From b22aad1ce27c5ff08ff5bfe975a11e28b3476d14 Mon Sep 17 00:00:00 2001
From: Lisa Kim <lisa@goteleport.com>
Date: Thu, 2 Jan 2025 16:05:49 -0800
Subject: [PATCH] Allow adding app server labels from join token for install.sh

---
 lib/web/join_tokens.go               |  8 ++++++++
 lib/web/join_tokens_test.go          | 12 ++++++++++++
 lib/web/scripts/node-join/install.sh |  3 +++
 3 files changed, 23 insertions(+)

diff --git a/lib/web/join_tokens.go b/lib/web/join_tokens.go
index 033040a8545e0..d0afba1214c00 100644
--- a/lib/web/join_tokens.go
+++ b/lib/web/join_tokens.go
@@ -630,6 +630,7 @@ func getJoinScript(ctx context.Context, settings scriptSettings, m nodeAPIGetter
 	var buf bytes.Buffer
 	// If app install mode is requested but parameters are blank for some reason,
 	// we need to return an error.
+	var appServerResourceLabels []string
 	if settings.appInstallMode {
 		if errs := validation.IsDNS1035Label(settings.appName); len(errs) > 0 {
 			return "", trace.BadParameter("appName %q must be a valid DNS subdomain: https://goteleport.com/docs/application-access/guides/connecting-apps/#application-name", settings.appName)
@@ -637,6 +638,12 @@ func getJoinScript(ctx context.Context, settings scriptSettings, m nodeAPIGetter
 		if !appURIPattern.MatchString(settings.appURI) {
 			return "", trace.BadParameter("appURI %q contains invalid characters", settings.appURI)
 		}
+
+		suggestedLabels := token.GetSuggestedLabels()
+		appServerResourceLabels, err = scripts.MarshalLabelsYAML(suggestedLabels, 6)
+		if err != nil {
+			return "", trace.Wrap(err)
+		}
 	}
 
 	if settings.discoveryInstallMode {
@@ -694,6 +701,7 @@ func getJoinScript(ctx context.Context, settings scriptSettings, m nodeAPIGetter
 		"db_service_resource_labels": dbServiceResourceLabels,
 		"discoveryInstallMode":       settings.discoveryInstallMode,
 		"discoveryGroup":             shsprintf.EscapeDefaultContext(settings.discoveryGroup),
+		"appServerResourceLabels":    appServerResourceLabels,
 	})
 	if err != nil {
 		return "", trace.Wrap(err)
diff --git a/lib/web/join_tokens_test.go b/lib/web/join_tokens_test.go
index 08be47c4e448c..7b48b7b64e827 100644
--- a/lib/web/join_tokens_test.go
+++ b/lib/web/join_tokens_test.go
@@ -695,6 +695,18 @@ func TestGetNodeJoinScript(t *testing.T) {
 				require.Contains(t, script, fmt.Sprintf("%s=%s", types.InternalResourceIDLabel, internalResourceID))
 			},
 		},
+		{
+			desc:      "app server labels",
+			settings:  scriptSettings{token: validToken, appInstallMode: true, appName: "app-name", appURI: "app-uri"},
+			errAssert: require.NoError,
+			extraAssertions: func(script string) {
+				require.Contains(t, script, `APP_NAME='app-name'`)
+				require.Contains(t, script, `APP_URI='app-uri'`)
+				require.Contains(t, script, `public_addr`)
+				require.Contains(t, script, `    labels:`)
+				require.Contains(t, script, fmt.Sprintf("%s=%s", types.InternalResourceIDLabel, internalResourceID))
+			},
+		},
 	} {
 		t.Run(test.desc, func(t *testing.T) {
 			script, err := getJoinScript(context.Background(), test.settings, m)
diff --git a/lib/web/scripts/node-join/install.sh b/lib/web/scripts/node-join/install.sh
index 3d8403c00787d..b0b69cad16fab 100755
--- a/lib/web/scripts/node-join/install.sh
+++ b/lib/web/scripts/node-join/install.sh
@@ -463,6 +463,9 @@ app_service:
   - name: "${APP_NAME}"
     uri: "${APP_URI}"
     public_addr: ${APP_PUBLIC_ADDR}
+    labels:{{range $index, $line := .appServerResourceLabels}}
+        {{$line -}}
+{{end}}
 EOF
 }
 # installs the provided teleport config (for database service)