* feat: text output, geo, and `--skill` support
Layer three orthogonal additions on top of the core command:
- Text rendering: period header, matches summary, wrapped facet
panel, events table. `--all-facets` opts out of the top-5
truncation.
- Geo filter (`--latitude`/`--longitude`/`--radius`, all three
required together). Geo applies to events only; the stats endpoint
has no geo params, so facet counts and `total` cover the
window+query without geo. Text output prints a Note when geo is
active.
- `--skill` prints an embedded Markdown skill for LLM agents and
skips the backend entirely.
* fix: update skill to follow RFD 0037e
* fix: small fixes reported in PR review
* fix: small suggestion about code comment
* feat: iteration based on notion/customer request
* feat: add sanitization to text rendering
* fix: small fix to the access request review
* fix: typos and PR suggestions
* fix: help message indentation
We are standardizing docs guides to add a `page_type` frontmatter field,
with values for how-to guides, references, etc. We can then use this
field to apply linting rules that ensure each guide type follows
type-specific docs site conventions. The first convention is that each
docs page must have an outcome statement, the structure of which depends
on the guide's type. Human and AI agent readers can determine from the
outcome statement whether to continue reading the guide or not.
This change assigns the `page_type` frontmatter field to 47 guides.
Where an outcome statement is missing, it adds one. Where an outcome
statement exists, it ensures that the statement matches the standard
structure so we can add a linter later on.
Of the 47 guides:
- 28 guides already included the expected outcome statement, but needed
a page_type frontmatter field.
- 11 guides included an outcome statement but required tweaking so it
followed the expected structure.
- 8 guides had no outcome statement at all
In the Jenkins guide, also change "Architecture" to "How it works" to
accommodate the page structure linter (instead of disabling it). In the
current plan, this linter will also run the outcome statement check.
* checkpoints for docker getting started guide
* adding verification commands with expected output preceeding the troubleshooting checkpoints
* adding a few more checkpoint tips
* lint error with heading
* lint error with heading
* removing duplicate suggestion and reorganizing
* pulled in master to resolve conflicts as the directory structure changed since I started drafting these updates
* edited checkpoints, formatting, and moved k8 content
* cut down the number of items in the checkpoints, rephrased some sentences, fixed link paths as they were added before the pages was moved
* created a section forcommon troubleshooting items vs so many checkpoints
* changing container to variable
* adding back the sidebar label, and added '-t' (tty) flag to docker exec command to improve text output/alignment
* post-feedback: formatting, troubleshooting content revisions
* post-feedback: formatting, and slimming down troubleshooting content
* post-feedback: formatting, and slimming down troubleshooting content
* rephrasing intro paragraph, as most prod Teleport deployments in containers are running on k8s
* followed AI suggestions and implemented suggestions on removing previous k8 content and streamlining
* cleanup, restored backup guidance
* linter flagged for list spacing - added lines
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@gmail.com>
---------
Co-authored-by: Paul Gottschling <paul.gottschling@gmail.com>
* feat: add `tctl investigate` command
Add a tctl subcommand that searches Teleport's Identity Security
activity logs. The command exposes structured filter flags mirroring
the Identity Security UI: ~19 include/exclude pairs mapping to Lucene
fields (user, resource, IP, country, etc.). Multiple values on the
same flag are OR'd; different flags are AND'd.
`--query` accepts a raw Lucene expression for cases the structured
flags can't express (wildcards, regex, OR across fields) and is
mutually exclusive with the structured filters.
Facets and events are fetched in parallel via errgroup. `total` is
derived from the `event_type` facet on the stats endpoint, so it can
drift a few percent from `len(data)` on long windows.
This PR ships JSON/YAML output only. Text rendering, the geo filter,
and the `--skill` flag land in the next PR in the stack.
