Teleport: Extend variable interpolation syntax

[klizhentas]

Description

Current role variables only support the following sytnax:

kuberentes_groups: ['{{variable_name}}']

with the proposal implemented, the following will become possible:

kuberentes_groups: ['IAM#{{variable_name}}-suffix']

In addition function calls will be possible with addition of regexp_replace function:

logins: ['{{regexp.replace(user.spec.traits[email], "^(.)@.*, "\1")}}']

Which is consistent with our current variable where syntax:

https://gravitational.com/gravity/docs/hub/#cluster-rbac-using-labels

where: contains(user.spec.traits["roles"], resource.metadata.labels["team"])

Functions

Two functions will be added:

Generic regexp replace function for common cases:

regexp.replace(what, expression, replacement)

Specific function to handle a very common edge case for capturing local part of the email:

email.local(user.spec.traits["email"])

Properties access

Our simplified version supported external and internal shortcuts. The extended version supports
access to arbitrary metadata of the user context:

# access to user traits dictionary
user.spec.traits
# access to user email trait
user.spec.traits["email"]
# access to cluster metadata labels
resource.metadata.labels

```

[klizhentas]

@benarent @russjones @webvictim @fspmarshall please review

[benarent]

This look good for adding extra data to variables.

My concern with regexp_replace is less to do with the syntax, but the unfriendliness of regex in general. In the example it looks like it has an unmatched closing parenthesis. We can help users by providing common examples in the docs, so the UX will be a little smoother.

[fspmarshall]

I like how this is shaping up. As interpolation becomes more feature-rich it may be worth having a dedicated subsection of the docs just for this.

[webvictim]

Yeah, 100% to an exclusive docs section. This is the sort of thing that's incredibly powerful, but also very hard for anyone who isn't involved with this stuff day-to-day to understand. It would also be very nice to output the evaluated role at DEBUG or even TRACE level logging - just to save manually having to evaluate options, count punctuation and stuff like that.

We should also define _exactly_ what values can be used, so:

• where does external.traits come from and what other values might be acceptable?
• how does the customer show a list of usable traits for their own IDP?
• is there a difference between internal and external traits, and if so, what?

Our docs are currently pretty nebulous on this for things like RBAC - we often get questions on "what's the full list of RBAC verbs supported and what does each one do?"

[klizhentas]

@webvictim @fspmarshall @benarent @russjones good follow ups. I have added some clarifications. Note, most parts are already implemented and are part of Gravity featureset and Teleport feature set.

[aelkugia]

This was addressed in 4.2.6. Closing ticket

[webvictim]

This actually wasn't addressed fully in 4.2.6. It's my understanding that support was added for email.local but not for regexp.replace. @klizhentas Please confirm?

I think if we want to close this then we should change the scope of this issue and open a new one for the missing feature.