Teleport: [Feature Request] Allow RBAC based on node_labels with same key with multiple values

[ken5scal]

What happened: This is an issue to request a feature.

What you expected to happen:

• What we want: Allowing to declare node_labels which permits certain role to login nodes which share same key but different values.

For example, say there are two nodes each have a label "application -> web01" or "application -> web02". We would want a 'web' role to be able to login both nodes; but
it is not available yet (correct me if I'm wrong) , because spec.allow.node_labels do not allow to declare in a such way.

kind: role
version: v3
metadata:
  name: web
spec:
  allow:
    logins: [root, '{{internal.logins}}']

    # node labels that a user can connect to. The wildcard ('*') means "any node"
    # Following is not Possible★★
    # node_labels:
    #   application: web0\d   <-  ★★regex is not supported

    # node_labels:
    #   application: web01   <-  ★★node_labels with same key w/ multiple values are not supported
    #   application: web02   

   # node_lables:
   #      application:      <- ★★ this is not supported as well.
   #          - web01
   #          - web02

So either implementing regex expression, the map[label_key][]label_value could be nice for us.

How to reproduce it (as minimally and precisely as possible):
n/a

Environment:

• Teleport version (use teleport version): Teleport Enterprise v2.6.7 git:v2.6.7-0-g280f0fe3
• Tsh version (use tsh version): Teleport v2.6.7 git:v2.6.7-0-g280f0fe3
• OS (e.g. from /etc/os-release): N/A

Browser environment
N/A
Relevant Debug Logs If Applicable
N/A

[klizhentas]

I think node_labels as a list not as a map is a good idea @kontsevoy what do you think?

[klizhentas]

Actually, thinking about it a bit more, it would be more aligned with https://github.com/gravitational/teleport/issues/2052 to support regular expressions in RBAC node labels just as we added for role mapping

[klizhentas]

allow:
  node_labels:
    'env: '^production|staging$'
deny:
  node_labels:
    'env: '^test$'

[klizhentas]

The upside of this approach in addition to being flexible it does not include any migrations or structure changes, so it will be easy to add.

[kontsevoy]

@klizhentas love it.

[klizhentas]

ok, for the record, we have decided to support both formats:

scalar values with regexp

allow:
  node_labels:
    'env: '^production|staging$'
deny:
  node_labels:
    'env: '^test$'

list values:

allow:
  node_labels:
    'env: ['^production|staging$', 'test']
deny:
  node_labels:
    'env: ['^test$', 'list']

[klizhentas]

k, I'm going to close this one as it has been partially implemented and create a new one just for regular expressions.

[ken5scal]

@klizhentas Thanks for yor implementation! when is it going to be available in enterprise version?

[klizhentas]

It's going to be available in the next 2.7.x release upgrade this week.

[ken5scal]

tx!