RBAC: conditionally exclude certain labels without a full blown deny

[programmerq]

What would you like Teleport to do?

It should be possible for a role to express "allow all except" without using a full-blown deny rule.

What problem does this solve?

A teleport user is supposed to have access to hundreds of resources but needs to submit an access request for a small number of resources only (prod). The labeling strategy for a large number of resources is dynamic and inconsistent enough, that it would be much easier to say "allow all but this". Using a simple deny rule will not work because the deny will still take precedence if this user were to request access to the prod server via access workflows.

If a workaround exists, please include it.

• A painful approach would be to expect the Teleport administrator to script out a process that would update a role with a long and ever-changing list of matching patterns.

Things that were investigated, but didn't work out.

• It looks like no conditional options exist for node_labels, db_labels, and other label allow rules in RoleSpecV5. Potentially, a where/filter could only apply a deny if the user doesn't have the role granted by an access request.

  deny:
      db_labels:
          Env: production

  Something like where: !contains(user.spec.roles, "prodrole" could make the above deny only activate if the user hasn't issued an access request for prodrole.

• Use of a negative lookahead assertion in the allow rule. Golang uses re2, which does not support negative lookahead assertions.

  allow:
      db_labels:
          Env: '^(?!production))' # pcre style negative lookahead does not work

[klizhentas]

If we use expression of the labels matching, we can implement this in scope of #10204

[russjones]

@jdconti This will be addressed by @nklaassen as part of his new Predicate work in Teleport 14 (maybe a Teleport 13.x release).

[nklaassen]

This is addressed by label expressions released in 13.1.1

For the example you could write

allow:
    db_labels_expression: |
        labels["Env"] != "production"