This PR includes a new Role resource version that is compatible with V5 spec.
The new resource introduces the `kubernetes_resources` definition that allows operators to limit the Kubernetes resources that each member can access. The `kubernetes_resources` entries must follow the following format: `{"kind":"<kind>", "namespace":"<namespace>","name":"<pod>"}`. Currently, it only supports objects of `kind` `pod`. Valid examples `<namespace>/<name>:
- `*/*`: matches all pods in all namespaces.
- `default/*`: matches all pods in the `default` namespace.
- `*/nginx-*`: matches every pod prefixed with `nginx-` in every namespace.
For older resource versions - V5, V4, V3 - `kubernetes_resources` is automatically populated with `{"kind":"pod","namespace":"*","name":"*"}` to keep compatibility. For the newest version, it's mandatory to define its value otherwise access to pods will be denied.
Part of #18434
* Add app access support to Machine ID
This adds support for app access to Machine ID. Users can specify a
new destination-level `app` field which will request certificates
with the given app. Users can then either open a proxied connection
to the app, or supply the credentials via `curl` and access the app
through the public-facing proxy.
This includes a small change to `tsh` to support identity files in
various app-related commands (`proxy app`, `app ls`, etc). The
existing `tsh` wrappers in `tbot` automatically support these app
commands.
* Add app request test
* Clean up test
* Update lib/tbot/config/config_destination.go
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
* Address review feedback
* Simplify `getApp` call
* Simplify `getApp` further
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
* start hashing out machine id CA rotation
* filter out incoming ca events by type
* support multiple trusted certificate authorities in known_hosts
* remove redundant trace.Debug from `tbot` `main()`
* filter to only recieve relevant CA events
* add exponential backoff to renewal
* remove unnecessary `.Ping()` check with new client
* add unit test for filtering CA events
* debounce reloads
* add retry limit and backoff for CA watching
* add integration test for CA rotation
* modify CA rotation watcher loop to retry forever
Co-authored-by: Tim Buckley <tim@goteleport.com>
* Properly handle empty list of role requests
Currently, an empty list of role requests results in an ambiguous
situation: we usually use the presence of role requests to determine
whether or not we'd return impersonated certs or not. An empty list
of role requests returns a fresh set of non-impersonated certs
(possibly renewed if allowed), while a non-empty list of role requests
returns certs with just those roles. However, if a client _intends_
to request impersonated certs but provides an empty list of role
requests it will instead receive non-impersonated (possibly renewable)
certs with the full permissions of the original user.
This could theoretically result in privilege escalation if a Machine
ID bot: (a) had any worthwhile permissions of its own, which is not
the case unless the bot role was manually modified and (b)
accidentally handed certs off to an attacker.
In practice this bug is fairly difficult to hit: `tbot` always
auto-fills all requestable roles if they are otherwise unset, and
`tctl bots add` requires `--roles=` to be passed. An empty string
here can trigger the bug however it is unlikely a user would pass this
by accident. Moreover, a bot without requestable roles cannot
accomplish much of anything, so this is exceedingly unlikely to
be intended behavior.
Additionally, certificate generation checks help to mitigate the
issue: bots currently lock themselves by accident after the first
renewal when this bug is triggered as they don't explicitly handle
receiving renewable certs when impersonated certs are expected. If an
attacker were to attempt a renewal, the generation counter would
similarly limit access, and as noted previously, the bot role grants
only minimal read-only access anyway.
---
To resolve the issue, this adds a new `RoleRequestsOnly` flag to
`UserCertsRequest` that allows clients to unambiguously specify if
they wish to receive a non-impersonated, possibly renewable, cert with
all the original user's roles and permissions, or if they wish to
receive only role-impersonated certs (or an error if roles are empty).
Machine ID passes this flag in all situations where an impersonated
cert is desired.
Additionally, we also now ensure users add at least one role in
`CreateBot()` (called by `tctl bots add`) as this is almost certainly
an unintended situation.
Fixes#13411
* Address review feedback, rename flag to UseRoleRequests
* Return a local error if no roles are specified
* start refactoring tbot to have a core struct
* refactor tbot into lib/
* move `tbot` subpackages to `lib/tbot`
* remove mutex pointer
* move `tshwrap` to `lib/` from `/tool/tbot/`
* move new template ssh client render test to lib/
* address pr feedback
* add request changed
Tiago Silva