.deny.inGitHubPermissions,
MCP: tt.deny.inMCPPermissions,
BeamLabels: tt.deny.inBeamLabels,
},
},
}
@@ -3915,6 +3957,7 @@ func TestApplyTraits(t *testing.T) {
require.Equal(t, rule.spec.outSudoers, outRole.GetHostSudoers(rule.condition))
require.Equal(t, rule.spec.outKubeResources, outRole.GetRoleConditions(rule.condition).KubernetesResources)
require.Equal(t, rule.spec.outGitHubPermissions, outRole.GetRoleConditions(rule.condition).GitHubPermissions)
require.Equal(t, rule.spec.outBeamLabels, outRole.GetRoleConditions(rule.condition).BeamLabels)
}
})
}
@@ -9648,6 +9691,13 @@ func TestCheckAccessWithLabelExpressions(t *testing.T) {
&types.WindowsDesktopV3{ResourceHeader: types.ResourceHeader{Kind: types.KindWindowsDesktop}},
&types.WindowsDesktopServiceV3{ResourceHeader: types.ResourceHeader{Kind: types.KindWindowsDesktopService}},
&types.UserGroupV1{ResourceHeader: types.ResourceHeader{Kind: types.KindUserGroup}},
types.Resource153ToResourceWithLabels(&beamsv1.Beam{
Kind: types.KindBeam,
Version: types.V1,
Metadata: &headerv1.Metadata{
Labels: map[string]string{},
},
}),
}
for _, r := range resources {
r.SetStaticLabels(map[string]string{"env": "prod"})