{ "description": "ScopedRoleV1 is the Schema for the scopedrolesv1 API", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", "type": [ "string", "null" ] }, "kind": { "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", "type": [ "string", "null" ] }, "metadata": { "type": [ "object", "null" ] }, "scope": { "description": "Scope is the scope of the role resource.", "type": [ "string", "null" ] }, "spec": { "additionalProperties": false, "description": "ScopedRole resource definition v1 from Teleport", "properties": { "assignable_scopes": { "description": "AssignableScopes is a list of scopes to which this role can be assigned.", "items": { "type": "string" }, "nullable": true, "type": [ "array", "null" ] }, "defaults": { "additionalProperties": false, "description": "Defaults specifies default values for controls common across multiple protocols. If the same control specified in defaults is also specified in a protocol block, the value in the protocol block takes precedence.", "nullable": true, "properties": { "client_idle_timeout": { "description": "ClientIdleTimeout sets the default idle timeout for access sessions across all protocols that do not specify their own value. Must be a valid Go duration string (e.g. \"30m\", \"1h\").", "type": [ "string", "null" ] }, "disconnect_expired_cert": { "description": "DisconnectExpiredCert defines the default behavior of all protocols when certs expire for a session. If unset, cluster wide defaults are used.", "type": [ "boolean", "null" ] }, "lock": { "additionalProperties": false, "description": "Lock specifies the default locking mode for access sessions across all protocols that do not specify their own value. If unset, cluster wide defaults are used.", "nullable": true, "properties": { "mode": { "description": "Allowed values: strict or best_effort. Defaults to value cluster wide auth preference if not set.", "type": [ "string", "null" ] } }, "type": [ "object", "null" ] }, "session_recording": { "additionalProperties": false, "description": "SessionRecording configures the session recording strategy for all protocols that don't explicitly set their session recording mode.", "nullable": true, "properties": { "mode": { "description": "Mode sets the session recording mode. Allowed values: strict or best_effort.", "type": [ "string", "null" ] } }, "type": [ "object", "null" ] } }, "type": [ "object", "null" ] }, "kube": { "additionalProperties": false, "description": "The kubernetes specific configuration for a scoped role.", "nullable": true, "properties": { "client_idle_timeout": { "description": "Overrides the defaults block idle timeout specifically for kube sessions. Must be a valid Go duration string (e.g. \"30m\", \"1h\"). If empty, the defaults block value (or global default) applies.", "type": [ "string", "null" ] }, "disconnect_expired_cert": { "description": "DisconnectExpiredCert controls whether Kube sessions are disconnected when the user certificate expires.", "type": [ "boolean", "null" ] }, "groups": { "description": "The list of kubernetes groups this role allows.", "items": { "type": "string" }, "nullable": true, "type": [ "array", "null" ] }, "labels": { "description": "The map of kubernetes cluster labels used for RBAC.", "items": { "additionalProperties": false, "properties": { "name": { "description": "The name of the label.", "type": [ "string", "null" ] }, "values": { "description": "The values associated with the label.", "items": { "type": "string" }, "nullable": true, "type": [ "array", "null" ] } }, "type": "object" }, "nullable": true, "type": [ "array", "null" ] }, "lock": { "additionalProperties": false, "description": "Lock configures the role's locking behavior for kubernetes sessions.", "nullable": true, "properties": { "mode": { "description": "Allowed values: strict or best_effort. Defaults to value cluster wide auth preference if not set.", "type": [ "string", "null" ] } }, "type": [ "object", "null" ] }, "users": { "description": "An optional list of impersonatable kubernetes users this role allows.", "items": { "type": "string" }, "nullable": true, "type": [ "array", "null" ] } }, "type": [ "object", "null" ] }, "rules": { "description": "Rules describes basic resource:verb permissions (e.g. scoped_role:read).", "items": { "additionalProperties": false, "properties": { "resources": { "description": "Resources is a list of resource kinds (e.g. 'scoped_token') that the below verbs apply to.", "items": { "type": "string" }, "nullable": true, "type": [ "array", "null" ] }, "verbs": { "description": "Verbs is the list of action verbs (e.g. 'read') that apply to the above resources.", "items": { "type": "string" }, "nullable": true, "type": [ "array", "null" ] } }, "type": "object" }, "nullable": true, "type": [ "array", "null" ] }, "ssh": { "additionalProperties": false, "description": "Ssh specifies controls that govern SSH access.", "nullable": true, "properties": { "client_idle_timeout": { "description": "ClientIdleTimeout overrides the defaults block idle timeout specifically for SSH sessions. Must be a valid Go duration string (e.g. \"30m\", \"1h\"). If empty, the defaults block value (or global default) applies.", "type": [ "string", "null" ] }, "disconnect_expired_cert": { "description": "DisconnectExpiredCert controls whether SSH sessions are disconnected when the user certificate expires. Defaults to value cluster wide auth preference if not set.", "type": [ "boolean", "null" ] }, "enhanced_recording": { "additionalProperties": false, "description": "EnhancedRecording is