diff --git a/CHANGELOG.md b/CHANGELOG.md index a379689dcd1..0f1eba9cab8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -71,7 +71,7 @@ by `insecure-drop`, which still creates temporary users but does not create a home directory. Users who need home directory creation should either wrap `useradd`/`userdel` or use PAM. -##### Packages no longer published to legacy Debian and RPM repos +#### Packages no longer published to legacy Debian and RPM repos `deb.releases.teleport.dev` and `rpm.releases.teleport.dev` were deprecated in Teleport 11. Beginning in Teleport 15, Debian and RPM packages will no longer be @@ -167,6 +167,15 @@ perform this step since it must be done by an administrator at installation time. As a result, Teleport's service account can use more restrictive permissions. +#### Example AWS cluster deployments updated + +The AWS terraform examples for Teleport clusters have been updated to use the +newer hardened Amazon Linux 2023 AMIs. Additionally, the default architecture +and instance type has been changed to ARM64/Graviton. + +As a result of this modernization, the legacy monitoring stack configuration +used with the legacy AMIs has been removed. + ## 14.0.0 (09/20/23) Teleport 14 brings the following new major features and improvements: diff --git a/assets/aws/files/bin/teleport-all-pre-start b/assets/aws/files/bin/teleport-all-pre-start index 403572ed14c..fafa554918a 100755 --- a/assets/aws/files/bin/teleport-all-pre-start +++ b/assets/aws/files/bin/teleport-all-pre-start @@ -1,5 +1,5 @@ #!/bin/bash -# This script prepares a Letsencrypt certificate before all-in-one Teleport starts for the first time (if needed) +# This script prepares a Let's Encrypt certificate before all-in-one Teleport starts for the first time (if needed) set -e if [[ "${DEBUG:-false}" == "true" ]]; then set -x @@ -10,11 +10,11 @@ if [ -f /etc/teleport.d/conf ]; then source /etc/teleport.d/conf fi -# check for letsencrypt +# check for Let's Encrypt if [[ "${USE_LETSENCRYPT}" != "true" ]]; then - echo "Not using Letsencrypt, exiting with success" + echo "Not using Let's Encrypt, exiting with success" exit 0 fi # copy certificates into place -/bin/aws s3 sync --exact-timestamps s3://${TELEPORT_S3_BUCKET}/live/${TELEPORT_DOMAIN_NAME} /var/lib/teleport \ No newline at end of file +/bin/aws s3 sync --exact-timestamps s3://${TELEPORT_S3_BUCKET}/live/${TELEPORT_DOMAIN_NAME} /var/lib/teleport diff --git a/assets/aws/files/bin/teleport-generate-config b/assets/aws/files/bin/teleport-generate-config index 9f2776c7db2..b1042e5abab 100755 --- a/assets/aws/files/bin/teleport-generate-config +++ b/assets/aws/files/bin/teleport-generate-config @@ -215,7 +215,7 @@ fi touch ${USE_CONFIG_PATH} chmod 664 ${USE_CONFIG_PATH} -# Use letsencrypt by default unless we are explicitly using ACM here +# Use Let's Encrypt by default unless we are explicitly using ACM here if [[ "${USE_ACM}" != "true" ]]; then rm -f ${USE_CONFD_DIR}/role.all-acm echo "use-letsencrypt" > ${USE_CONFD_DIR}/use-letsencrypt @@ -358,7 +358,7 @@ EOF write_ssh_and_tunnel_section 443 fi - # if we are using letsencrypt (i.e. not ACM) then append config lines + # if we are using Let's Encrypt (i.e. not ACM) then append config lines if [[ "${USE_ACM}" != "true" ]]; then write_https_keypairs_section else @@ -427,15 +427,6 @@ EOF systemctl_wrap enable teleport-node.service systemctl_wrap start --no-block teleport-node.service -elif [[ "${TELEPORT_ROLE}" == "monitor" ]]; then - echo "monitor" > ${USE_CONFD_DIR}/role.monitor - # disable teleport service if this has the monitor role - systemctl_wrap disable teleport.service - # no teleport config needed - rm -f ${USE_CONFIG_PATH} - # run monitor setup as an independent service - systemctl_wrap start --no-block teleport-monitor-setup.service - # starter cluster configuration elif [[ "${TELEPORT_ROLE}" == "auth,node,proxy" ]]; then echo "Teleport all-in-one configuration selected." @@ -445,7 +436,7 @@ elif [[ "${TELEPORT_ROLE}" == "auth,node,proxy" ]]; then # always enable TLS routing when ACM is enabled USE_TLS_ROUTING=true sed -i 's/USE_TLS_ROUTING=false/USE_TLS_ROUTING=true/g' ${USE_CONFD_DIR}/conf - # remove letsencrypt config + # remove Let's Encrypt config rm -f ${USE_CONFD_DIR}/use-letsencrypt sed -i 's/USE_LETSENCRYPT=true/USE_LETSENCRYPT=false/g' ${USE_CONFD_DIR}/conf # enable ACM role to use alternative unit file @@ -563,10 +554,10 @@ EOF systemctl_wrap enable teleport-acm.service systemctl_wrap start --no-block teleport-acm.service - # alternatively, if we are using letsencrypt, append config lines + # alternatively, if we are using Let's Encrypt, append config lines elif [[ "${USE_LETSENCRYPT}" == "true" ]] && [[ "${USE_ACM}" == "false" ]]; then - echo "Letsencrypt support enabled" - # these variables must all be set for letsencrypt to work + echo "Let's Encrypt support enabled" + # these variables must all be set for Let's Encrypt to work # it also needs the running instance to have permissions to read from/write to the S3 bucket if [[ "${TELEPORT_DOMAIN_ADMIN_EMAIL}" != "" && "${TELEPORT_DOMAIN_NAME}" != "" && "${TELEPORT_S3_BUCKET}" != "" ]]; then write_https_keypairs_section @@ -662,10 +653,10 @@ EOF write_kubernetes_section TELEPORT_EXTERNAL_HOSTNAME fi - # if we are using letsencrypt, append config lines + # if we are using Let's Encrypt, append config lines if [[ "${USE_LETSENCRYPT}" == "true" ]]; then - echo "Letsencrypt support enabled" - # these variables must all be set for letsencrypt to work + echo "Let's Encrypt support enabled" + # these variables must all be set for Let's Encrypt to work # it also needs the running instance to have permissions to read from/write to the S3 bucket if [[ "${TELEPORT_DOMAIN_ADMIN_EMAIL}" != "" && "${TELEPORT_DOMAIN_NAME}" != "" && "${TELEPORT_S3_BUCKET}" != "" ]]; then write_https_keypairs_section @@ -693,145 +684,8 @@ EOF fi fi -# enable telegraf service if running in cluster mode -if [[ "${TELEPORT_ROLE}" == "auth" || "${TELEPORT_ROLE}" == "node" || "${TELEPORT_ROLE}" == "proxy" ]]; then - # Install teleport telegraf configuration - # Telegraf will collect prometheus metrics and send to influxdb collector - cat >/etc/telegraf/telegraf.conf < ${USE_CONFD_DIR}/role.agent cat >${USE_CONFIG_PATH} <" ``` The AWS region to run in. You should pick from the supported list as detailed in the [README](https://github.com/gravitational/teleport/blob/branch/v(=teleport.major_version=)/examples/aws/terraform/ha-autoscale-cluster/README.md). -These are regions which support [DynamoDB encryption at rest](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/EncryptionAtRest.html). +These are regions that support [DynamoDB encryption at rest](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/EncryptionAtRest.html). ### cluster_name @@ -157,35 +155,36 @@ cluster from scratch, so choose carefully. A good example might be something lik ### ami_name ```code -$ export TF_VAR_ami_name="gravitational-teleport-ami-ent-(=teleport.version=)" +$ export TF_VAR_ami_name="teleport-ent-(=teleport.version=)" ``` -Gravitational automatically builds and publishes Teleport Community Edition, Enterprise, and Enterprise FIPS 140-2 -AMIs when we release a new version of Teleport. The AMI names follow the format: `gravitational-teleport-ami--` -where `` is either `oss` or `ent` (Enterprise) and `version` is the version of Teleport e.g. `(=teleport.version=)`. +Teleport (Gravitational) automatically builds and publishes Teleport Community Edition, Enterprise, and Enterprise FIPS 140-2 +AMIs when we release a new version of Teleport. The AMI names follow the format: `teleport---` +where `` is either `oss` or `ent` (Enterprise), `version` is the version of Teleport, e.g. `(=teleport.version=)`, +and `` is either `x86_64` or `arm64`. FIPS 140-2 compatible AMIs (which deploy Teleport in FIPS 140-2 mode by default) have the `-fips` suffix. -The AWS account ID which publishes these AMIs is `126027368216`. You can list the available AMIs with +The AWS account ID that publishes these AMIs is `146628656107`. You can list the available AMIs with the example `awscli` commands below. The output is in JSON format by default. OSS AMIs
