mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-02 23:31:08 +08:00
rosstimothy
3c0e27b4f8
Historically proxy templates have only supported an exact hostname
match via the `Host` field defined. This limits some of the benefits
of using proxy templates and forces users to do a bunch of extra
work in their ssh config. For example, if a user today wanted to
leverage proxy templates to connect to a host via a label, predicate
expression, or fuzzy match, they would be required to use tsh ls,
find the matching UUID or hostname and provide that to tsh for
evaluation with the template expression.
SSH Config:
```
Match Host *.example.com
ProxyCommand tsh proxy ssh %r@$(tsh ls --search=$(echo %h | cut -d. -f1) -f json | jq -r '.[0].metadata.name'):%p
```
The above requires multiple subshells, a connection to the Auth
server, and jq to be installed on the client machine in order to
work.
To reduce the amount of effort required to connect to a resource
proxy templates have been updated with a `Search` and a `Query`
field to support fuzzy search and predicate expressions much like
`tsh ls --search` and `tsh ls --query`. The order of operations
for matching the target host is: 1) Host, 2) Predicate Expression,
3) Query.
In addition to the proxy template changes, tsh proxy ssh
has also been updated to allow resolving the target via
searching or querying -- though ONLY via proxy templates.
There are no additional `--query` or `--search` flags added
to tsh proxy ssh for the time being. This is mostly for CLI UX
reasons since neither tsh ssh or tsh proxy ssh support those
flags today, and only allow filtering by label via supplying
key value pairs in the hostname (tsh ssh alice@foo=bar,env=dev).
tsh proxy ssh is however still limited to connecting to a single
host at a time. If there are no matches, or multiple matches found
as a result of target resolution, then an error is returned.
With the new functionality, the above example can be simplified to
the following.
SSH Config:
```
Match Host *.example.com
ProxyCommand tsh proxy ssh %r@%h
```
Proxy Template:
```
- template: '^(.*).example.com:\d+$'
search: "$1"
```
This shifts the resposibility of host resolution from the caller
to tsh. It allows resolution to happen in the same process that
will initiate the connection, reducing a dial to the cluster, and
eliminating the need for any subshells, or extra tools outside
of tsh to be present.