mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-01 21:52:02 +08:00
Tim Buckley
81f42bbaed
* Add `where` predicate and Machine ID support to SSH host certificates
This adds `where` RBAC predicate support to `host_cert`
pseudo-resources, and adds support for requesting host certs to
Machine ID (with or without these RBAC predicates).
More specifically, this:
* Makes 3 new set functions available during `where` predicate
evaluation: `all_equal`, `all_end_with`, and `is_subset`. These
make it possible to examine the `host_cert.principals` field.
* Adds a new optional `host_cert` field to the standard `where`
context. It's only ever set specifically in `GenerateHostCert()`.
* Sets a custom context in `GenerateHostCert()` to pass along host
cert parameters.
* Makes current config available to tbot config templates
* Adds a new `ssh_host_cert` config template to Machine ID
* Refactors `tbot/config` tests to use shared mock bot / auth
implementations.
Host certs can be requested in Machine ID by adding a new config
template:
```yaml
destinations:
- directory: /opt/machine-id
configs:
- ssh_host_cert:
principals: [foo.example.com]
```
Bots will need a role like the following:
```yaml
kind: role
metadata:
name: hostcert-bot
version: v5
spec:
allow:
rules:
- resources:
- host_cert
verbs:
- create
where: 'is_subset(host_cert.principals, "foo.example.com")'
```
See the RFD for more information:
https://github.com/gravitational/teleport/blob/master/rfd/0083-machine-id-host-certs.md
* Fix lint failure
* Improve doc comments on the new predicate functions.
* Address review feedback
* Address review feedback
- Remove `AuthenticatedUserClientFromIdentity`'s unnecessary
AuthServer param
- Add missing doc comments
- Pull out `getTestIdent` from the Kubernetes template test
- Move various test helpers into their own file
- Unexport new predicate functions
54 lines
1.9 KiB
Go
54 lines
1.9 KiB
Go
/*
|
|
Copyright 2022 Gravitational, Inc.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package config
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/gravitational/teleport/api/client/proto"
|
|
"github.com/gravitational/teleport/api/client/webclient"
|
|
"github.com/gravitational/teleport/api/types"
|
|
"github.com/gravitational/teleport/lib/auth"
|
|
"github.com/gravitational/teleport/lib/tbot/identity"
|
|
)
|
|
|
|
// Bot is an interface covering various public tbot.Bot methods to circumvent
|
|
// import cycle issues.
|
|
type Bot interface {
|
|
// AuthPing pings the auth server and returns the (possibly cached) response.
|
|
AuthPing(ctx context.Context) (*proto.PingResponse, error)
|
|
|
|
// ProxyPing returns a (possibly cached) ping response from the Teleport proxy.
|
|
// Note that it relies on the auth server being configured with a sane proxy
|
|
// public address.
|
|
ProxyPing(ctx context.Context) (*webclient.PingResponse, error)
|
|
|
|
// GetCertAuthorities returns the possibly cached CAs of the given type and
|
|
// requests them from the server if unavailable.
|
|
GetCertAuthorities(ctx context.Context, caType types.CertAuthType) ([]types.CertAuthority, error)
|
|
|
|
// Client retrieves the current auth client.
|
|
Client() auth.ClientI
|
|
|
|
// AuthenticatedUserClientFromIdentity returns a client backed by a specific
|
|
// identity.
|
|
AuthenticatedUserClientFromIdentity(ctx context.Context, id *identity.Identity) (auth.ClientI, error)
|
|
|
|
// Config returns the current bot config
|
|
Config() *BotConfig
|
|
}
|