* Mentioned in the documentation that we ignore "kube-system" and "kube-public" namespaces for kube app discovery.
* Use admonition
Co-authored-by: Hugo Shaka <hugo.hervieux@goteleport.com>
* Rerender kube agent docs
---------
Co-authored-by: Hugo Shaka <hugo.hervieux@goteleport.com>
* Add a Discovery Service section
Closes#38741
Add a dedicated sidebar section for the Teleport Discovery Service.
Since the Discovery Service is a separate agent service from the SSH
Service, Kubernetes Service, etc., it makes sense to add a dedicated
section for this service. In the future, we can include configuration
guides, architecture guides, etc. in this section.
To create the new section, this change moves existing auto-discovery
guides from other sections of the docs.
* Respond to hugoShaka feedback
- Move the Kubernetes application discovery docs
- Edit the "Kubernetes Access" intro to include a link to Kubernetes
auto-discovery
* Update TAG version to 1.11.0
* Add a guide for deploying TAG using Helm
* Fix prose lint
* Add auto-generated reference for TAG Helm chart
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update TAG example role to v7
* Fix link to TAG Helm guide
* Pin TAG Helm chart version
Pins to the same version as TAG itself,
Helm chart and TAG are versioned in lockstep
* Call out the teleport Helm chart more explicitly
* Bump TAG version to 1.13.0
Expecting it to be released by the time these docs go live.
* Replace teleport-cluster parameters with Vars
* Elaborate trust of the TAG CA in Teleport
* Fix the marker style
* Fix the link to teleport-cluster reference
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
See #36816
The docs are inconsistent in using "automatic updates" vs. "automatic
upgrades". Prefer the former to be consistent with the
`teleport-ent-updater` script.
- Replace "automatic upgrade" with "automatic update" in docs pages.
- Replace "automatic upgrade" uses in the `teleport-kube-agent` chart
and regenerate the docs.
- Catch uses of "automatic upgrade" in the `consistent-terms` Vale rule
* Change Open source and OSS to Teleport Community Edition
* Change open-source to Teleport Community Edition
* Role access requests in the nav and title
* Add how to verify the binaries are FIPS-compliant
* Clean up some wording and typos
* Typo and spellchecker update
* Links to headings changes
* Path to the link was missing the file extension
* Modify regions that support FIPS/FedRAMP
* Replace version, git, and go version with variables
* Add main documentation for Kubernetes Apps Discovery
* Improve wording.
* Add internal link for annotation
* Improve wording.
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Remove unneeded symbol
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Improve wording.
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Make example cluster names consistent
* Restructure the Kubernetes app discovery guide (#31606)
- Move the docs to the Application Access section, since this material
has to do with proxying applications via the Application Service.
- Split up the guide into separate guides for different documentation
purposes: a how-to guide, configuration reference, and architecture
guide.
- Fix linter/spelling issues
* Add not about running agent inside the Kuberentes cluster
* Add instruction how to enabled kube app discovery on existing installation
* Add example of configuration of teleport-kube-agent Helm chart
* convert tip to tabs
* fix wrong ref
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Link to azure guide
* ToC
* initial version of the azure helm guide
* Use <Var> in section 3 and later
Co-authored-by: Gus Luxton <gus@goteleport.com>
* Use TabItem, tweak values.yaml and dns
* hint for non-Azure DNS users
* it's ClusterIssuer, not GlobalIssuer
Co-authored-by: Gus Luxton <gus@goteleport.com>
* Recommend --version
Co-authored-by: Gus Luxton <gus@goteleport.com>
* Update docs/pages/deploy-a-cluster/helm-deployments/azure.mdx
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* spelling fixes
---------
Co-authored-by: Gus Luxton <gus@goteleport.com>
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* feat: add in podmonitor to teleport-kube-agent helmchart
* fix: backport fixes to linting and tests to teleport-cluster chart
* docs: document the `podMonitor` field in chart references
* Apply suggestions from code review
* Lint
---------
Co-authored-by: ThameezBo <thameezbo@double.cloud>
* Add Kubernetes/Helm instructions to the RDS guide
Closes#27753
Add "Kubernetes" tabs as counterparts to Linux host instructions,
following the structure we have used in Access Request plugin guides:
where we show how to install Teleport on a VM, include `helm repo add`
instructions. And when we show how to run a Teleport service, include
`helm install` instructions.
