TeleportScopedRoleV1
resources.teleport.dev / v1
apiVersion: resources.teleport.dev/v1
kind: TeleportScopedRoleV1
metadata:
name: example
apiVersion
string
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
kind
string
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
metadata
object
scope
string
Scope is the scope of the role resource.
spec object
ScopedRole resource definition v1 from Teleport
app object
The App Access specific configuration for a scoped role.
client_idle_timeout
string
Overrides the defaults block idle timeout specifically for app sessions. Must be a valid Go duration string (e.g. "30m", "1h"). If empty, the defaults block value (or global default) applies.
disconnect_expired_cert
boolean
DisconnectExpiredCert controls whether App sessions are disconnected when the user certificate expires. If empty, the defaults block value (or global default) applies.
label_expression
string
LabelExpression is an optional predicate expression evaluated against an application's labels.
labels []object
The set of application labels used for RBAC.
name
string
The name of the label.
values
[]string
The values associated with the label.
lock object
Lock configures the role's locking behavior for app sessions. If empty, the defaults block value (or global default) applies.
mode
string
Allowed values: strict or best_effort. Defaults to value cluster wide auth preference if not set.
assignable_scopes
[]string
AssignableScopes is a list of scopes to which this role can be assigned.
defaults object
Defaults specifies default values for controls common across multiple protocols. If the same control specified in defaults is also specified in a protocol block, the value in the protocol block takes precedence.
client_idle_timeout
string
ClientIdleTimeout sets the default idle timeout for access sessions across all protocols that do not specify their own value. Must be a valid Go duration string (e.g. "30m", "1h"). The cluster-wide default is used only when neither this nor the protocol's equivalent control is set.
disconnect_expired_cert
boolean
DisconnectExpiredCert defines the default behavior of all protocols when certs expire for a session. The cluster-wide default is used only when neither this nor the protocol's equivalent control is set.
lock object
Lock specifies the default locking mode for access sessions across all protocols that do not specify their own value. The cluster-wide default is used only when neither this nor the protocol's equivalent control is set.
mode
string
Allowed values: strict or best_effort. Defaults to value cluster wide auth preference if not set.
session_recording object
SessionRecording configures the session recording strategy for all protocols that don't explicitly set their session recording mode. If neither this nor the protocol's equivalent control is set, best_effort is used.
mode
string
Mode sets the session recording mode. Allowed values: strict or best_effort.
kube object
The kubernetes specific configuration for a scoped role.
client_idle_timeout
string
Overrides the defaults block idle timeout specifically for kube sessions. Must be a valid Go duration string (e.g. "30m", "1h"). If empty, the defaults block value (or global default) applies.
disconnect_expired_cert
boolean
DisconnectExpiredCert controls whether Kube sessions are disconnected when the user certificate expires. If empty, the defaults block value (or global default) applies.
groups
[]string
The list of kubernetes groups this role allows.
label_expression
string
LabelExpression is an optional predicate expression evaluated against a kubernetes server's labels.
labels []object
The map of kubernetes cluster labels used for RBAC.
name
string
The name of the label.
values
[]string
The values associated with the label.
lock object
Lock configures the role's locking behavior for kubernetes sessions. If empty, the defaults block value (or global default) applies.
mode
string
Allowed values: strict or best_effort. Defaults to value cluster wide auth preference if not set.
resources []object
The kubernetes resources this role grants access to.
api_group
string
The kube API group of the kube resource. It supports wildcards.
kind
string
The kube resource type.
name
string
The kube resource name. It supports wildcards.
namespace
string
The kube resource namespace. It supports wildcards.
verbs
[]string
The allowed kube verbs for interacting with the kube resource.
users
[]string
An optional list of impersonatable kubernetes users this role allows.
rules []object
Rules describes basic resource:verb permissions (e.g. scoped_role:read).
resources
[]string
Resources is a list of resource kinds (e.g. 'scoped_token') that the below verbs apply to.
verbs
[]string
Verbs is the list of action verbs (e.g. 'read') that apply to the above resources.
