Tim Buckley 81f42bbaed Add where predicate and Machine ID support to SSH host certificates (#16261) ...

* Add `where` predicate and Machine ID support to SSH host certificates

This adds `where` RBAC predicate support to `host_cert`
pseudo-resources, and adds support for requesting host certs to
Machine ID (with or without these RBAC predicates).

More specifically, this:
 * Makes 3 new set functions available during `where` predicate
   evaluation: `all_equal`, `all_end_with`, and `is_subset`. These
   make it possible to examine the `host_cert.principals` field.
 * Adds a new optional `host_cert` field to the standard `where`
   context. It's only ever set specifically in `GenerateHostCert()`.
 * Sets a custom context in `GenerateHostCert()` to pass along host
   cert parameters.
 * Makes current config available to tbot config templates
 * Adds a new `ssh_host_cert` config template to Machine ID
 * Refactors `tbot/config` tests to use shared mock bot / auth
   implementations.

Host certs can be requested in Machine ID by adding a new config
template:
```yaml
destinations:
  - directory: /opt/machine-id
    configs:
      - ssh_host_cert:
          principals: [foo.example.com]
```

Bots will need a role like the following:
```yaml
kind: role
metadata:
  name: hostcert-bot
version: v5
spec:
  allow:
    rules:
      - resources:
          - host_cert
        verbs:
          - create
        where: 'is_subset(host_cert.principals, "foo.example.com")'
```

See the RFD for more information:
https://github.com/gravitational/teleport/blob/master/rfd/0083-machine-id-host-certs.md

* Fix lint failure

* Improve doc comments on the new predicate functions.

* Address review feedback

* Address review feedback

- Remove `AuthenticatedUserClientFromIdentity`'s unnecessary
  AuthServer param
- Add missing doc comments
- Pull out `getTestIdent` from the Kubernetes template test
- Move various test helpers into their own file
- Unexport new predicate functions

2022-09-14 20:18:05 +00:00

..

kubeconfig.yaml.golden

Add where predicate and Machine ID support to SSH host certificates (#16261)

2022-09-14 20:18:05 +00:00