```code - $ aws --region ec2 describe-images --owners 126027368216 --filters 'Name=name,Values=gravitational-teleport-ami-oss-(=teleport.version=)' + $ aws --region ec2 describe-images --owners 146628656107 --filters 'Name=name,Values=teleport-oss-(=teleport.version=)-*' ``` Enterprise AMIs
```code - $ aws --region ec2 describe-images --owners 126027368216 --filters 'Name=name,Values=gravitational-teleport-ami-ent-(=teleport.version=)' + $ aws --region ec2 describe-images --owners 146628656107 --filters 'Name=name,Values=teleport-ent-(=teleport.version=)-*' ``` - List Enterprise FIPS 140-2 AMIs
+ Enterprise FIPS 140-2 AMIs
```code - $ aws --region ec2 describe-images --owners 126027368216 --filters 'Name=name,Values=gravitational-teleport-ami-ent-(=teleport.version=)-fips' + $ aws --region ec2 describe-images --owners 146628656107 --filters 'Name=name,Values=teleport-ent-(=teleport.version=)-*-fips-*' ``` @@ -297,32 +296,16 @@ Remember that S3 bucket names must be globally unique, so if you see errors rela $ export TF_VAR_email="support@example.com" ``` -LetsEncrypt requires an email address for every certificate registered which can be used to send notifications and +Let's Encrypt requires an email address for every certificate registered that can be used to send notifications and useful information. We recommend a generic ops/support email address which the team deploying Teleport has access to. -### grafana_pass - -```code -$ export TF_VAR_grafana_pass="CHANGE_THIS_VALUE" -``` - -We deploy Grafana along with every Terraform deployment and automatically make stats on cluster usage available in -a custom dashboard. This variable sets up the password for the Grafana `admin` user. The Grafana web UI is served -on the same subdomain as specified above in [`route53_domain`](#route53\_domain) on port 8443. - -With the variables set in this example, it would be available on [https://teleport.example.com:8443](https://teleport.example.com:8443) - -If you do not change this from the default (`CHANGE_THIS_VALUE`), then it will be set to a random value for security -and you will need to log into the monitoring instance to discover this manually. As such, we recommend setting this -to a known value at the outset. - ### use_acm ```code $ export TF_VAR_use_acm="true" ``` -If set to the string `"false"`, Terraform will use [LetsEncrypt](https://letsencrypt.org/) to provision the public-facing +If set to the string `"false"`, Terraform will use [Let's Encrypt](https://letsencrypt.org/) to provision the public-facing web UI certificate for the Teleport cluster ([`route53_domain`](#route53\_domain) - so [https://teleport.example.com](https://teleport.example.com) in this example). This uses an [AWS network load balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/introduction.html) to load-balance connections to the Teleport cluster's web UI, and its SSL termination is handled by Teleport itself. @@ -357,12 +340,12 @@ $ export TF_VAR_teleport_auth_type="local" ``` This value can be used to change the default authentication type used for the Teleport cluster. This is useful for persisting a -default authentication type across AMI upgrades when you have a SAML, OIDC or GitHub connector configured in DynamoDB. +default authentication type across AMI upgrades when you have a SAML, OIDC, or GitHub connector configured in DynamoDB. The default is `local`. - Teleport Community Edition supports `local` or `github` -- Teleport Enterprise Edition supports `local`, `github`, `oidc` or `saml` -- Teleport Enterprise FIPS deployments have local authentication disabled, so should use `github`, `oidc` or `saml` +- Teleport Enterprise Edition supports `local`, `github`, `oidc`, or `saml` +- Teleport Enterprise FIPS deployments have local authentication disabled, so should use `github`, `oidc`, or `saml` See the [Teleport authentication reference](../../reference/authentication.mdx) for more information. @@ -372,13 +355,12 @@ See the [Teleport authentication reference](../../reference/authentication.mdx) Our reference deployment will provision the following instances for your cluster using AWS Auto Scaling Groups (ASG) with these default settings: -- 2 x `m4.large` Teleport Auth Service instances in an ASG, behind an internal network load balancer, configured using DynamoDB for +- 2 x `m7g.large` Teleport Auth Service instances in an ASG, behind an internal network load balancer, configured using DynamoDB for shared storage. [The desired size of the ASG is configured here](https://github.com/gravitational/teleport/blob/branch/v(=teleport.major_version=)/examples/aws/terraform/ha-autoscale-cluster/auth_asg.tf#L11) -- 2 x `m4.large` Teleport Proxy Service instances in an ASG, behind a public-facing load balancer - NLB for LetsEncrypt, ALB for ACM. [The desired size of the ASG is configured here](https://github.com/gravitational/teleport/blob/branch/v(=teleport.major_version=)/examples/aws/terraform/ha-autoscale-cluster/proxy_asg.tf#L12) -- 1 x `m4.large` Teleport SSH Service instance in an ASG. Server instances in this ASG will join with Teleport SSH Service enabled and connected to the **auth** +- 2 x `m7g.large` Teleport Proxy Service instances in an ASG, behind a public-facing load balancer - NLB for LetsEncrypt, ALB for ACM. [The desired size of the ASG is configured here](https://github.com/gravitational/teleport/blob/branch/v(=teleport.major_version=)/examples/aws/terraform/ha-autoscale-cluster/proxy_asg.tf#L12) +- 1 x `m7g.large` Teleport SSH Service instance in an ASG. Server instances in this ASG will join with Teleport SSH Service enabled and connected to the **auth** service. [The desired size of the ASG is configured here](https://github.com/gravitational/teleport/blob/branch/v(=teleport.major_version=)/examples/aws/terraform/ha-autoscale-cluster/node_asg.tf#L10) -- 1 x `m4.large` monitoring server in an ASG which hosts the Grafana instance and receives monitoring data from each service in the cluster. [The desired size of the ASG is configured here](https://github.com/gravitational/teleport/blob/branch/v(=teleport.major_version=)/examples/aws/terraform/ha-autoscale-cluster/monitor_asg.tf#L12) -- 1 x `t2.medium` bastion server which is the only permitted source for inbound SSH traffic to the instances. This is done +- 1 x `t4g.medium` bastion server which is the only permitted source for inbound SSH traffic to the instances. This is done to avoid exposing each instance to the internet directly. [The instance types used for each ASG can be configured here](https://github.com/gravitational/teleport/blob/branch/v(=teleport.major_version=)/examples/aws/terraform/ha-autoscale-cluster/vars.tf#L23-L45) diff --git a/docs/pages/deploy-a-cluster/deployments/aws-starter-cluster-terraform.mdx b/docs/pages/deploy-a-cluster/deployments/aws-starter-cluster-terraform.mdx index 297db08e246..8a9cbbd003f 100644 --- a/docs/pages/deploy-a-cluster/deployments/aws-starter-cluster-terraform.mdx +++ b/docs/pages/deploy-a-cluster/deployments/aws-starter-cluster-terraform.mdx @@ -35,7 +35,7 @@ $ terraform version Terraform v1.5.6 ``` -You will also require the `aws` command line tool. This is available in Ubuntu/Debian/Fedora/CentOS and MacOS Homebrew +You will also require the `aws` command line tool. This is available in Ubuntu/Debian/Fedora/CentOS and macOS Homebrew as the `awscli` package. Fedora/CentOS: `yum -y install awscli` @@ -61,7 +61,7 @@ You should also have a default region set under `~/.aws/config`: ```code $ cat ~/.aws/config # [default] -# region = us-east-1 +# region = us-west-2 ``` As a result, you should be able to run a command like `aws ec2 describe-instances` to list running EC2 instances. @@ -79,7 +79,7 @@ AWS services: - [IAM](https://aws.amazon.com/iam/) - [SSM Parameter Store](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html) -The Terraform deployment itself will create a new IAM role to be used by the Teleport instance which has appropriately +The Terraform deployment itself will create a new IAM role to be used by the Teleport instance that has appropriately limited permission scopes for AWS services. However, the initial cluster setup must be done by a user with a high level of AWS permissions. @@ -108,10 +108,8 @@ Initializing the backend... Initializing provider plugins... - Checking for available provider plugins... -- Installing hashicorp/random v3.5.1... -- Installed hashicorp/random v3.5.1 (signed by HashiCorp) -- Installing hashicorp/aws v4.67.0... -- Installed hashicorp/aws v4.67.0 (signed by HashiCorp) +- Installing hashicorp/aws v5.31.0... +- Installed hashicorp/aws v5.31.0 (signed by HashiCorp) Terraform has been successfully initialized! @@ -154,7 +152,7 @@ $ export TF_VAR_region="" ``` The AWS region to run in. You should pick from the supported list as detailed in the [README](https://github.com/gravitational/teleport/blob/branch/v(=teleport.major_version=)/examples/aws/terraform/starter-cluster/README.md). -These are regions which support [DynamoDB encryption at rest](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/EncryptionAtRest.html). +These are regions that support [DynamoDB encryption at rest](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/EncryptionAtRest.html). ### cluster_name @@ -170,35 +168,36 @@ cluster from scratch, so choose carefully. A good example might be something lik ### ami_name ```code -$ export TF_VAR_ami_name="gravitational-teleport-ami-ent-(=teleport.version=)" +$ export TF_VAR_ami_name="teleport-ent-(=teleport.version=)" ``` -Gravitational automatically builds and publishes OSS, Enterprise and Enterprise FIPS 140-2 AMIs when we -release a new version of Teleport. The AMI names follow the format: `gravitational-teleport-ami--` -where `` is either `oss` or `ent` (Enterprise) and `version` is the version of Teleport e.g. `(=teleport.version=)`. +Teleport (Gravitational) automatically builds and publishes OSS, Enterprise and Enterprise FIPS 140-2 AMIs when we +release a new version of Teleport. The AMI names follow the format: `teleport---` +where `` is either `oss` or `ent` (Enterprise), `version` is the version of Teleport e.g. `(=teleport.version=)`, +and `arch` is either `x86_64` or `arm64`. FIPS 140-2 compatible AMIs (which deploy Teleport in FIPS 140-2 mode by default) have the `-fips` suffix. -The AWS account ID which publishes these AMIs is `126027368216`. You can list the available AMIs with +The AWS account ID that publishes these AMIs is `146628656107`. You can list the available AMIs with the example `awscli` commands below. The output is in JSON format by default. OSS AMIs
```code - $ aws --region ec2 describe-images --owners 126027368216 --filters 'Name=name,Values=gravitational-teleport-ami-oss-(=teleport.version=)' + $ aws --region ec2 describe-images --owners 146628656107 --filters 'Name=name,Values=teleport-oss-(=teleport.version=)-*' ``` Enterprise AMIs
```code - $ aws --region ec2 describe-images --owners 126027368216 --filters 'Name=name,Values=gravitational-teleport-ami-ent-(=teleport.version=)' + $ aws --region ec2 describe-images --owners 146628656107 --filters 'Name=name,Values=teleport-ent-(=teleport.version=)-*' ``` - List Enterprise FIPS 140-2 AMIs
+ Enterprise FIPS 140-2 AMIs
```code - aws --region ec2 describe-images --owners 126027368216 --filters 'Name=name,Values=gravitational-teleport-ami-ent-(=teleport.version=)-fips' + $ aws --region ec2 describe-images --owners 146628656107 --filters 'Name=name,Values=teleport-ent-(=teleport.version=)-*-fips-*' ``` @@ -318,7 +317,7 @@ A `micro` instance is fine for testing, but if this server will need to support $ export TF_VAR_email="support@example.com" ``` -LetsEncrypt requires an email address for every certificate registered which can be used to send notifications and +Let's Encrypt requires an email address for every certificate registered which can be used to send notifications and useful information. We recommend a generic ops/support email address which the team deploying Teleport has access to. ### use_letsencrypt @@ -327,7 +326,7 @@ useful information. We recommend a generic ops/support email address which the t $ export TF_VAR_use_letsencrypt="false" ``` -If set to the string `"true"`, Terraform will use [LetsEncrypt](https://letsencrypt.org/) to provision the public-facing +If set to the string `"true"`, Terraform will use [Let's Encrypt](https://letsencrypt.org/) to provision the public-facing web UI certificate for the Teleport cluster ([`route53_domain`](#route53\_domain) - so [https://teleport.example.com](https://teleport.example.com) in this example). This uses an [AWS network load balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/introduction.html) to load-balance connections to the Teleport cluster's web UI, and its SSL termination is handled by Teleport itself. @@ -374,8 +373,8 @@ default authentication type across AMI upgrades when you have a SAML, OIDC or Gi The default is `local`. - Teleport Community Edition supports `local` or `github` -- Teleport Enterprise Edition supports `local`, `github`, `oidc` or `saml` -- Teleport Enterprise FIPS deployments have local authentication disabled, so should use `github`, `oidc` or `saml` +- Teleport Enterprise Edition supports `local`, `github`, `oidc`, or `saml` +- Teleport Enterprise FIPS deployments have local authentication disabled, so should use `github`, `oidc`, or `saml` See the [Teleport authentication reference](../../reference/authentication.mdx) for more information. diff --git a/docs/pages/installation.mdx b/docs/pages/installation.mdx index 76a7b3cda09..0b563bae934 100644 --- a/docs/pages/installation.mdx +++ b/docs/pages/installation.mdx @@ -370,14 +370,16 @@ for a list of the available configuration options. The image names all include the build timestamp (shown as `$TIMESTAMP` in the table below), and are tagged for easier searching. -| Image name | Edition | Architecture | FIPS support | AMI Tags | Owner Account ID | -| - | - | - | - | - | - | -| `teleport-oss-(=teleport.version=)-x86_64-$TIMESTAMP` | OSS | amd64 | No | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: oss`, `TeleportFipsEnabled: false` | 146628656107 | -| `teleport-oss-(=teleport.version=)-arm64-$TIMESTAMP` | OSS | arm64 | No | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: oss`, `TeleportFipsEnabled: false` | 146628656107 | -| `teleport-ent-(=teleport.version=)-x86_64-$TIMESTAMP` | Enterprise | amd64 | No | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: ent`, `TeleportFipsEnabled: false` | 146628656107 | -| `teleport-ent-(=teleport.version=)-arm64-$TIMESTAMP` | Enterprise | arm64 | No | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: ent`, `TeleportFipsEnabled: false` | 146628656107 | -| `teleport-ent-(=teleport.version=)-x86_64-fips-$TIMESTAMP` | Enterprise | amd64 | Yes | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: ent`, `TeleportFipsEnabled: true` | 146628656107 | -| `teleport-ent-(=teleport.version=)-arm64-fips-$TIMESTAMP` | Enterprise | arm64 | Yes | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: ent`, `TeleportFipsEnabled: true` | 146628656107 | +| Image name | Edition | Architecture | FIPS support | AMI Tags | +| - | - | - | - | - | +| `teleport-oss-(=teleport.version=)-x86_64-$TIMESTAMP` | OSS | amd64 | No | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: oss`, `TeleportFipsEnabled: false` | +| `teleport-oss-(=teleport.version=)-arm64-$TIMESTAMP` | OSS | arm64 | No | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: oss`, `TeleportFipsEnabled: false` | +| `teleport-ent-(=teleport.version=)-x86_64-$TIMESTAMP` | Enterprise | amd64 | No | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: ent`, `TeleportFipsEnabled: false` | +| `teleport-ent-(=teleport.version=)-arm64-$TIMESTAMP` | Enterprise | arm64 | No | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: ent`, `TeleportFipsEnabled: false` | +| `teleport-ent-(=teleport.version=)-x86_64-fips-$TIMESTAMP` | Enterprise | amd64 | Yes | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: ent`, `TeleportFipsEnabled: true` | +| `teleport-ent-(=teleport.version=)-arm64-fips-$TIMESTAMP` | Enterprise | arm64 | Yes | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: ent`, `TeleportFipsEnabled: true` | + +These AMIs are owned by AWS account ID `146628656107`. All images are based on Amazon Linux 2023 and have been hardened using the Amazon EC2 ImageBuilder [STIG](https://public.cyber.mil/stigs/) hardening diff --git a/examples/aws/terraform/ha-autoscale-cluster/Makefile b/examples/aws/terraform/ha-autoscale-cluster/Makefile index b29688680ee..854bbd2282c 100644 --- a/examples/aws/terraform/ha-autoscale-cluster/Makefile +++ b/examples/aws/terraform/ha-autoscale-cluster/Makefile @@ -43,16 +43,13 @@ TF_VAR_enable_mysql_listener ?= true # This will be ignored if TF_VAR_use_tls_routing is set to true TF_VAR_enable_postgres_listener ?= true -# Bucket name to store encrypted letsencrypt certificates. +# Bucket name to store encrypted Let's Encrypt certificates. TF_VAR_s3_bucket_name ?= -# Email of your support org, used for Letsencrypt cert registration process. +# Email of your support org, used for Let's Encrypt cert registration process. TF_VAR_email ?= -# Setup grafana password for "admin" user. Grafana will be served on https://cluster.example.com:8443 after install -TF_VAR_grafana_pass ?= - -# (optional) Set to true to use ACM (Amazon Certificate Manager) to provision certificates rather than Letsencrypt +# (optional) Set to true to use ACM (Amazon Certificate Manager) to provision certificates rather than Let's Encrypt # If you wish to use a pre-existing ACM certificate rather than having Terraform generate one for you, you can import it: # terraform import aws_acm_certificate.cert TF_VAR_use_acm ?= false @@ -69,8 +66,8 @@ TF_VAR_use_tls_routing ?= false # This is useful for persisting a different default authentication type across AMI upgrades when you have a SAML, OIDC # or GitHub connector configured in DynamoDB. The default if not set is "local". # Teleport Community Edition supports "local" or "github" -# Teleport Enterprise Edition supports "local", "github", "oidc" or "saml" -# Teleport Enterprise FIPS deployments have local authentication disabled, so should use "github", "oidc" or "saml" +# Teleport Enterprise Edition supports "local", "github", "oidc", or "saml" +# Teleport Enterprise FIPS deployments have local authentication disabled, so should use "github", "oidc", or "saml" TF_VAR_teleport_auth_type ?= "local" export diff --git a/examples/aws/terraform/ha-autoscale-cluster/README.md b/examples/aws/terraform/ha-autoscale-cluster/README.md index e0c72a70a08..b3b76015bd9 100644 --- a/examples/aws/terraform/ha-autoscale-cluster/README.md +++ b/examples/aws/terraform/ha-autoscale-cluster/README.md @@ -33,20 +33,20 @@ In order to spin up AWS resources using these Terraform examples, you need the f # Set variables for Terraform # Region to run in - we currently have AMIs in the following regions: -# ap-south-1,ap-northeast-2,ap-southeast-1,ap-southeast-2,ap-northeast-1,ca-central-1,eu-central-1,eu-west-1,eu-west-2 -# sa-east-1,us-east-1,us-east-2,us-west-1,us-west-2 +# ap-northeast-1, ap-northeast-2, ap-northeast-3, ap-south-1, ap-southeast-1, ap-southeast-2, ca-central-1, eu-central-1 +# eu-north-1, eu-west-1, eu-west-2, eu-west-3, sa-east-1, us-east-1, us-east-2, us-west-1, us-west-2 export TF_VAR_region="us-west-2" # Cluster name is a unique cluster name to use, should be unique and not contain spaces or other special characters export TF_VAR_cluster_name="teleport.example.com" # AMI name contains the version of Teleport to install, and whether to use OSS or Enterprise version -# These AMIs are published by Gravitational and shared as public whenever a new version of Teleport is released +# These AMIs are published by Teleport (Gravitational) and shared as public whenever a new version of Teleport is released # To list available AMIs: -# OSS: aws ec2 describe-images --owners 126027368216 --filters 'Name=name,Values=gravitational-teleport-ami-oss*' -# Enterprise: aws ec2 describe-images --owners 126027368216 --filters 'Name=name,Values=gravitational-teleport-ami-ent*' +# OSS: aws ec2 describe-images --owners 146628656107 --filters 'Name=name,Values=teleport-oss-*' +# Enterprise: aws ec2 describe-images --owners 146628656107 --filters 'Name=name,Values=teleport-ent-*' # FIPS 140-2 images are also available for Enterprise customers, look for '-fips' on the end of the AMI's name -export TF_VAR_ami_name="gravitational-teleport-ami-ent-14.3.0" +export TF_VAR_ami_name="teleport-ent-14.3.0-arm64" # AWS SSH key name to provision in installed instances, should be available in the region export TF_VAR_key_name="example" @@ -104,16 +104,13 @@ export TF_VAR_s3_bucket_name="teleport.example.com" # Email of your support org, used for Let's Encrypt cert registration process. export TF_VAR_email="support@example.com" -# Setup grafana password for "admin" user. Grafana will be served on https://cluster.example.com:8443 after install -export TF_VAR_grafana_pass="CHANGE_THIS_VALUE" - # This value can be used to change the default authentication type used for the Teleport cluster. # See https://goteleport.com/docs/reference/authentication for more information. # This is useful for persisting a different default authentication type across AMI upgrades when you have a SAML, OIDC # or GitHub connector configured in DynamoDB. The default is "local". # Teleport