the set of BPF events to record for enhanced session recording.", "nullable": true, "properties": { "command": { "description": "Command enables session.command in audit logs", "type": [ "boolean", "null" ] }, "disk": { "description": "Disk enables session.disk in audit logs", "type": [ "boolean", "null" ] }, "network": { "description": "Network enables session.network in audit logs", "type": [ "boolean", "null" ] } }, "type": [ "object", "null" ] }, "file_copy": { "description": "FileCopy indicates whether remote file operations via SCP or SFTP are allowed over an SSH session. It defaults to allowing the user to download and upload files by default.", "type": [ "boolean", "null" ] }, "forward_agent": { "description": "ForwardAgent enables SSH agent forwarding.", "type": [ "boolean", "null" ] }, "host_sudoers": { "description": "Sudoers is a list of entries to include in a users sudoer file", "items": { "type": "string" }, "nullable": true, "type": [ "array", "null" ] }, "host_user_creation": { "additionalProperties": false, "description": "HostUserCreation configures the creation of host users.", "nullable": true, "properties": { "groups": { "description": "Groups is a list of host groups to add the user to.", "items": { "type": "string" }, "nullable": true, "type": [ "array", "null" ] }, "mode": { "description": "Mode specifies how the host user should be created.", "type": [ "string", "null" ] }, "shell": { "description": "Shell is the shell to set for the user.", "type": [ "string", "null" ] } }, "type": [ "object", "null" ] }, "labels": { "description": "Labels is the set of node labels used to dynamically select which nodes this role applies to.", "items": { "additionalProperties": false, "properties": { "name": { "description": "The name of the label.", "type": [ "string", "null" ] }, "values": { "description": "The values associated with the label.", "items": { "type": "string" }, "nullable": true, "type": [ "array", "null" ] } }, "type": "object" }, "nullable": true, "type": [ "array", "null" ] }, "lock": { "additionalProperties": false, "description": "Lock configures the role's locking behavior for SSH sessions.", "nullable": true, "properties": { "mode": { "description": "Allowed values: strict or best_effort. Defaults to value cluster wide auth preference if not set.", "type": [ "string", "null" ] } }, "type": [ "object", "null" ] }, "logins": { "description": "Logins is the list of OS logins this role permits on matching nodes.", "items": { "type": "string" }, "nullable": true, "type": [ "array", "null" ] }, "max_sessions": { "description": "MaxSessions defines the maximum number of concurrent sessions per connection.", "format": "int64", "type": [ "integer", "null" ] }, "permit_x11_forwarding": { "description": "PermitX11Forwarding, when true, authorizes use of X11 forwarding over SSH sessions. If not set, X11 forwarding is not permitted.", "type": [ "boolean", "null" ] }, "port_forwarding": { "additionalProperties": false, "description": "SSHPortForwarding configures what types of SSH port forwarding are allowed by a role.", "nullable": true, "properties": { "local": { "additionalProperties": false, "description": "Allow for local port forwarding.", "nullable": true, "properties": { "enabled": { "type": [ "boolean", "null" ] } }, "type": [ "object", "null" ] }, "remote": { "additionalProperties": false, "description": "Allow for remote port forwarding.", "nullable": true, "properties": { "enabled": { "type": [ "boolean", "null" ] } }, "type": [ "object", "null" ] } }, "type": [ "object", "null" ] }, "session_recording": { "additionalProperties": false, "description": "SessionRecording configures the session recording strategy for SSH sessions.", "nullable": true, "properties": { "mode": { "description": "Mode sets the session recording mode. Allowed values: strict or best_effort.", "type": [ "string", "null" ] } }, "type": [ "object", "null" ] } }, "type": [ "object", "null" ] } }, "type": [ "object", "null" ] }, "status": { "additionalProperties": false, "description": "Status defines the observed state of the Teleport resource", "properties": { "conditions": { "description": "Conditions represent the latest available observations of an object's state", "items": { "additionalProperties": false, "description": "Condition contains details for one aspect of the current state of this API Resource.", "properties": { "lastTransitionTime": { "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.", "format": "date-time", "type": "string" }, "message": { "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.", "maxLength": 32768, "type": "string" }, "observedGeneration": { "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", "format": "int64", "minimum": 0, "type": [ "integer", "null" ] }, "reason": { "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.", "maxLength": 1024, "minLength": 1, "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$", "type": "string" }, "status": { "description": "status of the condition, one of True, False, Unknown.", "enum": [ "True", "False", "Unknown" ], "type": "string" }, "type": { "description": "type of condition in CamelCase or in foo.example.com/CamelCase.", "maxLength": 316, "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$", "type": "string" } }, "required": [ "lastTransitionTime", "message", "reason", "status", "type" ], "type": "object" }, "type": [ "array", "null" ] }, "teleportResourceID": { "format": "int64", "type": [ "integer", "null" ] } }, "type": [ "object", "null" ] } }, "type": "object" }