From a38d3848ee9322b08f428f8abdc7b01636418c1e Mon Sep 17 00:00:00 2001 From: Reed Loden Date: Sat, 6 Jan 2024 12:03:30 -0800 Subject: [PATCH] Update AWS HA autoscale and starter cluster examples to use hardened AMIs with Graviton/ARM64 (#35956) AWS starter and HA autoscale cluster examples are outdated now that legacy AMIs have been deprecated. Update them to use hardened AMIs and bump AWS terraform provider to v5.x. Graviton is the preferred (and cheaper) platform on EC2, so our documentation /example code should use such instance types. This also means using ARM64 builds as well. Remove the `monitor` role and associated infrastructure (as the new hardened AMIs lack telegraf, influxdb, etc.). s/letsencrypt/Let's Encrypt/ Ref #34282. Ref #36110. Closes #2734. Closes #4756. Closes #4572. --- CHANGELOG.md | 11 +- assets/aws/files/bin/teleport-all-pre-start | 8 +- assets/aws/files/bin/teleport-generate-config | 166 +----------- assets/aws/files/bin/teleport-get-cert | 2 +- assets/aws/files/bin/teleport-lock | 2 +- .../files/tests/ha-auth-fips-tlsrouting.bats | 1 - assets/aws/files/tests/ha-auth-fips.bats | 3 +- assets/aws/files/tests/ha-auth-oss.bats | 1 - .../aws/files/tests/ha-auth-tlsrouting.bats | 3 +- assets/aws/files/tests/ha-auth.bats | 3 +- assets/aws/files/tests/ha-node.bats | 1 - .../aws/files/tests/ha-proxy-acm-alias.bats | 1 - .../files/tests/ha-proxy-acm-tlsrouting.bats | 3 +- assets/aws/files/tests/ha-proxy-acm.bats | 1 - assets/aws/files/tests/ha-proxy-mysql.bats | 1 - assets/aws/files/tests/ha-proxy-no-db.bats | 1 - .../aws/files/tests/ha-proxy-tlsrouting.bats | 3 +- assets/aws/files/tests/ha-proxy.bats | 1 - .../aws-ha-autoscale-cluster-terraform.mdx | 70 ++--- .../aws-starter-cluster-terraform.mdx | 43 ++- docs/pages/installation.mdx | 18 +- .../terraform/ha-autoscale-cluster/Makefile | 13 +- .../terraform/ha-autoscale-cluster/README.md | 19 +- .../ha-autoscale-cluster/ansible/upgrade.yaml | 6 +- .../assets/grafana-nginx-acm.conf | 62 ----- .../assets/grafana-nginx.conf | 75 ------ .../assets/health-dashboard.json | 1 - .../ha-autoscale-cluster/auth-user-data.tpl | 3 +- .../ha-autoscale-cluster/auth_asg.tf | 2 - .../ha-autoscale-cluster/auth_iam.tf | 2 +- .../terraform/ha-autoscale-cluster/bastion.tf | 3 +- .../terraform/ha-autoscale-cluster/data.tf | 2 +- .../monitor-user-data.tpl | 9 - .../ha-autoscale-cluster/monitor_asg.tf | 244 ------------------ .../ha-autoscale-cluster/monitor_iam.tf | 89 ------- .../ha-autoscale-cluster/node-user-data.tpl | 3 +- .../ha-autoscale-cluster/node_asg.tf | 2 - .../ha-autoscale-cluster/provider.tf | 6 +- .../ha-autoscale-cluster/proxy-user-data.tpl | 3 +- .../ha-autoscale-cluster/proxy_asg.tf | 4 +- .../ha-autoscale-cluster/proxy_network.tf | 79 +----- .../terraform/ha-autoscale-cluster/route53.tf | 4 +- .../aws/terraform/ha-autoscale-cluster/s3.tf | 25 -- .../aws/terraform/ha-autoscale-cluster/ssm.tf | 8 - .../terraform/ha-autoscale-cluster/vars.tf | 56 +--- .../aws/terraform/ha-autoscale-cluster/vpc.tf | 4 +- .../aws/terraform/starter-cluster/Makefile | 10 +- .../aws/terraform/starter-cluster/README.md | 18 +- .../aws/terraform/starter-cluster/data.tf | 4 +- examples/aws/terraform/starter-cluster/ssm.tf | 2 +- .../aws/terraform/starter-cluster/vars.tf | 4 +- 51 files changed, 155 insertions(+), 950 deletions(-) delete mode 100644 examples/aws/terraform/ha-autoscale-cluster/assets/grafana-nginx-acm.conf delete mode 100644 examples/aws/terraform/ha-autoscale-cluster/assets/grafana-nginx.conf delete mode 100644 examples/aws/terraform/ha-autoscale-cluster/assets/health-dashboard.json delete mode 100644 examples/aws/terraform/ha-autoscale-cluster/monitor-user-data.tpl delete mode 100644 examples/aws/terraform/ha-autoscale-cluster/monitor_asg.tf delete mode 100644 examples/aws/terraform/ha-autoscale-cluster/monitor_iam.tf diff --git a/CHANGELOG.md b/CHANGELOG.md index a379689dcd1..0f1eba9cab8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -71,7 +71,7 @@ by `insecure-drop`, which still creates temporary users but does not create a home directory. Users who need home directory creation should either wrap `useradd`/`userdel` or use PAM. -##### Packages no longer published to legacy Debian and RPM repos +#### Packages no longer published to legacy Debian and RPM repos `deb.releases.teleport.dev` and `rpm.releases.teleport.dev` were deprecated in Teleport 11. Beginning in Teleport 15, Debian and RPM packages will no longer be @@ -167,6 +167,15 @@ perform this step since it must be done by an administrator at installation time. As a result, Teleport's service account can use more restrictive permissions. +#### Example AWS cluster deployments updated + +The AWS terraform examples for Teleport clusters have been updated to use the +newer hardened Amazon Linux 2023 AMIs. Additionally, the default architecture +and instance type has been changed to ARM64/Graviton. + +As a result of this modernization, the legacy monitoring stack configuration +used with the legacy AMIs has been removed. + ## 14.0.0 (09/20/23) Teleport 14 brings the following new major features and improvements: diff --git a/assets/aws/files/bin/teleport-all-pre-start b/assets/aws/files/bin/teleport-all-pre-start index 403572ed14c..fafa554918a 100755 --- a/assets/aws/files/bin/teleport-all-pre-start +++ b/assets/aws/files/bin/teleport-all-pre-start @@ -1,5 +1,5 @@ #!/bin/bash -# This script prepares a Letsencrypt certificate before all-in-one Teleport starts for the first time (if needed) +# This script prepares a Let's Encrypt certificate before all-in-one Teleport starts for the first time (if needed) set -e if [[ "${DEBUG:-false}" == "true" ]]; then set -x @@ -10,11 +10,11 @@ if [ -f /etc/teleport.d/conf ]; then source /etc/teleport.d/conf fi -# check for letsencrypt +# check for Let's Encrypt if [[ "${USE_LETSENCRYPT}" != "true" ]]; then - echo "Not using Letsencrypt, exiting with success" + echo "Not using Let's Encrypt, exiting with success" exit 0 fi # copy certificates into place -/bin/aws s3 sync --exact-timestamps s3://${TELEPORT_S3_BUCKET}/live/${TELEPORT_DOMAIN_NAME} /var/lib/teleport \ No newline at end of file +/bin/aws s3 sync --exact-timestamps s3://${TELEPORT_S3_BUCKET}/live/${TELEPORT_DOMAIN_NAME} /var/lib/teleport diff --git a/assets/aws/files/bin/teleport-generate-config b/assets/aws/files/bin/teleport-generate-config index 9f2776c7db2..b1042e5abab 100755 --- a/assets/aws/files/bin/teleport-generate-config +++ b/assets/aws/files/bin/teleport-generate-config @@ -215,7 +215,7 @@ fi touch ${USE_CONFIG_PATH} chmod 664 ${USE_CONFIG_PATH} -# Use letsencrypt by default unless we are explicitly using ACM here +# Use Let's Encrypt by default unless we are explicitly using ACM here if [[ "${USE_ACM}" != "true" ]]; then rm -f ${USE_CONFD_DIR}/role.all-acm echo "use-letsencrypt" > ${USE_CONFD_DIR}/use-letsencrypt @@ -358,7 +358,7 @@ EOF write_ssh_and_tunnel_section 443 fi - # if we are using letsencrypt (i.e. not ACM) then append config lines + # if we are using Let's Encrypt (i.e. not ACM) then append config lines if [[ "${USE_ACM}" != "true" ]]; then write_https_keypairs_section else @@ -427,15 +427,6 @@ EOF systemctl_wrap enable teleport-node.service systemctl_wrap start --no-block teleport-node.service -elif [[ "${TELEPORT_ROLE}" == "monitor" ]]; then - echo "monitor" > ${USE_CONFD_DIR}/role.monitor - # disable teleport service if this has the monitor role - systemctl_wrap disable teleport.service - # no teleport config needed - rm -f ${USE_CONFIG_PATH} - # run monitor setup as an independent service - systemctl_wrap start --no-block teleport-monitor-setup.service - # starter cluster configuration elif [[ "${TELEPORT_ROLE}" == "auth,node,proxy" ]]; then echo "Teleport all-in-one configuration selected." @@ -445,7 +436,7 @@ elif [[ "${TELEPORT_ROLE}" == "auth,node,proxy" ]]; then # always enable TLS routing when ACM is enabled USE_TLS_ROUTING=true