* fix: address codex suggestions
* fix: update flag description
* docs: add prereqs to selinux guide
* reduced verbiage, streamlined bullets, and split the agent requirement
* minor sentence edits. also removed dupe info, we already have the first header with the rhel requirements
* Update docs/pages/zero-trust-access/management/security/selinux.mdx
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
---------
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
* docs: distinguish host user creation from host sudoers in SSH guides
* clarified conflicting language, added missing comma to yaml as it was causing syntax errors when testing, and clarified examples
* post-feedback: clarifications and corrections
* added note about insecure-drop users
* First Draft of teleport-session-review skill
Framework based on ACL skill
* Adds Examples and Playbook for how to use Session Search
* Add a preflight check
* Feedback from Docs
* Extra Testing on a Teleport Cloud Tenant
* Docs to Skill
* Remove local dev for now
* update locate commands to include $TSH
* Update docs/pages/identity-security/session-summaries/session-search.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Remove Filter caveats
These have been fixed
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Document user display names and how Teleport derives them
* remove redundant notes on display name behavior in user types documentation
* drop unnecessary word
* refine user display name mapping for Okta, Microsoft Entra ID, SAML/OIDC, and SCIM integrations
* refactor: streamline display name documentation across identity provider integrations
* update user display name documentation
* improve clarity and consistency in user display name documentation
* Add public docs for the CA override feature
* Use `code` blocks instead of `shell`
* Number steps as n/d. Move alternatives to H3.
* Move intro paragraphs to "How it works"
* Remove "Supported CAs" section, move its contents to other sections
* Mention specific commands in the info box
* Emphasize future growth
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Update Go version to v1.26.4
* Rm GO_VERSION from Makefile/Dockerfile and rely on go.mod to inform Go version. Update code to adhere to 1.26 deprecation/changes.
Signed-off-by: Chris Thach <chris.thach@goteleport.com>
* Bump e to 54d1d0cb67b71860b943de477b3146d32ccdd74a.
Signed-off-by: Chris Thach <chris.thach@goteleport.com>
---------
Signed-off-by: Chris Thach <chris.thach@goteleport.com>
Co-authored-by: teleport-renovate[bot] <275214890+teleport-renovate[bot]@users.noreply.github.com>
Co-authored-by: Chris Thach <chris.thach@goteleport.com>
We are standardizing docs guides to add a page_type frontmatter field,
with values for how-to guides, references, etc. We can then use this
field to apply linting rules that ensure each guide type follows
type-specific docs site conventions. The first convention is that each
docs page must have an outcome statement, the structure of which depends
on the guide's type. Human and AI agent readers can determine from the
outcome statement whether to continue reading the guide or not.
This change assigns the `page_type` frontmatter field to 55 guides.
Where an outcome statement is missing, it adds one. Where an outcome
statement exists, it ensures that the statement matches the standard
structure so we can add a linter later on. (A majority of guides were
already compliant.)
We are standardizing docs guides to add a page_type frontmatter field,
with values for how-to guides, references, etc. We can then use this
field to apply linting rules that ensure each guide type follows
type-specific docs site conventions. The first convention is that each
docs page must have an outcome statement, the structure of which depends
on the guide's type. Human and AI agent readers can determine from the
outcome statement whether to continue reading the guide or not.
This change applies a `page_type` frontmatter field to 46 guides in the
`enroll-resources` section of the docs. Most of these guides already
include the expected outcome statement. For those that do not, this
change adds one:
- Automatic user provisioning introduction partial
- Host user creation
- Encrypted session recording guide
- ClickHouse guide (rewording the existing outcome statement to match
the standard structure we are rolling out).
- Automatic session recording key rotation
- Manual session recording key rotation
- macOS launchd guide
Rename --from/--to to --from-utc/--to-utc on `recordings search` to
match the `recordings ls` flag naming convention. The old names are
kept as hidden aliases for backward compatibility.
For JSON and YAML output formats, automatically paginate through result
batches until up to 500 sessions are collected rather than stopping
after the first batch. When results are truncated, a --resume-token
hint is printed to stderr so the caller can continue from where the
previous run left off.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Fixes#64890
Before #61492, the SSO index page briefly documented single log out
(SLO) for SAML. #61492 refactored our SSO authentication connector
guides to remove the duplication between the landing page and individual
IdP guides, but inadvertently removed the reference to the partial that
documented SLO. This change restores the partial to the closest location
available to its original one: below the `idp-initiated.mdx` partial in
our SAML guidance.
* app: Reject duplicate effective public_addr in static config
Extend the existing duplicate-name check in applyAppsConfig to also
reject static apps that resolve to the same effective routing FQDN.
