Add Query field to CrownJewel specifications (#44982)

Introduced a Query field to the CrownJewelSpec to facilitate Access Graph queries. Updated corresponding protobuf definitions, validation logic, and tests to support the new field.

api/proto/teleport/crownjewel/v1/crownjewel.proto

@@ -42,9 +42,13 @@ message CrownJewel {
 // CrownJewelSpec is the specification of a Crown Jewel.
 message CrownJewelSpec {
   // TeleportMatchers is a list of teleport matchers.
+  // DEPRECATED: Use query instead.
   repeated TeleportMatcher teleport_matchers = 1;
   // AWSMatchers is a list of AWS matchers.
+  // DEPRECATED: Use query instead.
   repeated AWSMatcher aws_matchers = 2;
+  // Query is a Access Graph query to match resources.
+  string query = 3;
 }
 
 // TeleportMatcher represents a matcher for Teleport resources.

lib/auth/crownjewel/object.go

@@ -60,7 +60,7 @@ func ValidateCrownJewel(jewel *crownjewelv1.CrownJewel) error {
 		return trace.BadParameter("crown jewel name is empty")
 	case jewel.Spec == nil:
 		return trace.BadParameter("crown jewel spec is nil")
-	case len(jewel.Spec.TeleportMatchers) == 0 && len(jewel.Spec.AwsMatchers) == 0:
+	case len(jewel.Spec.TeleportMatchers) == 0 && len(jewel.Spec.AwsMatchers) == 0 && jewel.Spec.Query == "":
 		return trace.BadParameter("crown jewel must have at least one matcher")
 	}
 

lib/auth/crownjewel/object_test.go

@@ -78,6 +78,18 @@ func TestValidateCrownJewel(t *testing.T) {
 			},
 			wantErr: require.NoError,
 		},
+		{
+			name: "ValidCrownJewelWithQuery",
+			jewel: &crownjewelv1.CrownJewel{
+				Metadata: &headerv1.Metadata{
+					Name: "test",
+				},
+				Spec: &crownjewelv1.CrownJewelSpec{
+					Query: "SELECT * FROM nodes",
+				},
+			},
+			wantErr: require.NoError,
+		},
 		{
 			name: "MissingMatchers",
 			jewel: &crownjewelv1.CrownJewel{

lib/services/crown_jewels_test.go

@@ -65,6 +65,7 @@ func TestUnmarshalCrownJewel(t *testing.T) {
 			},
 		},
 		Spec: &crownjewelv1.CrownJewelSpec{
+			Query: "SELECT * FROM nodes",
 			TeleportMatchers: []*crownjewelv1.TeleportMatcher{
 				{
 					Kinds: []string{"node"},
@@ -106,6 +107,7 @@ metadata:
     env: example
   name: example-crown-jewel
 spec:
+  query: "SELECT * FROM nodes"
   aws_matchers:
     - regions:
         - us-west-1