sed -i 's/USE_TLS_ROUTING=false/USE_TLS_ROUTING=true/g' ${USE_CONFD_DIR}/conf - # remove letsencrypt config + # remove Let's Encrypt config rm -f ${USE_CONFD_DIR}/use-letsencrypt sed -i 's/USE_LETSENCRYPT=true/USE_LETSENCRYPT=false/g' ${USE_CONFD_DIR}/conf # enable ACM role to use alternative unit file @@ -563,10 +554,10 @@ EOF systemctl_wrap enable teleport-acm.service systemctl_wrap start --no-block teleport-acm.service - # alternatively, if we are using letsencrypt, append config lines + # alternatively, if we are using Let's Encrypt, append config lines elif [[ "${USE_LETSENCRYPT}" == "true" ]] && [[ "${USE_ACM}" == "false" ]]; then - echo "Letsencrypt support enabled" - # these variables must all be set for letsencrypt to work + echo "Let's Encrypt support enabled" + # these variables must all be set for Let's Encrypt to work # it also needs the running instance to have permissions to read from/write to the S3 bucket if [[ "${TELEPORT_DOMAIN_ADMIN_EMAIL}" != "" && "${TELEPORT_DOMAIN_NAME}" != "" && "${TELEPORT_S3_BUCKET}" != "" ]]; then write_https_keypairs_section @@ -662,10 +653,10 @@ EOF write_kubernetes_section TELEPORT_EXTERNAL_HOSTNAME fi - # if we are using letsencrypt, append config lines + # if we are using Let's Encrypt, append config lines if [[ "${USE_LETSENCRYPT}" == "true" ]]; then - echo "Letsencrypt support enabled" - # these variables must all be set for letsencrypt to work + echo "Let's Encrypt support enabled" + # these variables must all be set for Let's Encrypt to work # it also needs the running instance to have permissions to read from/write to the S3 bucket if [[ "${TELEPORT_DOMAIN_ADMIN_EMAIL}" != "" && "${TELEPORT_DOMAIN_NAME}" != "" && "${TELEPORT_S3_BUCKET}" != "" ]]; then write_https_keypairs_section @@ -693,145 +684,8 @@ EOF fi fi -# enable telegraf service if running in cluster mode -if [[ "${TELEPORT_ROLE}" == "auth" || "${TELEPORT_ROLE}" == "node" || "${TELEPORT_ROLE}" == "proxy" ]]; then - # Install teleport telegraf configuration - # Telegraf will collect prometheus metrics and send to influxdb collector - cat >/etc/telegraf/telegraf.conf < ${USE_CONFD_DIR}/role.agent cat >${USE_CONFIG_PATH} <" ``` The AWS region to run in. You should pick from the supported list as detailed in the [README](https://github.com/gravitational/teleport/blob/branch/v(=teleport.major_version=)/examples/aws/terraform/ha-autoscale-cluster/README.md). -These are regions which support [DynamoDB encryption at rest](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/EncryptionAtRest.html). +These are regions that support [DynamoDB encryption at rest](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/EncryptionAtRest.html). ### cluster_name @@ -157,35 +155,36 @@ cluster from scratch, so choose carefully. A good example might be something lik ### ami_name ```code -$ export TF_VAR_ami_name="gravitational-teleport-ami-ent-(=teleport.version=)" +$ export TF_VAR_ami_name="teleport-ent-(=teleport.version=)" ``` -Gravitational automatically builds and publishes Teleport Community Edition, Enterprise, and Enterprise FIPS 140-2 -AMIs when we release a new version of Teleport. The AMI names follow the format: `gravitational-teleport-ami--` -where `` is either `oss` or `ent` (Enterprise) and `version` is the version of Teleport e.g. `(=teleport.version=)`. +Teleport (Gravitational) automatically builds and publishes Teleport Community Edition, Enterprise, and Enterprise FIPS 140-2 +AMIs when we release a new version of Teleport. The AMI names follow the format: `teleport---` +where `` is either `oss` or `ent` (Enterprise), `version` is the version of Teleport, e.g. `(=teleport.version=)`, +and `` is either `x86_64` or `arm64`. FIPS 140-2 compatible AMIs (which deploy Teleport in FIPS 140-2 mode by default) have the `-fips` suffix. -The AWS account ID which publishes these AMIs is `126027368216`. You can list the available AMIs with +The AWS account ID that publishes these AMIs is `146628656107`. You can list the available AMIs with the example `awscli` commands below. The output is in JSON format by default. OSS AMIs
```code - $ aws --region ec2 describe-images --owners 126027368216 --filters 'Name=name,Values=gravitational-teleport-ami-oss-(=teleport.version=)' + $ aws --region ec2 describe-images --owners 146628656107 --filters 'Name=name,Values=teleport-oss-(=teleport.version=)-*' ``` Enterprise AMIs
```code - $ aws --region ec2 describe-images --owners 126027368216 --filters 'Name=name,Values=gravitational-teleport-ami-ent-(=teleport.version=)' + $ aws --region ec2 describe-images --owners 146628656107 --filters 'Name=name,Values=teleport-ent-(=teleport.version=)-*' ``` - List Enterprise FIPS 140-2 AMIs
+ Enterprise FIPS 140-2 AMIs
```code - $ aws --region ec2 describe-images --owners 126027368216 --filters 'Name=name,Values=gravitational-teleport-ami-ent-(=teleport.version=)-fips' + $ aws --region ec2 describe-images --owners 146628656107 --filters 'Name=name,Values=teleport-ent-(=teleport.version=)-*-fips-*' ``` @@ -297,32 +296,16 @@ Remember that S3 bucket names must be globally unique, so if you see errors rela $ export TF_VAR_email="support@example.com" ``` -LetsEncrypt requires an email address for every certificate registered which can be used to send notifications and +Let's Encrypt requires an email address for every certificate registered that can be used to send notifications and useful information. We recommend a generic ops/support email address which the team deploying Teleport has access to. -### grafana_pass - -```code -$ export TF_VAR_grafana_pass="CHANGE_THIS_VALUE" -``` - -We deploy Grafana along with every Terraform deployment and automatically make stats on cluster usage available in -a custom dashboard. This variable sets up the password for the Grafana `admin` user. The Grafana web UI is served -on the same subdomain as specified above in [`route53_domain`](#route53\_domain) on port 8443. - -With the variables set in this example, it would be available on [https://teleport.example.com:8443](https://teleport.example.com:8443) - -If you do not change this from the default (`CHANGE_THIS_VALUE`), then it will be set to a random value for security -and you will need to log into the monitoring instance to discover this manually. As such, we recommend setting this -to a known value at the outset. - ### use_acm ```code $ export TF_VAR_use_acm="true" ``` -If set to the string `"false"`, Terraform will use [LetsEncrypt](https://letsencrypt.org/) to provision the public-facing +If set to the string `"false"`, Terraform will use [Let's Encrypt](https://letsencrypt.org/) to provision the public-facing web UI certificate for the Teleport cluster ([`route53_domain`](#route53\_domain) - so [https://teleport.example.com](https://teleport.example.com) in this example). This uses an [AWS network load balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/introduction.html) to load-balance connections to the Teleport cluster's web UI, and its SSL termination is handled by Teleport itself. @@ -357,12 +340,12 @@ $ export TF_VAR_teleport_auth_type="local" ``` This value can be used to change the default authentication type used for the Teleport cluster. This is useful for persisting a -default authentication type across AMI upgrades when you have a SAML, OIDC or GitHub connector configured in DynamoDB. +default authentication type across AMI upgrades when you have a SAML, OIDC, or GitHub connector configured in DynamoDB. The default is `local`. - Teleport Community Edition supports `local` or `github` -- Teleport Enterprise Edition supports `local`, `github`, `oidc` or `saml` -- Teleport Enterprise FIPS deployments have local authentication disabled, so should use `github`, `oidc` or `saml` +- Teleport Enterprise Edition supports `local`, `github`, `oidc`, or `saml` +- Teleport Enterprise FIPS deployments have local authentication disabled, so