In this guide, I've hardcoded a Teleport configuration file in order to
run `teleport db configure bootstrap`, then inserted the config file
into a Helm values file.
This change also includes instructions to use a local `teleport` binary
in order to bootstrap IAM resources.
This also adds minor formatting and readability changes, e.g., the `Var`
component.
* Respond to alexfornuto feedback
* Update docs/pages/database-access/guides/rds.mdx
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* Fix linter warnings
* Add Service Account IAM instructions
Frame the guide around authenticating the Teleport agent pod's service
account via the IAM OIDC provider.
* Respond to stevenGravy feedback
* Minor tweaks
- Ensure `Var` names are consistent
- Use obviously fake values for resource URIs
- Use the correct value for the OIDC issuer ID
* Respond to alexfornuto feedback
* Fix spelling
* Fix linter issues
---------
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* helm: Add ingress template
* helm: Add ingress support
With the changes introducing automatic websocket upgrades for TLS routing in Teleport 13, we can finally add support for a Kubernetes ingress.
* Remove unnecessary brackets
* Tidying
* Gating
* Fix lint and schema
* Fix lint examples
* Handle wildcards
* Tidy up wildcard support
* Don't add AWS annotations when using ingress
* Update AWS docs to use Ingress/ALB with ACM
* Automatically listens on 443, make values simpler
* Support ingress.spec overrides
* Enable ingress and set spec.ingressClassName
* Update values schema
* typo
* Whitelist 'healthcheck' for spellcheck
* Address Hugo's comments from code review
* Apply Paul's comments from code review
* Few more docs fixes
* Update teleport-cluster reference
* Add values file and fix lint/tests
* Fix docs lint
* Add proxy_service.trust_x_forwarded_for when ingress is enabled and Teleport version >=14
* Fix semver check for pre-releases
* Indent ingress section correctly
* Address docs feedback from Hugo/Tiago
* Add warning about using tsh with ingress
* Fix lint spelling
* Add instructions for checking AWS LB controller installation
* Whitelist ingressclass in spellcheck
* What a stupid error
* Promote IAC docs for agents and dynamic resources
Closes#27382Closes#25418Closes#25442
Two aspects of setting up a Teleport cluster are omnipresent in the docs
but never get dedicated treatment:
- Running agents
- Applying dynamic resources
As a result, it is difficult to include discussions about those topics
that are separate from a specific workflow or how-to guide. One glaring
absence has been prominent guidance on using infrastructure-as-code
tools to achieve these tasks.
This change improves the visibility of Teleport's support for
infrastructure-as-code tools by:
- Creating top-level docs sections for running agents and applying
dynamic resources
- Making IAC instructions prominent within these sections
The intention is for readers to become familiar with different methods
of applying dynamic resources and running agents, including how to do
this with IAC, so they can apply this knowledge when reading other parts
of the docs.
As a result, in the docs sidebar, the "Dynamic Resources" section comes
before the section on RBAC, and the "Teleport Agents" section comes
before the sections related to individual Teleport services
("Application Access", "Server Access", etc.).
The new section on dynamic resources also gives us a place to put other
guides to using the Terraform provider and Kubernetes Operator, e.g., if
we add guides to using these tools with popular GitOps platforms.
Likewise, the section on agents gives us a place to put other agent-wide
information, e.g., how to enable an additional Teleport service on an
instance that is already running.
To allow for these changes, I have also made the following, more
tangentially related sidebar changes:
- **Renamed sidebar sections to be noun phrases instead of verb
phrases:** Currently, one half of the sidebar is made of imperative
phrases like "Manage Access" and "Manage your Cluster". This doesn't
really work for the sections on agents and dynamic resources, so I
have renamed these sections for consistency.
