Kubernetes RBAC configuration with Teleport

[anaryk]

Hi everyone, I'm trying to set up teleport, but I came across one minor problem with role configuration. I was able to set up a cluster admin using the system:masters kubernetes group, but once I tried to create roles that would only show pods and logs, for example, it no longer worked. Does anyone know how to do this, or do you not have a sample configuration?

This configuration works, but only on the admin cluster.

kind: role
metadata:
  id: 1634851657518580604
  name: new_role_name
spec:
  allow:
    app_labels:
      '*': '*'
    db_labels:
      '*': '*'
    kubernetes_groups:
    - system:masters
    kubernetes_labels:
      '*': '*'
    logins:
    - root
    node_labels:
      '*': '*'
    rules:
    - resources:
      - '*'
      verbs:
      - '*'
  deny:
    logins:
    - guest
  options:
    cert_format: standard
    enhanced_recording:
    - command
    - network
    forward_agent: false
    max_session_ttl: 8h0m0s
    port_forwarding: true
version: v3

Unfortunately, this limited configuration does not work

kind: role
metadata:
  id: 1634851657518580604
  name: new_role_name
spec:
  allow:
    app_labels:
      '*': '*'
    db_labels:
      '*': '*'
    kubernetes_groups:
    - 'view'
    kubernetes_labels:
      '*': '*'
    logins:
    - root
    node_labels:
      '*': '*'
    rules:
    - resources:
      - 'pods'
      - 'pods/logs' 
      verbs:
      - 'get'
      - 'list'
  deny:
    logins:
    - guest
  options:
    cert_format: standard
    enhanced_recording:
    - command
    - network
    forward_agent: false
    max_session_ttl: 8h0m0s
    port_forwarding: true
version: v3

Thank you so much for the advice

[stevenGravy]

Teleport matches to groups or users that are configured within your k8s cluster. Here is an example how to map given groups to your teleport roles. #8581