Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove 'Origin: aws-identity-center' that is crashing v16 agents #50656

Merged
merged 1 commit into from
Dec 31, 2024
Merged

Remove 'Origin: aws-identity-center' that is crashing v16 agents #50656

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 10 additions & 2 deletions lib/services/presets.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,6 @@ import (
"github.com/gravitational/teleport/api/constants"
apidefaults "github.com/gravitational/teleport/api/defaults"
"github.com/gravitational/teleport/api/types"
"github.com/gravitational/teleport/api/types/common"
apiutils "github.com/gravitational/teleport/api/utils"
"github.com/gravitational/teleport/lib/modules"
"github.com/gravitational/teleport/lib/utils"
Expand Down Expand Up @@ -597,7 +596,11 @@ func NewSystemIdentityCenterAccessRole() types.Role {
Description: "Access AWS IAM Identity Center resources",
Labels: map[string]string{
types.TeleportInternalResourceType: types.SystemResource,
types.OriginLabel: common.OriginAWSIdentityCenter,
// OriginLabel should not be set to AWS Identity center because:
// - identity center is not the one owning this role, this role
// is part of the Teleport system requirements
// - setting the label to a value not support in older agents
// (v16) will cause them to crash.
},
},
Spec: types.RoleSpecV6{
Expand Down Expand Up @@ -688,6 +691,11 @@ func bootstrapRoleMetadataLabels() map[string]map[string]string {
types.TeleportInternalResourceType: types.SystemResource,
types.OriginLabel: types.OriginOkta,
},
// We unset the OriginLabel on the system AWS IC role because this value
// was not supported on v16 agents and this crashes them.
teleport.SystemIdentityCenterAccessRoleName: {
types.TeleportInternalResourceType: types.SystemResource,
},
// Group access, reviewer and requester are intentionally not added here as there may be
// existing customer defined roles that have these labels.
}
Expand Down
Loading