- **Moved the "Manage your Cluster" and "Deploy a Cluster" sections**: I
have arranged the sidebar so more basic topics (i.e., those that new
users and experienced users alike will need to be familiar with) are
on the top and more advanced ones are on the bottom.
The other sections that are currently in the first half of the sidebar
are topics that all Teleport users will need to get familiar with,
while day two operations and self-hosted production deployments are
more advanced topics.
- **Edited the landing page:** I have edited the landing page of the
docs to reflect the new sidebar organization. This also makes the page
shorter, simpler, and more opinionated. It spells out a high-level
sequence for setting up Teleport, then provides a list of advanced
topics for further reading.
Links correspond to sidebar sections--as before, I wanted to describe
the topic of each sidebar section so users would know this information
without having to navigate away from the landing page.
* Move the "Dynamic Configuration" section
Make this a subsection of "Manage your Cluster" since it's not
self-evidently clear as a top-level docs section. Users will probably
need an introduction via the "Manage your Cluster" section intro page.
This also reverts some of the more drastic sidebar changes introduced by
the previous commit.
Responds to xinding33 feedback.
* Make IAC learning tracks prominent/hard to avoid
Closes#27751
Responds to xinding33 feedback
The motivation is to be more opinionated about the course that users
take through the docs. We currently recommend two tracks for
self-service users, i.e., the users expected to make use of the landing
page:
- Setting up a toy self-hosted Teleport cluster
- Setting up a Teleport Team/Enterprise Cloud cluster that can
eventually become production ready
By moving the "Get Started" guide to the landing page, we direct users
immediately on to the first track. This change then gives new users a
way to enter the second track from the docs landing page with a
prominent link to the Teleport Team docs.
This change also edits The landing page to direct users who have
completed the getting started experience to instructions for setting up
a pool of agents on Terraform, helping to make infrastructure-as-code a
first-class citizen of the docs.
This change also removes the menu of links that used to confront users
on the landing page. Since all sidebar sections include introduction
pages, users interested in the content of a sidebar section can visit
the section. By removing links, we make it clearer for users how to
proceed through the docs.
* Fix linter errors
* Incorporate Trivy recommendations
* Respond to alexfornuto feedback
* Restore list of dynamic resources to the reference
* Fix linter warnings
* Remove the ".sh" extension from userdata script
The Terraform module that reads this file does not need the extension,
which was causing trouble for our shellcheck linter.
* Fix Helm chart Join token secret creation
Since #20763 was merged, we lost the ability of the chart reusing the
externally created secrets for join token.
This PR changes the logic and allows to control the secret creation
using the `joinTokenSecret.create` boolean and the secret name with
`joinTokenSecret.name`.
Fixes#20763
* Add changelog
This change makes the experience of getting started with Teleport more
opinionated and more precisely molded around our intended audience. The
assumption is that people who want to go through our getting started
experience are skilled technologists who:
- Are curious about how Teleport works and want to tinker with a toy
cluster
- Need to set up a production cluster in order to protect their
infrastructure, in which case a toy cluster is less important than a
way to get started with the real thing
Promote the "Linux Server" guide
--------------------------------
Make the "Linux Server" guide the definitive introduction to OSS
Teleport by removing other "Try out Teleport" guides and moving this one
to the "Home" section. We want to remove the need for users to decide
which getting started guide to try, and this guide is the only one that
lets users spin up a fully fledged demo cluster besides the Digital
Ocean guide.
To let users know about the DigitalOcean 1-Click droplet, this change
links to our DigitalOcean 1-Click app from within the Linux Server
guide. It also advises users who don't meet the Linux Server guide
prerequisites to sign up for a Teleport Enterprise Cloud free trial.
This change also removes the Docker guide and redirects Docker-related
traffic to the Installation page, since the Docker guide is more of a
Getting Started guide than an integration guide, and our Installation
page already includes Docker setup information.