should use `github`, `oidc`, or `saml` See the [Teleport authentication reference](../../reference/authentication.mdx) for more information. @@ -372,13 +355,12 @@ See the [Teleport authentication reference](../../reference/authentication.mdx) Our reference deployment will provision the following instances for your cluster using AWS Auto Scaling Groups (ASG) with these default settings: -- 2 x `m4.large` Teleport Auth Service instances in an ASG, behind an internal network load balancer, configured using DynamoDB for +- 2 x `m7g.large` Teleport Auth Service instances in an ASG, behind an internal network load balancer, configured using DynamoDB for shared storage. [The desired size of the ASG is configured here](https://github.com/gravitational/teleport/blob/branch/v(=teleport.major_version=)/examples/aws/terraform/ha-autoscale-cluster/auth_asg.tf#L11) -- 2 x `m4.large` Teleport Proxy Service instances in an ASG, behind a public-facing load balancer - NLB for LetsEncrypt, ALB for ACM. [The desired size of the ASG is configured here](https://github.com/gravitational/teleport/blob/branch/v(=teleport.major_version=)/examples/aws/terraform/ha-autoscale-cluster/proxy_asg.tf#L12) -- 1 x `m4.large` Teleport SSH Service instance in an ASG. Server instances in this ASG will join with Teleport SSH Service enabled and connected to the **auth** +- 2 x `m7g.large` Teleport Proxy Service instances in an ASG, behind a public-facing load balancer - NLB for LetsEncrypt, ALB for ACM. [The desired size of the ASG is configured here](https://github.com/gravitational/teleport/blob/branch/v(=teleport.major_version=)/examples/aws/terraform/ha-autoscale-cluster/proxy_asg.tf#L12) +- 1 x `m7g.large` Teleport SSH Service instance in an ASG. Server instances in this ASG will join with Teleport SSH Service enabled and connected to the **auth** service. [The desired size of the ASG is configured here](https://github.com/gravitational/teleport/blob/branch/v(=teleport.major_version=)/examples/aws/terraform/ha-autoscale-cluster/node_asg.tf#L10) -- 1 x `m4.large` monitoring server in an ASG which hosts the Grafana instance and receives monitoring data from each service in the cluster. [The desired size of the ASG is configured here](https://github.com/gravitational/teleport/blob/branch/v(=teleport.major_version=)/examples/aws/terraform/ha-autoscale-cluster/monitor_asg.tf#L12) -- 1 x `t2.medium` bastion server which is the only permitted source for inbound SSH traffic to the instances. This is done +- 1 x `t4g.medium` bastion server which is the only permitted source for inbound SSH traffic to the instances. This is done to avoid exposing each instance to the internet directly. [The instance types used for each ASG can be configured here](https://github.com/gravitational/teleport/blob/branch/v(=teleport.major_version=)/examples/aws/terraform/ha-autoscale-cluster/vars.tf#L23-L45) diff --git a/docs/pages/deploy-a-cluster/deployments/aws-starter-cluster-terraform.mdx b/docs/pages/deploy-a-cluster/deployments/aws-starter-cluster-terraform.mdx index 297db08e246..8a9cbbd003f 100644 --- a/docs/pages/deploy-a-cluster/deployments/aws-starter-cluster-terraform.mdx +++ b/docs/pages/deploy-a-cluster/deployments/aws-starter-cluster-terraform.mdx @@ -35,7 +35,7 @@ $ terraform version Terraform v1.5.6 ``` -You will also require the `aws` command line tool. This is available in Ubuntu/Debian/Fedora/CentOS and MacOS Homebrew +You will also require the `aws` command line tool. This is available in Ubuntu/Debian/Fedora/CentOS and macOS Homebrew as the `awscli` package. Fedora/CentOS: `yum -y install awscli` @@ -61,7 +61,7 @@ You should also have a default region set under `~/.aws/config`: ```code $ cat ~/.aws/config # [default] -# region = us-east-1 +# region = us-west-2 ``` As a result, you should be able to run a command like `aws ec2 describe-instances` to list running EC2 instances. @@ -79,7 +79,7 @@ AWS services: - [IAM](https://aws.amazon.com/iam/) - [SSM Parameter Store](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html) -The Terraform deployment itself will create a new IAM role to be used by the Teleport instance which has appropriately +The Terraform deployment itself will create a new IAM role to be used by the Teleport instance that has appropriately limited permission scopes for AWS services. However, the initial cluster setup must be done by a user with a high level of AWS permissions. @@ -108,10 +108,8 @@ Initializing the backend... Initializing provider plugins... - Checking for available provider plugins... -- Installing hashicorp/random v3.5.1... -- Installed hashicorp/random v3.5.1 (signed by HashiCorp) -- Installing hashicorp/aws v4.67.0... -- Installed hashicorp/aws v4.67.0 (signed by HashiCorp) +- Installing hashicorp/aws v5.31.0... +- Installed hashicorp/aws v5.31.0 (signed by HashiCorp) Terraform has been successfully initialized! @@ -154,7 +152,7 @@ $ export TF_VAR_region="" ``` The AWS region to run in. You should pick from the supported list as detailed in the [README](https://github.com/gravitational/teleport/blob/branch/v(=teleport.major_version=)/examples/aws/terraform/starter-cluster/README.md). -These are regions which support [DynamoDB encryption at rest](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/EncryptionAtRest.html). +These are regions that support [DynamoDB encryption at rest](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/EncryptionAtRest.html). ### cluster_name @@ -170,35 +168,36 @@ cluster from scratch, so choose carefully. A good example might be something lik ### ami_name ```code -$ export TF_VAR_ami_name="gravitational-teleport-ami-ent-(=teleport.version=)" +$ export TF_VAR_ami_name="teleport-ent-(=teleport.version=)" ``` -Gravitational automatically builds and publishes OSS, Enterprise and Enterprise FIPS 140-2 AMIs when we -release a new version of Teleport. The AMI names follow the format: `gravitational-teleport-ami--` -where `` is either `oss` or `ent` (Enterprise) and `version` is the version of Teleport e.g. `(=teleport.version=)`. +Teleport (Gravitational) automatically builds and publishes OSS, Enterprise and Enterprise FIPS 140-2 AMIs when we +release a new version of Teleport. The AMI names follow the format: `teleport---` +where `` is either `oss` or `ent` (Enterprise), `version` is the version of Teleport e.g. `(=teleport.version=)`, +and `arch` is either `x86_64` or `arm64`. FIPS 140-2 compatible AMIs (which deploy Teleport in FIPS 140-2 mode by default) have the `-fips` suffix. -The AWS account ID which publishes these AMIs is `126027368216`. You can list the available AMIs with +The AWS account ID that publishes these AMIs is `146628656107`. You can list the available AMIs with the example `awscli` commands below. The output is in JSON format by default. OSS AMIs
```code - $ aws --region ec2 describe-images --owners 126027368216 --filters 'Name=name,Values=gravitational-teleport-ami-oss-(=teleport.version=)' + $ aws --region ec2 describe-images --owners 146628656107 --filters 'Name=name,Values=teleport-oss-(=teleport.version=)-*' ``` Enterprise AMIs
```code - $ aws --region ec2 describe-images --owners 126027368216 --filters 'Name=name,Values=gravitational-teleport-ami-ent-(=teleport.version=)' + $ aws --region ec2 describe-images --owners 146628656107 --filters 'Name=name,Values=teleport-ent-(=teleport.version=)-*' ``` - List Enterprise FIPS 140-2 AMIs
+ Enterprise FIPS 140-2 AMIs
```code - aws --region ec2 describe-images --owners 126027368216 --filters 'Name=name,Values=gravitational-teleport-ami-ent-(=teleport.version=)-fips' + $ aws --region ec2 describe-images --owners 146628656107 --filters 'Name=name,Values=teleport-ent-(=teleport.version=)-*-fips-*' ``` @@ -318,7 +317,7 @@ A `micro` instance is fine for testing, but if this server will need to support $ export TF_VAR_email="support@example.com" ``` -LetsEncrypt requires an email address for every certificate registered which can be used to send notifications and +Let's Encrypt requires an email address for every certificate registered which can be used to send notifications and useful information. We recommend a generic ops/support email address which the team deploying Teleport has access to. ### use_letsencrypt @@ -327,7 +326,7 @@ useful information. We recommend a generic ops/support email address which the t $ export TF_VAR_use_letsencrypt="false" ``` -If set to the string `"true"`, Terraform will use [LetsEncrypt](https://letsencrypt.org/) to provision the public-facing +If set to the string `"true"`, Terraform will use [Let's Encrypt](https://letsencrypt.org/) to provision the public-facing web UI certificate for the Teleport cluster ([`route53_domain`](#route53\_domain) - so [https://teleport.example.com](https://teleport.example.com) in this example). This uses an [AWS network load balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/introduction.html) to load-balance connections to the Teleport cluster's web UI, and its SSL termination is handled by Teleport itself. @@ -374,8 +373,8 @@ default authentication type across AMI upgrades when you have a SAML, OIDC or Gi The default is `local`. - Teleport Community Edition supports `local` or `github` -- Teleport Enterprise Edition supports `local`, `github`, `oidc` or `saml` -- Teleport Enterprise FIPS deployments have local authentication disabled, so should use `github`, `oidc` or `saml` +- Teleport Enterprise Edition supports `local`, `github`, `oidc`, or `saml` +- Teleport Enterprise FIPS deployments have local authentication disabled, so should use `github`, `oidc`, or `saml` See the [Teleport authentication reference](../../reference/authentication.mdx) for more information. diff --git a/docs/pages/installation.mdx b/docs/pages/installation.mdx index 76a7b3cda09..0b563bae934 100644 --- a/docs/pages/installation.mdx +++ b/docs/pages/installation.mdx @@ -370,14 +370,16 @@ for a list of the available configuration options. The image names all include the build timestamp (shown as `$TIMESTAMP` in the table below), and are tagged for easier searching. -| Image name | Edition | Architecture | FIPS support | AMI Tags | Owner Account ID | -| - | - | - | - | - | - | -| `teleport-oss-(=teleport.version=)-x86_64-$TIMESTAMP` | OSS | amd64 | No | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: oss`, `TeleportFipsEnabled: false` | 146628656107 | -| `teleport-oss-(=teleport.version=)-arm64-$TIMESTAMP` | OSS | arm64 | No | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: oss`, `TeleportFipsEnabled: false` | 146628656107 | -| `teleport-ent-(=teleport.version=)-x86_64-$TIMESTAMP` | Enterprise | amd64 | No | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: ent`, `TeleportFipsEnabled: false` | 146628656107 | -| `teleport-ent-(=teleport.version=)-arm64-$TIMESTAMP` | Enterprise | arm64 | No | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: ent`, `TeleportFipsEnabled: false` | 146628656107 | -| `teleport-ent-(=teleport.version=)-x86_64-fips-$TIMESTAMP` | Enterprise | amd64 | Yes | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: ent`, `TeleportFipsEnabled: true` | 146628656107 | -| `teleport-ent-(=teleport.version=)-arm64-fips-$TIMESTAMP` | Enterprise | arm64 | Yes | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: ent`, `TeleportFipsEnabled: true` | 146628656107 | +| Image name | Edition | Architecture | FIPS support | AMI Tags | +| - | - | - | - | - | +| `teleport-oss-(=teleport.version=)-x86_64-$TIMESTAMP` | OSS | amd64 | No | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: oss`, `TeleportFipsEnabled: false` | +| `teleport-oss-(=teleport.version=)-arm64-$TIMESTAMP` | OSS | arm64 | No | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: oss`, `TeleportFipsEnabled: false` | +| `teleport-ent-(=teleport.version=)-x86_64-$TIMESTAMP` | Enterprise | amd64 | No | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: ent`, `TeleportFipsEnabled: false` | +| `teleport-ent-(=teleport.version=)-arm64-$TIMESTAMP` | Enterprise | arm64 | No | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: ent`, `TeleportFipsEnabled: false` | +| `teleport-ent-(=teleport.version=)-x86_64-fips-$TIMESTAMP` | Enterprise | amd64 | Yes | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: ent`, `TeleportFipsEnabled: true` | +| `teleport-ent-(=teleport.version=)-arm64-fips-$TIMESTAMP` | Enterprise | arm64 | Yes | `TeleportVersion: (=teleport.version=)`, `TeleportEdition: ent`, `TeleportFipsEnabled: true` | + +These AMIs are owned by AWS account ID `146628656107`. All images are based on Amazon Linux 2023 and have been hardened using the Amazon EC2 ImageBuilder [STIG](https://public.cyber.mil/stigs/) hardening diff --git a/examples/aws/terraform/ha-autoscale-cluster/Makefile b/examples/aws/terraform/ha-autoscale-cluster/Makefile index b29688680ee..854bbd2282c 100644 --- a/examples/aws/terraform/ha-autoscale-cluster/Makefile +++ b/examples/aws/terraform/ha-autoscale-cluster/Makefile @@ -43,16 +43,13 @@ TF_VAR_enable_mysql_listener ?= true # This will be ignored if TF_VAR_use_tls_routing is set to true TF_VAR_enable_postgres_listener ?= true -# Bucket name to store encrypted letsencrypt certificates. +# Bucket name to store encrypted Let's Encrypt certificates. TF_VAR_s3_bucket_name ?= -# Email of your support org, used for Letsencrypt cert registration process. +# Email of your support org, used for Let's Encrypt cert registration process. TF_VAR_email ?= -# Setup grafana password for "admin" user. Grafana will be served on https://cluster.example.com:8443 after install -TF_VAR_grafana_pass ?= - -# (optional) Set to true to use ACM (Amazon Certificate Manager) to provision certificates rather than Letsencrypt +# (optional) Set to true to use ACM (Amazon Certificate Manager) to provision certificates rather than Let's Encrypt # If you wish to use a pre-existing ACM certificate rather than having Terraform generate one for you, you can import it: # terraform import aws_acm_certificate.cert TF_VAR_use_acm ?= false @@ -69,8 +66,8 @@ TF_VAR_use_tls_routing ?= false # This is useful for persisting a different default authentication type across AMI upgrades when you have a SAML, OIDC # or GitHub connector configured in DynamoDB. The default if not set is "local". # Teleport Community Edition supports "local" or "github" -# Teleport Enterprise Edition supports "local", "github", "oidc" or "saml" -# Teleport Enterprise FIPS deployments have local authentication disabled, so should use "github", "oidc" or "saml" +# Teleport Enterprise Edition supports "local", "github", "oidc", or "saml" +# Teleport Enterprise FIPS deployments have local authentication disabled, so should use "github", "oidc", or "saml" TF_VAR_teleport_auth_type ?