Community Edition supports "local" or "github" -# Teleport Enterprise Edition supports "local", "github", "oidc" or "saml" -# Teleport Enterprise FIPS deployments have local authentication disabled, so should use "github", "oidc" or "saml" +# Teleport Enterprise Edition supports "local", "github", "oidc", or "saml" +# Teleport Enterprise FIPS deployments have local authentication disabled, so should use "github", "oidc", or "saml" export TF_VAR_teleport_auth_type="local" # plan diff --git a/examples/aws/terraform/ha-autoscale-cluster/ansible/upgrade.yaml b/examples/aws/terraform/ha-autoscale-cluster/ansible/upgrade.yaml index 33e2f1920e9..e8d25c6bb96 100644 --- a/examples/aws/terraform/ha-autoscale-cluster/ansible/upgrade.yaml +++ b/examples/aws/terraform/ha-autoscale-cluster/ansible/upgrade.yaml @@ -36,8 +36,8 @@ block: - name: Download and unpack new version of teleport get_url: - url: https://get.gravitational.com/teleport/{{teleport_version}}/teleport-ent-v{{teleport_version}}-linux-amd64-bin.tar.gz - dest: /tmp/teleport-ent-v{{teleport_version}}-linux-amd64-bin.tar.gz + url: https://cdn.teleport.dev/teleport-ent-v{{teleport_version}}-linux-arm64-bin.tar.gz + dest: /tmp/teleport-ent-v{{teleport_version}}-linux-arm64-bin.tar.gz - name: Unpack teleport binaries unarchive: extra_opts: ['--strip-components=1', '--show-stored-names'] @@ -47,7 +47,7 @@ - "VERSION" - "INSTALL" - "CHANGELOG" - src: /tmp/teleport-ent-v{{teleport_version}}-linux-amd64-bin.tar.gz + src: /tmp/teleport-ent-v{{teleport_version}}-linux-arm64-bin.tar.gz dest: /usr/local/bin remote_src: true owner: "{{ 'root' if 'node' in group_names else 'teleport' }}" diff --git a/examples/aws/terraform/ha-autoscale-cluster/assets/grafana-nginx-acm.conf b/examples/aws/terraform/ha-autoscale-cluster/assets/grafana-nginx-acm.conf deleted file mode 100644 index 56e265983ec..00000000000 --- a/examples/aws/terraform/ha-autoscale-cluster/assets/grafana-nginx-acm.conf +++ /dev/null @@ -1,62 +0,0 @@ -worker_processes auto; -user nginx; -pid /run/nginx.pid; - -events { - worker_connections 2048; -} - -http { - sendfile on; - tcp_nopush on; - tcp_nodelay on; - keepalive_timeout 65; - types_hash_max_size 2048; - # server_tokens off; - - # server_names_hash_bucket_size 64; - # server_name_in_redirect off; - - include /etc/nginx/mime.types; - default_type application/octet-stream; - - ## - # Logging Settings - ## - error_log stderr; - access_log /var/log/nginx/access.log; - error_log /var/log/nginx/error.log; - - - ## - # Gzip Settings - ## - gzip on; - - ## - # Websocket settings - ## - map $http_upgrade $connection_upgrade { - default upgrade; - '' close; - } - - # - # Frontend grafana (no TLS, as we're using ACM on the LB) - # - server { - listen 8444 default_server; - location / { - proxy_pass http://127.0.0.1:3000; - proxy_set_header Host $http_host; - } - # Proxy Grafana Live WebSocket connections. - location /api/live/ { - proxy_http_version 1.1; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection $connection_upgrade; - proxy_set_header Host $http_host; - proxy_pass http://127.0.0.1:3000; - } - } -} diff --git a/examples/aws/terraform/ha-autoscale-cluster/assets/grafana-nginx.conf b/examples/aws/terraform/ha-autoscale-cluster/assets/grafana-nginx.conf deleted file mode 100644 index 1ba67d19df1..00000000000 --- a/examples/aws/terraform/ha-autoscale-cluster/assets/grafana-nginx.conf +++ /dev/null @@ -1,75 +0,0 @@ -worker_processes auto; -user nginx; -pid /run/nginx.pid; - -events { - worker_connections 2048; -} - -http { - sendfile on; - tcp_nopush on; - tcp_nodelay on; - keepalive_timeout 65; - types_hash_max_size 2048; - # server_tokens off; - - # server_names_hash_bucket_size 64; - # server_name_in_redirect off; - - include /etc/nginx/mime.types; - default_type application/octet-stream; - - ## - # TLS settings - we are pretty strict here - # but well, it's a dev service, why not? - ## - ssl_protocols TLSv1.2 TLSv1.3; - ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; - ssl_prefer_server_ciphers off; - - ## - # Logging Settings - ## - error_log stderr; - access_log /var/log/nginx/access.log; - error_log /var/log/nginx/error.log; - - - ## - # Gzip Settings - ## - gzip on; - - ## - # Websocket settings - ## - map $http_upgrade $connection_upgrade { - default upgrade; - '' close; - } - - # - # Frontend grafana with TLS - # - server { - listen 8443 default_server ssl http2; - ssl_certificate_key /etc/tls/certs/privkey.pem; - ssl_certificate /etc/tls/certs/fullchain.pem; - ssl_session_timeout 1d; - ssl_session_cache shared:SSL:10m; # about 40000 sessions - ssl_session_tickets off; - location / { - proxy_pass http://127.0.0.1:3000; - proxy_set_header Host $http_host; - } - # Proxy Grafana Live WebSocket connections. - location /api/live/ { - proxy_http_version 1.1; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection $connection_upgrade; - proxy_set_header Host $http_host; - proxy_pass http://127.0.0.1:3000; - } - } -} diff --git a/examples/aws/terraform/ha-autoscale-cluster/assets/health-dashboard.json b/examples/aws/terraform/ha-autoscale-cluster/assets/health-dashboard.json deleted file mode 100644 index 0dddb1f6278..00000000000 --- a/examples/aws/terraform/ha-autoscale-cluster/assets/health-dashboard.json +++ /dev/null @@ -1 +0,0 @@ -{"dashboard": {"style": "dark", "rows": [{"repeat": null, "titleSize": "h6", "repeatIteration": null, "title": "Dashboard Row", "height": 247, "repeatRowId": null, "panels": [{"bars": false, "timeFrom": null, "links": [], "thresholds": [], "spaceLength": 10, "nullPointMode": "null", "renderer": "flot", "id": 1, "linewidth": 1, "steppedLine": false, "targets": [{"dsType": "influxdb", "tags": [], "measurement": "teleport_go_goroutines", "groupBy": [{"type": "tag", "params": ["host"]}], "select": [[{"type": "field", "params": ["gauge"]}]], "orderByTime": "ASC", "policy": "default", "refId": "A", "resultFormat": "time_series"}], "fill": 1, "span": 6, "title": "Goroutines (Max Per Interval)", "tooltip": {"sort": 0, "shared": true, "value_type": "individual"}, "legend": {"total": false, "show": true, "max": false, "min": false, "current": false, "values": false, "avg": false}, "yaxes": [{"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": "Goroutine Count"}, {"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": "Time"}], "xaxis": {"buckets": null, "show": true, "values": [], "mode": "time", "name": null}, "seriesOverrides": [], "percentage": false, "type": "graph", "dashes": false, "dashLength": 10, "stack": false, "timeShift": null, "aliasColors": {}, "lines": true, "points": false, "datasource": "InfluxDB", "pointradius": 5}, {"bars": false, "timeFrom": null, "links": [], "thresholds": [], "spaceLength": 10, "nullPointMode": "null", "renderer": "flot", "id": 2, "linewidth": 1, "steppedLine": false, "targets": [{"dsType": "influxdb", "tags": [], "measurement": "teleport_process_open_fds", "groupBy": [{"type": "tag", "params": ["host"]}], "select": [[{"type": "field", "params": ["gauge"]}]], "orderByTime": "ASC", "policy": "default", "refId": "A", "resultFormat": "time_series"}], "fill": 1, "span": 6, "title": "Open File Descriptors (Max)", "tooltip": {"sort": 0, "shared": true, "value_type": "individual"}, "legend": {"total": false, "show": true, "max": false, "min": false, "current": false, "values": false, "avg": false}, "yaxes": [{"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": "File Descriptors (Max)"}, {"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": null}], "xaxis": {"buckets": null, "show": true, "values": [], "mode": "time", "name": null}, "seriesOverrides": [], "percentage": false, "type": "graph", "dashes": false, "dashLength": 10, "stack": false, "timeShift": null, "aliasColors": {}, "lines": true, "points": false, "datasource": "InfluxDB", "pointradius": 5}], "showTitle": false, "collapse": false}, {"repeat": null, "titleSize": "h6", "repeatIteration": null, "title": "Dashboard Row", "height": 238, "repeatRowId": null, "panels": [{"bars": false, "timeFrom": null, "links": [], "thresholds": [], "spaceLength": 10, "nullPointMode": "null", "renderer": "flot", "id": 3, "linewidth": 1, "steppedLine": false, "targets": [{"dsType": "influxdb", "tags": [], "measurement": "teleport_go_memstats_heap_inuse_bytes", "groupBy": [{"type": "tag", "params": ["host"]}], "select": [[{"type": "field", "params": ["gauge"]}]], "orderByTime": "ASC", "policy": "default", "refId": "B", "resultFormat": "time_series"}], "fill": 1, "span": 6, "title": "Heap In Use Bytes", "tooltip": {"sort": 0, "shared": true, "value_type": "individual"}, "legend": {"total": false, "show": true, "max": false, "min": false, "current": false, "values": false, "avg": false}, "yaxes": [{"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": "Megabytes"}, {"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": null}], "xaxis": {"buckets": null, "show": true, "values": [], "mode": "time", "name": null}, "seriesOverrides": [], "percentage": false, "type": "graph", "dashes": false, "dashLength": 10, "stack": false, "timeShift": null, "aliasColors": {}, "lines": true, "points": false, "datasource": "InfluxDB", "pointradius": 5}, {"bars": false, "timeFrom": null, "links": [], "thresholds": [], "spaceLength": 10, "nullPointMode": "null", "renderer": "flot", "id": 5, "linewidth": 1, "steppedLine": false, "targets": [{"dsType": "influxdb", "hide": false, "tags": [], "measurement": "teleport_process_cpu_seconds_total", "refId": "A", "select": [[{"type": "field", "params": ["counter"]}, {"type": "non_negative_derivative", "params": ["10s"]}, {"type": "math", "params": [" / 10"]}]], "orderByTime": "ASC", "policy": "default", "groupBy": [{"type": "tag", "params": ["host"]}], "resultFormat": "time_series"}], "fill": 1, "span": 6, "title": "Teleport CPU Cores", "tooltip": {"sort": 0, "shared": true, "value_type": "individual"}, "legend": {"total": false, "show": true, "max": false, "min": false, "current": false, "values": false, "avg": false}, "yaxes": [{"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": null}, {"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": null}], "xaxis": {"buckets": null, "show": true, "values": [], "mode": "time", "name": null}, "seriesOverrides": [], "percentage": false, "type": "graph", "dashes": false, "dashLength": 10, "stack": false, "timeShift": null, "aliasColors": {}, "lines": true, "points": false, "datasource": "InfluxDB", "pointradius": 5}], "showTitle": false, "collapse": false}, {"repeat": null, "titleSize": "h6", "repeatIteration": null, "title": "Dashboard Row", "height": 220, "repeatRowId": null, "panels": [{"bars": false, "timeFrom": null, "links": [], "thresholds": [], "spaceLength": 10, "nullPointMode": "null", "renderer": "flot", "id": 6, "linewidth": 1, "steppedLine": false, "targets": [{"dsType": "influxdb", "hide": false, "rawQuery": false, "tags": [], "measurement": "teleport_server_interactive_sessions_total", "refId": "A", "select": [[{"type": "field", "params": ["gauge"]}]], "orderByTime": "ASC", "policy": "default", "query": "SELECT \"\" FROM \"teleport_audit_slice_bytes\" WHERE $timeFilter", "groupBy": [{"type": "tag", "params": ["host"]}], "resultFormat": "time_series"}], "fill": 1, "span": 6, "title": "Interactive Sessions", "tooltip": {"sort": 0, "shared": true, "value_type": "individual"}, "legend": {"total": false, "show": true, "max": false, "min": false, "current": false, "values": false, "avg": false}, "yaxes": [{"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": null}, {"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": null}], "xaxis": {"buckets": null, "show": true, "values": [], "mode": "time", "name": null}, "seriesOverrides": [], "percentage": false, "type": "graph", "dashes": false, "dashLength": 10, "stack": false, "timeShift": null, "aliasColors": {}, "lines": true, "points": false, "datasource": "InfluxDB", "pointradius": 5}, {"bars": false, "timeFrom": null, "links": [], "thresholds": [], "spaceLength": 10, "nullPointMode": "null", "renderer": "flot", "id": 7, "linewidth": 1, "steppedLine": false, "targets": [{"dsType": "influxdb", "hide": false, "rawQuery": true, "tags": [], "measurement": "teleport_access_point_requests", "refId": "A", "select": [[{"type": "field", "params": ["counter"]}, {"type": "non_negative_derivative", "params": ["10s"]}, {"type": "math", "params": [" / 10"]}]], "orderByTime": "ASC", "policy": "default", "query": "SELECT non_negative_derivative(max(\"counter\"), 1s) FROM \"teleport_access_point_requests\" WHERE $timeFilter GROUP BY \"host\", time(1s)", "groupBy": [], "resultFormat": "time_series"}], "fill": 1, "span": 6, "title": "Access Point Requests Per Second", "tooltip": {"sort": 0, "shared": true, "value_type": "individual"}, "legend": {"total": false, "show": true, "max": false, "min": false, "current": false, "values": false, "avg": false}, "yaxes": [{"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": null}, {"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": null}], "xaxis": {"buckets": null, "show": true, "values": [], "mode": "time", "name": null}, "seriesOverrides": [], "percentage": false, "type": "graph", "dashes": false, "dashLength": 10, "stack": false, "timeShift": null, "aliasColors": {}, "lines": true, "points": false, "datasource": "InfluxDB", "pointradius": 5}], "showTitle": false, "collapse": false}, {"repeat": null, "titleSize": "h6", "repeatIteration": null, "title": "Dashboard Row", "height": 253, "repeatRowId": null, "panels": [{"bars": false, "timeFrom": null, "links": [], "thresholds": [], "spaceLength": 10, "nullPointMode": "null", "renderer": "flot", "id": 4, "linewidth": 1, "steppedLine": false, "targets": [{"dsType": "influxdb", "hide": false, "rawQuery": true, "tags": [], "measurement": "teleport_audit_requests_total", "refId": "A", "select": [[{"type": "field", "params": ["counter"]}, {"type": "non_negative_derivative", "params": ["1s"]}, {"type": "math", "params": [" / 10"]}]], "orderByTime": "ASC", "policy": "default", "query": "SELECT non_negative_derivative(max(\"counter\"), 1s) FROM \"teleport_audit_requests_total\" WHERE $timeFilter GROUP BY \"host\", time(1s)", "groupBy": [{"type": "tag", "params": ["host"]}], "resultFormat": "time_series"}], "fill": 1, "span": 6, "title": "Audit Log Requests Per Second", "tooltip": {"sort": 0, "shared": true, "value_type": "individual"}, "legend": {"total": false, "show": true, "max": false, "min": false, "current": false, "values": false, "avg": false}, "yaxes": [{"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": null}, {"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": null}], "xaxis": {"buckets": null, "show": true, "values": [], "mode": "time", "name": null}, "seriesOverrides": [], "percentage": false, "type": "graph", "dashes": false, "dashLength": 10, "stack": false, "timeShift": null, "aliasColors": {}, "lines": true, "points": false, "datasource": "InfluxDB", "pointradius": 5}, {"bars": false, "timeFrom": null, "links": [], "thresholds": [], "spaceLength": 10, "nullPointMode": "null", "renderer": "flot", "id": 8, "linewidth": 1, "steppedLine": false, "targets": [{"dsType": "influxdb", "tags": [], "measurement": "teleport_audit_server_open_files", "groupBy": [{"type": "tag", "params": ["host"]}], "select": [[{"type": "field", "params": ["gauge"]}]], "orderByTime": "ASC", "policy": "default", "refId": "A", "resultFormat": "time_series"}], "fill": 1, "span": 6, "title": "Audit Server Open Files", "tooltip": {"sort": 0, "shared": true, "value_type": "individual"}, "legend": {"total": false, "show": true, "max": false, "min": false, "current": false, "values": false, "avg": false}, "yaxes": [{"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": null}, {"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": null}], "xaxis": {"buckets": null, "show": true, "values": [], "mode": "time", "name": null}, "seriesOverrides": [], "percentage": false, "type": "graph", "dashes": false, "dashLength": 10, "stack": false, "timeShift": null, "aliasColors": {}, "lines": true, "points": false, "datasource": "InfluxDB", "pointradius": 5}], "showTitle": false, "collapse": false}, {"repeat": null, "titleSize": "h6", "repeatIteration": null, "title": "Dashboard Row", "height": 310, "repeatRowId": null, "panels": [{"bars": false, "timeFrom": null, "links": [], "thresholds": [], "spaceLength": 10, "nullPointMode": "null", "renderer": "flot", "id": 9, "linewidth": 1, "steppedLine": false, "targets": [{"dsType": "influxdb", "rawQuery": true, "tags": [], "orderByTime": "ASC", "refId": "A", "alias": "", "select": [[{"type": "field", "params": ["5000"]}, {"type": "math", "params": [" / 100"]}], [{"type": "field", "params": ["973097.5341796875"]}]], "measurement": "teleport_access_point_latency_microseconds", "policy": "default", "query": "SELECT \"5000\" / \"973097.5341796875\" FROM \"teleport_access_point_latency_microseconds\" WHERE $timeFilter GROUP BY \"host\"", "groupBy": [{"type": "tag", "params": ["host"]}], "resultFormat": "time_series"}, {"dsType": "influxdb", "rawQuery": true, "tags": [], "refId": "C", "alias": "", "select": [[{"type": "field", "params": ["value"]}, {"type": "mean", "params": []}]], "orderByTime": "ASC", "policy": "default", "query": "SELECT \"16875\" / \"973097.5341796875\" FROM \"teleport_access_point_latency_microseconds\" WHERE $timeFilter GROUP BY \"host\"", "groupBy": [{"type": "time", "params": ["$__interval"]}, {"type": "fill", "params": ["null"]}], "resultFormat": "time_series"}, {"dsType": "influxdb", "rawQuery": true, "tags": [], "refId": "D", "alias": "56ms", "select": [[{"type": "field", "params": ["value"]}, {"type": "mean", "params": []}]], "orderByTime": "ASC", "policy": "default", "query": "SELECT \"56953.125\" / \"973097.5341796875\" FROM \"teleport_access_point_latency_microseconds\" WHERE $timeFilter GROUP BY \"host\"", "groupBy": [{"type": "time", "params": ["$__interval"]}, {"type": "fill", "params": ["null"]}], "resultFormat": "time_series"}, {"dsType": "influxdb", "rawQuery": true, "tags": [], "refId": "E", "alias": "", "select": [[{"type": "field", "params": ["value"]}, {"type": "mean", "params": []}]], "orderByTime": "ASC", "policy": "default", "query": "SELECT \"85429.6875\" / \"973097.5341796875\" FROM \"teleport_access_point_latency_microseconds\" WHERE $timeFilter GROUP BY \"host\"", "groupBy": [{"type": "time", "params": ["$__interval"]}, {"type": "fill", "params": ["null"]}], "resultFormat": "time_series"}], "fill": 1, "span": 4, "title": "Access Point Latency Histogram", "tooltip": {"sort": 0, "shared": true, "value_type": "individual"}, "legend": {"total": false, "show": true, "max": false, "min": false, "current": false, "values": false, "avg": false}, "yaxes": [{"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": null}, {"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": null}], "xaxis": {"buckets": null, "show": true, "values": [], "mode": "time", "name": null}, "seriesOverrides": [], "percentage": false, "type": "graph", "dashes": false, "dashLength": 10, "stack": false, "timeShift": null, "aliasColors": {}, "lines": true, "points": false, "datasource": "InfluxDB", "pointradius": 5}, {"bars": false, "timeFrom": null, "links": [], "thresholds": [], "spaceLength": 10, "nullPointMode": "null", "renderer": "flot", "id": 10, "linewidth": 1, "steppedLine": false, "targets": [{"dsType": "influxdb", "rawQuery": true, "tags": [], "orderByTime": "ASC", "refId": "A", "alias": "", "select": [[{"type": "field", "params": ["5000"]}, {"type": "math", "params": [" / 100"]}], [{"type": "field", "params": ["973097.5341796875"]}]], "measurement": "teleport_access_point_latency_microseconds", "policy": "default", "query": "SELECT \"5000\" / \"973097.5341796875\" FROM \"teleport_access_point_cache_latency_microseconds\" WHERE $timeFilter GROUP BY \"host\"", "groupBy": [{"type": "tag", "params": ["host"]}], "resultFormat": "time_series"}, {"dsType": "influxdb", "rawQuery": true, "tags": [], "refId": "C", "alias": "", "select": [[{"type": "field", "params": ["value"]}, {"type": "mean", "params": []}]], "orderByTime": "ASC", "policy": "default", "query": "SELECT \"16875\" / \"973097.5341796875\" FROM \"teleport_access_point_cache_latency_microseconds\" WHERE $timeFilter GROUP BY \"host\"", "groupBy": [{"type": "time", "params": ["$__interval"]}, {"type": "fill", "params": ["null"]}], "resultFormat": "time_series"}, {"dsType": "influxdb", "rawQuery": true, "tags": [], "refId": "D", "alias": "56ms", "select": [[{"type": "field", "params": ["value"]}, {"type": "mean", "params": []}]], "orderByTime": "ASC", "policy": "default", "query": "SELECT \"56953.125\" / \"973097.5341796875\" FROM \"teleport_access_point_cache_latency_microseconds\" WHERE $timeFilter GROUP BY \"host\"", "groupBy": [{"type": "time", "params": ["$__interval"]}, {"type": "fill", "params": ["null"]}], "resultFormat": "time_series"}, {"dsType": "influxdb", "rawQuery": true, "tags": [], "refId": "E", "alias": "", "select": [[{"type": "field", "params": ["value"]}, {"type": "mean", "params": []}]], "orderByTime": "ASC", "policy": "default", "query": "SELECT \"85429.6875\" / \"973097.5341796875\" FROM \"teleport_access_point_cache_latency_microseconds\" WHERE $timeFilter GROUP BY \"host\"", "groupBy": [{"type": "time", "params": ["$__interval"]}, {"type": "fill", "params": ["null"]}], "resultFormat": "time_series"}], "fill": 1, "span": 4, "title": "Access Point Cache Latency Histogram", "tooltip": {"sort": 0, "shared": true, "value_type": "individual"}, "legend": {"total": false, "show": true, "max": false, "min": false, "current": false, "values": false, "avg": false}, "yaxes": [{"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": null}, {"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": null}], "xaxis": {"buckets": null, "show": true, "values": [], "mode": "time", "name": null}, "seriesOverrides": [], "percentage": false, "type": "graph", "dashes": false, "dashLength": 10, "stack": false, "timeShift": null, "aliasColors": {}, "lines": true, "points": false, "datasource": "InfluxDB", "pointradius": 5}, {"bars": false, "timeFrom": null, "links": [], "thresholds": [], "spaceLength": 10, "nullPointMode": "null", "renderer": "flot", "id": 