* [Backend]: allow more db fields to be updatable
* Add preventing duplicate keys for label creator
* Add sort compare fn helper
* Update db request update object
* Update CreateDatabase component
- Uncomment and touch up db service checker
- Fix db service label checking
- Allow user to make changes to updatable db fields
- Split defining db name and the other fields into
two views, to prevent user from changing the db name
which is not allowed with the update action
* Address CR: use nil value to determine CACert update
* Few more touch ups
- address CR: don't OR update db request field CACert
and use consistent camelCasing
- remove the skip button for deploying service since
we have the service checker now, which auto skips it
for user if detects service
- refactor label matching for both register database
and deploy service steps
* Address CR: make all fields updatable
* Update service polling after rebase
* Add RBAC labels for Databas Services access
This PR adds a new set of Labels that controls access to the
DatabaseService resource.
We changed the `RoleSet.checkAccess` to allow for checks in Resources
without Labels.
However adding complexity to this function is something that can bit us
in the future.
So, this PR reverts that change and adds a new set of labels.
Those labels will control whether the RoleSet has access to
DatabaseServices.
Given that this is a new condition that we add to the default `editor`
role, we had to create a migration/backfill for the roles that don't
have them.
This allow us to migrate the roles created previously and add this new
allow condition.
* remove preset for remote proxy and database labels
* Remove db_service_labels wildcard from editor preset role
* Fix early exit logic
This PR includes a new Role resource version that is compatible with V5 spec.
The new resource introduces the `kubernetes_resources` definition that allows operators to limit the Kubernetes resources that each member can access. The `kubernetes_resources` entries must follow the following format: `{"kind":"<kind>", "namespace":"<namespace>","name":"<pod>"}`. Currently, it only supports objects of `kind` `pod`. Valid examples `<namespace>/<name>:
- `*/*`: matches all pods in all namespaces.
- `default/*`: matches all pods in the `default` namespace.
- `*/nginx-*`: matches every pod prefixed with `nginx-` in every namespace.
For older resource versions - V5, V4, V3 - `kubernetes_resources` is automatically populated with `{"kind":"pod","namespace":"*","name":"*"}` to keep compatibility. For the newest version, it's mandatory to define its value otherwise access to pods will be denied.
Part of #18434
* DatabaseService resource: client and server CRUD
In the context of Teleport Discover, we must be able to known if there's
any DatabaseService available to proxy a given Database resource.
If there's none available, we will offer a script for the user to run
and install a DatabaseService which proxies the desired Database
resource.
By DatabaseService, we mean the process that Teleport binary manages
when the `teleport.yaml` config has the following section:
```yaml
db_service:
enabled: "yes"
```
To accomplish this we are creating a new resource: DatabaseService.
The UI will fetch all DatabaseServices and check if there's any
ResourceMatcher that matches the DatabaseLabels.
A previous PR created the DatabaseService resource.
This PR creates all the necessary CRUD operations:
- Add Service to manage DatabaseServices resources in the backend.
- Add GetAll, Upsert, Delete and DeleteAll operations to Client.
- Add DatabaseService support to ListResources.
- Add WebAPI endpoint to list DatabaseServices using ListResources.
The next PR will add the heartbeat mechanism to the DatabaseService
process.
* Add db access rule required for db discovery
in editors role
For the webapi layer:
* Return db access with user context
* Add AWS RDS fields for creating db request
* Return hostname of each queried db server
This commit adds two new endpoints:
Create a database with
```
POST .../databases
{
"name": "<databasename>",
"protocol": "<protocol>",
"uri": "<uri>",
"labels": [{"name":"<name>", "value": "<value>"}...]
}
```
Update a database's `ca_cert` (the only updatable field for now)
```
PUT .../databases/:database
{
"ca_cert": "------BEGIN CERTIFICATE-----\n <certificate> --END..."
}
```
Lisa Kim