This PR updates the parsers for the role
`spec.allow.request.thresholds.filter` and `spec.allow.review.where`
expression fields to support a new function `regexp.match(list, re)`.
It follows the typical teleport style following from role templates,
`where` expressions, login rules, and label expressions:
- `list` can be a `[]string` or a `string` (a single string is treated
as a list of length 1).
- `re` can be a glob pattern like `example-*` or a proper regex like
`^example-.*$` when surrounded by `^$`.
Some examples are included in the docs and tests.
I have switched from using `NewJSONBoolParser` to new dedicated parsers
based on `typical`. These should have better performance in terms of
speed and memory, be easier to extend in the future, and provide better
error messages when users write invalid expressions.
These were the only uses of `NewJSONBoolParser`, so it has been removed.
Changelog: add `regexp.match` to access request `filter` and `where`
expressions
* Mentioned in the documentation that we ignore "kube-system" and "kube-public" namespaces for kube app discovery.
* Use admonition
Co-authored-by: Hugo Shaka <hugo.hervieux@goteleport.com>
* Rerender kube agent docs
---------
Co-authored-by: Hugo Shaka <hugo.hervieux@goteleport.com>
We have seen several cases of tools that terminate the mTLS connection
from Teleport and drop the client certificates, preventing Teleport
from making an authenticated LDAP connection.
Update the preflight and postrelease docs for starting a new release
branch and after publishing that release for the first time to update
the GitHub Action the scheduled building of the buildboxes.
* Add architectural information to database guides
Closes#21540
Rather than attempt to describe the entirety of the database access
architecture in the `/docs/database-access/architecture/` guide, this
change:
- Edits the architecture guide to clarify that authentication between
the Teleport Database Service and each proxied database depends on the
database.
- Adds a "How it works" H2 before the "Prerequisites" H2 of each how-to
guide for accessing a specific database, describing the architecture
of the setup shown in the guide.
* Respond to greedy52 feedback
- Correct the DynamoDB and OpenSearch architecture descriptions.
- Correct the AWS Redis architecture description by moving a description
from later in the page. Also adds Redis ACL to the prerequisites.
- Edit the Azure Cache for Redis and Azure MySQL and PostgreSQL guides
to say "Microsoft Entra ID" in the architecture section. This change
does not attempt to correct "Azure AD" elsewhere in the guides, as
this entails fixing UI instructions that are outside the scope of the
PR.
Closes#40026
Reduce the space that our standard prerequisites partials take within
docs pages by:
- Using prose instead of tabs to suggest different possibilities for
getting started.
- Removing example commands to find the `tctl` and `tsh` versions. The
intended audience of the Teleport docs should be familiar enough with CLI
tools to infer that there is a `version` subcommand, as this is a
convention across CLI tools.
This change also removes `user-client-prereqs.mdx`, since it is no
longer used, and replaces `no-oss-prereq-tabs.mdx` with
`commercial-prereqs-tabs.mdx` (the two address the same use cases).
* Remove auto-discovery from specific DB guides
Closes#22942
Help users enroll specific databases with Teleport while directing them
auto-discovery instructions if they want to go that route.
- Revert #30913 for guides to enrolling specific databases. For guides
that always included auto-discovery instructions, add instructions to
enroll databases at specific URLs.
- Add a note in the introduction sections of AWS guides that it is
possible to enroll AWS databases with auto-discovery, linking to the
relevant guide.
* Respond to greedy52 feedback
- Remove auto-discovery notes where they are incorrect.
- Remove unneeded `id` flags.
- Use `teleport db configure create` for Redshift Serverless, removing
unneeded config fields. Also add the `aws-bootstrap.mdx` partial to
the Redshift Serverless guide, making it more consistent with other
guides that include `teleport db configure bootstrap` instructions.
- Minor spelling/grammar tweaks.
- Fix example description outputs.
- Use URI/protocol flags in `rds-proxy.mdx` instructions.
- Restore `opensearch` to `database-config.yaml`.
* Respond to greedy52 feedback
- Add the `--name` parameter to `db configure create`
- Edit `tsh db ls` output in the RDS guide
* Fix linter issues
* Refresh the AWS app access guide
Issues closed:
--------------
Add a statement of benefits, a brief architecture overview, more
troubleshooting information, and a summary of IAM resources created in
this guide.
Closes#10853
Add troubleshooting re: trust relationships and
checking logs.
Closes#17880
Add more explicit trust relationship guidance and uses
CLI examples instead of console screenshots.
Closes#34167
Add more context re: the trust relationship
instructions.
Closes#11797
Add instructions that a user can follow to deploy the
Application Service on EKS.
Closes#24373
Other changes to make the guide easier to follow:
-------------------------------------------------
- Only show one IAM role. Remove the `ExamplePowerUser` role for
simplicity.
- Use the `aws` CLI for creating IAM resources. This is faster to follow
than the current approach, takes up less page real estate, and doesn't
require screenshots. Using the CLI also makes the trust relationship
instructions more explicit.
- Move external links to a "Further reading" section so readers can get
through the guide more quickly.
- Remove the video, since it's long out of date.
- Reduce the number of steps: Convert steps into H3s in order to make it
easier to form a mental model of the guide and make the step count
less intimidating.
- Add EC2 instance profile instructions.
- Add a quick boto3 python example for `tsh proxy aws`
* Respond to greedy52 feedback
- Say "EKS" instead of just "Kubernetes" in the prerequisites.
- Edit the trust policy for the `ExampleReadOnlyAccess` role in the
cross-account use case to include an external ID and require a
specific role for the principal.
* Respond to kimlisa feedback
- Fix unclear subsection intro sentence.
- Fix a potentially confusing reference to Step 1.
- Fix an unclear use of "configuration".
- Clarify a heading.
