Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Apply static host users to nodes #46365

Merged
merged 1 commit into from
Sep 11, 2024
Merged

Apply static host users to nodes #46365

merged 1 commit into from
Sep 11, 2024

Conversation

atburke
Copy link
Contributor

@atburke atburke commented Sep 7, 2024

This change adds functionality to create host users on a node from matching static host user resources.

Part of #42712.

Changelog: Added user provisioning from static host user resources

lib/srv/regular/sshserver.go Outdated Show resolved Hide resolved
lib/srv/regular/sshserver.go Outdated Show resolved Hide resolved
lib/srv/regular/sshserver.go Outdated Show resolved Hide resolved
lib/srv/regular/sshserver.go Outdated Show resolved Hide resolved
lib/srv/regular/sshserver.go Outdated Show resolved Hide resolved
lib/srv/regular/sshserver.go Outdated Show resolved Hide resolved
lib/service/service.go Outdated Show resolved Hide resolved
lib/srv/regular/sshserver.go Outdated Show resolved Hide resolved
lib/srv/ctx.go Outdated Show resolved Hide resolved
lib/srv/regular/sshserver.go Outdated Show resolved Hide resolved
lib/srv/regular/sshserver.go Outdated Show resolved Hide resolved
lib/srv/statichostusers.go Outdated Show resolved Hide resolved
lib/srv/statichostusers.go Outdated Show resolved Hide resolved
lib/srv/statichostusers.go Outdated Show resolved Hide resolved
lib/srv/statichostusers.go Outdated Show resolved Hide resolved
lib/srv/usermgmt.go Show resolved Hide resolved
lib/srv/usermgmt_test.go Show resolved Hide resolved
return trace.Wrap(err)
}
if hasStaticGroup {
ui.Groups = append(ui.Groups, types.TeleportStaticGroup)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since this is the same path as non-static host user creation, this means a static user's group assignments can be modified if you have a role that allows logging in as that user. Is that something that we should allow? It seems like you might want a static user to always have a particular set of groups assigned, regardless of whether or not a user starts a session against it.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Definitely not. Static host users should be 100% distinct from auto user creation.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Groups will only be updated if both the existing user and mode are static. I think the shared keep mode was obscuring that, it should be clearer now with the internal enum.

lib/srv/statichostusers.go Outdated Show resolved Hide resolved
lib/srv/statichostusers.go Outdated Show resolved Hide resolved
lib/srv/statichostusers.go Outdated Show resolved Hide resolved
Comment on lines 83 to 89
retry, err := retryutils.NewLinear(retryutils.LinearConfig{
Step: 100 * time.Millisecond,
Max: time.Second,
})
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we should mimic the linear config specified by other resource watchers: https://github.com/gravitational/teleport/blob/master/lib/services/watcher.go#L138-L144.

lib/srv/statichostusers.go Show resolved Hide resolved
lib/srv/statichostusers.go Outdated Show resolved Hide resolved
lib/cache/cache_test.go Outdated Show resolved Hide resolved
lib/srv/statichostusers.go Outdated Show resolved Hide resolved
This change adds functionality to create host users on a node from
matching static host user resources.
@atburke atburke force-pushed the atburke/static-user-apply branch from 5914aab to 87e95ec Compare September 11, 2024 17:27
@atburke atburke added this pull request to the merge queue Sep 11, 2024
Merged via the queue into master with commit 70c8679 Sep 11, 2024
40 checks passed
@atburke atburke deleted the atburke/static-user-apply branch September 11, 2024 18:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants