Machine ID: Support path-based Kubernetes routing #50898
Conversation
This adds a new `kubernetes/v2` service to support path-based routing, which allows clients to access an arbitrary number of Kubernetes clusters using a single issued identity. It can be used with `tbot start kubernetes/v2` and specifying one or more explicit clusters with `--kubernetes-cluster-name` or a label selector with `--kubernetes-cluster-labels`.
timothyb89
force-pushed
the
timothyb89/kubernetes-path-routing-tbot
branch
from
c5e81d3 to
eef0afc
Compare
| type KubernetesSelector struct { | ||
| Name string `yaml:"name,omitempty"` | ||
|
|
||
| Labels map[string]string `yaml:"labels,omitempty"` |
There was a problem hiding this comment.
When specifying selectors throughout the rest of Teleport, we usually seem to support multiple values being provided as an OR. Perhaps we ought to support that here for consistency.
There was a problem hiding this comment.
There's always a chance I'm just missing a better API, but we don't seem to expose any generic RPC for querying resources with a list of label values from a client. ListResources only supports a map[string]string label selector, sadly. This API also doesn't accept wildcards, which is unfortunate.
That does put this at odds with #50812 which has explicit server-side support for full label queries through its RPC. What do you think, does this limitation pose a significant UX problem?
There was a problem hiding this comment.
Ah - in which case, let's leave it as is for now. I'd figured that the ListResources API would support this but apparently not. It should be possible to migrate from map[string]string to map[string][]string at a later date anyway.
This adds a new
kubernetes/v2service to support path-based routing, which allows clients to access an arbitrary number of Kubernetes clusters using a single issued identity.It can be used with
tbot start kubernetes/v2and specifying one or more explicit clusters with--kubernetes-cluster-nameor a label selector with--kubernetes-cluster-labels.Part of #40405. Requires #50567.