Hiding sections from Teleport's web UI

[webvictim]

Normally, a Teleport cluster's web UI will show all 5 protocols in its left-hand navigation bar:

It may be desirable in some circumstances to hide certain sections - for example, a user may only have Application access and no other protocols available, and showing other blank tabs may confuse them.

You can hide one or more protocols from the left-hand navigation bar by adding a deny section like this to any Teleport role:

kind: role
metadata:
  name: only-show-apps
spec:
  allow: {}
  deny:
    rules:
    - resources:
      - node
      - kube_server
      - db_server
      - windows_desktop
      verbs:
      - list

Granting this role to a user will remove these sections. When they next log into Teleport, they will only see the Applications section. It will also be the default view shown when they log in:

Here's the full list of protocol -> resource name mappings:

Servers: node (only supported in Teleport 9.1.0+)
Applications: app_server
Kubernetes: kube_server (or kube_service prior to Teleport 10)
Databases: db_server
Desktops: windows_desktop

It's not currently possible to completely hide the "Activity" or "Clusters" sections. We are looking at adding this support to the UI in future.

[marcosimioni]

@webvictim thank you, this is exactly what I was looking for.
Any news regarding the ability to hide the "Activity" and "Clusters" sections?

[webvictim]

I think the role as described in this issue here may help, but it's still not possible to completely hide those sections AFAIK.

[Pulseeey]

@webvictim Appreciate this.
It seems like the Kubernetes section won't hide for me when doing this, everything else is hidden fine. Has the value been changed from kube_service?

[webvictim]

I didn't realise, but it's apparently now kube_server instead. I'll update the post. Thanks for pointing it out.

[Pulseeey]

No worries, all good now. Any ideas on how to get the Windows tsh client working with this applied? I now get 'ERROR: access denied to perform action "list" on "kube_server"' when trying to login to the cluster.

[webvictim]

I think that's a bug with tsh: #8529

Due to this, I don't believe it's currently possible to completely hide Kubernetes clusters from a user's role and still log in properly using tsh. I know there were changes made to tsh recently so that it doesn't update kube context when logging in unless specifically requested, but I think it still attempts to list Kubernetes clusters as part of the tsh status output and that's why the error occurs.

This bug has now been fixed and it's possible to hide Kubernetes from the UI without affecting tsh behaviour.

[okejadi]

Hi.. Any news regarding the ability to hide the "Active Sessions" sections?