Edit the Linux Server getting started guide
-------------------------------------------
- Remove Application Service instructions, since it can turn off users
who, for example, don't use Python or don't want to run the
Application Service (plus we already mention it at the end of the
guide for users who do want to run this service).
- Update installation instructions to use our one-liner.
- Make this guide more explicitly focused on the Open Source edition,
removing Enterprise instructions. Users who want to tinker with
Teleport will not be interested in the Enterprise edition.
- Add session recording instructions. Most of the content of the Linux
Server guide has to do with setting up Teleport, rather than seeing
Teleport features, so I wanted to adjust this balance a bit.
- Remove the permission warning. It takes up around 1/4 of the screen
height when viewing the page, and we expect our intended audience to
know this information already.
Change the Enterprise information architecture
----------------------------------------------
- Remove the Enterprise "Getting Started" guide: This guide shows you
how to deploy a demo Teleport Enterprise cluster, which is sort of a
contradiction in terms. Enterprise users expect a production-grade
cluster, which is not what you get in this guide.
- In the Enterprise Introduction page, include instructions to read the
Deployment Guides, which show how to set up a mature HA deployment,
plus a recommendation to use Teleport Enterprise Cloud unless you need
the Enterprise-specific features explained in this guide.
* Change Helm reference `--set` formatting
Closes#9686
Since the `--set` flag examples aren't commands, this change removes the
shell prompts and changes code fence labels from `code` to `text`.
* Remove --set examples from Helm references
Keep the values.yaml examples. Used the following script to generate the
change:
files="$(find docs/pages/reference/helm-reference -name "*.mdx")";
for i in $(echo "$files"); do
tmp=$(awk 'BEGIN{yaml=""}
/<Tabs>/{t=1}
t==1 && /```yaml/{y=1; yaml="`values.yaml` example:\n\n"}
y==1{yaml = (yaml "\n" $0)}
y==1 && /```$/{y=0; print yaml; yaml=""}
t==1 && /<\/Tabs/{t=0; next}
t==0{print $0 }' $i)
echo "$tmp" > $i;
done
* Add docs subsection about joining services
Closes#21851
Also see #21305
Restructure the "Adding Nodes" guide to make joining Teleport processes
via the Proxy Service the default approach. Make it easier for users to
put these instructions in the context of our other joining methods by
creating a separate docs subsection for our joining guides.
This change also updates the previous "Adding Nodes" guide based on
testing.
This also renames "Node" to "Teleport process" and clarifies the
distinction between running a Teleport process and running services on
the process.
* Respond to zmb3 feedback
* Respond to alexfornuto feedback
* Improve the "Join Token" guide descriptionA
Makes this guide consistent with
df3e36e49e
* Move the Kubernetes guide
* Fix spelling
* Linter fixes
In gravitational/docs#238, we will add a linter that lints for incorrect
usage of Teleport terms. This change fixes linter violations to
anticipate this new linter.
Changes include:
- Ensuring that Teleport service names are capitalized
- No longer using the "[Resource] Access" terminology. Instead, talk
about adding resources, using Teleport services, etc.
* Support spellchecking in docs content
In gravitational/docs#261, we will add a script that checks the spelling
of each version of the docs. This change edits one version of the docs
content to support this, including:
- A cspell configuration file
- A new step in the GitHub Actions in the "Lint (Docs)" workflow that
runs the spellcheck script we will add in `gravitational/docs`
- Fix mispellings so this passes the lint job. The mispellings are in a
file that we generated automatically, but there are few enough of
them, and we haven't merged the auto-generation script yet, that I
think it makes sense to fix them in the generated file for now.
* Respond to PR feedback
- Remove misspellings from the ignore list
- Sort the ignore list (and format it via prettier)
* Use the new yarn spellcheck command
* Spelling fixes
* spell fixes and add words to cspell.json
---------
Co-authored-by: Steven Martin <steven@goteleport.com>
