Adding automatic migration path for existing static host users #46804
+67
−30
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
eriktate
commented
Sep 20, 2024
| @@ -1009,6 +1009,9 @@ type HostUsersInfo struct { | |||
| GID string | |||
| // Shell is the default login shell for a host user | |||
| Shell string | |||
| // TakeOwnership determines whether or not an existing user should be | |||
| // taken over by teleport | |||
| TakeOwnership bool | |||
There was a problem hiding this comment.
I think we should eventually support this on the role spec as well and consider removing the implicit migration when teleport-keep is present in a role's host_groups.
There was a problem hiding this comment.
For the moment does this only apply to static host users? If so, let's note that in the comment for this field to set expectations.
eriktate
force-pushed
the
eriktate/add-static-host-user-migration
branch
from
de90e7d
to
ed73366
Compare
rosstimothy
approved these changes
Sep 20, 2024
| @@ -1009,6 +1009,9 @@ type HostUsersInfo struct { | |||
| GID string | |||
| // Shell is the default login shell for a host user | |||
| Shell string | |||
| // TakeOwnership determines whether or not an existing user should be | |||
| // taken over by teleport | |||
| TakeOwnership bool | |||
There was a problem hiding this comment.
For the moment does this only apply to static host users? If so, let's note that in the comment for this field to set expectations.
eriktate
force-pushed
the
eriktate/add-static-host-user-migration
branch
from
ed73366
to
8095db5
Compare
atburke
approved these changes
Sep 20, 2024
public-teleport-github-review-bot
bot
removed request for
avatus and
rudream
eriktate
force-pushed
the
eriktate/add-static-host-user-migration
branch
from
8095db5
to
b99fa8e
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Closes #46803
Adding
take_ownership_if_user_existsflag to static host user resource to allow for automatic migration/import of unmanaged users with colliding names. When set totrue, host user creation will add theteleport-staticgroup to the existing user along with any groups defined on the SHU resource.changelog: Added a new flag to static host users spec that allows teleport to automatically take ownership across matching hosts of any users with the same name as the static host user.