* Predicate expressions using the "name" identifier will now use
field "hostname" when `ls` querying for nodes, as expected by
the user
* Change predicate expression for access request that use
name identifier to using the actual json field names
* Add `where` predicate and Machine ID support to SSH host certificates
This adds `where` RBAC predicate support to `host_cert`
pseudo-resources, and adds support for requesting host certs to
Machine ID (with or without these RBAC predicates).
More specifically, this:
* Makes 3 new set functions available during `where` predicate
evaluation: `all_equal`, `all_end_with`, and `is_subset`. These
make it possible to examine the `host_cert.principals` field.
* Adds a new optional `host_cert` field to the standard `where`
context. It's only ever set specifically in `GenerateHostCert()`.
* Sets a custom context in `GenerateHostCert()` to pass along host
cert parameters.
* Makes current config available to tbot config templates
* Adds a new `ssh_host_cert` config template to Machine ID
* Refactors `tbot/config` tests to use shared mock bot / auth
implementations.
Host certs can be requested in Machine ID by adding a new config
template:
```yaml
destinations:
- directory: /opt/machine-id
configs:
- ssh_host_cert:
principals: [foo.example.com]
```
Bots will need a role like the following:
```yaml
kind: role
metadata:
name: hostcert-bot
version: v5
spec:
allow:
rules:
- resources:
- host_cert
verbs:
- create
where: 'is_subset(host_cert.principals, "foo.example.com")'
```
See the RFD for more information:
https://github.com/gravitational/teleport/blob/master/rfd/0083-machine-id-host-certs.md
* Fix lint failure
* Improve doc comments on the new predicate functions.
* Address review feedback
* Address review feedback
- Remove `AuthenticatedUserClientFromIdentity`'s unnecessary
AuthServer param
- Add missing doc comments
- Pull out `getTestIdent` from the Kubernetes template test
- Move various test helpers into their own file
- Unexport new predicate functions
Created a predicate parser that's customized for our
ResourceWithLabels. Plan is to allow UI and CLI users
to use this predicate language to filter resources by
labels and json fields.
Also updates vulcand/predicate to latest v1.2.0
Part of RFD 55
Lisa Kim