mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-04 02:21:02 +08:00
Tiago Silva
f07d0079ef
GKE Autopilot clusters deny impersonating `system:masters` kubernetes group due to security reasons ( https://cloud.google.com/kubernetes-engine/docs/concepts/autopilot-security#built-in-security ). Since it is the only product that enforces this and most administrators impersonate `system:masters`, this limitation has created too many difficulties in being understood. First because the error is not clear enough and second because it doesn't explain what's the real problem and what part of the Teleport fails. This PR tries to solve the problem by changing the original error message to a more user-friendly, one that better explains the problem and its origin. Example of response body that is rewritten: > Error from server (Forbidden): groups "system:masters" is forbidden: > User "<user>" cannot impersonate resource "groups" in API group "" at the cluster > scope: GKE Warden authz [denied by user-impersonation-limitation]: impersonating > system identities are not allowed The rewritten response body will look like: > Error from server (Forbidden): "GKE Autopilot denied the request because it impersonates the "system:masters" group. > Your Teleport Roles [role1,role2] have given access to the "system:masters" group for the cluster "<cluster>". > For additional information and resolution, please visit https://goteleport.com/docs/kubernetes-access/troubleshooting/#unable-to-connect-to-gke-autopilot-clusters Fixes #28506