= "local" export diff --git a/examples/aws/terraform/ha-autoscale-cluster/README.md b/examples/aws/terraform/ha-autoscale-cluster/README.md index e0c72a70a08..b3b76015bd9 100644 --- a/examples/aws/terraform/ha-autoscale-cluster/README.md +++ b/examples/aws/terraform/ha-autoscale-cluster/README.md @@ -33,20 +33,20 @@ In order to spin up AWS resources using these Terraform examples, you need the f # Set variables for Terraform # Region to run in - we currently have AMIs in the following regions: -# ap-south-1,ap-northeast-2,ap-southeast-1,ap-southeast-2,ap-northeast-1,ca-central-1,eu-central-1,eu-west-1,eu-west-2 -# sa-east-1,us-east-1,us-east-2,us-west-1,us-west-2 +# ap-northeast-1, ap-northeast-2, ap-northeast-3, ap-south-1, ap-southeast-1, ap-southeast-2, ca-central-1, eu-central-1 +# eu-north-1, eu-west-1, eu-west-2, eu-west-3, sa-east-1, us-east-1, us-east-2, us-west-1, us-west-2 export TF_VAR_region="us-west-2" # Cluster name is a unique cluster name to use, should be unique and not contain spaces or other special characters export TF_VAR_cluster_name="teleport.example.com" # AMI name contains the version of Teleport to install, and whether to use OSS or Enterprise version -# These AMIs are published by Gravitational and shared as public whenever a new version of Teleport is released +# These AMIs are published by Teleport (Gravitational) and shared as public whenever a new version of Teleport is released # To list available AMIs: -# OSS: aws ec2 describe-images --owners 126027368216 --filters 'Name=name,Values=gravitational-teleport-ami-oss*' -# Enterprise: aws ec2 describe-images --owners 126027368216 --filters 'Name=name,Values=gravitational-teleport-ami-ent*' +# OSS: aws ec2 describe-images --owners 146628656107 --filters 'Name=name,Values=teleport-oss-*' +# Enterprise: aws ec2 describe-images --owners 146628656107 --filters 'Name=name,Values=teleport-ent-*' # FIPS 140-2 images are also available for Enterprise customers, look for '-fips' on the end of the AMI's name -export TF_VAR_ami_name="gravitational-teleport-ami-ent-14.3.0" +export TF_VAR_ami_name="teleport-ent-14.3.0-arm64" # AWS SSH key name to provision in installed instances, should be available in the region export TF_VAR_key_name="example" @@ -104,16 +104,13 @@ export TF_VAR_s3_bucket_name="teleport.example.com" # Email of your support org, used for Let's Encrypt cert registration process. export TF_VAR_email="support@example.com" -# Setup grafana password for "admin" user. Grafana will be served on https://cluster.example.com:8443 after install -export TF_VAR_grafana_pass="CHANGE_THIS_VALUE" - # This value can be used to change the default authentication type used for the Teleport cluster. # See https://goteleport.com/docs/reference/authentication for more information. # This is useful for persisting a different default authentication type across AMI upgrades when you have a SAML, OIDC # or GitHub connector configured in DynamoDB. The default is "local". # Teleport Community Edition supports "local" or "github" -# Teleport Enterprise Edition supports "local", "github", "oidc" or "saml" -# Teleport Enterprise FIPS deployments have local authentication disabled, so should use "github", "oidc" or "saml" +# Teleport Enterprise Edition supports "local", "github", "oidc", or "saml" +# Teleport Enterprise FIPS deployments have local authentication disabled, so should use "github", "oidc", or "saml" export TF_VAR_teleport_auth_type="local" # plan diff --git a/examples/aws/terraform/ha-autoscale-cluster/ansible/upgrade.yaml b/examples/aws/terraform/ha-autoscale-cluster/ansible/upgrade.yaml index 33e2f1920e9..e8d25c6bb96 100644 --- a/examples/aws/terraform/ha-autoscale-cluster/ansible/upgrade.yaml +++ b/examples/aws/terraform/ha-autoscale-cluster/ansible/upgrade.yaml @@ -36,8 +36,8 @@ block: - name: Download and unpack new version of teleport get_url: - url: https://get.gravitational.com/teleport/{{teleport_version}}/teleport-ent-v{{teleport_version}}-linux-amd64-bin.tar.gz - dest: /tmp/teleport-ent-v{{teleport_version}}-linux-amd64-bin.tar.gz + url: https://cdn.teleport.dev/teleport-ent-v{{teleport_version}}-linux-arm64-bin.tar.gz + dest: /tmp/teleport-ent-v{{teleport_version}}-linux-arm64-bin.tar.gz - name: Unpack teleport binaries unarchive: extra_opts: ['--strip-components=1', '--show-stored-names'] @@ -47,7 +47,7 @@ - "VERSION" - "INSTALL" - "CHANGELOG" - src: /tmp/teleport-ent-v{{teleport_version}}-linux-amd64-bin.tar.gz + src: /tmp/teleport-ent-v{{teleport_version}}-linux-arm64-bin.tar.gz dest: /usr/local/bin remote_src: true owner: "{{ 'root' if 'node' in group_names else 'teleport' }}" diff --git a/examples/aws/terraform/ha-autoscale-cluster/assets/grafana-nginx-acm.conf b/examples/aws/terraform/ha-autoscale-cluster/assets/grafana-nginx-acm.conf deleted file mode 100644 index 56e265983ec..00000000000 --- a/examples/aws/terraform/ha-autoscale-cluster/assets/grafana-nginx-acm.conf +++ /dev/null @@ -1,62 +0,0 @@ -worker_processes auto; -user nginx; -pid /run/nginx.pid; - -events { - worker_connections 2048; -} - -http { - sendfile on; - tcp_nopush on; - tcp_nodelay on; - keepalive_timeout 65; - types_hash_max_size 2048; - # server_tokens off; - - # server_names_hash_bucket_size 64; - # server_name_in_redirect off; - - include /etc/nginx/mime.types; - default_type application/octet-stream; - - ## - # Logging Settings - ## - error_log stderr; - access_log /var/log/nginx/access.log; - error_log /var/log/nginx/error.log; - - - ## - # Gzip Settings - ## - gzip on; - - ## - # Websocket settings - ## - map $http_upgrade $connection_upgrade { - default upgrade; - '' close; - } - - # - # Frontend grafana (no TLS, as we're using ACM on the LB) - # - server { - listen 8444 default_server; - location / { - proxy_pass http://127.0.0.1:3000; - proxy_set_header Host $http_host; - } - # Proxy Grafana Live WebSocket connections. - location /api/live/ { - proxy_http_version 1.1; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection $connection_upgrade; - proxy_set_header Host $http_host; - proxy_pass http://127.0.0.1:3000; - } - } -} diff --git a/examples/aws/terraform/ha-autoscale-cluster/assets/grafana-nginx.conf b/examples/aws/terraform/ha-autoscale-cluster/assets/grafana-nginx.conf deleted file mode 100644 index 1ba67d19df1..00000000000 --- a/examples/aws/terraform/ha-autoscale-cluster/assets/grafana-nginx.conf +++ /dev/null @@ -1,75 +0,0 @@ -worker_processes auto; -user nginx; -pid /run/nginx.pid; - -events { - worker_connections 2048; -} - -http { - sendfile on; - tcp_nopush on; - tcp_nodelay on; - keepalive_timeout 65; - types_hash_max_size 2048; - # server_tokens off; - - # server_names_hash_bucket_size 64; - # server_name_in_redirect off; - - include /etc/nginx/mime.types; - default_type application/octet-stream; - - ## - # TLS settings - we are pretty strict here - # but well, it's a dev service, why not? - ## - ssl_protocols TLSv1.2 TLSv1.3; - ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; - ssl_prefer_server_ciphers off; - - ## - # Logging Settings - ## - error_log stderr; - access_log /var/log/nginx/access.log; - error_log /var/log/nginx/error.log; - - - ## - # Gzip Settings - ## - gzip on; - - ## - # Websocket settings - ## - map $http_upgrade $connection_upgrade { - default upgrade; - '' close; - } - - # - # Frontend grafana with TLS - # - server { - listen 8443 default_server ssl http2; - ssl_certificate_key /etc/tls/certs/privkey.pem; - ssl_certificate /etc/tls/certs/fullchain.pem; - ssl_session_timeout 1d; - ssl_session_cache shared:SSL:10m; # about 40000 sessions - ssl_session_tickets off; - location / { - proxy_pass http://127.0.0.1:3000; - proxy_set_header Host $http_host; - } - # Proxy Grafana Live WebSocket connections. - location /api/live/ { - proxy_http_version 1.1; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection $connection_upgrade; - proxy_set_header Host $http_host; - proxy_pass http://127.0.0.1:3000; - } - } -} diff --git a/examples/aws/terraform/ha-autoscale-cluster/assets/health-dashboard.json b/examples/aws/terraform/ha-autoscale-cluster/assets/health-dashboard.json deleted file mode 100644 index 0dddb1f6278..00000000000 --- a/examples/aws/terraform/ha-autoscale-cluster/assets/health-dashboard.json +++ /dev/null @@ -1 +0,0 @@ -{"dashboard": {"style": "dark", "rows": [{"repeat": null, "titleSize": "h6", "repeatIteration": null, "title": "Dashboard Row", "height": 247, "repeatRowId": null, "panels": [{"bars": false, "timeFrom": null, "links": [], "thresholds": [], "spaceLength": 10, "nullPointMode": "null", "renderer": "flot", "id": 1, "linewidth": 1, "steppedLine": false, "targets": [{"dsType": "influxdb", "tags": [], "measurement": "teleport_go_goroutines", "groupBy": [{"type": "tag", "params": ["host"]}], "select": [[{"type": "field", "params": ["gauge"]}]], "orderByTime": "ASC", "policy": "default", "refId": "A", "resultFormat": "time_series"}], "fill": 1, "span": 6, "title": "Goroutines (Max Per