- Minor clarity/accuracy improvements.
- Use a Var component for the Proxy Service address in the Linux server
config file snippet.
* Document how to import resources into Terraform
Closes#9720
Add a guide to importing Teleport resources into Terraform. While it is
mostly straightforward to add an `import` block, determining the ID to
use for each resource requires some planning, since the ID depends on
the resource type.
This change also edits the Terraform provider guide, since testing out
this guide was required to test out the resource import workflow:
- Minor style and readability tweaks.
- Remove the `-f` flag in `tctl create`: This way a user doesn't
accidentally override an existing `terraform` role
- Add a `tbot` data directory in an unprivileged path in the working
directory of the setup script. This way, we don't need to give
`teleport` ownership of the default Machine ID output directory.
- Fix identity file paths. These should point to a file called
`identity` in the `terraform-identity` directory.
- Edit the "Next steps" section to point to the resource import guide.
* Respond to Tener feedback
- Edit the "Terraform Provider" guide title to describe the purpose of
the guide more explicitly, distinguishing it from the new guide.
- Describe general rules for finding the ID of a resource, rather than
using a comprehensive table.
- Incorporate the import instructions into the setup guide. This way, we
don't need to clarify the relationship between two guides, which
wasn't entirely clear at the outset.
- Add a more explicit benefit statement for importing resources.
- Use the `-v` flag in `rm` commands
* Update docs/pages/management/dynamic-resources/terraform-provider.mdx
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
---------
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Update github docs to remove misleading guidance
based on multiple user feedback, the Organization slug is not lowercased and does not follow the same rules as the team slug. If following the admonition for organisations, it will not work
~~~
teams_to_logins:
- logins:
- admin
organization: Teleport-Training-1
team: admin
~~~
~~~
"attributes": {
"Teleport-Training-1": [
"admin",
"test-caps-and-spaces"
]
},
"cluster_name": "ip-172-31-36-239-ec2-internal",
"code": "T1001I",
"ei": 0,
"event": "user.login",
"method": "github",
"success": true,
~~~
* Update github-sso.mdx
Updates the resource parser with two new functions: `contains` and
`split`. When used together they provide the ability to
search for resources that have labels with multiple values in a
delimited list. For example, if a resource has label `foo=bar,baz,bang`
then `split(labels[foo], ",")` would transform the
comma label value from a string into a list: ["bar", "baz", "bang"]
The list could then be fed to `contains` to determine if bar exists
in the list: `contains(split(labels[foo], ","), bar)`.
* Framework out workload-id docs
* Explain SPIFFE IDs/SVIDs
* Add pages to config
* Add very rough content for `tsh wworkloadid issue`
* Very rough start on "Teleport's Workload Identity"
* Explain Teleport offering and show example role
* Add `spiffe` to documented role spec
* Add advice on structuring SPIFFE IDs
* Add alternative to getting started guide
* Start notes on integrating SPIFFE with your workloads
* Add notes on using the `spiffe-svid` output
* Notes on using a Proxy to implement SPIFFE
* Add link to rust based sdk
* Add reference to `spiffe-inspect`
* Add prerequisites
* Finish rough drafting of workload id docs
* Link to Workload Identity from Machine ID introduction
* Update docs/pages/machine-id/workload-identity.mdx
Co-authored-by: Ben Arent <ben@goteleport.com>
* Adjust preview header
* Complete tsh guide
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* ADjust as per code review
* Explain workload identity a bit more
* Explain why Teleport Workload Identity is not Teleport Machine Identity
* Expand SPIFFE on first use
* Explain workload api endpoint
* Mention wildcard support in dns_sans
* Fix spellcheck
* Fix link to workload id guide from access guides
---------
Co-authored-by: Ben Arent <ben@goteleport.com>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Drone is dead and gone. This change removes a few of its ghosts so
that others won't trip on them.
There are a couple more that aren't as easy to remove such as relcli
depending on DRONE_REPO and DRONE_TAG, but we'll loop back to pick them
up in time.
Contributes to https://github.com/gravitational/SecOps/issues/481
Closes#38824
In the Networking reference, the discussion of environment variables
didn't make it sufficiently clear that `/etc/default/teleport` is the
environment file specified in the Teleport unit file.
This change includes the unit file to make it more explicit how the file
uses `/etc/default/teleport`.
Closes#38933
Simplify the instructions in the `install-linux.mdx` partial by
including instructions for the one-line installation script instead of
having the user choose the Teleport edition from a dropdown menu, then
choose a package manager. The one-line installation script chooses a
package manager automatically.
Since we only include `install-linux.mdx` in guides to installing
Teleport on agent nodes, instruct the user to get the version of either
the automatic updater (if automatic updates are enabled) or the Teleport
cluster.
This approach has the advantage of not using tabs, so it creates less
noise when authors include this partial in a `Tabs` component.
Also include a link to our installation guide at the end of the partial
for readers who want more information on our package repos.
* document creating SSH servers via IAC
* add links and index page
* Apply suggestions from code review
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* address feedback + fix Var XML tags
* test tctl flow and fill tctl command outputs
* fix kubernetes and terraform documentation
* make docs linter happy
---------
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Fix Cloud installation instructions
The current instructions are missing a `"` character in the `curl`
command and target the wrong channel for the current Teleport Cloud
version: `default` instead of `stable/cloud`. This change corrects the
instructions.
* Add further fixes to the Installation page
- For Cloud users, specify a `teleport-ent` version.
- Turn the release channel into an environment variable so Cloud users
can use `stable/cloud`.
- Correct an errant `yum` command in the `zypper` instructions. Also
trust the repo key.
* Respond to bernardjkim feedback
Add a note re: specifying a `teleport-ent` version on Debian/Ubuntu.
Steven Martin