Add static host user proto defs #44610
Conversation
atburke
added
no-changelog
| @@ -0,0 +1,44 @@ | |||
| syntax = "proto3"; | |||
|
|
|||
| package teleport.statichostuser.v1; | |||
There was a problem hiding this comment.
What do you think about generalizing the package a bit to encompass all of auto user provisioning?
| package teleport.statichostuser.v1; | |
| package teleport.userprovisioning.v1; |
| rpc CreateStaticHostUser(CreateStaticHostUserRequest) returns (CreateStaticHostUserResponse); | ||
| // UpdateStaticHostUser updates an existing static host user. | ||
| rpc UpdateStaticHostUser(UpdateStaticHostUserRequest) returns (UpdateStaticHostUserResponse); | ||
| // UpsertStaticHostUser creates a new static host user or forcefully updates an existing static host user. | ||
| rpc UpsertStaticHostUser(UpsertStaticHostUserRequest) returns (UpsertStaticHostUserResponse); |
There was a problem hiding this comment.
https://github.com/gravitational/teleport/blob/master/rfd/0153-resource-guidelines.md#create
https://github.com/gravitational/teleport/blob/master/rfd/0153-resource-guidelines.md#update
https://github.com/gravitational/teleport/blob/master/rfd/0153-resource-guidelines.md#upsert
| rpc CreateStaticHostUser(CreateStaticHostUserRequest) returns (CreateStaticHostUserResponse); | |
| // UpdateStaticHostUser updates an existing static host user. | |
| rpc UpdateStaticHostUser(UpdateStaticHostUserRequest) returns (UpdateStaticHostUserResponse); | |
| // UpsertStaticHostUser creates a new static host user or forcefully updates an existing static host user. | |
| rpc UpsertStaticHostUser(UpsertStaticHostUserRequest) returns (UpsertStaticHostUserResponse); | |
| rpc CreateStaticHostUser(CreateStaticHostUserRequest) returns (StaticHostUser); | |
| // UpdateStaticHostUser updates an existing static host user. | |
| rpc UpdateStaticHostUser(UpdateStaticHostUserRequest) returns (StaticHostUser); | |
| // UpsertStaticHostUser creates a new static host user or forcefully updates an existing static host user. | |
| rpc UpsertStaticHostUser(UpsertStaticHostUserRequest) returns (StaticHostUser); |
| if u.Spec.NodeLabels != nil { | ||
| for key, value := range u.Spec.NodeLabels.Values { | ||
| if key == types.Wildcard && !(len(value.Values) == 1 && value.Values[0] == types.Wildcard) { | ||
| return trace.BadParameter("selector *:<val> is not supported") | ||
| } | ||
| } | ||
| } |
There was a problem hiding this comment.
This validation appears to be much more lax than the validation of equivalent fields of a role.
https://github.com/gravitational/teleport/blob/master/lib/services/role.go#L251
https://github.com/gravitational/teleport/blob/master/lib/services/role.go#L334-L348
There was a problem hiding this comment.
Trait templating doesn't apply here because when we create a host user, there won't be a user to pull traits from. I tried adding the expression validation, but it would require moving a LOT of stuff from lib/utils to api/utils and I think it would be much simpler to just do that in lib/services like we do for roles.
There was a problem hiding this comment.
I think it might make more sense for validation logic to be moved out of api and into a place that can make use of lib/utils in that case. If you want to omit it here and move it to lib/services or similar in a future PR that's fine with me.
| // node_labels is a map of node labels (used to dynamically grant access to | ||
| // nodes). |
There was a problem hiding this comment.
Here and below, update the comment since the labels here are used to select nodes, not to grant access to nodes.
| // node_labels is a map of node labels (used to dynamically grant access to | |
| // nodes). | |
| // node_labels is a map of node labels that will create a user | |
| // for this resource |
public-teleport-github-review-bot
bot
removed the request for review
from rudream
This change adds the proto definition for the static host user resource and its gRPC service.
atburke
force-pushed
the
atburke/static-user-proto
branch
from
fa529da to
a134b2d
Compare
This change adds the proto definition for the static host user resource and its gRPC service.
This change adds the proto definition for the static host user resource (RFD 175) and its gRPC service.
Part of #42712.