Interval)", "tooltip": {"sort": 0, "shared": true, "value_type": "individual"}, "legend": {"total": false, "show": true, "max": false, "min": false, "current": false, "values": false, "avg": false}, "yaxes": [{"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": "Goroutine Count"}, {"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": "Time"}], "xaxis": {"buckets": null, "show": true, "values": [], "mode": "time", "name": null}, "seriesOverrides": [], "percentage": false, "type": "graph", "dashes": false, "dashLength": 10, "stack": false, "timeShift": null, "aliasColors": {}, "lines": true, "points": false, "datasource": "InfluxDB", "pointradius": 5}, {"bars": false, "timeFrom": null, "links": [], "thresholds": [], "spaceLength": 10, "nullPointMode": "null", "renderer": "flot", "id": 2, "linewidth": 1, "steppedLine": false, "targets": [{"dsType": "influxdb", "tags": [], "measurement": "teleport_process_open_fds", "groupBy": [{"type": "tag", "params": ["host"]}], "select": [[{"type": "field", "params": ["gauge"]}]], "orderByTime": "ASC", "policy": "default", "refId": "A", "resultFormat": "time_series"}], "fill": 1, "span": 6, "title": "Open File Descriptors (Max)", "tooltip": {"sort": 0, "shared": true, "value_type": "individual"}, "legend": {"total": false, "show": true, "max": false, "min": false, "current": false, "values": false, "avg": false}, "yaxes": [{"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": "File Descriptors (Max)"}, {"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": null}], "xaxis": {"buckets": null, "show": true, "values": [], "mode": "time", "name": null}, "seriesOverrides": [], "percentage": false, "type": "graph", "dashes": false, "dashLength": 10, "stack": false, "timeShift": null, "aliasColors": {}, "lines": true, "points": false, "datasource": "InfluxDB", "pointradius": 5}], "showTitle": false, "collapse": false}, {"repeat": null, "titleSize": "h6", "repeatIteration": null, "title": "Dashboard Row", "height": 238, "repeatRowId": null, "panels": [{"bars": false, "timeFrom": null, "links": [], "thresholds": [], "spaceLength": 10, "nullPointMode": "null", "renderer": "flot", "id": 3, "linewidth": 1, "steppedLine": false, "targets": [{"dsType": "influxdb", "tags": [], "measurement": "teleport_go_memstats_heap_inuse_bytes", "groupBy": [{"type": "tag", "params": ["host"]}], "select": [[{"type": "field", "params": ["gauge"]}]], "orderByTime": "ASC", "policy": "default", "refId": "B", "resultFormat": "time_series"}], "fill": 1, "span": 6, "title": "Heap In Use Bytes", "tooltip": {"sort": 0, "shared": true, "value_type": "individual"}, "legend": {"total": false, "show": true, "max": false, "min": false, "current": false, "values": false, "avg": false}, "yaxes": [{"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": "Megabytes"}, {"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": null}], "xaxis": {"buckets": null, "show": true, "values": [], "mode": "time", "name": null}, "seriesOverrides": [], "percentage": false, "type": "graph", "dashes": false, "dashLength": 10, "stack": false, "timeShift": null, "aliasColors": {}, "lines": true, "points": false, "datasource": "InfluxDB", "pointradius": 5}, {"bars": false, "timeFrom": null, "links": [], "thresholds": [], "spaceLength": 10, "nullPointMode": "null", "renderer": "flot", "id": 5, "linewidth": 1, "steppedLine": false, "targets": [{"dsType": "influxdb", "hide": false, "tags": [], "measurement": "teleport_process_cpu_seconds_total", "refId": "A", "select": [[{"type": "field", "params": ["counter"]}, {"type": "non_negative_derivative", "params": ["10s"]}, {"type": "math", "params": [" / 10"]}]], "orderByTime": "ASC", "policy": "default", "groupBy": [{"type": "tag", "params": ["host"]}], "resultFormat": "time_series"}], "fill": 1, "span": 6, "title": "Teleport CPU Cores", "tooltip": {"sort": 0, "shared": true, "value_type": "individual"}, "legend": {"total": false, "show": true, "max": false, "min": false, "current": false, "values": false, "avg": false}, "yaxes": [{"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": null}, {"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": null}], "xaxis": {"buckets": null, "show": true, "values": [], "mode": "time", "name": null}, "seriesOverrides": [], "percentage": false, "type": "graph", "dashes": false, "dashLength": 10, "stack": false, "timeShift": null, "aliasColors": {}, "lines": true, "points": false, "datasource": "InfluxDB", "pointradius": 5}], "showTitle": false, "collapse": false}, {"repeat": null, "titleSize": "h6", "repeatIteration": null, "title": "Dashboard Row", "height": 220, "repeatRowId": null, "panels": [{"bars": false, "timeFrom": null, "links": [], "thresholds": [], "spaceLength": 10, "nullPointMode": "null", "renderer": "flot", "id": 6, "linewidth": 1, "steppedLine": false, "targets": [{"dsType": "influxdb", "hide": false, "rawQuery": false, "tags": [], "measurement": "teleport_server_interactive_sessions_total", "refId": "A", "select": [[{"type": "field", "params": ["gauge"]}]], "orderByTime": "ASC", "policy": "default", "query": "SELECT \"\" FROM \"teleport_audit_slice_bytes\" WHERE $timeFilter", "groupBy": [{"type": "tag", "params": ["host"]}], "resultFormat": "time_series"}], "fill": 1, "span": 6, "title": "Interactive Sessions", "tooltip": {"sort": 0, "shared": true, "value_type": "individual"}, "legend": {"total": false, "show": true, "max": false, "min": false, "current": false, "values": false, "avg": false}, "yaxes": [{"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": null}, {"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": null}], "xaxis": {"buckets": null, "show": true, "values": [], "mode": "time", "name": null}, "seriesOverrides": [], "percentage": false, "type": "graph", "dashes": false, "dashLength": 10, "stack": false, "timeShift": null, "aliasColors": {}, "lines": true, "points": false, "datasource": "InfluxDB", "pointradius": 5}, {"bars": false, "timeFrom": null, "links": [], "thresholds": [], "spaceLength": 10, "nullPointMode": "null", "renderer": "flot", "id": 7, "linewidth": 1, "steppedLine": false, "targets": [{"dsType": "influxdb", "hide": false, "rawQuery": true, "tags": [], "measurement": "teleport_access_point_requests", "refId": "A", "select": [[{"type": "field", "params": ["counter"]}, {"type": "non_negative_derivative", "params": ["10s"]}, {"type": "math", "params": [" / 10"]}]], "orderByTime": "ASC", "policy": "default", "query": "SELECT non_negative_derivative(max(\"counter\"), 1s) FROM \"teleport_access_point_requests\" WHERE $timeFilter GROUP BY \"host\", time(1s)", "groupBy": [], "resultFormat": "time_series"}], "fill": 1, "span": 6, "title": "Access Point Requests Per Second", "tooltip": {"sort": 0, "shared": true, "value_type": "individual"}, "legend": {"total": false, "show": true, "max": false, "min": false, "current": false, "values": false, "avg": false}, "yaxes": [{"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": null}, {"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": null}], "xaxis": {"buckets": null, "show": true, "values": [], "mode": "time", "name": null}, "seriesOverrides": [], "percentage": false, "type": "graph", "dashes": false, "dashLength": 10, "stack": false, "timeShift": null, "aliasColors": {}, "lines": true, "points": false, "datasource": "InfluxDB", "pointradius": 5}], "showTitle": false, "collapse": false}, {"repeat": null, "titleSize": "h6", "repeatIteration": null, "title": "Dashboard Row", "height": 253, "repeatRowId": null, "panels": [{"bars": false, "timeFrom": null, "links": [], "thresholds": [], "spaceLength": 10, "nullPointMode": "null", "renderer": "flot", "id": 4, "linewidth": 1, "steppedLine": false, "targets": [{"dsType": "influxdb", "hide": false, "rawQuery": true, "tags": [], "measurement": "teleport_audit_requests_total", "refId": "A", "select": [[{"type": "field", "params": ["counter"]}, {"type": "non_negative_derivative", "params": ["1s"]}, {"type": "math", "params": [" / 