ERROR: a role referenced in a mapping is not defined

[alanlubold]

When trying to create a trusted cluster, I am getting an error:

arc@6-0-0-0-13:/usr/local/bin2 $ sudo ./tctl --config=/etc/teleport2.yaml create /etc/trusted_cluster2.yaml
*ERROR: a role "arc" referenced in a mapping :[arc] is not defined

(the reason for all the 2's is that there are two separate instances of Teleport running on the machine. The other one is using a different server and is working fine.)

There is a role called arc, which has been working well for some time on many trusted clusters. The main server was originally version 11, since step-updated to 14. The various members of the trusted clusters were also step-updated, and during this the "tctl create trusted_cluster.yaml" did not need to be run. This is the first time it has been run on a new trusted cluster and it has failed.

Here is the trusted_cluster2.yaml file, with the server name Xed out:

kind: trusted_cluster
version: v2
metadata:
name: main2
spec:
enabled: true
role_map:

• local:
  • arc
    remote: '*'
    token: XXX
    tunnel_addr: XXX:3080
    web_proxy_addr: XXX:3080

Here is the roles.yaml file from the server, which was created some time ago, and was just force recreated successfully:

kind: role
version: v5
metadata:
name: admin
spec:
allow:
logins:
- ubuntu
- arc
- pi
node_labels:
'': ''

Please let me know if there is any more information I need to supply.

Thanks in advance.

[Venture200]

Hello

I was getting same problem as well, the reason is that you haven't created the role in your cluster but in root cluster. Try to create the role where you want to add resources, then in trusted cluster add that role definition

kind: role
metadata:
name:
spec:
allow:
logins:
- admin
node_labels:
application: goo
environment: prod
zone: fed0
app_labels:
application: goo
environment: prod
zone: fed0
rules:
- resources:
- node
verbs:
- list
- read
- ssh
- resources:
- app
verbs:
- list
- read
- connect
- resources:
- event
verbs:
- list
- read
- resources:
- session
verbs:
- read
- list
where: contains(session.participants, user.metadata.name)
deny:
logins:
- guest
options:
cert_format: standard
create_db_user: false
create_desktop_user: false
create_host_user: false
desktop_clipboard: true
desktop_directory_sharing: true
enhanced_recording:
- command
- network
forward_agent: false
idp:
saml:
enabled: true
max_session_ttl: 8h0m0s
pin_source_ip: false
port_forwarding: true
record_session:
default: best_effort
desktop: true
ssh_file_copy: true
version: v7

and then in your truster cluster file add this role

• local:
  -
  remote:

[webvictim]

As far as I can see, your role is not called arc, it's called admin?

[Venture200]

Hello, @webvictim my app service appear and disappear time to time, what's the cause ? it's not containerized app

[webvictim]

Hey - please make a new post about this as it's a separate issue.

[alanlubold]

Gus, Thank you for your response. I did figure it out in the end, I was confused between the role on the server versus the what I thought was a role on the remote machine. Thanks again, Alan From: Gus Luxton ***@***.***> Sent: Wednesday, June 5, 2024 9:39 PM To: gravitational/teleport ***@***.***> Cc: alanlubold ***@***.***>; Author ***@***.***> Subject: Re: [gravitational/teleport] ERROR: a role referenced in a mapping is not defined (Discussion #33880) As far as I can see, your role is not called arc, it's called admin? — Reply to this email directly, view it on GitHub <#33880 (comment)> , or unsubscribe <https://github.com/notifications/unsubscribe-auth/AOXEI2Z3H2J7V5LA3Q2E2O3ZF64SXAVCNFSM6AAAAAA6NZVCTGVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4TMOBUGAYDO> . You are receiving this because you authored the thread. <https://github.com/notifications/beacon/AOXEI25B2VDXCCTICXXQHQLZF64SXA5CNFSM6AAAAAA6NZVCTGWGG33NNVSW45C7OR4XAZNRIRUXGY3VONZWS33OINXW23LFNZ2KUY3PNVWWK3TUL5UWJTQASPCCO.gif> Message ID: ***@***.*** ***@***.***> >

[alanlubold]

Gus, That wasn’t me, not sure how someone hijacked my post. Maybe they copied me on it by mistake. I’m not VentureBoy. Alan From: Gus Luxton ***@***.***> Sent: Saturday, June 8, 2024 10:28 AM To: gravitational/teleport ***@***.***> Cc: alanlubold ***@***.***>; Author ***@***.***> Subject: Re: [gravitational/teleport] ERROR: a role referenced in a mapping is not defined (Discussion #33880) Hey - please make a new post about this as it's a separate issue. — Reply to this email directly, view it on GitHub <#33880 (reply in thread)> , or unsubscribe <https://github.com/notifications/unsubscribe-auth/AOXEI24R7U7HGJAD7UEXCYTZGMIFZAVCNFSM6AAAAAA6NZVCTGVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4TOMJUGEYTS> . You are receiving this because you authored the thread. <https://github.com/notifications/beacon/AOXEI226XSJF7R766VLZUGDZGMIFZA5CNFSM6AAAAAA6NZVCTGWGG33NNVSW45C7OR4XAZNRIRUXGY3VONZWS33OINXW23LFNZ2KUY3PNVWWK3TUL5UWJTQASQ44O.gif> Message ID: ***@***.*** ***@***.***> >

[webvictim]

I know :)