* kube: Return errors when users aren't allowed to list resources
Previously to this commit, if the user was denied to list resources from
a certain namespace, Teleport would return an empty list instead of
returning an error if it's impossible for the request to match any
resource in that namespace.
This commit returns an error for cases where the role's
`kubernetes_resources` denies any resource to be returned. This is a
small nit to incorporate some customer expectations.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Update lib/utils/replace.go
Co-authored-by: Hugo Shaka <hugo.hervieux@goteleport.com>
* handle code review suggestions
* Update lib/utils/replace.go
Co-authored-by: Anton Miniailo <anton@goteleport.com>
* fix test names
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: Hugo Shaka <hugo.hervieux@goteleport.com>
Co-authored-by: Anton Miniailo <anton@goteleport.com>
This PR adds a RBAC controll logic for Kubernetes Custom Resources.
Access to clustom resources is determined by the access level of the
namespace resource where the custom resource is defined.
This is a special case because custom resources are not defined in the
user's resources list.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
This PR corrects the behavior of handling namespaces for Kubernetes
per-Resource RBAC.
The new behavior allows accessing the resources withing the namespace
`someNamespace` if a rule `kind: namespace, name: someNamespace` is
defined for `kubernetes_resources`.
It also allows users to see namespaces (list, get or watch requests) if
they have other resources defined for the namepsace without requiring
explicit rules for `kind:namespace, name: someNamespace`.
As an example:
```yaml
allow:
kubernetes_resources:
- kind: namespace
name: someNamespace
- kind: pod
namespace: otherNamespace
name: *
```
Reads as: the user has access to everything in namespace someNamespace
AND to pods in otherNamespace.
```
$ kubectl get ns
someNamespace
otherNamespace
```
Pods:
```
$ kubectl get pods -n someNamespace
pod1
pod2
$ kubectl get pods -n otherNamespace
pod3
pod4
```
Other resources:
```
$ kubectl get secret -n someNamespace
secret1
secret2
$ kubectl get secret -n otherNamespace
REQUEST IS DENIED
```
* Extend Teleport RBAC to suport Kubernetes Verbs
This PR extends Teleport per-Resource RBAC to support Kubernetes verbs
restriction. With this change it's possible to restrict certain actions
allowed by the underlying `kubernetes_users` and `kubernetes_resources`.
Supported verbs:
- `get`
- `create`
- `update`
- `patch`
- `delete`
- `list`
- `watch`
- `deletecollection`
Fixes#27095
* address timr's comments
* assign wildcard to verbs for role <7
* address marco's reviews
This PR introduces a mechanism to control access to Pods in Kubernetes clusters based on access criteria defined in user Roles or Resource Access Requests.
New `Role` version - `v6` - introduced a new field `kubernetes_resources` that allows admins to restrict access to a subset of cluster resources based on the configuration provided.
This PR implements the resource control for `pods` and allows
```yaml
kubernetes_resources:
- kind: pod
name: nginx-*
namespace: default
- kind: pod
name: *
namespace: dev
```
It also implements the logic blocks for supporting Resource Access Requests to Kubernetes Pods. The tsh boilerplate is not included in this PR and will be included in future PRs.
An example of usage:
```
tsh request search --kind pod --kube-cluster=minikube
Name Namespace Labels Resource ID
--------------------------------- --------- -------------------------------------- ---------------------------------------------
nginx-deployment-6595874d85-6j2zm default app=nginx,pod-template-hash=6595874d85 /tele.teleport.local/pod/minikube/default/...
nginx-deployment-6595874d85-7xgmb default app=nginx,pod-template-hash=6595874d85 /tele.teleport.local/pod/minikube/default/...
nginx-deployment-6595874d85-c4kz8 default app=nginx,pod-template-hash=6595874d85 /tele.teleport.local/pod/minikube/default/...
test default run=test /tele.teleport.local/pod/minikube/default/...
To request access to these resources, run
> tsh request create --resource /tele.teleport.local/pod/minikube/default/nginx-deployment-6595874d85-6j2zm --resource /tele.teleport.local/pod/minikube/default/nginx-deployment-6595874d85-7xgmb --resource /tele.teleport.local/pod/minikube/default/nginx-deployment-6595874d85-c4kz8 --resource /tele.teleport.local/pod/minikube/default/test \
--reason <request reason>
```
Part of #18434