10"]}]], "orderByTime": "ASC", "policy": "default", "query": "SELECT non_negative_derivative(max(\"counter\"), 1s) FROM \"teleport_audit_requests_total\" WHERE $timeFilter GROUP BY \"host\", time(1s)", "groupBy": [{"type": "tag", "params": ["host"]}], "resultFormat": "time_series"}], "fill": 1, "span": 6, "title": "Audit Log Requests Per Second", "tooltip": {"sort": 0, "shared": true, "value_type": "individual"}, "legend": {"total": false, "show": true, "max": false, "min": false, "current": false, "values": false, "avg": false}, "yaxes": [{"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": null}, {"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": null}], "xaxis": {"buckets": null, "show": true, "values": [], "mode": "time", "name": null}, "seriesOverrides": [], "percentage": false, "type": "graph", "dashes": false, "dashLength": 10, "stack": false, "timeShift": null, "aliasColors": {}, "lines": true, "points": false, "datasource": "InfluxDB", "pointradius": 5}, {"bars": false, "timeFrom": null, "links": [], "thresholds": [], "spaceLength": 10, "nullPointMode": "null", "renderer": "flot", "id": 8, "linewidth": 1, "steppedLine": false, "targets": [{"dsType": "influxdb", "tags": [], "measurement": "teleport_audit_server_open_files", "groupBy": [{"type": "tag", "params": ["host"]}], "select": [[{"type": "field", "params": ["gauge"]}]], "orderByTime": "ASC", "policy": "default", "refId": "A", "resultFormat": "time_series"}], "fill": 1, "span": 6, "title": "Audit Server Open Files", "tooltip": {"sort": 0, "shared": true, "value_type": "individual"}, "legend": {"total": false, "show": true, "max": false, "min": false, "current": false, "values": false, "avg": false}, "yaxes": [{"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": null}, {"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": null}], "xaxis": {"buckets": null, "show": true, "values": [], "mode": "time", "name": null}, "seriesOverrides": [], "percentage": false, "type": "graph", "dashes": false, "dashLength": 10, "stack": false, "timeShift": null, "aliasColors": {}, "lines": true, "points": false, "datasource": "InfluxDB", "pointradius": 5}], "showTitle": false, "collapse": false}, {"repeat": null, "titleSize": "h6", "repeatIteration": null, "title": "Dashboard Row", "height": 310, "repeatRowId": null, "panels": [{"bars": false, "timeFrom": null, "links": [], "thresholds": [], "spaceLength": 10, "nullPointMode": "null", "renderer": "flot", "id": 9, "linewidth": 1, "steppedLine": false, "targets": [{"dsType": "influxdb", "rawQuery": true, "tags": [], "orderByTime": "ASC", "refId": "A", "alias": "", "select": [[{"type": "field", "params": ["5000"]}, {"type": "math", "params": [" / 100"]}], [{"type": "field", "params": ["973097.5341796875"]}]], "measurement": "teleport_access_point_latency_microseconds", "policy": "default", "query": "SELECT \"5000\" / \"973097.5341796875\" FROM \"teleport_access_point_latency_microseconds\" WHERE $timeFilter GROUP BY \"host\"", "groupBy": [{"type": "tag", "params": ["host"]}], "resultFormat": "time_series"}, {"dsType": "influxdb", "rawQuery": true, "tags": [], "refId": "C", "alias": "", "select": [[{"type": "field", "params": ["value"]}, {"type": "mean", "params": []}]], "orderByTime": "ASC", "policy": "default", "query": "SELECT \"16875\" / \"973097.5341796875\" FROM \"teleport_access_point_latency_microseconds\" WHERE $timeFilter GROUP BY \"host\"", "groupBy": [{"type": "time", "params": ["$__interval"]}, {"type": "fill", "params": ["null"]}], "resultFormat": "time_series"}, {"dsType": "influxdb", "rawQuery": true, "tags": [], "refId": "D", "alias": "56ms", "select": [[{"type": "field", "params": ["value"]}, {"type": "mean", "params": []}]], "orderByTime": "ASC", "policy": "default", "query": "SELECT \"56953.125\" / \"973097.5341796875\" FROM \"teleport_access_point_latency_microseconds\" WHERE $timeFilter GROUP BY \"host\"", "groupBy": [{"type": "time", "params": ["$__interval"]}, {"type": "fill", "params": ["null"]}], "resultFormat": "time_series"}, {"dsType": "influxdb", "rawQuery": true, "tags": [], "refId": "E", "alias": "", "select": [[{"type": "field", "params": ["value"]}, {"type": "mean", "params": []}]], "orderByTime": "ASC", "policy": "default", "query": "SELECT \"85429.6875\" / \"973097.5341796875\" FROM \"teleport_access_point_latency_microseconds\" WHERE $timeFilter GROUP BY \"host\"", "groupBy": [{"type": "time", "params": ["$__interval"]}, {"type": "fill", "params": ["null"]}], "resultFormat": "time_series"}], "fill": 1, "span": 4, "title": "Access Point Latency Histogram", "tooltip": {"sort": 0, "shared": true, "value_type": "individual"}, "legend": {"total": false, "show": true, "max": false, "min": false, "current": false, "values": false, "avg": false}, "yaxes": [{"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": null}, {"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": null}], "xaxis": {"buckets": null, "show": true, "values": [], "mode": "time", "name": null}, "seriesOverrides": [], "percentage": false, "type": "graph", "dashes": false, "dashLength": 10, "stack": false, "timeShift": null, "aliasColors": {}, "lines": true, "points": false, "datasource": "InfluxDB", "pointradius": 5}, {"bars": false, "timeFrom": null, "links": [], "thresholds": [], "spaceLength": 10, "nullPointMode": "null", "renderer": "flot", "id": 10, "linewidth": 1, "steppedLine": false, "targets": [{"dsType": "influxdb", "rawQuery": true, "tags": [], "orderByTime": "ASC", "refId": "A", "alias": "", "select": [[{"type": "field", "params": ["5000"]}, {"type": "math", "params": [" / 100"]}], [{"type": "field", "params": ["973097.5341796875"]}]], "measurement": "teleport_access_point_latency_microseconds", "policy": "default", "query": "SELECT \"5000\" / \"973097.5341796875\" FROM \"teleport_access_point_cache_latency_microseconds\" WHERE $timeFilter GROUP BY \"host\"", "groupBy": [{"type": "tag", "params": ["host"]}], "resultFormat": "time_series"}, {"dsType": "influxdb", "rawQuery": true, "tags": [], "refId": "C", "alias": "", "select": [[{"type": "field", "params": ["value"]}, {"type": "mean", "params": []}]], "orderByTime": "ASC", "policy": "default", "query": "SELECT \"16875\" / \"973097.5341796875\" FROM \"teleport_access_point_cache_latency_microseconds\" WHERE $timeFilter GROUP BY \"host\"", "groupBy": [{"type": "time", "params": ["$__interval"]}, {"type": "fill", "params": ["null"]}], "resultFormat": "time_series"}, {"dsType": "influxdb", "rawQuery": true, "tags": [], "refId": "D", "alias": "56ms", "select": [[{"type": "field", "params": ["value"]}, {"type": "mean", "params": []}]], "orderByTime": "ASC", "policy": "default", "query": "SELECT \"56953.125\" / \"973097.5341796875\" FROM \"teleport_access_point_cache_latency_microseconds\" WHERE $timeFilter GROUP BY \"host\"", "groupBy": [{"type": "time", "params": ["$__interval"]}, {"type": "fill", "params": ["null"]}], "resultFormat": "time_series"}, {"dsType": "influxdb", "rawQuery": true, "tags": [], "refId": "E", "alias": "", "select": [[{"type": "field", "params": ["value"]}, {"type": "mean", "params": []}]], "orderByTime": "ASC", "policy": "default", "query": "SELECT \"85429.6875\" / \"973097.5341796875\" FROM \"teleport_access_point_cache_latency_microseconds\" WHERE $timeFilter GROUP BY \"host\"", "groupBy": [{"type": "time", "params": ["$__interval"]}, {"type": "fill", "params": ["null"]}], "resultFormat": "time_series"}], "fill": 1, "span": 4, "title": "Access Point Cache Latency Histogram", "tooltip": {"sort": 0, "shared": true, "value_type": "individual"}, "legend": {"total": false, "show": true, "max": false, "min": false, "current": false, "values": false, "avg": false}, "yaxes": [{"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": null}, {"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": null}], "xaxis": {"buckets": null, "show": true, "values": [], "mode": "time", "name": null}, "seriesOverrides": [], "percentage": false, "type": "graph", "dashes": false, "dashLength": 