11, "linewidth": 1, "steppedLine": false, "targets": [{"dsType": "influxdb", "rawQuery": true, "tags": [], "orderByTime": "ASC", "refId": "A", "alias": "", "select": [[{"type": "field", "params": ["5000"]}, {"type": "math", "params": [" / 100"]}], [{"type": "field", "params": ["973097.5341796875"]}]], "measurement": "teleport_access_point_latency_microseconds", "policy": "default", "query": "SELECT \"5000\" / \"973097.5341796875\" FROM \"teleport_audit_latency_microseconds\" WHERE $timeFilter GROUP BY \"host\"", "groupBy": [{"type": "tag", "params": ["host"]}], "resultFormat": "time_series"}, {"dsType": "influxdb", "rawQuery": true, "tags": [], "refId": "C", "alias": "", "select": [[{"type": "field", "params": ["value"]}, {"type": "mean", "params": []}]], "orderByTime": "ASC", "policy": "default", "query": "SELECT \"16875\" / \"973097.5341796875\" FROM \"teleport_audit_latency_microseconds\" WHERE $timeFilter GROUP BY \"host\"", "groupBy": [{"type": "time", "params": ["$__interval"]}, {"type": "fill", "params": ["null"]}], "resultFormat": "time_series"}, {"dsType": "influxdb", "rawQuery": true, "tags": [], "refId": "D", "alias": "56ms", "select": [[{"type": "field", "params": ["value"]}, {"type": "mean", "params": []}]], "orderByTime": "ASC", "policy": "default", "query": "SELECT \"56953.125\" / \"973097.5341796875\" FROM \"teleport_audit_latency_microseconds\" WHERE $timeFilter GROUP BY \"host\"", "groupBy": [{"type": "time", "params": ["$__interval"]}, {"type": "fill", "params": ["null"]}], "resultFormat": "time_series"}, {"dsType": "influxdb", "rawQuery": true, "tags": [], "refId": "E", "alias": "", "select": [[{"type": "field", "params": ["value"]}, {"type": "mean", "params": []}]], "orderByTime": "ASC", "policy": "default", "query": "SELECT \"85429.6875\" / \"973097.5341796875\" FROM \"teleport_audit_latency_microseconds\" WHERE $timeFilter GROUP BY \"host\"", "groupBy": [{"type": "time", "params": ["$__interval"]}, {"type": "fill", "params": ["null"]}], "resultFormat": "time_series"}], "fill": 1, "span": 4, "title": "Audit Log API Latency Histogram", "tooltip": {"sort": 0, "shared": true, "value_type": "individual"}, "legend": {"total": false, "show": true, "max": false, "min": false, "current": false, "values": false, "avg": false}, "yaxes": [{"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": null}, {"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": null}], "xaxis": {"buckets": null, "show": true, "values": [], "mode": "time", "name": null}, "seriesOverrides": [], "percentage": false, "type": "graph", "dashes": false, "dashLength": 10, "stack": false, "timeShift": null, "aliasColors": {}, "lines": true, "points": false, "datasource": "InfluxDB", "pointradius": 5}], "showTitle": false, "collapse": false}], "templating": {"list": []}, "links": [], "gnetId": null, "graphTooltip": 0, "hideControls": false, "tags": [], "editable": true, "refresh": "5s", "id": null, "__inputs": [{"description": "", "pluginName": "InfluxDB", "label": "InfluxDB", "pluginId": "influxdb", "type": "datasource", "name": "DS_INFLUXDB"}], "timepicker": {"time_options": ["5m", "15m", "1h", "6h", "12h", "24h", "2d", "7d", "30d"], "refresh_intervals": ["5s", "10s", "30s", "1m", "5m", "15m", "30m", "1h", "2h", "1d"]}, "title": "Teleport Health Stats", "version": 5, "time": {"to": "now", "from": "now-15m"}, "__requires": [{"version": "4.6.3", "type": "grafana", "id": "grafana", "name": "Grafana"}, {"version": "", "type": "panel", "id": "graph", "name": "Graph"}, {"version": "1.0.0", "type": "datasource", "id": "influxdb", "name": "InfluxDB"}], "timezone": "browser", "schemaVersion": 14, "annotations": {"list": [{"enable": true, "hide": true, "name": "Annotations & Alerts", "builtIn": 1, "datasource": "-- Grafana --", "type": "dashboard", "iconColor": "rgba(0, 211, 255, 1)"}]}}} \ No newline at end of file diff --git a/examples/aws/terraform/ha-autoscale-cluster/auth-user-data.tpl b/examples/aws/terraform/ha-autoscale-cluster/auth-user-data.tpl index 107966e6f97..befdf45355e 100644 --- a/examples/aws/terraform/ha-autoscale-cluster/auth-user-data.tpl +++ b/examples/aws/terraform/ha-autoscale-cluster/auth-user-data.tpl @@ -9,10 +9,9 @@ TELEPORT_DOMAIN_ADMIN_EMAIL=${email} TELEPORT_DOMAIN_NAME=${domain_name} TELEPORT_DYNAMO_TABLE_NAME=${dynamo_table_name} TELEPORT_DYNAMO_EVENTS_TABLE_NAME=${dynamo_events_table_name} -TELEPORT_INFLUXDB_ADDRESS=${influxdb_addr} TELEPORT_LICENSE_PATH=${license_path} TELEPORT_LOCKS_TABLE_NAME=${locks_table_name} TELEPORT_S3_BUCKET=${s3_bucket} USE_ACM=${use_acm} USE_TLS_ROUTING=${use_tls_routing} -EOF \ No newline at end of file +EOF diff --git a/examples/aws/terraform/ha-autoscale-cluster/auth_asg.tf b/examples/aws/terraform/ha-autoscale-cluster/auth_asg.tf index b12f9540697..ceaaac76825 100644 --- a/examples/aws/terraform/ha-autoscale-cluster/auth_asg.tf +++ b/examples/aws/terraform/ha-autoscale-cluster/auth_asg.tf @@ -64,9 +64,7 @@ resource "aws_launch_template" "auth" { email = var.email domain_name = var.route53_domain s3_bucket = var.s3_bucket_name - influxdb_addr = "http://${aws_lb.monitor.dns_name}:8086" license_path = var.license_path - telegraf_version = var.telegraf_version teleport_uid = var.teleport_uid use_acm = var.use_acm use_tls_routing = var.use_tls_routing diff --git a/examples/aws/terraform/ha-autoscale-cluster/auth_iam.tf b/examples/aws/terraform/ha-autoscale-cluster/auth_iam.tf index ed00a078aa7..a79a6a7588c 100644 --- a/examples/aws/terraform/ha-autoscale-cluster/auth_iam.tf +++ b/examples/aws/terraform/ha-autoscale-cluster/auth_iam.tf @@ -120,7 +120,7 @@ EOF } -// S3 is used for letsencrypt, auth servers request certificates from letsencrypt +// S3 is used for Let's Encrypt, auth servers request certificates from Let's Encrypt // and publish to S3 encrypted bucket. SSM is not used, because certificates and private keys // are too big for SSM. resource "aws_iam_role_policy" "auth_s3" { diff --git a/examples/aws/terraform/ha-autoscale-cluster/bastion.tf b/examples/aws/terraform/ha-autoscale-cluster/bastion.tf index c9984a8ab67..26d9d6f3763 100644 --- a/examples/aws/terraform/ha-autoscale-cluster/bastion.tf +++ b/examples/aws/terraform/ha-autoscale-cluster/bastion.tf @@ -1,10 +1,11 @@ +# orca-iac disable=b61415c4-ce88-4f3a-930b-821d0a4530bb // Bastion is an emergency access bastion // that could be spun up on demand in case // of the need to have emergency administrative access resource "aws_instance" "bastion" { count = "1" ami = data.aws_ami.base.id - instance_type = "t2.medium" + instance_type = "t4g.medium" key_name = var.key_name associate_public_ip_address = true source_dest_check = false diff --git a/examples/aws/terraform/ha-autoscale-cluster/data.tf b/examples/aws/terraform/ha-autoscale-cluster/data.tf index 0be9363075d..f532a8ae744 100644 --- a/examples/aws/terraform/ha-autoscale-cluster/data.tf +++ b/examples/aws/terraform/ha-autoscale-cluster/data.tf @@ -3,7 +3,7 @@ // are relying on systemd data "aws_ami" "base" { most_recent = true - owners = [126027368216] + owners = [146628656107] filter { name = "name" diff --git a/examples/aws/terraform/ha-autoscale-cluster/monitor-user-data.tpl b/examples/aws/terraform/ha-autoscale-cluster/monitor-user-data.tpl deleted file mode 100644 index f24eaf0f883..00000000000 --- a/examples/aws/terraform/ha-autoscale-cluster/monitor-user-data.tpl +++ /dev/null @@ -1,9 +0,0 @@ -#!/bin/bash -cat >/etc/teleport.d/conf <