mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-04 19:12:46 +08:00
Paul Gottschling
f89e734090
* Create a partial for adding a role to a user Closes #16697 Closes #18373 * Address PR feedback * Edit the Kubernetes RBAC partial
72 lines
1.8 KiB
Plaintext
72 lines
1.8 KiB
Plaintext
Teleport's Access Request plugins authenticate to your Teleport cluster as a
|
|
user with permissions to list and read Access Requests. This way, plugins can
|
|
retrieve Access Requests from the Teleport Auth Service and present them to
|
|
reviewers.
|
|
|
|
Define a user and role called `access-plugin` by adding the following content to
|
|
a file called `access-plugin.yaml`:
|
|
|
|
```yaml
|
|
kind: role
|
|
version: v5
|
|
metadata:
|
|
name: access-plugin
|
|
spec:
|
|
allow:
|
|
rules:
|
|
- resources: ['access_request']
|
|
verbs: ['list', 'read']
|
|
- resources: ['access_plugin_data']
|
|
verbs: ['update']
|
|
---
|
|
kind: user
|
|
metadata:
|
|
name: access-plugin
|
|
spec:
|
|
roles: ['access-plugin']
|
|
version: v2
|
|
```
|
|
|
|
Create the user and role:
|
|
|
|
```code
|
|
$ tctl create -f access-plugin.yaml
|
|
```
|
|
|
|
As with all Teleport users, the Teleport Auth Service authenticates the
|
|
`access-plugin` user by issuing short-lived TLS credentials. In this case, we
|
|
will need to request the credentials manually by *impersonating* the
|
|
`access-plugin` role and user.
|
|
|
|
<ScopedBlock scope={["oss", "enterprise"]}>If you are using `tctl` from the Auth
|
|
Service host, you will already have impersonation privileges.</ScopedBlock>
|
|
|
|
To grant your user impersonation privileges for `access-plugin`, define a role
|
|
called `access-plugin-impersonator` by pasting the following YAML document into
|
|
a file called `access-plugin-impersonator.yaml`:
|
|
|
|
```yaml
|
|
kind: role
|
|
version: v5
|
|
metadata:
|
|
name: access-plugin-impersonator
|
|
spec:
|
|
allow:
|
|
impersonate:
|
|
roles:
|
|
- access-plugin
|
|
users:
|
|
- access-plugin
|
|
```
|
|
|
|
Create the `access-plugin-impersonator` role:
|
|
|
|
```code
|
|
$ tctl create -f access-plugin-impersonator.yaml
|
|
```
|
|
|
|
(!docs/pages/includes/add-role-to-user.mdx role="access-plugin-impersonator"!)
|
|
|
|
You will now be able to generate signed certificates for the `access-plugin`
|
|
role and user.
|