10, "stack": false, "timeShift": null, "aliasColors": {}, "lines": true, "points": false, "datasource": "InfluxDB", "pointradius": 5}, {"bars": false, "timeFrom": null, "links": [], "thresholds": [], "spaceLength": 10, "nullPointMode": "null", "renderer": "flot", "id": 11, "linewidth": 1, "steppedLine": false, "targets": [{"dsType": "influxdb", "rawQuery": true, "tags": [], "orderByTime": "ASC", "refId": "A", "alias": "", "select": [[{"type": "field", "params": ["5000"]}, {"type": "math", "params": [" / 100"]}], [{"type": "field", "params": ["973097.5341796875"]}]], "measurement": "teleport_access_point_latency_microseconds", "policy": "default", "query": "SELECT \"5000\" / \"973097.5341796875\" FROM \"teleport_audit_latency_microseconds\" WHERE $timeFilter GROUP BY \"host\"", "groupBy": [{"type": "tag", "params": ["host"]}], "resultFormat": "time_series"}, {"dsType": "influxdb", "rawQuery": true, "tags": [], "refId": "C", "alias": "", "select": [[{"type": "field", "params": ["value"]}, {"type": "mean", "params": []}]], "orderByTime": "ASC", "policy": "default", "query": "SELECT \"16875\" / \"973097.5341796875\" FROM \"teleport_audit_latency_microseconds\" WHERE $timeFilter GROUP BY \"host\"", "groupBy": [{"type": "time", "params": ["$__interval"]}, {"type": "fill", "params": ["null"]}], "resultFormat": "time_series"}, {"dsType": "influxdb", "rawQuery": true, "tags": [], "refId": "D", "alias": "56ms", "select": [[{"type": "field", "params": ["value"]}, {"type": "mean", "params": []}]], "orderByTime": "ASC", "policy": "default", "query": "SELECT \"56953.125\" / \"973097.5341796875\" FROM \"teleport_audit_latency_microseconds\" WHERE $timeFilter GROUP BY \"host\"", "groupBy": [{"type": "time", "params": ["$__interval"]}, {"type": "fill", "params": ["null"]}], "resultFormat": "time_series"}, {"dsType": "influxdb", "rawQuery": true, "tags": [], "refId": "E", "alias": "", "select": [[{"type": "field", "params": ["value"]}, {"type": "mean", "params": []}]], "orderByTime": "ASC", "policy": "default", "query": "SELECT \"85429.6875\" / \"973097.5341796875\" FROM \"teleport_audit_latency_microseconds\" WHERE $timeFilter GROUP BY \"host\"", "groupBy": [{"type": "time", "params": ["$__interval"]}, {"type": "fill", "params": ["null"]}], "resultFormat": "time_series"}], "fill": 1, "span": 4, "title": "Audit Log API Latency Histogram", "tooltip": {"sort": 0, "shared": true, "value_type": "individual"}, "legend": {"total": false, "show": true, "max": false, "min": false, "current": false, "values": false, "avg": false}, "yaxes": [{"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": null}, {"logBase": 1, "show": true, "max": null, "format": "short", "min": null, "label": null}], "xaxis": {"buckets": null, "show": true, "values": [], "mode": "time", "name": null}, "seriesOverrides": [], "percentage": false, "type": "graph", "dashes": false, "dashLength": 10, "stack": false, "timeShift": null, "aliasColors": {}, "lines": true, "points": false, "datasource": "InfluxDB", "pointradius": 5}], "showTitle": false, "collapse": false}], "templating": {"list": []}, "links": [], "gnetId": null, "graphTooltip": 0, "hideControls": false, "tags": [], "editable": true, "refresh": "5s", "id": null, "__inputs": [{"description": "", "pluginName": "InfluxDB", "label": "InfluxDB", "pluginId": "influxdb", "type": "datasource", "name": "DS_INFLUXDB"}], "timepicker": {"time_options": ["5m", "15m", "1h", "6h", "12h", "24h", "2d", "7d", "30d"], "refresh_intervals": ["5s", "10s", "30s", "1m", "5m", "15m", "30m", "1h", "2h", "1d"]}, "title": "Teleport Health Stats", "version": 5, "time": {"to": "now", "from": "now-15m"}, "__requires": [{"version": "4.6.3", "type": "grafana", "id": "grafana", "name": "Grafana"}, {"version": "", "type": "panel", "id": "graph", "name": "Graph"}, {"version": "1.0.0", "type": "datasource", "id": "influxdb", "name": "InfluxDB"}], "timezone": "browser", "schemaVersion": 14, "annotations": {"list": [{"enable": true, "hide": true, "name": "Annotations & Alerts", "builtIn": 1, "datasource": "-- Grafana --", "type": "dashboard", "iconColor": "rgba(0, 211, 255, 1)"}]}}} \ No newline at end of file diff --git a/examples/aws/terraform/ha-autoscale-cluster/auth-user-data.tpl b/examples/aws/terraform/ha-autoscale-cluster/auth-user-data.tpl index 107966e6f97..befdf45355e 100644 --- a/examples/aws/terraform/ha-autoscale-cluster/auth-user-data.tpl +++ b/examples/aws/terraform/ha-autoscale-cluster/auth-user-data.tpl @@ -9,10 +9,9 @@ TELEPORT_DOMAIN_ADMIN_EMAIL=${email} TELEPORT_DOMAIN_NAME=${domain_name} TELEPORT_DYNAMO_TABLE_NAME=${dynamo_table_name} TELEPORT_DYNAMO_EVENTS_TABLE_NAME=${dynamo_events_table_name} -TELEPORT_INFLUXDB_ADDRESS=${influxdb_addr} TELEPORT_LICENSE_PATH=${license_path} TELEPORT_LOCKS_TABLE_NAME=${locks_table_name} TELEPORT_S3_BUCKET=${s3_bucket} USE_ACM=${use_acm} USE_TLS_ROUTING=${use_tls_routing} -EOF \ No newline at end of file +EOF diff --git a/examples/aws/terraform/ha-autoscale-cluster/auth_asg.tf b/examples/aws/terraform/ha-autoscale-cluster/auth_asg.tf index b12f9540697..ceaaac76825 100644 --- a/examples/aws/terraform/ha-autoscale-cluster/auth_asg.tf +++ b/examples/aws/terraform/ha-autoscale-cluster/auth_asg.tf @@ -64,9 +64,7 @@ resource "aws_launch_template" "auth" { email = var.email domain_name = var.route53_domain s3_bucket = var.s3_bucket_name - influxdb_addr = "http://${aws_lb.monitor.dns_name}:8086" license_path = var.license_path - telegraf_version = var.telegraf_version teleport_uid = var.teleport_uid use_acm = var.use_acm use_tls_routing = var.use_tls_routing diff --git a/examples/aws/terraform/ha-autoscale-cluster/auth_iam.tf b/examples/aws/terraform/ha-autoscale-cluster/auth_iam.tf index ed00a078aa7..a79a6a7588c 100644 --- a/examples/aws/terraform/ha-autoscale-cluster/auth_iam.tf +++ b/examples/aws/terraform/ha-autoscale-cluster/auth_iam.tf @@ -120,7 +120,7 @@ EOF } -// S3 is used for letsencrypt, auth servers request certificates from letsencrypt +// S3 is used for Let's Encrypt, auth servers request certificates from Let's Encrypt // and publish to S3 encrypted bucket. SSM is not used, because certificates and private keys // are too big for SSM. resource "aws_iam_role_policy" "auth_s3" { diff --git a/examples/aws/terraform/ha-autoscale-cluster/bastion.tf b/examples/aws/terraform/ha-autoscale-cluster/bastion.tf index c9984a8ab67..26d9d6f3763 100644 --- a/examples/aws/terraform/ha-autoscale-cluster/bastion.tf +++ b/examples/aws/terraform/ha-autoscale-cluster/bastion.tf @@ -1,10 +1,11 @@ +# orca-iac disable=b61415c4-ce88-4f3a-930b-821d0a4530bb // Bastion is an emergency access bastion // that could be spun up on demand in case // of the need to have emergency administrative access resource "aws_instance" "bastion" { count = "1" ami = data.aws_ami.base.id - instance_type = "t2.medium" + instance_type = "t4g.medium" key_name = var.key_name associate_public_ip_address = true source_dest_check = false diff --git a/examples/aws/terraform/ha-autoscale-cluster/data.tf b/examples/aws/terraform/ha-autoscale-cluster/data.tf index 0be9363075d..f532a8ae744 100644 --- a/examples/aws/terraform/ha-autoscale-cluster/data.tf +++ b/examples/aws/terraform/ha-autoscale-cluster/data.tf @@ -3,7 +3,7 @@ // are relying on systemd data "aws_ami" "base" { most_recent = true - owners = [126027368216] + owners = [146628656107] filter { name = "name" diff --git a/examples/aws/terraform/ha-autoscale-cluster/monitor-user-data.tpl b/examples/aws/terraform/ha-autoscale-cluster/monitor-user-data.tpl deleted file mode 100644 index f24eaf0f883..00000000000 --- a/examples/aws/terraform/ha-autoscale-cluster/monitor-user-data.tpl +++ /dev/null @@ -1,9 +0,0 @@ -#!/bin/bash -cat >/etc/teleport.d/conf <