Skip to main content
Version: 19.x (unreleased)

Application Resources

Report an Issue

A role of version v9 denies every HTTP request to an application it grants, unless a rule under spec.allow.app_resources authorizes the request. Earlier role versions authorize an application as a whole, so a user who reaches the application can send any request to it. Role v9 does not affect TCP, MCP, cloud (AWS console, Azure, and GCP), LLM, or Identity Center applications.

Rules​

In Teleport 19 the only supported rule is allow_all: true, which authorizes every request to the applications the role grants. It must be the only rule in the list, and app_resources is valid only under allow.

kind: role
version: v9
metadata:
  name: gitlab-dev
spec:
  allow:
    app_labels:
      vendor: [gitlab]
    app_resources:
      - allow_all: true

Teleport 19 rejects a role that sets any of the following app_resources fields. The role schema still declares them so that version skew or a rollback cannot silently drop one and widen the access a role grants.

  • paths
  • methods
  • where
  • allow_encoded
  • allow_code
  • allow_reason
  • deny_code_hint
  • deny_reason_hint

Teleport 19 rejects spec.allow.app_resources_expressions on the same grounds. It expresses the same rules as predicates.

When a v9 role and a v8 or older role both grant the same application, Teleport drops the older roles from the decision, so they cannot restore unrestricted access to an application a v9 role restricts.

Agent version requirements​

Upgrade all Application Service agents to Teleport 19 before using role v9. An agent on Teleport 18 or earlier cannot evaluate app_resources, so the Auth Service serves it a downgraded v8 copy of each v9 role. For a role with an allow_all rule the copy grants the same access as v9. For any other role the copy moves the allow app_labels and app_labels_expression to the deny side, so the older agent denies those applications instead of granting them. A role does not record which application types it grants, so a downgraded role also denies the TCP, MCP, and cloud applications it selects, and can deny more applications than the v9 role restricts.