Fail fast at startup rather than dispatch non-deterministically via
servers[rand.N(len(servers))] in lib/web/app/match.go.
Compute the effective FQDN per app as:
- public_addr, normalized through idna.ToASCII + trim trailing dot +
lowercase to match services.ValidateApp's proxy-collision compare,
- name + proxy_public_addr (one entry per proxy public addr) when
public_addr is empty, or when use_any_proxy_public_addr is true
(matching utils.AssembleAppFQDN),
- name + cluster_name as a fallback when proxy_service is enabled
but proxy_public_addr is unset (matching proxyDNSName in
lib/web/apps.go).
Limit the check to static app_service.apps. Dynamic apps are out of
scope; defer best-effort detection to a follow-up RFD.
* app: Address review feedback on static FQDN dedupe
Mirror runtime registration when computing default app FQDNs.
`FindPublicAddr` in `lib/srv/app/watcher.go` uses an IP-valued
proxy `public_addr` as-is and falls back to `cluster_name` only
when the proxy `public_addr` is unset; the validator previously
skipped IPs and fell back to `cluster_name` whenever a proxy
`public_addr` looked like an IP, which let a YAML config slip
through that would still collide at registration.
Extract `utils.DefaultAppFQDN(appName, proxyHost, clusterName)` as
the shared source of truth for default FQDN derivation. Both the
static config validator (`lib/config`) and `FindPublicAddr` call
it so the two paths stay in sync.
Ignore the local `proxy_service` config when it is disabled.
`FindPublicAddr` reads registered proxies from the backend, so a
disabled local proxy contributes nothing at runtime; the
validator was previously treating leftover `cfg.Proxy.PublicAddrs`
entries as effective routing suffixes and could fail startup on a
false duplicate FQDN when the apps would route through a
different proxy.
Make a malformed proxy `public_addr` or `cluster_name` non-fatal
during validation. Enabling `app_service` should not block startup
on an address that no app depends on. Skip the malformed entry, log
a warning, and let the dedupe pass continue; a real collision still
errors.
Sort per-app FQDN iteration before checking the seen-set so the
error message is stable when one app has several effective FQDNs
that each collide with a previously seen app. Go map iteration is
random and the prior code picked whichever order Go produced.
Clarify the comment about `CheckAndSetDefaults`: it validates
`app.Name` and `app.PublicAddr` as DNS-1123 forms, it does not
transform them. The dedupe step relies on the input already
being lowercase ASCII without a trailing dot.
* app: Trim duplicate-FQDN docs and simplify sort
Cut the FQDN-derivation and multi-proxy implementation detail from the
duplicate-routing docs so users only see that colliding FQDNs are
ambiguous and Teleport rejects them when `proxy_service` is colocated.
Replace the collect-then-sort pair with `slices.Sorted`.
* Add Networking Reference Troubleshooting section
See #62997
Edit the Networking Reference to add a Troubleshooting section covering
three common networking errors when setting up a Teleport cluster:
- Connection reset by peer
- First record does not look like a TLS handshake
- Authentication handshake failed (teleport.cluster.local)
* Edit Networking Reference connection reset section
Make the guidance more general and explain the origin for users who may
not be familiar with TCP fundamentals.
* Clarify the Networking reference
Responds to **zmb3** feedback:
- Don't use code style to refer to a Teleport process.
- Use a broader level of detail for the "connection reset" discussion.
- Remove incorrect indication that that the Proxy Service has a SAN.
* docs: adding agentic identity in feature matrix
* post-meeting: Chris W. edits
* organizing Beams in per-feature structure to match rest of the tables
* Firecracker and beam lifecycle details
Adds the first user-facing Access Graph tctl command, listing security
detections with filters and a time window.
Talks to Access Graph through the web proxy and relies on the backend's typed
501/credential errors (see access-graph#1998) instead of a pre-emptive
features.json probe, so the CLI stays stateless.
* tctl: add YAML parity for structured output commands
* Add WriteProto Go Doc comment
* Make output format flag visible in evaluate-db-access command
* Make output format flag visible in evaluate SSH command
* remove x509 override dry-run format flag
* refactor: simplify error messages for unknown output formats
* refactor: replace printJSON with utils.WriteJSON and WriteJSONArray
Ghassan Gedeon Achi