Have there been changes to the ACL model in Teleport cloud recently?

[gord-lyr]

I see my agents are at 18.1.4 and before the last upgrade were at 17.5.2.

Since the upgrade, my non-admin role no longer displays many nodes, and (based on audit logs) no role changes were made. Is there some handling of the tags that changed between versions?

[stevenGravy]

An upgrade is typically not the reason. This can be something due to a change in the IDP or the nodes themselves if they had dynamic tagging for example.

[gord-lyr]

No dynamic tagging in use for the devices that are missing. Since it was a major version change, I thought there might be some functionality changes that I wasn't aware of that might be at play.
Are there Release Notes for each Teleport release?
I went looking, but couldn't find anything and Google/LLMs weren't of any help.

[stevenGravy]

Please see https://goteleport.com/docs/changelog/#1800-070325

[gord-lyr]

There has definitely been a behavioural change in how Teleport functions. I had this in my role:

node_labels:
env:
- dev
- uat
- prod
- customer
- lab
platform:
- product1_ssh
- product2_ssh
- product3_ssh

Had both of these + 2 additional labels specified in my teleport.yaml: customer & service (so that we could identify from the list which customer/service running on each node).

I now find that I must change the role to add these labels as *:

node_labels:
env:
- dev
- uat
- prod
- customer
- lab
platform:
- product1_ssh
- product2_ssh
- product3_ssh
customer: '*'
service: '*'

So, it looks like v7 didn't care about missing labels (maybe defaulted to *), but v8 requires all labels to be present in the role.

[zmb3]

I would not expect any changes here. Can you share a more complete reproduction including the full contents of the role your user has as well as the complete set of labels on the SSH node?