ssh object
Ssh specifies controls that govern SSH access.
client_idle_timeout
string
ClientIdleTimeout overrides the defaults block idle timeout specifically for SSH sessions. Must be a valid Go duration string (e.g. "30m", "1h"). If empty, the defaults block value (or global default) applies.
disconnect_expired_cert
boolean
DisconnectExpiredCert controls whether SSH sessions are disconnected when the user certificate expires. If empty, the defaults block value (or global default) applies.
enhanced_recording object
EnhancedRecording is the set of BPF events to record for enhanced session recording.
command
boolean
Command enables session.command in audit logs
disk
boolean
Disk enables session.disk in audit logs
network
boolean
Network enables session.network in audit logs
file_copy
boolean
FileCopy indicates whether remote file operations via SCP or SFTP are allowed over an SSH session. It defaults to allowing the user to download and upload files by default.
forward_agent
boolean
ForwardAgent enables SSH agent forwarding.
host_sudoers
[]string
Sudoers is a list of entries to include in a users sudoer file
host_user_creation object
HostUserCreation configures the creation of host users.
groups
[]string
Groups is a list of host groups to add the user to.
mode
string
Mode specifies how the host user should be created.
shell
string
Shell is the shell to set for the user.
label_expression
string
LabelExpression is an optional predicate expression evaluated against an ssh node's labels.
labels []object
Labels is the set of node labels used to dynamically select which nodes this role applies to.
name
string
The name of the label.
values
[]string
The values associated with the label.
lock object
Lock configures the role's locking behavior for SSH sessions. If empty, the defaults block value (or global default) applies.
mode
string
Allowed values: strict or best_effort. Defaults to value cluster wide auth preference if not set.
logins
[]string
Logins is the list of OS logins this role permits on matching nodes.
max_sessions
integer
MaxSessions defines the maximum number of concurrent sessions per connection.
format:
int64
permit_x11_forwarding
boolean
PermitX11Forwarding, when true, authorizes use of X11 forwarding over SSH sessions. If not set, X11 forwarding is not permitted.
port_forwarding object
SSHPortForwarding configures what types of SSH port forwarding are allowed by a role.
local object
Allow for local port forwarding.
enabled
boolean
remote object
Allow for remote port forwarding.
enabled
boolean
session_recording object
SessionRecording configures the session recording strategy for SSH sessions.
mode
string
Mode sets the session recording mode. Allowed values: strict or best_effort.
workload_identity object
WorkloadIdentity specifies controls that govern issuance using WorkloadIdentity resources.
labels []object
Labels is the set of WorkloadIdentity labels used to dynamically select which WorkloadIdentity resources this role permits issuance with. Issuance additionally requires the caller to hold read_no_secrets (and, for the multi-issue RPC, list) rules for the workload_identity kind in the relevant scope.
name
string
The name of the label.
values
[]string
The values associated with the label.
status object
Status defines the observed state of the Teleport resource
conditions []object
Conditions represent the latest available observations of an object's state
lastTransitionTime
string required
lastTransitionTime is the last time the condition transitioned from one status to another.
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
format:
date-time
message
string required
message is a human readable message indicating details about the transition.
This may be an empty string.
maxLength:
32768
observedGeneration
integer
observedGeneration represents the .metadata.generation that the condition was set based upon.
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
with respect to the current state of the instance.
format:
int64minimum:
0
reason
string required
reason contains a programmatic identifier indicating the reason for the condition's last transition.
Producers of specific condition types may define expected values and meanings for this field,
and whether the values are considered a guaranteed API.
The value should be a CamelCase string.
This field may not be empty.
pattern:
^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$minLength:
1maxLength:
1024
status
string required
status of the condition, one of True, False, Unknown.
enum:
True, False, Unknown
type
string required
type of condition in CamelCase or in foo.example.com/CamelCase.
pattern:
^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$maxLength:
316
teleportResourceID
integer
format:
int64No matches. Try .spec.app for an exact path