Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

New resources are not added to the Terraform preset role. #50208

Open
tenaciousdlg opened this issue Dec 13, 2024 · 1 comment
Open

New resources are not added to the Terraform preset role. #50208

tenaciousdlg opened this issue Dec 13, 2024 · 1 comment
Assignees
Labels
bug machine-id terraform-provider Issues relating to the Teleport Terraform provider in the teleport-plugins repo

Comments

@tenaciousdlg
Copy link
Contributor

Expected behavior:
Running Terraform operations after eval $(tctl terraform env) should allow functionality with all Teleport Terraform resources

Current behavior:
Actions against terraform-bot resources are failing due to -bot missing from the spec.allow.rules.resources section of the terraform-provider role

Bug details:

  • Teleport version
    tested on v16.4.6
  • Recreation steps
resource "teleport_bot" "bot" {
  name     = local.bot_name
  token_id = teleport_provision_token.bot_bot.metadata.name
  roles    = [teleport_role.bot.id]
}

running operations around a resource such as this will fail with

╷
│ Error: Error deleting Bot
│ 
│ Terraform user is missing on the Teleport side. Check that your auth credentials (certs) specified in provider configuration belong to existing user and are not expired.
│       access denied to perform action "delete" on "bot
  • Debug logs
@zmb3 zmb3 added machine-id terraform-provider Issues relating to the Teleport Terraform provider in the teleport-plugins repo labels Dec 13, 2024
@hugoShaka hugoShaka changed the title terraform bot support for preset terraform-provider Role New resources are not added to the Terraform preset role. Jan 17, 2025
@hugoShaka
Copy link
Contributor

Found the bug:

  • I put all the resources in a single rule
  • You created a teleport cluster with a version where TF did not support the bot resource (or the dynamic_windows_desktop one)
  • I added new resource support in the same rule
  • The role preset logic does not edit existing rules, it just adds more rules
  • The new resource did not get added to the old rule
  • Your TF role doesn't have permissions

@hugoShaka hugoShaka self-assigned this Jan 17, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug machine-id terraform-provider Issues relating to the Teleport Terraform provider in the teleport-plugins repo
Projects
None yet
Development

No branches or pull requests

3 participants