Incorrect RBAC processing in access tester

[gknw]

Description

What happened:

Looks like RBAC treats multiple node_labels in allow role block with logical AND (#8766), but access controller treats this with logical OR

Reproduction Steps

1. Create first node with label 'cluster' : 'production' and 'service': 'example'
2. Create second node with label 'cluster' : 'staging' and 'service': 'example'
3. Create role with

allow:
    logins: [admin]

    node_labels:
      'service': ['example']
      'cluster': ['production']

4. Create user with role from step 3
5. Login with user credential
6. tsh ls will show only first node
7. tctl access ls will show all nodes

Server Details

• Teleport version: v8.0.1
• Server OS (e.g. from /etc/os-release): Debian 11
• Where are you running Teleport?: VDS

Client Details

• Tsh version (tsh version): v8.0.1
• Computer OS: Linux
• Installed via: website download

[OliverKellyATech]

Hi Team,

Bumping this one as we ran into it today and caused quite a few problems when trying to understand how to correctly create new roles.

[zmb3]

Closing, as we've deprecated the roletester with Teleport 10.