* Fix Moderated session on leave pause action.
* Unpause when moderator rejoins session with onLeave=pause
This commite fixes a case when the moderator rejoins a paused session
but Teleport didn't resume the operations and the session was still
locked to everyone.
* Fix panic when re-joining SSH session.
* Update lib/kube/proxy/sess.go
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
* Update lib/kube/proxy/sess.go
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
* Fix typo
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
---------
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
This PR includes a new Role resource version that is compatible with V5 spec.
The new resource introduces the `kubernetes_resources` definition that allows operators to limit the Kubernetes resources that each member can access. The `kubernetes_resources` entries must follow the following format: `{"kind":"<kind>", "namespace":"<namespace>","name":"<pod>"}`. Currently, it only supports objects of `kind` `pod`. Valid examples `<namespace>/<name>:
- `*/*`: matches all pods in all namespaces.
- `default/*`: matches all pods in the `default` namespace.
- `*/nginx-*`: matches every pod prefixed with `nginx-` in every namespace.
For older resource versions - V5, V4, V3 - `kubernetes_resources` is automatically populated with `{"kind":"pod","namespace":"*","name":"*"}` to keep compatibility. For the newest version, it's mandatory to define its value otherwise access to pods will be denied.
Part of #18434
As pointed out in #15898, our moderated session filters use user.roles instead of user.spec.roles as the rest of Teleport.
This change adds support for both formats, so we don't break the existing filters and support the desired one.
